@mdbase-dev/connect-protocol 0.1.0-beta.93 → 0.1.0-beta.95

package/dist/application-authorization.d.ts

@@ -1,4 +1,4 @@
-import type { ApplicationFileRequirement } from "./files.js";
+import type { ApplicationFileRequest } from "./files.js";
 import { type CollectionOperation } from "./operations.js";
 import type { AuthorizationBindingProtocolVersion, ConnectContractRequirements } from "./compatibility.js";
 export type ApplicationAuthorizationFlow = "authorization_code" | "device_code";
@@ -21,7 +21,7 @@ export interface ApplicationAuthorizationBinding {
     code_challenge: string;
     contracts: ConnectContractRequirements;
     requested_operations: CollectionOperation[];
-    requested_files?: ApplicationFileRequirement;
+    requested_files?: ApplicationFileRequest;
     collection_id?: string;
 }
 export interface ApplicationAuthorizationProof {

package/dist/capabilities.d.ts

@@ -1,10 +1,29 @@
 import type { CollectionOperation } from "./operations.js";
-export declare const APPLICATION_CAPABILITY_CONTRACT_VERSION: 1;
-/**
- * Stable application-facing abilities. Applications declare intent in these
- * terms; Connect alone translates them into wire-level collection operations.
- */
+export declare const APPLICATION_CAPABILITY_CONTRACT_VERSION: 2;
 export declare const APPLICATION_CAPABILITY_DEFINITIONS: {
+    readonly "collection.read": readonly ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "validate", "read_type"];
+    readonly "records.create": readonly ["create"];
+    readonly "records.edit": readonly ["update", "rename"];
+    readonly "records.delete": readonly ["delete"];
+    readonly "views.manage": readonly ["create_view_source", "update_view_source", "delete_view_source"];
+    readonly "definitions.manage": readonly ["create_type", "update_type", "assess_type_pack", "apply_type_pack"];
+    readonly "background.schedule": readonly ["list_timers", "put_timer", "cancel_timer", "reconcile_timers"];
+    readonly "offline.replica": readonly ["sync"];
+};
+export declare const APPLICATION_SETUP_OPERATIONS: readonly ["assess_collection_setup", "apply_collection_setup"];
+export type ApplicationCapabilityId = keyof typeof APPLICATION_CAPABILITY_DEFINITIONS;
+export interface ApplicationCapabilityRequirements {
+    contract_version: typeof APPLICATION_CAPABILITY_CONTRACT_VERSION;
+    required: ApplicationCapabilityId[];
+    optional?: ApplicationCapabilityId[];
+}
+export declare function operationsForApplicationCapabilities(requirements: ApplicationCapabilityRequirements, options?: {
+    includeOptional?: boolean;
+}): CollectionOperation[];
+export declare function capabilityOperations(capability: ApplicationCapabilityId): CollectionOperation[];
+export declare function applicationOperationSelectionIsAtomic(requirements: ApplicationCapabilityRequirements, operations: readonly string[]): boolean;
+export declare const APPLICATION_CAPABILITY_V1_CONTRACT_VERSION: 1;
+export declare const APPLICATION_CAPABILITY_V1_DEFINITIONS: Readonly<{
     readonly "collection.inspect": readonly ["describe"];
     readonly "records.watch": readonly ["changes"];
     readonly "records.read": readonly ["read"];
@@ -39,14 +58,14 @@ export declare const APPLICATION_CAPABILITY_DEFINITIONS: {
     readonly "files.replace": readonly [];
     readonly "files.move": readonly [];
     readonly "files.delete": readonly [];
-};
-export type ApplicationCapabilityId = keyof typeof APPLICATION_CAPABILITY_DEFINITIONS;
-export interface ApplicationCapabilityRequirements {
-    contract_version: typeof APPLICATION_CAPABILITY_CONTRACT_VERSION;
-    required: ApplicationCapabilityId[];
-    optional?: ApplicationCapabilityId[];
+}>;
+export type LegacyApplicationCapabilityId = keyof typeof APPLICATION_CAPABILITY_V1_DEFINITIONS;
+export interface LegacyApplicationCapabilityRequirements {
+    contract_version: typeof APPLICATION_CAPABILITY_V1_CONTRACT_VERSION;
+    required: LegacyApplicationCapabilityId[];
+    optional?: LegacyApplicationCapabilityId[];
 }
-export declare function operationsForApplicationCapabilities(requirements: ApplicationCapabilityRequirements, options?: {
-    includeOptional?: boolean;
-}): CollectionOperation[];
-export declare function capabilityOperations(capability: ApplicationCapabilityId): CollectionOperation[];
+export declare function capabilityOperationsForContractVersion(contractVersion: number, capability: string): CollectionOperation[] | undefined;
+/** Fresh issuance only; never use this ceiling to reject retained authority or terminal replay. */
+export declare const FRESH_APPLICATION_AUTHORIZATION_VERSIONS: readonly [1];
+export declare function permitsFreshApplicationAuthorization(version: number): boolean;

