@mdbase-dev/connect-protocol 0.1.0-beta.26 → 0.1.0-beta.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -2,12 +2,11 @@ import type { ApplicationFileRequirement } from "./files.js";
2
2
  import type { CollectionOperation } from "./operations.js";
3
3
  export type ApplicationAuthorizationFlow = "authorization_code" | "device_code";
4
4
  export interface ApplicationAuthorizationBinding {
5
- protocol_version: 1;
5
+ protocol_version: 2;
6
6
  authorization_id: string;
7
7
  application_id: string;
8
8
  application_manifest_digest: string;
9
9
  application_installation_id: string;
10
- installation_agreement_public_key: string;
11
10
  installation_signing_public_key: string;
12
11
  grant_agreement_public_key: string;
13
12
  grant_signing_public_key: string;
@@ -26,5 +25,5 @@ export interface ApplicationAuthorizationProof {
26
25
  binding: ApplicationAuthorizationBinding;
27
26
  signature: string;
28
27
  }
29
- export declare function applicationInstallationIdFromPublicKeys(agreementPublicKey: string, signingPublicKey: string): Promise<string>;
28
+ export declare function applicationInstallationIdFromPublicKey(signingPublicKey: string): Promise<string>;
30
29
  export declare function authorizationSigningMessage(binding: ApplicationAuthorizationBinding): Uint8Array;
@@ -1,12 +1,8 @@
1
- const INSTALLATION_ID_DOMAIN = new TextEncoder().encode("mdbase-connect application installation id v1\0");
2
- const AUTHORIZATION_PROOF_DOMAIN = new TextEncoder().encode("mdbase-connect application authorization proof\0");
3
- export async function applicationInstallationIdFromPublicKeys(agreementPublicKey, signingPublicKey) {
4
- const agreement = publicKey(agreementPublicKey);
1
+ const INSTALLATION_ID_DOMAIN = new TextEncoder().encode("mdbase-connect application installation id v2\0");
2
+ const AUTHORIZATION_PROOF_DOMAIN = new TextEncoder().encode("mdbase-connect application authorization proof v2\0");
3
+ export async function applicationInstallationIdFromPublicKey(signingPublicKey) {
5
4
  const signing = publicKey(signingPublicKey);
6
- if (equalBytes(agreement, signing)) {
7
- throw new Error("Application installation agreement and signing keys must be distinct.");
8
- }
9
- const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", concat([INSTALLATION_ID_DOMAIN, field(agreement), field(signing)])));
5
+ const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", concat([INSTALLATION_ID_DOMAIN, field(signing)])));
10
6
  const id = digest.slice(0, 16);
11
7
  id[6] = (id[6] & 0x0f) | 0x80;
12
8
  id[8] = (id[8] & 0x3f) | 0x80;
@@ -20,7 +16,6 @@ export async function applicationInstallationIdFromPublicKeys(agreementPublicKey
20
16
  }
21
17
  export function authorizationSigningMessage(binding) {
22
18
  const keys = [
23
- publicKey(binding.installation_agreement_public_key),
24
19
  publicKey(binding.installation_signing_public_key),
25
20
  publicKey(binding.grant_agreement_public_key),
26
21
  publicKey(binding.grant_signing_public_key)
@@ -30,7 +25,7 @@ export function authorizationSigningMessage(binding) {
30
25
  }
31
26
  const nonce = canonicalBase64(binding.authorization_nonce);
32
27
  const challenge = canonicalBase64(binding.code_challenge);
33
- if (binding.protocol_version !== 1
28
+ if (binding.protocol_version !== 2
34
29
  || nonce.byteLength !== 32
35
30
  || !/^[0-9a-f]{64}$/u.test(binding.application_manifest_digest)
36
31
  || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(binding.issued_at)
@@ -0,0 +1,51 @@
1
+ import type { CollectionOperation } from "./operations.js";
2
+ export declare const APPLICATION_CAPABILITY_CONTRACT_VERSION: 1;
3
+ /**
4
+ * Stable application-facing abilities. Applications declare intent in these
5
+ * terms; Connect alone translates them into wire-level collection operations.
6
+ */
7
+ export declare const APPLICATION_CAPABILITY_DEFINITIONS: {
8
+ readonly "collection.inspect": readonly ["describe"];
9
+ readonly "records.watch": readonly ["changes"];
10
+ readonly "records.read": readonly ["read"];
11
+ readonly "records.query": readonly ["query"];
12
+ readonly "records.validate": readonly ["validate"];
13
+ readonly "records.create": readonly ["create"];
14
+ readonly "records.update": readonly ["update"];
15
+ readonly "records.delete": readonly ["delete"];
16
+ readonly "records.rename": readonly ["rename"];
17
+ readonly "views.list": readonly ["list_views"];
18
+ readonly "views.execute": readonly ["execute_view"];
19
+ readonly "views.source.read": readonly ["read_view_source"];
20
+ readonly "views.source.create": readonly ["create_view_source"];
21
+ readonly "views.source.update": readonly ["update_view_source"];
22
+ readonly "views.source.delete": readonly ["delete_view_source"];
23
+ readonly "definitions.contracts.current": readonly [];
24
+ readonly "definitions.read": readonly ["read_type"];
25
+ readonly "definitions.create": readonly ["create_type"];
26
+ readonly "definitions.update": readonly ["update_type"];
27
+ readonly "definitions.type-pack.inspect": readonly ["assess_type_pack"];
28
+ readonly "definitions.type-pack.apply": readonly ["assess_type_pack", "apply_type_pack"];
29
+ readonly "timers.list": readonly ["list_timers"];
30
+ readonly "timers.put": readonly ["put_timer"];
31
+ readonly "timers.cancel": readonly ["cancel_timer"];
32
+ readonly "timers.reconcile": readonly ["reconcile_timers"];
33
+ readonly "sync.offline-replica": readonly ["sync"];
34
+ readonly "notifications.background-delivery": readonly [];
35
+ readonly "files.list": readonly [];
36
+ readonly "files.read": readonly [];
37
+ readonly "files.add": readonly [];
38
+ readonly "files.replace": readonly [];
39
+ readonly "files.move": readonly [];
40
+ readonly "files.delete": readonly [];
41
+ };
42
+ export type ApplicationCapabilityId = keyof typeof APPLICATION_CAPABILITY_DEFINITIONS;
43
+ export interface ApplicationCapabilityRequirements {
44
+ contract_version: typeof APPLICATION_CAPABILITY_CONTRACT_VERSION;
45
+ required: ApplicationCapabilityId[];
46
+ optional?: ApplicationCapabilityId[];
47
+ }
48
+ export declare function operationsForApplicationCapabilities(requirements: ApplicationCapabilityRequirements, options?: {
49
+ includeOptional?: boolean;
50
+ }): CollectionOperation[];
51
+ export declare function capabilityOperations(capability: ApplicationCapabilityId): CollectionOperation[];
@@ -0,0 +1,49 @@
1
+ export const APPLICATION_CAPABILITY_CONTRACT_VERSION = 1;
2
+ /**
3
+ * Stable application-facing abilities. Applications declare intent in these
4
+ * terms; Connect alone translates them into wire-level collection operations.
