@mdbase-dev/connect-protocol 0.1.0-beta.31 → 0.1.0-beta.33

package/dist/connect-problems.generated.js

@@ -6,11 +6,13 @@ export const CONNECT_PROBLEM_CATALOG = {
     "application_identity_unavailable": { category: "compatibility", recovery: "upgrade_application" },
     "approval_window_blocked": { category: "authorization", recovery: "reauthorize" },
     "authority_authorization_changed": { category: "authorization", recovery: "reauthorize" },
+    "authorization_binding_incompatible": { category: "compatibility", recovery: "upgrade_application" },
     "authorization_cancelled": { category: "cancellation", recovery: "none" },
     "authorization_expired": { category: "authorization", recovery: "reauthorize" },
     "authorization_replayed": { category: "integrity", recovery: "reauthorize" },
     "browser_required": { category: "compatibility", recovery: "none" },
     "callback_url_required": { category: "validation", recovery: "fix_request" },
+    "capability_contract_incompatible": { category: "compatibility", recovery: "upgrade_application" },
     "change_cursor_reset": { category: "conflict", recovery: "refresh" },
     "collection_access_denied": { category: "authorization", recovery: "reauthorize" },
     "collection_configuration_invalid": { category: "validation", recovery: "repair_collection" },
@@ -31,6 +33,7 @@ export const CONNECT_PROBLEM_CATALOG = {
     "device_authorization_failed": { category: "authorization", recovery: "reauthorize" },
     "direct_operation_rejected": { category: "authorization", recovery: "reauthorize" },
     "discovery_failed": { category: "availability", recovery: "retry" },
+    "durable_mutation_unsupported": { category: "compatibility", recovery: "upgrade_connector" },
     "encrypted_relay_rejected": { category: "authorization", recovery: "reauthorize" },
     "encryption_required": { category: "authorization", recovery: "reauthorize" },
     "expired_token": { category: "authorization", recovery: "reauthorize" },
@@ -61,6 +64,8 @@ export const CONNECT_PROBLEM_CATALOG = {
     "manifest_load_failed": { category: "availability", recovery: "retry" },
     "manifest_required": { category: "validation", recovery: "fix_request" },
     "missing_grant_key": { category: "authorization", recovery: "reauthorize" },
+    "mutation_recovery_expired": { category: "compatibility", recovery: "none" },
+    "mutation_request_conflict": { category: "conflict", recovery: "resolve_conflict" },
     "no_pending_mutation": { category: "conflict", recovery: "refresh" },
     "not_authorized": { category: "authorization", recovery: "reauthorize" },
     "not_remote_authority": { category: "compatibility", recovery: "choose_collection" },
@@ -81,6 +86,11 @@ export const CONNECT_PROBLEM_CATALOG = {
     "reconnect_required": { category: "authorization", recovery: "reauthorize" },
     "redirect_uri_required": { category: "validation", recovery: "fix_request" },
     "reference_updates_unsupported": { category: "compatibility", recovery: "fix_request" },
+    "registry_backup_invalid": { category: "integrity", recovery: "contact_support" },
+    "registry_busy": { category: "availability", recovery: "retry" },
+    "registry_corrupt": { category: "integrity", recovery: "repair_collection" },
+    "registry_migration_failed": { category: "internal", recovery: "contact_support" },
+    "registry_schema_incompatible": { category: "compatibility", recovery: "upgrade_connector" },
     "relay_authorization_expired": { category: "authorization", recovery: "reauthorize" },
     "relay_unavailable": { category: "availability", recovery: "retry" },
     "sandbox_unsupported": { category: "compatibility", recovery: "fix_request" },
@@ -91,6 +101,7 @@ export const CONNECT_PROBLEM_CATALOG = {
     "temporarily_unavailable": { category: "availability", recovery: "retry" },
     "timeout": { category: "availability", recovery: "retry" },
     "token_exchange_failed": { category: "availability", recovery: "retry" },
+    "transport_protocol_incompatible": { category: "compatibility", recovery: "upgrade_connector" },
     "type_pack_provision_failed": { category: "validation", recovery: "repair_collection" },
     "unknown_collection": { category: "selection", recovery: "choose_collection" },
     "unsafe_file_path": { category: "validation", recovery: "fix_request" },
@@ -134,6 +145,70 @@ const CONNECT_PROBLEM_DETAIL_SCHEMAS = {
             }
         }
     },
+    "authorization_binding_incompatible": {
+        "type": "object",
+        "required": [
+            "contract",
+            "required",
+            "supported",
+            "peer"
+        ],
+        "properties": {
+            "contract": {
+                "type": "string"
+            },
+            "required": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "supported": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "peer": {
+                "type": "string"
+            },
+            "operation": {
+                "type": "string"
+            }
+        }
+    },
+    "capability_contract_incompatible": {
+        "type": "object",
+        "required": [
+            "contract",
+            "required",
+            "supported",
+            "peer"
+        ],
+        "properties": {
+            "contract": {
+                "type": "string"
+            },
+            "required": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "supported": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "peer": {
+                "type": "string"
+            },
+            "operation": {
+                "type": "string"
+            }
+        }
+    },
     "collection_configuration_invalid": {
         "type": "object",
         "required": [
@@ -226,6 +301,38 @@ const CONNECT_PROBLEM_DETAIL_SCHEMAS = {
             }
         }
     },
+    "durable_mutation_unsupported": {
+        "type": "object",
+        "required": [
+            "contract",
+            "required",
+            "supported",
+            "peer"
+        ],
+        "properties": {
+            "contract": {
+                "type": "string"
+            },
+            "required": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "supported": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "peer": {
+                "type": "string"
+            },
+            "operation": {
+                "type": "string"
+            }
+        }
+    },
     "insufficient_access": {
         "type": "object",
         "required": [
@@ -288,6 +395,17 @@ const CONNECT_PROBLEM_DETAIL_SCHEMAS = {
             }
         }
     },
+    "mutation_request_conflict": {
+        "type": "object",
+        "required": [
+            "request_id"
+        ],
+        "properties": {
+            "request_id": {
+                "type": "string"
+            }
+        }
+    },
     "operation_invalid": {
         "type": "object",
         "required": [
@@ -303,6 +421,17 @@ const CONNECT_PROBLEM_DETAIL_SCHEMAS = {
             "partial_result": {}
         }
     },
+    "operation_outcome_unknown": {
+        "type": "object",
+        "required": [
+            "request_id"
+        ],
+        "properties": {
+            "request_id": {
+                "type": "string"
+            }
+        }
+    },
     "rate_limited": {
         "type": "object",
         "required": [],
@@ -311,6 +440,38 @@ const CONNECT_PROBLEM_DETAIL_SCHEMAS = {
                 "type": "integer"
             }
         }
+    },
+    "transport_protocol_incompatible": {
+        "type": "object",
+        "required": [
+            "contract",
+            "required",
+            "supported",
+            "peer"
+        ],
+        "properties": {
+            "contract": {
+                "type": "string"
+            },
+            "required": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "supported": {
+                "type": "array",
+                "items": {
+                    "type": "integer"
+                }
+            },
+            "peer": {
+                "type": "string"
+            },
+            "operation": {
+                "type": "string"
+            }
+        }
     }
 };
 export function isConnectProblemCode(code) {