package/dist/capabilities.js

@@ -1,44 +1,19 @@
-export const APPLICATION_CAPABILITY_CONTRACT_VERSION = 1;
-/**
- * Stable application-facing abilities. Applications declare intent in these
- * terms; Connect alone translates them into wire-level collection operations.
- */
+// Generated by scripts/generate-application-capabilities.mjs. Do not edit directly.
+export const APPLICATION_CAPABILITY_CONTRACT_VERSION = 2;
 export const APPLICATION_CAPABILITY_DEFINITIONS = {
-    "collection.inspect": ["describe"],
-    "records.watch": ["changes"],
-    "records.read": ["read"],
-    "records.query": ["query"],
-    "records.validate": ["validate"],
+    "collection.read": ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "validate", "read_type"],
     "records.create": ["create"],
-    "records.update": ["update"],
+    "records.edit": ["update", "rename"],
     "records.delete": ["delete"],
-    "records.rename": ["rename"],
-    "views.list": ["list_views"],
-    "views.execute": ["execute_view"],
-    "views.source.read": ["read_view_source"],
-    "views.source.create": ["create_view_source"],
-    "views.source.update": ["update_view_source"],
-    "views.source.delete": ["delete_view_source"],
-    "definitions.contracts.current": [],
-    "definitions.read": ["read_type"],
-    "definitions.create": ["create_type"],
-    "definitions.update": ["update_type"],
-    "definitions.type-pack.inspect": ["assess_type_pack"],
-    "definitions.type-pack.apply": ["assess_type_pack", "apply_type_pack"],
-    "collection.setup.apply": ["assess_collection_setup", "apply_collection_setup"],
-    "timers.list": ["list_timers"],
-    "timers.put": ["put_timer"],
-    "timers.cancel": ["cancel_timer"],
-    "timers.reconcile": ["reconcile_timers"],
-    "sync.offline-replica": ["sync"],
-    "notifications.background-delivery": [],
-    "files.list": [],
-    "files.read": [],
-    "files.add": [],
-    "files.replace": [],
-    "files.move": [],
-    "files.delete": []
+    "views.manage": ["create_view_source", "update_view_source", "delete_view_source"],
+    "definitions.manage": ["create_type", "update_type", "assess_type_pack", "apply_type_pack"],
+    "background.schedule": ["list_timers", "put_timer", "cancel_timer", "reconcile_timers"],
+    "offline.replica": ["sync"]
 };
+export const APPLICATION_SETUP_OPERATIONS = [
+    "assess_collection_setup",
+    "apply_collection_setup"
+];
 export function operationsForApplicationCapabilities(requirements, options = {}) {
     const capabilities = options.includeOptional === false
         ? requirements.required
@@ -48,3 +23,68 @@ export function operationsForApplicationCapabilities(requirements, options = {})
 export function capabilityOperations(capability) {
     return [...APPLICATION_CAPABILITY_DEFINITIONS[capability]];
 }
+export function applicationOperationSelectionIsAtomic(requirements, operations) {
+    const selected = new Set(operations);
+    const declared = [...requirements.required, ...(requirements.optional ?? [])];
+    const allowed = new Set(declared.flatMap((capability) => APPLICATION_CAPABILITY_DEFINITIONS[capability]));
+    if ([...selected].some((operation) => !allowed.has(operation))) {
+        return false;
+    }
+    return declared.every((capability) => {
+        const capabilityOperations = APPLICATION_CAPABILITY_DEFINITIONS[capability];
+        const count = capabilityOperations.filter((operation) => selected.has(operation)).length;
+        return requirements.required.includes(capability)
+            ? count === capabilityOperations.length
+            : count === 0 || count === capabilityOperations.length;
+    });
+}
+// Frozen predecessor catalog. Lookup availability does not imply declaration acceptance.
+export const APPLICATION_CAPABILITY_V1_CONTRACT_VERSION = 1;
+export const APPLICATION_CAPABILITY_V1_DEFINITIONS = Object.freeze({
+    "collection.inspect": Object.freeze(["describe"]),
+    "records.watch": Object.freeze(["changes"]),
+    "records.read": Object.freeze(["read"]),
+    "records.query": Object.freeze(["query"]),
+    "records.validate": Object.freeze(["validate"]),
+    "records.create": Object.freeze(["create"]),
+    "records.update": Object.freeze(["update"]),
+    "records.delete": Object.freeze(["delete"]),
+    "records.rename": Object.freeze(["rename"]),
+    "views.list": Object.freeze(["list_views"]),
+    "views.execute": Object.freeze(["execute_view"]),
+    "views.source.read": Object.freeze(["read_view_source"]),
+    "views.source.create": Object.freeze(["create_view_source"]),
+    "views.source.update": Object.freeze(["update_view_source"]),
+    "views.source.delete": Object.freeze(["delete_view_source"]),
+    "definitions.contracts.current": Object.freeze([]),
+    "definitions.read": Object.freeze(["read_type"]),
+    "definitions.create": Object.freeze(["create_type"]),
+    "definitions.update": Object.freeze(["update_type"]),
+    "definitions.type-pack.inspect": Object.freeze(["assess_type_pack"]),
+    "definitions.type-pack.apply": Object.freeze(["assess_type_pack", "apply_type_pack"]),
+    "collection.setup.apply": Object.freeze(["assess_collection_setup", "apply_collection_setup"]),
+    "timers.list": Object.freeze(["list_timers"]),
+    "timers.put": Object.freeze(["put_timer"]),
+    "timers.cancel": Object.freeze(["cancel_timer"]),
+    "timers.reconcile": Object.freeze(["reconcile_timers"]),
+    "sync.offline-replica": Object.freeze(["sync"]),
+    "notifications.background-delivery": Object.freeze([]),
+    "files.list": Object.freeze([]),
+    "files.read": Object.freeze([]),
+    "files.add": Object.freeze([]),
+    "files.replace": Object.freeze([]),
+    "files.move": Object.freeze([]),
+    "files.delete": Object.freeze([])
+});
+export function capabilityOperationsForContractVersion(contractVersion, capability) {
+    const definitions = contractVersion === 1 ? APPLICATION_CAPABILITY_V1_DEFINITIONS
+        : contractVersion === 2 ? APPLICATION_CAPABILITY_DEFINITIONS : undefined;
+    if (!definitions || !Object.hasOwn(definitions, capability))
+        return undefined;
+    return [...definitions[capability]];
+}
+/** Fresh issuance only; never use this ceiling to reject retained authority or terminal replay. */
+export const FRESH_APPLICATION_AUTHORIZATION_VERSIONS = Object.freeze([1]);
+export function permitsFreshApplicationAuthorization(version) {
+    return FRESH_APPLICATION_AUTHORIZATION_VERSIONS.some((supported) => supported === version);
+}