5
+ */
6
+ export const APPLICATION_CAPABILITY_DEFINITIONS = {
7
+ "collection.inspect": ["describe"],
8
+ "records.watch": ["changes"],
9
+ "records.read": ["read"],
10
+ "records.query": ["query"],
11
+ "records.validate": ["validate"],
12
+ "records.create": ["create"],
13
+ "records.update": ["update"],
14
+ "records.delete": ["delete"],
15
+ "records.rename": ["rename"],
16
+ "views.list": ["list_views"],
17
+ "views.execute": ["execute_view"],
18
+ "views.source.read": ["read_view_source"],
19
+ "views.source.create": ["create_view_source"],
20
+ "views.source.update": ["update_view_source"],
21
+ "views.source.delete": ["delete_view_source"],
22
+ "definitions.contracts.current": [],
23
+ "definitions.read": ["read_type"],
24
+ "definitions.create": ["create_type"],
25
+ "definitions.update": ["update_type"],
26
+ "definitions.type-pack.inspect": ["assess_type_pack"],
27
+ "definitions.type-pack.apply": ["assess_type_pack", "apply_type_pack"],
28
+ "timers.list": ["list_timers"],
29
+ "timers.put": ["put_timer"],
30
+ "timers.cancel": ["cancel_timer"],
31
+ "timers.reconcile": ["reconcile_timers"],
32
+ "sync.offline-replica": ["sync"],
33
+ "notifications.background-delivery": [],
34
+ "files.list": [],
35
+ "files.read": [],
36
+ "files.add": [],
37
+ "files.replace": [],
38
+ "files.move": [],
39
+ "files.delete": []
40
+ };
41
+ export function operationsForApplicationCapabilities(requirements, options = {}) {
42
+ const capabilities = options.includeOptional === false
43
+ ? requirements.required
44
+ : [...requirements.required, ...(requirements.optional ?? [])];
45
+ return [...new Set(capabilities.flatMap((capability) => APPLICATION_CAPABILITY_DEFINITIONS[capability]))];
46
+ }
47
+ export function capabilityOperations(capability) {
48
+ return [...APPLICATION_CAPABILITY_DEFINITIONS[capability]];
49
+ }
@@ -8,6 +8,10 @@ export declare const CONNECT_PROBLEM_CATALOG: {
8
8
  readonly category: "availability";
9
9
  readonly recovery: "resume_connector_access";
10
10
  };
11
+ readonly application_identity_unavailable: {
12
+ readonly category: "compatibility";
13
+ readonly recovery: "upgrade_application";
14
+ };
11
15
  readonly approval_window_blocked: {
12
16
  readonly category: "authorization";
13
17
  readonly recovery: "reauthorize";
@@ -24,6 +28,10 @@ export declare const CONNECT_PROBLEM_CATALOG: {
24
28
  readonly category: "authorization";
25
29
  readonly recovery: "reauthorize";
26
30
  };
31
+ readonly authorization_replayed: {
32
+ readonly category: "integrity";
33
+ readonly recovery: "reauthorize";
34
+ };
27
35
  readonly browser_required: {
28
36
  readonly category: "compatibility";
29
37
  readonly recovery: "none";
@@ -152,10 +160,6 @@ export declare const CONNECT_PROBLEM_CATALOG: {
152
160
  readonly category: "conflict";
153
161
  readonly recovery: "retry";
154
162
  };
155
- readonly first_contact_handler_required: {
156
- readonly category: "compatibility";
157
- readonly recovery: "upgrade_application";
158
- };
159
163
  readonly hosted_provider_unavailable: {
160
164
  readonly category: "availability";
161
165
  readonly recovery: "retry";
@@ -164,6 +168,10 @@ export declare const CONNECT_PROBLEM_CATALOG: {
164
168
  readonly category: "authorization";
165
169
  readonly recovery: "reauthorize";
166
170
  };
171
+ readonly invalid_application_authorization: {
172
+ readonly category: "validation";
173
+ readonly recovery: "fix_request";
174
+ };
167
175
  readonly invalid_application_manifest: {
168
176
  readonly category: "validation";
169
177
  readonly recovery: "fix_request";
@@ -180,10 +188,6 @@ export declare const CONNECT_PROBLEM_CATALOG: {
180
188
  readonly category: "integrity";
181
189
  readonly recovery: "contact_support";
182
190
  };
183
- readonly invalid_first_contact: {
184
- readonly category: "integrity";
185
- readonly recovery: "contact_support";
186
- };
187
191
  readonly invalid_loopback_url: {
188
192
  readonly category: "validation";
189
193
  readonly recovery: "fix_request";
@@ -304,6 +308,10 @@ export declare const CONNECT_PROBLEM_CATALOG: {
304
308
  readonly category: "availability";
305
309
  readonly recovery: "retry";
306
310
  };
311
+ readonly reconnect_required: {
312
+ readonly category: "authorization";
313
+ readonly recovery: "reauthorize";
314
+ };
307
315
  readonly redirect_uri_required: {
308
316
  readonly category: "validation";
309
317
  readonly recovery: "fix_request";
@@ -388,6 +396,7 @@ export interface ConnectProblemDetailsByCode {
388
396
  "return_to"?: string;
389
397
  };
390
398
  "access_paused": undefined;
399
+ "application_identity_unavailable": undefined;
391
400
  "approval_window_blocked": {
392
401
  "user_code": string;
393
402
  "verification_uri": string;
@@ -398,6 +407,7 @@ export interface ConnectProblemDetailsByCode {
398
407
  "authority_authorization_changed": undefined;
399
408
  "authorization_cancelled": undefined;
400
409
  "authorization_expired": undefined;
410
+ "authorization_replayed": undefined;
401
411
  "browser_required": undefined;
402
412
  "callback_url_required": undefined;
403
413
  "change_cursor_reset": undefined;
@@ -446,18 +456,17 @@ export interface ConnectProblemDetailsByCode {
446
456
  "file_not_found": undefined;
447
457
  "file_source_mismatch": undefined;
448
458
  "file_upload_incomplete": undefined;
449
- "first_contact_handler_required": undefined;
450
459
  "hosted_provider_unavailable": undefined;
451
460
  "insufficient_access": {
452
461
  "required_operations": Array<string>;
453
462
  "granted_operations": Array<string>;
454
463
  "missing_operations": Array<string>;
455
464
  };
465
+ "invalid_application_authorization": undefined;
456
466
  "invalid_application_manifest": undefined;
457
467
  "invalid_callback": undefined;
458
468
  "invalid_device_authorization_response": undefined;
459
469
  "invalid_encrypted_response": undefined;
460
- "invalid_first_contact": undefined;
461
470
  "invalid_loopback_url": undefined;
462
471
  "invalid_mutation_id": undefined;
463
472
  "invalid_operation_response": undefined;
@@ -493,6 +502,7 @@ export interface ConnectProblemDetailsByCode {
493
502
  "rate_limited": {
494
503
  "retry_after_ms"?: number;
495
504
  };
505
+ "reconnect_required": undefined;
496
506
  "redirect_uri_required": undefined;
497
507
  "reference_updates_unsupported": undefined;
498
508
  "relay_authorization_expired": undefined;
@@ -524,6 +534,12 @@ export interface ConnectProblemByCode {
524
534
  recovery: "resume_connector_access";
525
535
  details?: never;
526
536
  };
537
+ "application_identity_unavailable": ConnectProblemBase & {