package/dist/files.d.ts

@@ -152,6 +152,8 @@ export interface FileTransferStatus {
     state: FileTransferState;
     received: number[];
     received_bytes: number;
+    /** Object-store receipts for the currently durable multipart parts. */
+    uploaded_parts: UploadedFilePart[];
 }
 export interface PrepareFileUploadPartRequest {
     protocol_version: 1;

package/dist/index.d.ts

@@ -3,24 +3,31 @@ import type { ApplicationFileRequirement, CollectionFileDescriptor, FileCapabili
 import type { CollectionOperation } from "./operations.js";
 import type { ApplicationCapabilityRequirements } from "./capabilities.js";
 import type { ContractRequirement, ContractSetupChoice, TypePackProvision } from "./type-packs.js";
+import type { ConfigurationProvision, ConfigurationRequirement } from "./collection-setup.js";
 import type { ApplicationAuthorizationProof } from "./application-authorization.js";
 export * from "./connect-problems.generated.js";
 export * from "./files.js";
 export * from "./operations.js";
+export * from "./mutation-fingerprint.js";
+export * from "./compatibility.js";
 export * from "./capabilities.js";
 export * from "./application-authorization.js";
 export * from "./type-packs.js";
+export * from "./collection-setup.js";
 export declare const CONTROL_PROTOCOL_VERSION: 1;
-export declare const ENCRYPTED_RELAY_PROTOCOL_VERSION: 1;
-export declare const APPLICATION_AUTHORIZATION_PROTOCOL_VERSION: 2;
+export { AUTHORIZATION_BINDING_PROTOCOL_VERSION as APPLICATION_AUTHORIZATION_PROTOCOL_VERSION } from "./compatibility.js";
 export declare const LOOPBACK_PROTOCOL_VERSION: 1;
 export declare const DEFAULT_LOOPBACK_PORT: 28485;
 export declare const RELAY_ENCRYPTION_SUITE: "P256-HKDF-SHA256-AES256GCM";
+export declare const GRANT_ENCRYPTION_PROTOCOL_VERSION: 1;
 export declare const SYNC_PROTOCOL_VERSION: 1;
 export declare const CONTRACT_SETUP_CAPABILITY: "contract-setup-v1";
 export declare const FILE_RELAY_CAPABILITY: "file-relay-v1";
-export declare const RELAY_REQUIRED_CAPABILITIES: readonly ["application-authorization-v2", "authorization-activation", "encrypted-relay", "policy-ack"];
-export declare const RELAY_CAPABILITIES: readonly ["application-authorization-v2", "authorization-activation", "encrypted-relay", "policy-ack", "contract-setup-v1", "file-relay-v1"];
+export declare const RELAY_REQUIRED_CAPABILITIES: readonly ["application-authorization-v4", "authorization-activation", "encrypted-relay", "policy-ack"];
+export declare const MINIMUM_CONNECTOR_VERSION: "0.1.0-beta.33";
+export declare const HOSTED_PROVIDER_REQUIRED_CAPABILITIES: readonly ["durable-mutation-journal-v1", "durable-file-lifecycle-v1"];
+export declare const HOSTED_PROVIDER_CAPABILITIES: readonly ["durable-mutation-journal-v1", "durable-file-lifecycle-v1", "mutation-replay-after-credential-retirement-v1"];
+export declare const RELAY_CAPABILITIES: readonly ["application-authorization-v4", "authorization-activation", "encrypted-relay", "policy-ack", "contract-setup-v1", "file-relay-v1"];
 export declare const AUTHORITY_PROOF_VERSION: 1;
 export declare const AUTHORITY_PROOF_ALGORITHM: "P256-SHA256";
 export declare const AUTHORITY_PROOF_DOMAIN: "mdbase-authority-request-proof-v1";
@@ -42,7 +49,7 @@ export declare const CONNECT_SCHEMA_IDS: {
     readonly dataContract: "https://mdbase.dev/schemas/v0.3/data-contract.schema.json";
     readonly eventActionInterop: "https://mdbase.dev/schemas/interop/v0.1/profile.schema.json";
     readonly protocol: "https://mdbase.dev/connect/schemas/connect-protocol.v1.json";
-    readonly encryptedRelay: "https://mdbase.dev/connect/schemas/encrypted-relay.v1.json";
+    readonly encryptedRelay: "https://mdbase.dev/connect/schemas/encrypted-relay.v2.json";
     readonly files: "https://mdbase.dev/connect/schemas/files.v1.json";
     readonly sync: "https://mdbase.dev/connect/schemas/sync.v1.json";
 };
@@ -148,6 +155,8 @@ export interface NotificationWebhook {
 }
 export interface ApplicationRequirements {
     contracts: ContractRequirement[];
