@mdbase-dev/connect-protocol 0.1.0-beta.92 → 0.1.0-beta.94

package/dist/connect-problems.generated.d.ts

@@ -264,6 +264,10 @@ export declare const CONNECT_PROBLEM_CATALOG: {
         readonly category: "integrity";
         readonly recovery: "contact_support";
     };
+    readonly legacy_scope_reauthorization_required: {
+        readonly category: "authorization";
+        readonly recovery: "reauthorize";
+    };
     readonly managed_fcm_not_declared: {
         readonly category: "compatibility";
         readonly recovery: "fix_request";
@@ -595,6 +599,7 @@ export interface ConnectProblemDetailsByCode {
     "invalid_read_cursor": undefined;
     "invalid_request": undefined;
     "invalid_token_response": undefined;
+    "legacy_scope_reauthorization_required": undefined;
     "managed_fcm_not_declared": undefined;
     "manifest_load_failed": undefined;
     "manifest_required": undefined;
@@ -1058,6 +1063,12 @@ export interface ConnectProblemByCode {
         recovery: "contact_support";
         details?: never;
     };
+    "legacy_scope_reauthorization_required": ConnectProblemBase & {
+        code: "legacy_scope_reauthorization_required";
+        category: "authorization";
+        recovery: "reauthorize";
+        details?: never;
+    };
     "managed_fcm_not_declared": ConnectProblemBase & {
         code: "managed_fcm_not_declared";
         category: "compatibility";

package/dist/connect-problems.generated.js

@@ -67,6 +67,7 @@ export const CONNECT_PROBLEM_CATALOG = {
     "invalid_read_cursor": { category: "validation", recovery: "fix_request" },
     "invalid_request": { category: "validation", recovery: "fix_request" },
     "invalid_token_response": { category: "integrity", recovery: "contact_support" },
+    "legacy_scope_reauthorization_required": { category: "authorization", recovery: "reauthorize" },
     "managed_fcm_not_declared": { category: "compatibility", recovery: "fix_request" },
     "manifest_load_failed": { category: "availability", recovery: "retry" },
     "manifest_required": { category: "validation", recovery: "fix_request" },

package/dist/index.d.ts

@@ -102,11 +102,15 @@ export interface ApplicationNotifications {
  * `id` is stable presentation metadata rather than proof of a publisher. Each
  * exact declaration is independently identified and authorized by Connect.
  */
+export type CanonicalApplicationRequirements = Omit<ApplicationRequirements, "access" | "contracts"> & {
+    access: "full_collection";
+    contracts: [];
+};
 interface MdbaseAppManifestBase {
     manifest_version: 1;
     id: string;
     name: string;
-    requirements?: ApplicationRequirements;
+    requirements: CanonicalApplicationRequirements;
     provisions?: ApplicationProvisions;
     notifications?: ApplicationNotifications;
 }
@@ -164,7 +168,11 @@ export interface ApplicationRequirements {
     configuration?: ConfigurationRequirement[];
     /** Versioned semantic intent compiled by Connect into exact operations. */
     capabilities?: ApplicationCapabilityRequirements;
-    /** Access boundary requested after compatibility and provisioning checks. */
+    /**
+     * Collection boundary request. New declarations must explicitly use
+     * `full_collection`; omitted and `contract` remain parseable only for legacy
+     * diagnosis and reauthorization.
+     */
     access?: "contract" | "full_collection";
     /** Restrict authorization to durable provider-backed collections. */
     collection_kind?: "hosted";
@@ -178,11 +186,12 @@ export interface ApplicationProvisions {
 }
 export interface GrantScope {
     /**
-     * Exact contract definitions and sorted implementation sets approved by the
-     * user. Digests make the scope fail closed if either the interface or any
-     * provider changes after approval.
+     * Legacy semantic scope payload retained for wire/storage compatibility.
+     * Canonical application grants use an empty array; contracts remain available
+     * through collection resources and operation-level semantic selectors.
      */
     contracts: CollectionContractDescriptor[];
+    /** New authority must be `full_collection`; `contract` is legacy-only. */
     access: "contract" | "full_collection";
 }
 export interface RelayOperationRequest {
@@ -519,10 +528,11 @@ export interface RelayPolicySnapshot {
     protocol_version: 1;
     request_id: string;
     revision: string;
-    connector_id: string;
-    sequence: number;
-    lease_issued_at_ms: number;
-    lease_expires_at_ms: number;
+    /** Lease fields are absent on legacy N-1 grants-only snapshots. */
+    connector_id?: string;
+    sequence?: number;
+    lease_issued_at_ms?: number;
+    lease_expires_at_ms?: number;
     grants: GrantPolicy[];
 }
 export interface RelayHello {