538
+ code: "application_identity_unavailable";
539
+ category: "compatibility";
540
+ recovery: "upgrade_application";
541
+ details?: never;
542
+ };
527
543
  "approval_window_blocked": ConnectProblemBase & {
528
544
  code: "approval_window_blocked";
529
545
  category: "authorization";
@@ -548,6 +564,12 @@ export interface ConnectProblemByCode {
548
564
  recovery: "reauthorize";
549
565
  details?: never;
550
566
  };
567
+ "authorization_replayed": ConnectProblemBase & {
568
+ code: "authorization_replayed";
569
+ category: "integrity";
570
+ recovery: "reauthorize";
571
+ details?: never;
572
+ };
551
573
  "browser_required": ConnectProblemBase & {
552
574
  code: "browser_required";
553
575
  category: "compatibility";
@@ -740,12 +762,6 @@ export interface ConnectProblemByCode {
740
762
  recovery: "retry";
741
763
  details?: never;
742
764
  };
743
- "first_contact_handler_required": ConnectProblemBase & {
744
- code: "first_contact_handler_required";
745
- category: "compatibility";
746
- recovery: "upgrade_application";
747
- details?: never;
748
- };
749
765
  "hosted_provider_unavailable": ConnectProblemBase & {
750
766
  code: "hosted_provider_unavailable";
751
767
  category: "availability";
@@ -758,6 +774,12 @@ export interface ConnectProblemByCode {
758
774
  recovery: "reauthorize";
759
775
  details: ConnectProblemDetailsByCode["insufficient_access"];
760
776
  };
777
+ "invalid_application_authorization": ConnectProblemBase & {
778
+ code: "invalid_application_authorization";
779
+ category: "validation";
780
+ recovery: "fix_request";
781
+ details?: never;
782
+ };
761
783
  "invalid_application_manifest": ConnectProblemBase & {
762
784
  code: "invalid_application_manifest";
763
785
  category: "validation";
@@ -782,12 +804,6 @@ export interface ConnectProblemByCode {
782
804
  recovery: "contact_support";
783
805
  details?: never;
784
806
  };
785
- "invalid_first_contact": ConnectProblemBase & {
786
- code: "invalid_first_contact";
787
- category: "integrity";
788
- recovery: "contact_support";
789
- details?: never;
790
- };
791
807
  "invalid_loopback_url": ConnectProblemBase & {
792
808
  code: "invalid_loopback_url";
793
809
  category: "validation";
@@ -968,6 +984,12 @@ export interface ConnectProblemByCode {
968
984
  recovery: "retry";
969
985
  details?: ConnectProblemDetailsByCode["rate_limited"];
970
986
  };
987
+ "reconnect_required": ConnectProblemBase & {
988
+ code: "reconnect_required";
989
+ category: "authorization";
990
+ recovery: "reauthorize";
991
+ details?: never;
992
+ };
971
993
  "redirect_uri_required": ConnectProblemBase & {
972
994
  code: "redirect_uri_required";
973
995
  category: "validation";
@@ -3,10 +3,12 @@ export const CONNECT_PROBLEM_VERSION = 1;
3
3
  export const CONNECT_PROBLEM_CATALOG = {
4
4
  "access_denied": { category: "authorization", recovery: "reauthorize" },
5
5
  "access_paused": { category: "availability", recovery: "resume_connector_access" },
6
+ "application_identity_unavailable": { category: "compatibility", recovery: "upgrade_application" },
6
7
  "approval_window_blocked": { category: "authorization", recovery: "reauthorize" },
7
8
  "authority_authorization_changed": { category: "authorization", recovery: "reauthorize" },
8
9
  "authorization_cancelled": { category: "cancellation", recovery: "none" },
9
10
  "authorization_expired": { category: "authorization", recovery: "reauthorize" },
11
+ "authorization_replayed": { category: "integrity", recovery: "reauthorize" },
10
12
  "browser_required": { category: "compatibility", recovery: "none" },
11
13
  "callback_url_required": { category: "validation", recovery: "fix_request" },
12
14
  "change_cursor_reset": { category: "conflict", recovery: "refresh" },
@@ -39,14 +41,13 @@ export const CONNECT_PROBLEM_CATALOG = {
39
41
  "file_not_found": { category: "conflict", recovery: "refresh" },
40
42
  "file_source_mismatch": { category: "conflict", recovery: "refresh" },
41
43
  "file_upload_incomplete": { category: "conflict", recovery: "retry" },
42
- "first_contact_handler_required": { category: "compatibility", recovery: "upgrade_application" },
43
44
  "hosted_provider_unavailable": { category: "availability", recovery: "retry" },
44
45
  "insufficient_access": { category: "authorization", recovery: "reauthorize" },
46
+ "invalid_application_authorization": { category: "validation", recovery: "fix_request" },
45
47
  "invalid_application_manifest": { category: "validation", recovery: "fix_request" },
46
48
  "invalid_callback": { category: "validation", recovery: "fix_request" },
47
49
  "invalid_device_authorization_response": { category: "integrity", recovery: "contact_support" },
48
50
  "invalid_encrypted_response": { category: "integrity", recovery: "contact_support" },
49
- "invalid_first_contact": { category: "integrity", recovery: "contact_support" },
50
51
  "invalid_loopback_url": { category: "validation", recovery: "fix_request" },
51
52
  "invalid_mutation_id": { category: "validation", recovery: "fix_request" },
52
53
  "invalid_operation_response": { category: "integrity", recovery: "contact_support" },
@@ -77,6 +78,7 @@ export const CONNECT_PROBLEM_CATALOG = {
77
78
  "pending_mutation_unresolved": { category: "conflict", recovery: "resolve_outcome" },
78
79
  "query_snapshot_changed": { category: "conflict", recovery: "refresh" },
79
80
  "rate_limited": { category: "availability", recovery: "retry" },
81
+ "reconnect_required": { category: "authorization", recovery: "reauthorize" },
80
82
  "redirect_uri_required": { category: "validation", recovery: "fix_request" },
81
83
  "reference_updates_unsupported": { category: "compatibility", recovery: "fix_request" },
82
84
  "relay_authorization_expired": { category: "authorization", recovery: "reauthorize" },
package/dist/index.d.ts CHANGED
@@ -1,22 +1,26 @@
1
1
  import type { ConnectProblem } from "./connect-problems.generated.js";
2
2
  import type { ApplicationFileRequirement, CollectionFileDescriptor, FileCapability } from "./files.js";
3
3
  import type { CollectionOperation } from "./operations.js";
4
+ import type { ApplicationCapabilityRequirements } from "./capabilities.js";
5
+ import type { ContractRequirement, ContractSetupChoice, TypePackProvision } from "./type-packs.js";
4
6
  import type { ApplicationAuthorizationProof } from "./application-authorization.js";
5
7
  export * from "./connect-problems.generated.js";
6
8
  export * from "./files.js";
7
9
  export * from "./operations.js";
10
+ export * from "./capabilities.js";
8
11