+    /** Collection extension values required before the application is ready. */
+    configuration?: ConfigurationRequirement[];
     /** Versioned semantic intent compiled by Connect into exact operations. */
     capabilities?: ApplicationCapabilityRequirements;
     /** Access boundary requested after compatibility and provisioning checks. */
@@ -159,6 +168,8 @@ export interface ApplicationRequirements {
 }
 export interface ApplicationProvisions {
     type_packs: TypePackProvision[];
+    /** Narrow semantic changes that may satisfy configuration requirements. */
+    configuration?: ConfigurationProvision[];
 }
 export interface GrantScope {
     /**
@@ -171,7 +182,7 @@ export interface GrantScope {
 }
 export interface RelayOperationRequest {
     type: "operation_request";
-    protocol_version: 1;
+    protocol_version: 2;
     request_id: string;
     grant_id: string;
     collection_id: string;
@@ -181,29 +192,29 @@ export interface RelayOperationRequest {
 }
 export type RelayOperationResponse = {
     type: "operation_response";
-    protocol_version: 1;
+    protocol_version: 2;
     request_id: string;
     ok: true;
     result: unknown;
 } | {
     type: "operation_response";
-    protocol_version: 1;
+    protocol_version: 2;
     request_id: string;
     ok: false;
     problem: ConnectProblem;
 };
 export interface MdbaseOperationRequest<Input = unknown> {
-    protocol_version: 1;
+    protocol_version: 2;
     request_id: string;
     input: Input;
 }
 export type MdbaseOperationResponse<Result = unknown> = {
-    protocol_version: 1;
+    protocol_version: 2;
     request_id: string;
     ok: true;
     result: Result;
 } | {
-    protocol_version: 1;
+    protocol_version: 2;
     request_id: string;
     ok: false;
     problem: ConnectProblem;
@@ -232,7 +243,9 @@ export interface GrantPolicy {
     application_authorization: ApplicationAuthorizationProof;
 }
 /** Presentation-only grant shape used outside a local authorization boundary. */
-export type GrantSummary = Omit<GrantPolicy, "application_authorization">;
+export type GrantSummary = Omit<GrantPolicy, "application_authorization"> & {
+    contracts: import("./compatibility.js").ConnectContractRequirements;
+};
 export interface GrantEncryption {
     protocol_version: 1;
     suite: typeof RELAY_ENCRYPTION_SUITE;
@@ -244,7 +257,7 @@ export interface GrantEncryption {
     connector_agreement_public_key: string;
 }
 export interface EncryptedRelayEnvelope {
-    protocol_version: 1;
+    protocol_version: 2;
     suite: typeof RELAY_ENCRYPTION_SUITE;
     request_id: string;
     grant_id: string;
@@ -490,18 +503,22 @@ export interface RelayHello {
     protocol_version: 1;
     connector_version: string;
     capabilities: string[];
+    contract_support: import("./compatibility.js").ConnectContractSupport;
 }
 export interface RelayWelcome {
     type: "relay_welcome";
     protocol_version: 1;
     session_id: string;
     capabilities: string[];
+    contract_support: import("./compatibility.js").ConnectContractSupport;
 }
 export interface RelayIncompatible {
     type: "relay_incompatible";
     protocol_version: 1;
-    code: "connector_upgrade_required";
+    code: "connector_upgrade_required" | "transport_protocol_incompatible" | "authorization_binding_incompatible" | "capability_contract_incompatible" | "durable_mutation_unsupported";
     message: string;
+    details?: import("./connect-problems.generated.js").ConnectProblemDetailsByCode["transport_protocol_incompatible" | "authorization_binding_incompatible" | "capability_contract_incompatible" | "durable_mutation_unsupported"];
+    minimum_connector_version: string;
     update_url: string;
 }
 export interface RelayPolicyApplied {
@@ -539,6 +556,8 @@ export interface AuthorizationActivationResponse {
     contracts: CollectionContractDescriptor[];
     /** Exact setup plan applied by the authority. */
     contract_setups: ContractSetupChoice[];
+    setup_assessment?: unknown;
+    provision_receipt?: unknown;
     error?: {
         code: string;
         message: string;