package/dist/compatibility.d.ts

@@ -1,4 +1,4 @@
-import type { ApplicationFileRequirement } from "./files.js";
+import type { ApplicationFileRequest } from "./files.js";
 import { type CollectionOperation } from "./operations.js";
 export declare const OPERATION_TRANSPORT_PROTOCOL_VERSION: 3;
 export declare const LEGACY_OPERATION_TRANSPORT_PROTOCOL_VERSION: 2;
@@ -8,7 +8,7 @@ export declare const AUTHORIZATION_BINDING_PROTOCOL_VERSION: 5;
 export declare const LEGACY_AUTHORIZATION_BINDING_PROTOCOL_VERSION: 4;
 export declare const SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS: readonly [5, 4];
 export type AuthorizationBindingProtocolVersion = typeof SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS[number];
-export declare const SEMANTIC_CAPABILITY_CONTRACT_VERSION: 1;
+export declare const SEMANTIC_CAPABILITY_CONTRACT_VERSION: 2;
 export declare const DURABLE_MUTATION_CONTRACT_VERSION: 1;
 export interface ConnectContractRequirements {
     operation_transport: number;
@@ -30,7 +30,7 @@ export declare const CONNECT_CONTRACT_SUPPORT: ConnectContractSupport;
  * Produce the exact contract ceiling signed during authorization. `sync` is
  * conservatively mutation-capable because its action is selected per request.
  */
-export declare function authorizationContractRequirements(operations: readonly CollectionOperation[], files?: ApplicationFileRequirement, operationTransportRecovery?: readonly OperationTransportProtocolVersion[]): ConnectContractRequirements;
+export declare function authorizationContractRequirements(operations: readonly CollectionOperation[], files?: ApplicationFileRequest, operationTransportRecovery?: readonly OperationTransportProtocolVersion[], semanticCapabilityContractVersion?: 1 | 2): ConnectContractRequirements;
 export declare function supportsContractRequirements(required: ConnectContractRequirements, supported: ConnectContractSupport, durableMutation: boolean): boolean;
 export declare function isSupportedOperationTransport(version: number): version is OperationTransportProtocolVersion;
 export declare function isSupportedAuthorizationBinding(version: number): version is AuthorizationBindingProtocolVersion;