  export * from "./application-authorization.js";
12
+ export * from "./type-packs.js";
9
13
  export declare const CONTROL_PROTOCOL_VERSION: 1;
10
14
  export declare const ENCRYPTED_RELAY_PROTOCOL_VERSION: 1;
11
- export declare const FIRST_CONTACT_PROTOCOL_VERSION: 1;
15
+ export declare const APPLICATION_AUTHORIZATION_PROTOCOL_VERSION: 2;
12
16
  export declare const LOOPBACK_PROTOCOL_VERSION: 1;
13
17
  export declare const DEFAULT_LOOPBACK_PORT: 28485;
14
18
  export declare const RELAY_ENCRYPTION_SUITE: "P256-HKDF-SHA256-AES256GCM";
15
19
  export declare const SYNC_PROTOCOL_VERSION: 1;
16
20
  export declare const CONTRACT_SETUP_CAPABILITY: "contract-setup-v1";
17
21
  export declare const FILE_RELAY_CAPABILITY: "file-relay-v1";
18
- export declare const RELAY_REQUIRED_CAPABILITIES: readonly ["application-trust-v1", "authorization-activation", "encrypted-relay", "policy-ack"];
19
- export declare const RELAY_CAPABILITIES: readonly ["application-trust-v1", "authorization-activation", "encrypted-relay", "policy-ack", "contract-setup-v1", "file-relay-v1"];
22
+ export declare const RELAY_REQUIRED_CAPABILITIES: readonly ["application-authorization-v2", "authorization-activation", "encrypted-relay", "policy-ack"];
23
+ export declare const RELAY_CAPABILITIES: readonly ["application-authorization-v2", "authorization-activation", "encrypted-relay", "policy-ack", "contract-setup-v1", "file-relay-v1"];
20
24
  export declare const AUTHORITY_PROOF_VERSION: 1;
21
25
  export declare const AUTHORITY_PROOF_ALGORITHM: "P256-SHA256";
22
26
  export declare const AUTHORITY_PROOF_DOMAIN: "mdbase-authority-request-proof-v1";
@@ -142,13 +146,10 @@ export interface NotificationWebhook {
142
146
  connection_id: string;
143
147
  notification: MdbaseNotification;
144
148
  }
145
- export interface ContractRequirement {
146
- id: string;
147
- /** Exact semantic version of the collection-local mdbase data contract. */
148
- version: string;
149
- }
150
149
  export interface ApplicationRequirements {
151
150
  contracts: ContractRequirement[];
151
+ /** Versioned semantic intent compiled by Connect into exact operations. */
152
+ capabilities?: ApplicationCapabilityRequirements;
152
153
  /** Access boundary requested after compatibility and provisioning checks. */
153
154
  access?: "contract" | "full_collection";
154
155
  /** Restrict authorization to durable provider-backed collections. */
@@ -156,60 +157,9 @@ export interface ApplicationRequirements {
156
157
  /** First-class non-Markdown file access requested independently of records. */
157
158
  files?: ApplicationFileRequirement;
158
159
  }
159
- export interface TypePackManifestResource {
160
- kind: "contract" | "type" | "schema";
161
- source: string;
162
- target: string;
163
- digest: string;
164
- }
165
- export interface TypePackManifest {
166
- kind: "mdbase.type-pack";
167
- id: string;
168
- version: string;
169
- name?: string;
170
- description?: string;
171
- resources: TypePackManifestResource[];
172
- [extension: `x-${string}`]: unknown;
173
- }
174
- export interface TypePackSourceResource {
175
- source: string;
176
- document: string;
177
- }
178
- export interface TypePackProvision {
179
- /** Canonical type-pack manifest shown during approval and verified on install. */
180
- manifest: TypePackManifest;
181
- /** Exact UTF-8 resource bytes, keyed by each manifest source path. */
182
- resources: TypePackSourceResource[];
183
- /** Data contracts expected after the complete pack is installed. */
184
- provides: ContractRequirement[];
185
- }
186
- export interface TypePackResourceDiff {
187
- target: string;
188
- kind: "contract" | "type" | "schema";
189
- action: "create" | "replace" | "unchanged";
190
- digest: string;
191
- }
192
- export interface TypePackInstallResult {
193
- id: string;
194
- version: string;
195
- resources: TypePackResourceDiff[];
196
- cleanup_deferred: boolean;
197
- }
198
160
  export interface ApplicationProvisions {
199
161
  type_packs: TypePackProvision[];
200
162
  }
201
- export type ContractSetupChoice = {
202
- contract: ContractRequirement;
203
- mode: "starter";
204
- } | {
205
- contract: ContractRequirement;
206
- mode: "existing";
207
- type_name: string;
208
- /** Exact type source revision shown during approval. */
209
- type_revision: string;
210
- fields: Record<string, string>;
211
- binding?: JsonObject;
212
- };
213
163
  export interface GrantScope {
214
164
  /**
215
165
  * Exact contract definitions and sorted implementation sets approved by the
@@ -279,11 +229,10 @@ export interface GrantPolicy {
279
229
  created_at: string;
280
230
  encryption?: GrantEncryption;
281
231
  file_capability?: FileCapability;
282
- first_contact: FirstContactBinding;
283
232
  application_authorization: ApplicationAuthorizationProof;
284
233
  }
285
234
  /** Presentation-only grant shape used outside a local authorization boundary. */
286
- export type GrantSummary = Omit<GrantPolicy, "first_contact" | "application_authorization">;
235
+ export type GrantSummary = Omit<GrantPolicy, "application_authorization">;
287
236
  export interface GrantEncryption {
288
237
  protocol_version: 1;
289
238
  suite: typeof RELAY_ENCRYPTION_SUITE;
@@ -294,15 +243,6 @@ export interface GrantEncryption {
294
243
  application_agreement_public_key: string;
295
244
  connector_agreement_public_key: string;
296
245
  }
297
- export interface FirstContactBinding {
298
- protocol_version: typeof FIRST_CONTACT_PROTOCOL_VERSION;
299
- application_id: string;
300
- application_installation_id: string;
301
- application_agreement_public_key: string;
302
- application_signing_public_key: string;
303
- connector_id: string;
304
- connector_agreement_public_key: string;
305
- }
306
246
  export interface EncryptedRelayEnvelope {
307
247
  protocol_version: 1;
308
248
  suite: typeof RELAY_ENCRYPTION_SUITE;
@@ -336,7 +276,7 @@ export interface SyncCollectionResources {
336
276
  }
337
277
  export interface SyncResourceDocument {
338
278
  path: string;
339
- kind: "configuration" | "type" | "contract" | "schema" | "view";
279
+ kind: "configuration" | "lock" | "type" | "contract" | "schema" | "view";
340
280
  /** SHA-256 revision of the exact UTF-8 document (`sha256:<lowercase hex>`). */
341
281
  revision: string;
342
282
  document: string;
package/dist/index.js CHANGED
@@ -1,10 +1,12 @@
1
1
  export * from "./connect-problems.generated.js";
2
2
  export * from "./files.js";
3
3
  export * from "./operations.js";
4
+ export * from "./capabilities.js";
4
5
  export * from "./application-authorization.js";
6
+ export * from "./type-packs.js";