package/dist/index.js

@@ -1,24 +1,36 @@
 export * from "./connect-problems.generated.js";
 export * from "./files.js";
 export * from "./operations.js";
+export * from "./mutation-fingerprint.js";
+export * from "./compatibility.js";
 export * from "./capabilities.js";
 export * from "./application-authorization.js";
 export * from "./type-packs.js";
+export * from "./collection-setup.js";
 export const CONTROL_PROTOCOL_VERSION = 1;
-export const ENCRYPTED_RELAY_PROTOCOL_VERSION = 1;
-export const APPLICATION_AUTHORIZATION_PROTOCOL_VERSION = 2;
+export { AUTHORIZATION_BINDING_PROTOCOL_VERSION as APPLICATION_AUTHORIZATION_PROTOCOL_VERSION } from "./compatibility.js";
 export const LOOPBACK_PROTOCOL_VERSION = 1;
 export const DEFAULT_LOOPBACK_PORT = 28_485;
 export const RELAY_ENCRYPTION_SUITE = "P256-HKDF-SHA256-AES256GCM";
+export const GRANT_ENCRYPTION_PROTOCOL_VERSION = 1;
 export const SYNC_PROTOCOL_VERSION = 1;
 export const CONTRACT_SETUP_CAPABILITY = "contract-setup-v1";
 export const FILE_RELAY_CAPABILITY = "file-relay-v1";
 export const RELAY_REQUIRED_CAPABILITIES = [
-    "application-authorization-v2",
+    "application-authorization-v4",
     "authorization-activation",
     "encrypted-relay",
     "policy-ack"
 ];
+export const MINIMUM_CONNECTOR_VERSION = "0.1.0-beta.33";
+export const HOSTED_PROVIDER_REQUIRED_CAPABILITIES = [
+    "durable-mutation-journal-v1",
+    "durable-file-lifecycle-v1"
+];
+export const HOSTED_PROVIDER_CAPABILITIES = [
+    ...HOSTED_PROVIDER_REQUIRED_CAPABILITIES,
+    "mutation-replay-after-credential-retirement-v1"
+];
 export const RELAY_CAPABILITIES = [
     ...RELAY_REQUIRED_CAPABILITIES,
     CONTRACT_SETUP_CAPABILITY,
@@ -62,7 +74,7 @@ export const CONNECT_SCHEMA_IDS = {
     dataContract: "https://mdbase.dev/schemas/v0.3/data-contract.schema.json",
     eventActionInterop: "https://mdbase.dev/schemas/interop/v0.1/profile.schema.json",
     protocol: "https://mdbase.dev/connect/schemas/connect-protocol.v1.json",
-    encryptedRelay: "https://mdbase.dev/connect/schemas/encrypted-relay.v1.json",
+    encryptedRelay: "https://mdbase.dev/connect/schemas/encrypted-relay.v2.json",
     files: "https://mdbase.dev/connect/schemas/files.v1.json",
     sync: "https://mdbase.dev/connect/schemas/sync.v1.json"
 };