package/dist/compatibility.js

@@ -1,3 +1,4 @@
+import { APPLICATION_CAPABILITY_CONTRACT_VERSION } from "./capabilities.js";
 import { isMutatingOperation } from "./operations.js";
 export const OPERATION_TRANSPORT_PROTOCOL_VERSION = 3;
 export const LEGACY_OPERATION_TRANSPORT_PROTOCOL_VERSION = 2;
@@ -11,23 +12,23 @@ export const SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS = [
     AUTHORIZATION_BINDING_PROTOCOL_VERSION,
     LEGACY_AUTHORIZATION_BINDING_PROTOCOL_VERSION
 ];
-export const SEMANTIC_CAPABILITY_CONTRACT_VERSION = 1;
+export const SEMANTIC_CAPABILITY_CONTRACT_VERSION = APPLICATION_CAPABILITY_CONTRACT_VERSION;
 export const DURABLE_MUTATION_CONTRACT_VERSION = 1;
 export const CONNECT_CONTRACT_SUPPORT = {
     operation_transport: [...SUPPORTED_OPERATION_TRANSPORT_PROTOCOL_VERSIONS],
     authorization_binding: [...SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS],
-    semantic_capabilities: [SEMANTIC_CAPABILITY_CONTRACT_VERSION],
+    semantic_capabilities: [SEMANTIC_CAPABILITY_CONTRACT_VERSION, 1],
     durable_mutation: [DURABLE_MUTATION_CONTRACT_VERSION]
 };
 /**
  * Produce the exact contract ceiling signed during authorization. `sync` is
  * conservatively mutation-capable because its action is selected per request.
  */
-export function authorizationContractRequirements(operations, files, operationTransportRecovery = []) {
+export function authorizationContractRequirements(operations, files, operationTransportRecovery = [], semanticCapabilityContractVersion = APPLICATION_CAPABILITY_CONTRACT_VERSION) {
     const requirements = {
         operation_transport: OPERATION_TRANSPORT_PROTOCOL_VERSION,
         authorization_binding: AUTHORIZATION_BINDING_PROTOCOL_VERSION,
-        semantic_capabilities: 1
+        semantic_capabilities: semanticCapabilityContractVersion
     };
     const recovery = [...new Set(operationTransportRecovery)]
         .filter((version) => version !== OPERATION_TRANSPORT_PROTOCOL_VERSION)

package/dist/connect-problems.generated.d.ts

@@ -264,6 +264,10 @@ export declare const CONNECT_PROBLEM_CATALOG: {
         readonly category: "integrity";
         readonly recovery: "contact_support";
     };
+    readonly legacy_scope_reauthorization_required: {
+        readonly category: "authorization";
+        readonly recovery: "reauthorize";
+    };
     readonly managed_fcm_not_declared: {
         readonly category: "compatibility";
         readonly recovery: "fix_request";
@@ -595,6 +599,7 @@ export interface ConnectProblemDetailsByCode {
     "invalid_read_cursor": undefined;
     "invalid_request": undefined;
     "invalid_token_response": undefined;
+    "legacy_scope_reauthorization_required": undefined;
     "managed_fcm_not_declared": undefined;
     "manifest_load_failed": undefined;
     "manifest_required": undefined;
@@ -1058,6 +1063,12 @@ export interface ConnectProblemByCode {
         recovery: "contact_support";
         details?: never;
     };
+    "legacy_scope_reauthorization_required": ConnectProblemBase & {
+        code: "legacy_scope_reauthorization_required";
+        category: "authorization";
+        recovery: "reauthorize";
+        details?: never;
+    };
     "managed_fcm_not_declared": ConnectProblemBase & {
         code: "managed_fcm_not_declared";
         category: "compatibility";