5
7
  export const CONTROL_PROTOCOL_VERSION = 1;
6
8
  export const ENCRYPTED_RELAY_PROTOCOL_VERSION = 1;
7
- export const FIRST_CONTACT_PROTOCOL_VERSION = 1;
9
+ export const APPLICATION_AUTHORIZATION_PROTOCOL_VERSION = 2;
8
10
  export const LOOPBACK_PROTOCOL_VERSION = 1;
9
11
  export const DEFAULT_LOOPBACK_PORT = 28_485;
10
12
  export const RELAY_ENCRYPTION_SUITE = "P256-HKDF-SHA256-AES256GCM";
@@ -12,7 +14,7 @@ export const SYNC_PROTOCOL_VERSION = 1;
12
14
  export const CONTRACT_SETUP_CAPABILITY = "contract-setup-v1";
13
15
  export const FILE_RELAY_CAPABILITY = "file-relay-v1";
14
16
  export const RELAY_REQUIRED_CAPABILITIES = [
15
- "application-trust-v1",
17
+ "application-authorization-v2",
16
18
  "authorization-activation",
17
19
  "encrypted-relay",
18
20
  "policy-ack"
@@ -1 +1 @@
1
- export type CollectionOperation = "describe" | "changes" | "read" | "query" | "list_views" | "execute_view" | "read_view_source" | "create_view_source" | "update_view_source" | "delete_view_source" | "validate" | "create" | "update" | "delete" | "rename" | "read_type" | "create_type" | "update_type" | "install_type_pack" | "list_timers" | "put_timer" | "cancel_timer" | "reconcile_timers" | "sync";
1
+ export type CollectionOperation = "describe" | "changes" | "read" | "query" | "list_views" | "execute_view" | "read_view_source" | "create_view_source" | "update_view_source" | "delete_view_source" | "validate" | "create" | "update" | "delete" | "rename" | "read_type" | "create_type" | "update_type" | "assess_type_pack" | "apply_type_pack" | "list_timers" | "put_timer" | "cancel_timer" | "reconcile_timers" | "sync";
@@ -0,0 +1,133 @@
1
+ export interface ContractRequirement {
2
+ id: string;
3
+ /** Exact semantic version of the collection-local mdbase data contract. */
4
+ version: string;
5
+ /** Exact digest of the resolved portable contract identity. */
6
+ digest: string;
7
+ }
8
+ /** Exact identity of the standard record-created runtime event contract. */
9
+ export declare const MDBASE_RECORD_CREATED_CONTRACT: {
10
+ readonly id: "mdbase.record.created";
11
+ readonly version: "1.0.0";
12
+ readonly digest: "sha256:7f3bed6baa356ee9389e977ae7b77a102e2bee871a7c1d9f2026fc21cacdbfc9";
13
+ };
14
+ /** Exact identity of the standard record-modified runtime event contract. */
15
+ export declare const MDBASE_RECORD_MODIFIED_CONTRACT: {
16
+ readonly id: "mdbase.record.modified";
17
+ readonly version: "1.0.0";
18
+ readonly digest: "sha256:064187148a95701a1f5c749643d306d3c6708470b6b7ab0bf0c698d38dbcabe3";
19
+ };
20
+ /** Exact identity of the standard record-deleted runtime event contract. */
21
+ export declare const MDBASE_RECORD_DELETED_CONTRACT: {
22
+ readonly id: "mdbase.record.deleted";
23
+ readonly version: "1.0.0";
24
+ readonly digest: "sha256:84e5fb0f9d3bfdcd53f76cdc5035f94c7693fdea39a8ead190b10b422dd2ee09";
25
+ };
26
+ /** Exact identity of the standard record-renamed runtime event contract. */
27
+ export declare const MDBASE_RECORD_RENAMED_CONTRACT: {
28
+ readonly id: "mdbase.record.renamed";
29
+ readonly version: "1.0.0";
30
+ readonly digest: "sha256:c825ef8d7db775b784d7af27e6acdf6f2799d2c6440d486f5bfa78afcca71471";
31
+ };
32
+ /** Exact identity of the standard timer-fired runtime event contract. */
33
+ export declare const MDBASE_TIMER_FIRED_CONTRACT: {
34
+ readonly id: "mdbase.runtime.timer.fired";
35
+ readonly version: "1.0.0";
36
+ readonly digest: "sha256:41105be7a7abf33b31ced47e1e1965242236e40ccaea286b959b0a8c591f5642";
37
+ };
38
+ export interface TypePackManifestResource {
39
+ kind: "contract" | "type" | "schema";
40
+ mode: "managed" | "seed";
41
+ source: string;
42
+ target: string;
43
+ digest: string;
44
+ }
45
+ export interface TypePackManifest {
46
+ kind: "mdbase.type-pack";
47
+ id: string;
48
+ version: string;
49
+ name?: string;
50
+ description?: string;
51
+ resources: TypePackManifestResource[];
52
+ [extension: `x-${string}`]: unknown;
53
+ }
54
+ export interface TypePackSourceResource {
55
+ source: string;
56
+ document: string;
57
+ }
58
+ export interface TypePackProvision {
59
+ /** Canonical type-pack manifest shown during approval and verified on install. */
60
+ manifest: TypePackManifest;
61
+ /** Exact UTF-8 resource bytes, keyed by each manifest source path. */
62
+ resources: TypePackSourceResource[];
63
+ /** Data contracts expected after the complete pack is installed. */
64
+ provides: ContractRequirement[];
65
+ }
66
+ export interface TypePackResourceDiff {
67
+ source: string;
68
+ target: string;
69
+ kind: "contract" | "type" | "schema";
70
+ mode: "managed" | "seed";
71
+ action: "create" | "update" | "delete" | "adopt" | "unchanged" | "preserve" | "conflict";
72
+ digest: string;
73
+ current_digest?: string;
74
+ installed_digest?: string;
75
+ adopted_from_digest?: string;
76
+ reason?: string;
77
+ }
78
+ export interface TypePackReceipt {
79
+ id: string;
80
+ version: string;
81
+ digest: string;
82
+ installed_by: string;
83
+ resources: Omit<TypePackResourceDiff, "action" | "current_digest" | "installed_digest" | "reason">[];
84
+ }
85
+ export interface TypePackAssessment {
86
+ status: "current" | "install" | "upgrade" | "downgrade" | "reconfigure" | "conflict";
87
+ applicable: boolean;
88
+ assessment_digest: string;
89
+ current?: TypePackReceipt;
90
+ desired: TypePackReceipt;
91
+ resources: TypePackResourceDiff[];
92
+ lock: {
93
+ target: "mdbase.lock.yaml";
94
+ action: "create" | "update" | "unchanged";
95
+ digest: string;
96
+ };
97
+ contract_setups: {
98
+ choices: ContractSetupChoice[];
99
+ resources: TypePackResourceDiff[];
100
+ };
101
+ }
102
+ export interface TypePackApplyResult extends TypePackAssessment {
103
+ receipt: TypePackReceipt;
104
+ cleanup_deferred: boolean;
105
+ }
106
+ export interface AssessTypePackInput {
107
+ provision: TypePackProvision;
108
+ installed_by: string;
109
+ /** Explicit digest-pinned consent to claim differing unmanaged managed targets. */
110
+ adopt_resources?: Record<string, string>;
111
+ /** Seed resources deliberately omitted because the user selected an existing implementation. */
112
+ preserve_seed_targets?: string[];
113
+ /** Resolve canonical manifest targets to collection-specific paths. */
114
+ target_overrides?: Record<string, string>;
115
+ /** Reviewed edits to user-owned types, committed atomically with the pack. */
116
+ contract_setups?: ContractSetupChoice[];
117
+ }
118
+ export interface ApplyTypePackInput extends AssessTypePackInput {
119
+ expected_assessment_digest: string;
120
+ allow_downgrade?: boolean;
121
+ }