package/dist/manifest.js

@@ -40,7 +40,8 @@ export function validateAppManifest(value, options = {}) {
     const issues = [
         ...validateManifestOrigins(value, options.allowLocal === true),
         ...validateCapabilityRequirements(value),
-        ...validateProvisionRequirements(value)
+        ...validateProvisionRequirements(value),
+        ...validateConfigurationSetup(value)
     ];
     return issues.length === 0 ? { valid: true, issues: [] } : invalid(issues);
 }
@@ -52,8 +53,16 @@ export function parseAppManifest(value, options = {}) {
     const manifest = structuredClone(value);
     return {
         ...manifest,
-        requirements: manifest.requirements ?? { contracts: [] },
-        provisions: manifest.provisions ?? { type_packs: [] },
+        requirements: {
+            contracts: [],
+            configuration: [],
+            ...manifest.requirements
+        },
+        provisions: {
+            type_packs: [],
+            configuration: [],
+            ...manifest.provisions
+        },
         notifications: manifest.notifications ?? { criteria: [] }
     };
 }
@@ -253,6 +262,95 @@ function validateProvisionRequirements(value) {
     }
     return issues;
 }
+function validateConfigurationSetup(value) {
+    const manifest = asObject(value);
+    const requirements = asObject(manifest.requirements);
+    const provisions = asObject(manifest.provisions);
+    const requiredValues = Array.isArray(requirements.configuration)
+        ? requirements.configuration
+        : [];
+    const provisionValues = Array.isArray(provisions.configuration)
+        ? provisions.configuration
+        : [];
+    const issues = [];
+    const required = new Map();
+    for (const [index, candidate] of requiredValues.entries()) {
+        const requirement = asObject(candidate);
+        const id = String(requirement.id);
+        const path = String(requirement.path);
+        const pathError = configurationPointerError(path);
+        if (pathError) {
+            issues.push(issue(`/requirements/configuration/${index}/path`, "configurationPointer", pathError));
+        }
+        if (required.has(id)) {
+            issues.push(issue(`/requirements/configuration/${index}/id`, "uniqueRequirement", `duplicates configuration requirement ${id}`));
+        }
+        else {
+            required.set(id, { path, value: requirement.value, index });
+        }
+    }
+    const linked = new Set();
+    const contributionKeys = new Set();
+    for (const [index, candidate] of provisionValues.entries()) {
+        const provision = asObject(candidate);
+        const requirementId = String(provision.requirement);
+        const path = String(provision.path);
+        const pathError = configurationPointerError(path);
+        if (pathError) {
+            issues.push(issue(`/provisions/configuration/${index}/path`, "configurationPointer", pathError));
+        }
+        const requirement = required.get(requirementId);
+        if (!requirement) {
+            issues.push(issue(`/provisions/configuration/${index}/requirement`, "configurationRequirement", `references unknown configuration requirement ${requirementId}`));
+            continue;
+        }
+        if (linked.has(requirementId)) {
+            issues.push(issue(`/provisions/configuration/${index}/requirement`, "uniqueProvision", `configuration requirement ${requirementId} may have exactly one provision`));
+        }
+        linked.add(requirementId);
+        if (path !== requirement.path) {
+            issues.push(issue(`/provisions/configuration/${index}/path`, "configurationRequirement", `must equal /requirements/configuration/${requirement.index}/path`));
+        }
+        if (JSON.stringify(provision.value) !== JSON.stringify(requirement.value)) {
+            issues.push(issue(`/provisions/configuration/${index}/value`, "configurationRequirement", `must equal /requirements/configuration/${requirement.index}/value`));
+        }
+        const contributionKey = `${path}\0${JSON.stringify(provision.value)}`;