package/dist/manifest.js

@@ -54,7 +54,6 @@ export function parseAppManifest(value, options = {}) {
     return {
         ...manifest,
         requirements: {
-            contracts: [],
             configuration: [],
             ...manifest.requirements
         },
@@ -355,27 +354,24 @@ function validateCapabilityRequirements(value) {
     const manifest = asObject(value);
     const requirements = asObject(manifest.requirements);
     const capabilities = asObject(requirements.capabilities);
+    const issues = [];
+    if (requirements.access !== "full_collection") {
+        issues.push(issue("/requirements/access", "collectionAccess", "must explicitly request full_collection; legacy or omitted access is not widened"));
+    }
     if (Object.keys(capabilities).length === 0)
-        return [];
+        return issues;
     const required = Array.isArray(capabilities.required)
         ? capabilities.required.map(String)
         : [];
     const optional = Array.isArray(capabilities.optional)
         ? capabilities.optional.map(String)
         : [];
-    const issues = [];
     const overlap = optional.find((capability) => required.includes(capability));
     if (overlap) {
         issues.push(issue("/requirements/capabilities/optional", "disjoint", `must not repeat required capability ${overlap}`));
     }
     const declared = new Set([...required, ...optional]);
     const provisions = asObject(manifest.provisions);
-    if (Array.isArray(requirements.contracts)
-        && requirements.contracts.length > 0
-        && requirements.access !== "full_collection"
-        && !required.includes("definitions.contracts.current")) {
-        issues.push(issue("/requirements/capabilities/required", "contractCapability", "must require definitions.contracts.current for contract-scoped requirements"));
-    }
     if (declared.has("definitions.type-pack.apply")) {
         if (requirements.access !== "full_collection") {
             issues.push(issue("/requirements/access", "typePackAccess", "must be full_collection for definitions.type-pack.apply"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect-protocol",
-  "version": "0.1.0-beta.92",
+  "version": "0.1.0-beta.94",
   "private": false,
   "type": "module",
   "license": "MIT",

package/schemas/connect-problem.v1.schema.json

@@ -2955,6 +2955,46 @@
         }
       }
     },
+    {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "problem_version",
+        "code",
+        "category",
+        "recovery",
+        "message"
+      ],
+      "properties": {
+        "problem_version": {
+          "const": 1
+        },
+        "code": {
+          "const": "legacy_scope_reauthorization_required"
+        },
+        "category": {
+          "const": "authorization"
+        },
+        "recovery": {
+          "const": "reauthorize"
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        },
+        "operation_outcome": {
+          "enum": [
+            "not_sent",
+            "rejected",
+            "unknown"
+          ]
+        },
+        "trace_id": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
     {
       "type": "object",
       "additionalProperties": false,

package/schemas/connect-problems.v1.catalog.json

@@ -250,6 +250,7 @@
     "invalid_read_cursor": { "category": "validation", "recovery": "fix_request" },
     "invalid_request": { "category": "validation", "recovery": "fix_request" },
     "invalid_token_response": { "category": "integrity", "recovery": "contact_support" },
+    "legacy_scope_reauthorization_required": { "category": "authorization", "recovery": "reauthorize" },
     "managed_fcm_not_declared": { "category": "compatibility", "recovery": "fix_request" },
     "manifest_load_failed": { "category": "availability", "recovery": "retry" },
     "manifest_required": { "category": "validation", "recovery": "fix_request" },

package/schemas/mdbase-app.schema.json

@@ -111,13 +111,13 @@
     "requirements": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["contracts"],
+      "required": ["access", "contracts"],
       "properties": {
         "capabilities": { "$ref": "#/$defs/capabilityRequirements" },
         "access": {
-        "enum": ["contract", "full_collection"],
-        "description": "Access boundary requested after compatibility and provisioning checks."
-      },
+          "const": "full_collection",
+          "description": "Compatibility declaration for collection-level application authorization."
+        },
       "collection_kind": {
           "const": "hosted",
           "description": "Require a durable provider-backed collection with direct sync support."