122
+ export type ContractSetupChoice = {
123
+ contract: ContractRequirement;
124
+ mode: "starter";
125
+ } | {
126
+ contract: ContractRequirement;
127
+ mode: "existing";
128
+ type_name: string;
129
+ /** Exact type source revision shown during approval. */
130
+ type_revision: string;
131
+ fields: Record<string, string>;
132
+ binding?: Record<string, unknown>;
133
+ };
@@ -0,0 +1,30 @@
1
+ /** Exact identity of the standard record-created runtime event contract. */
2
+ export const MDBASE_RECORD_CREATED_CONTRACT = {
3
+ id: "mdbase.record.created",
4
+ version: "1.0.0",
5
+ digest: "sha256:7f3bed6baa356ee9389e977ae7b77a102e2bee871a7c1d9f2026fc21cacdbfc9",
6
+ };
7
+ /** Exact identity of the standard record-modified runtime event contract. */
8
+ export const MDBASE_RECORD_MODIFIED_CONTRACT = {
9
+ id: "mdbase.record.modified",
10
+ version: "1.0.0",
11
+ digest: "sha256:064187148a95701a1f5c749643d306d3c6708470b6b7ab0bf0c698d38dbcabe3",
12
+ };
13
+ /** Exact identity of the standard record-deleted runtime event contract. */
14
+ export const MDBASE_RECORD_DELETED_CONTRACT = {
15
+ id: "mdbase.record.deleted",
16
+ version: "1.0.0",
17
+ digest: "sha256:84e5fb0f9d3bfdcd53f76cdc5035f94c7693fdea39a8ead190b10b422dd2ee09",
18
+ };
19
+ /** Exact identity of the standard record-renamed runtime event contract. */
20
+ export const MDBASE_RECORD_RENAMED_CONTRACT = {
21
+ id: "mdbase.record.renamed",
22
+ version: "1.0.0",
23
+ digest: "sha256:c825ef8d7db775b784d7af27e6acdf6f2799d2c6440d486f5bfa78afcca71471",
24
+ };
25
+ /** Exact identity of the standard timer-fired runtime event contract. */
26
+ export const MDBASE_TIMER_FIRED_CONTRACT = {
27
+ id: "mdbase.runtime.timer.fired",
28
+ version: "1.0.0",
29
+ digest: "sha256:41105be7a7abf33b31ced47e1e1965242236e40ccaea286b959b0a8c591f5642",
30
+ };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mdbase-dev/connect-protocol",
3
- "version": "0.1.0-beta.26",
3
+ "version": "0.1.0-beta.28",
4
4
  "private": false,
5
5
  "type": "module",
6
6
  "license": "MIT",
@@ -93,6 +93,46 @@
93
93
  }
94
94
  }
95
95
  },
96
+ {
97
+ "type": "object",
98
+ "additionalProperties": false,
99
+ "required": [
100
+ "problem_version",
101
+ "code",
102
+ "category",
103
+ "recovery",
104
+ "message"
105
+ ],
106
+ "properties": {
107
+ "problem_version": {
108
+ "const": 1
109
+ },
110
+ "code": {
111
+ "const": "application_identity_unavailable"
112
+ },
113
+ "category": {
114
+ "const": "compatibility"
115
+ },
116
+ "recovery": {
117
+ "const": "upgrade_application"
118
+ },
119
+ "message": {
120
+ "type": "string",
121
+ "minLength": 1
122
+ },
123
+ "operation_outcome": {
124
+ "enum": [
125
+ "not_sent",
126
+ "rejected",
127
+ "unknown"
128
+ ]
129
+ },
130
+ "trace_id": {
131
+ "type": "string",
132
+ "minLength": 1
133
+ }
134
+ }
135
+ },
96
136
  {
97
137
  "type": "object",
98
138
  "additionalProperties": false,
@@ -282,6 +322,46 @@
282
322
  }
283
323
  }
284
324
  },
325
+ {
326
+ "type": "object",
327
+ "additionalProperties": false,
328
+ "required": [
329
+ "problem_version",
330
+ "code",
331
+ "category",
332
+ "recovery",
333
+ "message"
334
+ ],
335
+ "properties": {
336
+ "problem_version": {
337
+ "const": 1
338
+ },
339
+ "code": {
340
+ "const": "authorization_replayed"
341
+ },
342
+ "category": {
343
+ "const": "integrity"
344
+ },
345
+ "recovery": {
346
+ "const": "reauthorize"
347
+ },
348
+ "message": {
349
+ "type": "string",
350
+ "minLength": 1
351
+ },
352
+ "operation_outcome": {
353
+ "enum": [
354
+ "not_sent",
355
+ "rejected",
356
+ "unknown"
357
+ ]
358
+ },
359
+ "trace_id": {
360
+ "type": "string",
361
+ "minLength": 1
362
+ }
363
+ }
364
+ },
285
365
  {
286
366
  "type": "object",
287
367
  "additionalProperties": false,
@@ -1666,46 +1746,6 @@
1666
1746
  }
1667
1747
  }
1668
1748
  },
1669
- {
1670
- "type": "object",
1671
- "additionalProperties": false,
1672
- "required": [
1673
- "problem_version",
1674
- "code",
1675
- "category",
1676
- "recovery",
1677
- "message"
1678
- ],
1679
- "properties": {
1680
- "problem_version": {
1681
- "const": 1
1682
- },
1683
- "code": {
1684
- "const": "first_contact_handler_required"
1685
- },
1686
- "category": {
1687
- "const": "compatibility"
1688
- },
1689
- "recovery": {
1690
- "const": "upgrade_application"
1691
- },
1692
- "message": {
1693
- "type": "string",
1694
- "minLength": 1
1695
- },
1696
- "operation_outcome": {
1697
- "enum": [
1698
- "not_sent",
1699
- "rejected",
1700
- "unknown"
1701
- ]
1702
- },
1703
- "trace_id": {
1704
- "type": "string",
1705
- "minLength": 1
1706
- }
1707
- }
1708
- },
1709
1749
  {
1710
1750
  "type": "object",
1711
1751
  "additionalProperties": false,
@@ -1831,7 +1871,7 @@
1831
1871
  "const": 1
1832
1872
  },
1833
1873
  "code": {
1834
- "const": "invalid_application_manifest"
1874
+ "const": "invalid_application_authorization"
1835
1875
  },
1836
1876
  "category": {
1837
1877
  "const": "validation"
@@ -1871,7 +1911,7 @@
1871
1911
  "const": 1
1872
1912
  },
1873
1913
  "code": {
1874
- "const": "invalid_callback"
1914
+ "const": "invalid_application_manifest"
1875
1915
  },
1876
1916
  "category": {
1877
1917
  "const": "validation"
@@ -1911,13 +1951,13 @@
1911
1951
  "const": 1
1912
1952
  },
1913
1953
  "code": {
1914
- "const": "invalid_device_authorization_response"
1954
+ "const": "invalid_callback"
1915
1955
  },
1916
1956
  "category": {
1917
- "const": "integrity"
1957
+ "const": "validation"
1918
1958
  },
1919
1959
  "recovery": {
1920
- "const": "contact_support"
1960
+ "const": "fix_request"
1921
1961
  },
1922
1962
  "message": {
1923
1963
  "type": "string",
@@ -1951,7 +1991,7 @@
1951
1991
  "const": 1
1952
1992
  },
1953
1993
  "code": {
1954
- "const": "invalid_encrypted_response"
1994
+ "const": "invalid_device_authorization_response"
1955
1995
  },
1956
1996
  "category": {
1957
1997
  "const": "integrity"
@@ -1991,7 +2031,7 @@
1991
2031
  "const": 1
1992
2032
  },
1993
2033
  "code": {
1994
- "const": "invalid_first_contact"
2034
+ "const": "invalid_encrypted_response"
1995
2035
  },
1996
2036
  "category": {
1997
2037
  "const": "integrity"
@@ -3243,6 +3283,46 @@
3243
3283
  }
3244
3284
  }
3245
3285
  },
3286
+ {
3287
+ "type": "object",
3288
+ "additionalProperties": false,
3289
+ "required": [
3290
+ "problem_version",
3291
+ "code",
3292
+ "category",
3293
+ "recovery",
3294
+ "message"
3295
+ ],
3296
+ "properties": {
3297
+ "problem_version": {
3298
+ "const": 1
3299
+ },
3300
+ "code": {
3301
+ "const": "reconnect_required"
3302
+ },
3303
+ "category": {
3304
+ "const": "authorization"
3305