+        if (contributionKeys.has(contributionKey)) {
+            issues.push(issue(`/provisions/configuration/${index}`, "uniqueContribution", "duplicates another configuration path and value contribution"));
+        }
+        contributionKeys.add(contributionKey);
+    }
+    for (const [id, requirement] of required) {
+        if (!linked.has(id)) {
+            issues.push(issue(`/requirements/configuration/${requirement.index}`, "configurationProvision", `requires one provision linked by id ${id}`));
+        }
+    }
+    return issues;
+}
+function configurationPointerError(path) {
+    if (!path.startsWith("/") || new TextEncoder().encode(path).byteLength > 1024) {
+        return "must be a bounded RFC 6901 JSON pointer";
+    }
+    const encoded = path.slice(1).split("/");
+    if (encoded.length < 2 || encoded.length > 16) {
+        return "must address a value below an x-* extension namespace";
+    }
+    const segments = [];
+    for (const value of encoded) {
+        if (/~(?:[^01]|$)/u.test(value))
+            return "contains an invalid RFC 6901 escape";
+        const segment = value.replaceAll("~1", "/").replaceAll("~0", "~");
+        if (segment.length === 0
+            || segment === "-"
+            || /^\d+$/u.test(segment)
+            || [...segment].some((character) => /\p{Cc}/u.test(character)))
+            return "contains a disallowed object-key segment";
+        segments.push(segment);
+    }
+    return /^x-[a-z0-9][a-z0-9-]*$/u.test(segments[0])
+        ? undefined
+        : "must be inside a top-level x-* extension namespace";
+}
 function validateCapabilityRequirements(value) {
     const manifest = asObject(value);
     const requirements = asObject(manifest.requirements);
@@ -285,8 +383,23 @@ function validateCapabilityRequirements(value) {
     }
     if (Array.isArray(provisions.type_packs)
         && provisions.type_packs.length > 0
-        && !required.includes("definitions.type-pack.apply")) {
-        issues.push(issue("/requirements/capabilities/required", "typePackCapability", "must require definitions.type-pack.apply when bundled type packs are declared"));
+        && !required.includes("collection.setup.apply")) {
+        issues.push(issue("/requirements/capabilities/required", "collectionSetupCapability", "must require collection.setup.apply when bundled type packs are declared"));
+    }
+    const hasConfigurationProvisions = Array.isArray(provisions.configuration)
+        && provisions.configuration.length > 0;
+    const hasSetupProvisions = hasConfigurationProvisions
+        || (Array.isArray(provisions.type_packs) && provisions.type_packs.length > 0);
+    if (hasConfigurationProvisions && !required.includes("collection.setup.apply")) {
+        issues.push(issue("/requirements/capabilities/required", "collectionSetupCapability", "must require collection.setup.apply when configuration provisions are declared"));
+    }
+    if (declared.has("collection.setup.apply")) {
+        if (requirements.access !== "full_collection") {
+            issues.push(issue("/requirements/access", "collectionSetupAccess", "must be full_collection for collection.setup.apply"));
+        }
+        if (!hasSetupProvisions) {
+            issues.push(issue("/provisions", "collectionSetupProvision", "must declare a configuration provision or type pack for collection.setup.apply"));
+        }
     }
     if (declared.has("notifications.background-delivery")
         && !Array.isArray(asObject(manifest.notifications).criteria)) {

package/dist/mutation-fingerprint.d.ts

@@ -0,0 +1,6 @@
+import { type EncryptedOperation } from "./operations.js";
+export declare const MUTATION_FINGERPRINT_SCHEMA_VERSION: 1;
+export declare const MUTATION_FINGERPRINT_DOMAIN: "mdbase-connect mutation fingerprint v1\0";
+export declare function canonicalMutationInput(input: unknown): string;
+export declare function mutationFingerprintTranscript(operation: EncryptedOperation, input: unknown): Uint8Array<ArrayBuffer>;
+export declare function mutationFingerprint(operation: EncryptedOperation, input: unknown): Promise<string>;