package/dist/connect-problems.generated.js

@@ -67,6 +67,7 @@ export const CONNECT_PROBLEM_CATALOG = {
     "invalid_read_cursor": { category: "validation", recovery: "fix_request" },
     "invalid_request": { category: "validation", recovery: "fix_request" },
     "invalid_token_response": { category: "integrity", recovery: "contact_support" },
+    "legacy_scope_reauthorization_required": { category: "authorization", recovery: "reauthorize" },
     "managed_fcm_not_declared": { category: "compatibility", recovery: "fix_request" },
     "manifest_load_failed": { category: "availability", recovery: "retry" },
     "manifest_required": { category: "validation", recovery: "fix_request" },

package/dist/files.d.ts

@@ -1,3 +1,8 @@
+/** Frozen predecessor file declaration; never translate this into v2 intent. */
+export interface LegacyApplicationFileRequirement {
+    actions: FileAction[];
+    scope: FileScope;
+}
 export declare const FILE_PROTOCOL_VERSION: 1;
 export declare const FILE_TRANSFER_PROTOCOL_VERSION: 1;
 export declare const DEFAULT_FILE_CHUNK_BYTES: number;
@@ -43,9 +48,18 @@ export type FileScope = {
 };
 /** File intent declared by an application before an authority is selected. */
 export interface ApplicationFileRequirement {
+    required: FileAction[];
+    optional?: FileAction[];
+    scope: FileScope;
+}
+/** Exact file actions signed into an authorization request. */
+export interface ApplicationFileRequest {
     actions: FileAction[];
     scope: FileScope;
 }
+export declare function applicationFileRequest(requirement: ApplicationFileRequirement, options?: {
+    includeOptional?: boolean;
+}): ApplicationFileRequest;
 export interface FileCapability {
     kind: "files";
     protocol_version: 1;

package/dist/files.js

@@ -21,6 +21,15 @@ const RELAY_FILE_MAGIC_BYTES = new Uint8Array([0x4d, 0x44, 0x42, 0x52]);
 const RELAY_FILE_FRAME_VERSION = 1;
 const RELAY_FILE_FRAME_FLAGS = 0;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function applicationFileRequest(requirement, options = {}) {
+    return {
+        actions: [...new Set([
+                ...requirement.required,
+                ...(options.includeOptional === false ? [] : requirement.optional ?? [])
+            ])],
+        scope: structuredClone(requirement.scope)
+    };
+}
 export class FileFrameError extends Error {
     code;
     constructor(code, message) {