+ },
3306
+ "recovery": {
3307
+ "const": "reauthorize"
3308
+ },
3309
+ "message": {
3310
+ "type": "string",
3311
+ "minLength": 1
3312
+ },
3313
+ "operation_outcome": {
3314
+ "enum": [
3315
+ "not_sent",
3316
+ "rejected",
3317
+ "unknown"
3318
+ ]
3319
+ },
3320
+ "trace_id": {
3321
+ "type": "string",
3322
+ "minLength": 1
3323
+ }
3324
+ }
3325
+ },
3246
3326
  {
3247
3327
  "type": "object",
3248
3328
  "additionalProperties": false,
@@ -37,6 +37,7 @@
37
37
  }
38
38
  },
39
39
  "access_paused": { "category": "availability", "recovery": "resume_connector_access" },
40
+ "application_identity_unavailable": { "category": "compatibility", "recovery": "upgrade_application" },
40
41
  "approval_window_blocked": {
41
42
  "category": "authorization",
42
43
  "recovery": "reauthorize",
@@ -54,6 +55,7 @@
54
55
  "authority_authorization_changed": { "category": "authorization", "recovery": "reauthorize" },
55
56
  "authorization_cancelled": { "category": "cancellation", "recovery": "none" },
56
57
  "authorization_expired": { "category": "authorization", "recovery": "reauthorize" },
58
+ "authorization_replayed": { "category": "integrity", "recovery": "reauthorize" },
57
59
  "browser_required": { "category": "compatibility", "recovery": "none" },
58
60
  "callback_url_required": { "category": "validation", "recovery": "fix_request" },
59
61
  "change_cursor_reset": { "category": "conflict", "recovery": "refresh" },
@@ -151,7 +153,6 @@
151
153
  "file_not_found": { "category": "conflict", "recovery": "refresh" },
152
154
  "file_source_mismatch": { "category": "conflict", "recovery": "refresh" },
153
155
  "file_upload_incomplete": { "category": "conflict", "recovery": "retry" },
154
- "first_contact_handler_required": { "category": "compatibility", "recovery": "upgrade_application" },
155
156
  "hosted_provider_unavailable": { "category": "availability", "recovery": "retry" },
156
157
  "insufficient_access": {
157
158
  "category": "authorization",
@@ -165,11 +166,11 @@
165
166
  }
166
167
  }
167
168
  },
169
+ "invalid_application_authorization": { "category": "validation", "recovery": "fix_request" },
168
170
  "invalid_application_manifest": { "category": "validation", "recovery": "fix_request" },
169
171
  "invalid_callback": { "category": "validation", "recovery": "fix_request" },
170
172
  "invalid_device_authorization_response": { "category": "integrity", "recovery": "contact_support" },
171
173
  "invalid_encrypted_response": { "category": "integrity", "recovery": "contact_support" },
172
- "invalid_first_contact": { "category": "integrity", "recovery": "contact_support" },
173
174
  "invalid_loopback_url": { "category": "validation", "recovery": "fix_request" },
174
175
  "invalid_mutation_id": { "category": "validation", "recovery": "fix_request" },
175
176
  "invalid_operation_response": { "category": "integrity", "recovery": "contact_support" },
@@ -219,6 +220,7 @@
219
220
  }
220
221
  }
221
222
  },
223
+ "reconnect_required": { "category": "authorization", "recovery": "reauthorize" },
222
224
  "redirect_uri_required": { "category": "validation", "recovery": "fix_request" },
223
225
  "reference_updates_unsupported": { "category": "compatibility", "recovery": "fix_request" },
224
226
  "relay_authorization_expired": { "category": "authorization", "recovery": "reauthorize" },
@@ -22,15 +22,16 @@
22
22
  "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
23
23
  },
24
24
  "operation": {
25
- "enum": ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "create_view_source", "update_view_source", "delete_view_source", "validate", "create", "update", "delete", "rename", "read_type", "create_type", "update_type", "install_type_pack", "list_timers", "put_timer", "cancel_timer", "reconcile_timers", "sync"]
25
+ "enum": ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "create_view_source", "update_view_source", "delete_view_source", "validate", "create", "update", "delete", "rename", "read_type", "create_type", "update_type", "assess_type_pack", "apply_type_pack", "list_timers", "put_timer", "cancel_timer", "reconcile_timers", "sync"]
26
26
  },
27
27
  "contractRequirement": {
28
28
  "type": "object",
29
29
  "additionalProperties": false,
30
- "required": ["id", "version"],
30
+ "required": ["id", "version", "digest"],
31
31
  "properties": {
32
32
  "id": { "type": "string", "minLength": 1, "maxLength": 100, "pattern": "^[a-z0-9]+(?:[._-][a-z0-9]+)*$" },
33
- "version": { "$ref": "#/$defs/semanticVersion" }
33
+ "version": { "$ref": "#/$defs/semanticVersion" },
34
+ "digest": { "$ref": "#/$defs/digest" }
34
35
  }
35
36
  },
36
37
  "semanticVersion": {
@@ -202,7 +203,7 @@
202
203
  "grantPolicy": {
203
204
  "type": "object",
204
205
  "additionalProperties": false,
205
- "required": ["id", "application_id", "collection_id", "operations", "scope", "application_name", "application_distribution", "application_homepage", "application_origin", "collection_name", "created_at", "encryption", "first_contact", "application_authorization"],
206
+ "required": ["id", "application_id", "collection_id", "operations", "scope", "application_name", "application_distribution", "application_homepage", "application_origin", "collection_name", "created_at", "encryption", "application_authorization"],
206
207
  "properties": {
207
208
  "id": { "$ref": "#/$defs/uuid" },
208
209
  "application_id": { "$ref": "#/$defs/uuid" },
@@ -231,24 +232,9 @@
231
232
  "file_capability": {
232
233
  "$ref": "https://mdbase.dev/connect/schemas/files.v1.json#/$defs/fileCapability"
233
234
  },
234
- "first_contact": { "$ref": "#/$defs/firstContactBinding" },
235
235
  "application_authorization": { "$ref": "#/$defs/applicationAuthorizationProof" }
236
236
  }
237
237
  },
238
- "firstContactBinding": {
239
- "type": "object",
240
- "additionalProperties": false,
241
- "required": ["protocol_version", "application_id", "application_installation_id", "application_agreement_public_key", "application_signing_public_key", "connector_id", "connector_agreement_public_key"],
242
- "properties": {
243
- "protocol_version": { "const": 1 },
244
- "application_id": { "$ref": "#/$defs/uuid" },
245
- "application_installation_id": { "$ref": "#/$defs/uuid" },
246
- "application_agreement_public_key": { "$ref": "#/$defs/p256PublicKey" },
247
- "application_signing_public_key": { "$ref": "#/$defs/p256PublicKey" },
248
- "connector_id": { "$ref": "#/$defs/uuid" },
249
- "connector_agreement_public_key": { "$ref": "#/$defs/p256PublicKey" }
250
- }
251
- },
252
238
  "applicationAuthorizationProof": {
253
239
  "type": "object",
254
240
  "additionalProperties": false,
@@ -261,14 +247,13 @@
261
247
  "applicationAuthorizationBinding": {
262
248
  "type": "object",
263
249
  "additionalProperties": false,
264
- "required": ["protocol_version", "authorization_id", "application_id", "application_manifest_digest", "application_installation_id", "installation_agreement_public_key", "installation_signing_public_key", "grant_agreement_public_key", "grant_signing_public_key", "flow", "authorization_nonce", "issued_at", "expires_at", "code_challenge", "requested_operations"],
250
+ "required": ["protocol_version", "authorization_id", "application_id", "application_manifest_digest", "application_installation_id", "installation_signing_public_key", "grant_agreement_public_key", "grant_signing_public_key", "flow", "authorization_nonce", "issued_at", "expires_at", "code_challenge", "requested_operations"],
265
251
  "properties": {
266
- "protocol_version": { "const": 1 },
252
+ "protocol_version": { "const": 2 },
267
253
  "authorization_id": { "$ref": "#/$defs/uuid" },
268
254
  "application_id": { "$ref": "#/$defs/uuid" },
269
255
  "application_manifest_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
270
256
  "application_installation_id": { "$ref": "#/$defs/uuid" },
271
- "installation_agreement_public_key": { "$ref": "#/$defs/p256PublicKey" },
272
257
  "installation_signing_public_key": { "$ref": "#/$defs/p256PublicKey" },
273
258
  "grant_agreement_public_key": { "$ref": "#/$defs/p256PublicKey" },
274
259
  "grant_signing_public_key": { "$ref": "#/$defs/p256PublicKey" },
@@ -371,9 +356,10 @@
371
356
  "typePackManifestResource": {
372
357
  "type": "object",
373
358
  "additionalProperties": false,
374
- "required": ["kind", "source", "target", "digest"],
359
+ "required": ["kind", "mode", "source", "target", "digest"],
375
360
  "properties": {
376
361
  "kind": { "enum": ["contract", "type", "schema"] },
362
+ "mode": { "enum": ["managed", "seed"] },
377
363
  "source": { "type": "string", "minLength": 1, "maxLength": 500 },
378
364
  "target": { "type": "string", "minLength": 1, "maxLength": 500 },
379
365
  "digest": { "$ref": "#/$defs/digest" }
@@ -14,7 +14,7 @@
14
14
  "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
15
15
  },
16
16
  "operation": {
17
- "enum": ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "create_view_source", "update_view_source", "delete_view_source", "validate", "create", "update", "delete", "rename", "read_type", "create_type", "update_type", "install_type_pack", "list_timers", "put_timer", "cancel_timer", "reconcile_timers", "file_control"]
17
+ "enum": ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "create_view_source", "update_view_source", "delete_view_source", "validate", "create", "update", "delete", "rename", "read_type", "create_type", "update_type", "assess_type_pack", "apply_type_pack", "list_timers", "put_timer", "cancel_timer", "reconcile_timers", "file_control"]
18
18
  },
19
19
  "envelope": {
20
20
  "type": "object",
@@ -93,21 +93,23 @@
93
93
  "contract": {
94
94
  "type": "object",
95
95
  "additionalProperties": false,
96
- "required": ["id", "version"],
96
+ "required": ["id", "version", "digest"],
97
97
  "properties": {
98
98
  "id": { "$ref": "#/$defs/identifier" },
99
99
  "version": {
100
100
  "type": "string",
101
101
  "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
102
- }
102
+ },
103
+ "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
103
104
  }
104
105
  },
105
106
  "requirements": {
106
107
  "type": "object",
107
108
  "additionalProperties": false,
108
109
  "required": ["contracts"],
109
- "properties": {
110
- "access": {
110
+ "properties": {
111
+ "capabilities": { "$ref": "#/$defs/capabilityRequirements" },
112
+ "access": {
111
113
  "enum": ["contract", "full_collection"],
112
114
  "description": "Access boundary requested after compatibility and provisioning checks."
113
115
  },
@@ -124,6 +126,63 @@
124
126
  }
125
127
  }
126
128
  },
129
+ "capabilityRequirements": {
130
+ "type": "object",
131
+ "additionalProperties": false,
132
+ "required": ["contract_version", "required"],
133
+ "properties": {
134
+ "contract_version": { "const": 1 },
135
+ "required": {
136
+ "type": "array",
137
+ "maxItems": 32,
138
+ "uniqueItems": true,
139
+ "items": { "$ref": "#/$defs/applicationCapability" }
140
+ },
141
+ "optional": {
142
+ "type": "array",
143
+ "maxItems": 32,
144
+ "uniqueItems": true,
145
+ "items": { "$ref": "#/$defs/applicationCapability" }
146
+ }
147
+ }
148
+ },
149
+ "applicationCapability": {
150
+ "enum": [
151
+ "collection.inspect",
152
+ "records.watch",
153
+ "records.read",
154
+ "records.query",
155
+ "records.validate",
156
+ "records.create",
157
+ "records.update",
158
+ "records.delete",
159
+ "records.rename",
160
+ "views.list",
161
+ "views.execute",
162
+ "views.source.read",
163
+ "views.source.create",
164
+ "views.source.update",
165
+ "views.source.delete",
166
+ "definitions.contracts.current",
167
+ "definitions.read",
168
+ "definitions.create",
169
+ "definitions.update",
170
+ "definitions.type-pack.inspect",
171
+ "definitions.type-pack.apply",
172
+ "timers.list",
173
+ "timers.put",
174
+ "timers.cancel",
175
+ "timers.reconcile",
176
+ "sync.offline-replica",
177
+ "notifications.background-delivery",
178
+ "files.list",
179
+ "files.read",
180
+ "files.add",
181
+ "files.replace",
182
+ "files.move",
183
+ "files.delete"
184
+ ]
185
+ },
127
186
  "fileRequirement": {
128
187
  "type": "object",
129
188
  "additionalProperties": false,
@@ -213,9 +272,10 @@
213
272
  "typePackManifestResource": {
214
273
  "type": "object",
215
274
  "additionalProperties": false,
216
- "required": ["kind", "source", "target", "digest"],
275
+ "required": ["kind", "mode", "source", "target", "digest"],
217
276
  "properties": {
218
277
  "kind": { "enum": ["contract", "type", "schema"] },
278
+ "mode": { "enum": ["managed", "seed"] },
219
279
  "source": { "type": "string", "minLength": 1, "maxLength": 240 },
220
280
  "target": { "type": "string", "minLength": 1, "maxLength": 240 },
221
281
  "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
@@ -89,7 +89,7 @@
89
89
  "required": ["path", "kind", "revision", "document"],
90
90
  "properties": {
91
91
  "path": { "type": "string", "minLength": 1 },
92
- "kind": { "enum": ["configuration", "type", "contract", "schema", "view"] },
92
+ "kind": { "enum": ["configuration", "lock", "type", "contract", "schema", "view"] },
93
93
  "revision": { "$ref": "#/$defs/digest" },
94
94
  "document": { "type": "string" }
95
95
  }