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import type { ConnectProblem } from "./connect-problems.generated.js";
-import type { ApplicationFileRequirement, CollectionFileDescriptor, FileCapability } from "./files.js";
+import type { ApplicationFileRequirement, LegacyApplicationFileRequirement, CollectionFileDescriptor, FileCapability } from "./files.js";
 import type { CollectionOperation } from "./operations.js";
-import type { ApplicationCapabilityRequirements } from "./capabilities.js";
+import type { ApplicationCapabilityRequirements, LegacyApplicationCapabilityRequirements } from "./capabilities.js";
 import type { ContractRequirement, ContractSetupChoice, TypePackProvision } from "./type-packs.js";
 import type { ConfigurationProvision, ConfigurationRequirement } from "./collection-setup.js";
 import type { ApplicationAuthorizationProof } from "./application-authorization.js";
@@ -32,7 +32,8 @@ export declare const POLICY_FRESHNESS_LEASE_MINIMUM_CONNECTOR_VERSION: "0.1.0-be
 export declare const HOSTED_PROVIDER_REQUIRED_CAPABILITIES: readonly ["durable-mutation-journal-v1", "durable-file-lifecycle-v1"];
 export declare const HOSTED_CANDIDATE_B_ACTIVATION_CAPABILITY: "candidate-b-activation-v1";
 export declare const HOSTED_PROVIDER_CAPABILITIES: readonly ["durable-mutation-journal-v1", "durable-file-lifecycle-v1", "mutation-replay-after-credential-retirement-v1", "candidate-b-activation-v1"];
-export declare const RELAY_CAPABILITIES: readonly ["application-authorization-v4", "authorization-activation", "encrypted-relay", "policy-ack", "policy-freshness-lease-v1", "application-authorization-v5", "contract-setup-v1", "file-relay-v1", "protocol-usage-report-v1"];
+export declare const APPLICATION_DECLARATION_EVIDENCE_CAPABILITY: "application-declaration-evidence-v1";
+export declare const RELAY_CAPABILITIES: readonly ["application-declaration-evidence-v1", "application-authorization-v4", "authorization-activation", "encrypted-relay", "policy-ack", "policy-freshness-lease-v1", "application-authorization-v5", "contract-setup-v1", "file-relay-v1", "protocol-usage-report-v1"];
 export declare const AUTHORITY_PROOF_VERSION: 1;
 export declare const AUTHORITY_PROOF_ALGORITHM: "P256-SHA256";
 export declare const AUTHORITY_PROOF_DOMAIN: "mdbase-authority-request-proof-v1";
@@ -102,11 +103,15 @@ export interface ApplicationNotifications {
  * `id` is stable presentation metadata rather than proof of a publisher. Each
  * exact declaration is independently identified and authorized by Connect.
  */
+export type CanonicalApplicationRequirements = Omit<ApplicationRequirements, "access" | "contracts"> & {
+    access: "full_collection";
+    contracts: [];
+};
 interface MdbaseAppManifestBase {
     manifest_version: 1;
     id: string;
     name: string;
-    requirements?: ApplicationRequirements;
+    requirements: CanonicalApplicationRequirements;
     provisions?: ApplicationProvisions;
     notifications?: ApplicationNotifications;
 }
@@ -164,13 +169,29 @@ export interface ApplicationRequirements {
     configuration?: ConfigurationRequirement[];
     /** Versioned semantic intent compiled by Connect into exact operations. */
     capabilities?: ApplicationCapabilityRequirements;
-    /** Access boundary requested after compatibility and provisioning checks. */
+    /**
+     * Collection boundary request. New declarations must explicitly use
+     * `full_collection`; omitted and `contract` remain parseable only for legacy
+     * diagnosis and reauthorization.
+     */
     access?: "contract" | "full_collection";
     /** Restrict authorization to durable provider-backed collections. */
     collection_kind?: "hosted";
     /** First-class non-Markdown file access requested independently of records. */
     files?: ApplicationFileRequirement;
 }
+export type LegacyApplicationRequirements = Omit<ApplicationRequirements, "capabilities" | "files" | "access"> & {
+    access: "full_collection";
+    capabilities?: LegacyApplicationCapabilityRequirements;
+    files?: LegacyApplicationFileRequirement;
+};
+export type LegacyMdbaseWebAppManifest = Omit<MdbaseWebAppManifest, "requirements"> & {
+    requirements: LegacyApplicationRequirements;
+};
+export type LegacyMdbasePortableAppManifest = Omit<MdbasePortableAppManifest, "requirements"> & {
+    requirements: LegacyApplicationRequirements;
+};
+export type LegacyMdbaseAppManifest = LegacyMdbaseWebAppManifest | LegacyMdbasePortableAppManifest;
 export interface ApplicationProvisions {
     type_packs: TypePackProvision[];
     /** Narrow semantic changes that may satisfy configuration requirements. */
@@ -178,11 +199,12 @@ export interface ApplicationProvisions {
 }
 export interface GrantScope {
     /**
-     * Exact contract definitions and sorted implementation sets approved by the
-     * user. Digests make the scope fail closed if either the interface or any
-     * provider changes after approval.
+     * Legacy semantic scope payload retained for wire/storage compatibility.
+     * Canonical application grants use an empty array; contracts remain available
+     * through collection resources and operation-level semantic selectors.
      */
     contracts: CollectionContractDescriptor[];
+    /** New authority must be `full_collection`; `contract` is legacy-only. */
     access: "contract" | "full_collection";
 }
 export interface RelayOperationRequest {
@@ -225,6 +247,8 @@ export type MdbaseOperationResponse<Result = unknown> = {
     problem: ConnectProblem;
 };
 export interface GrantPolicy {
+    /** Complete normalized JSON evidence; never independent operation authority. */
+    application_declaration?: unknown;
     id: string;
     application_id: string;
     /** Stable declaration identity bound into the exact application authorization. */
@@ -519,10 +543,11 @@ export interface RelayPolicySnapshot {
     protocol_version: 1;
     request_id: string;
     revision: string;
-    connector_id: string;
-    sequence: number;
-    lease_issued_at_ms: number;
-    lease_expires_at_ms: number;
+    /** Lease fields are absent on legacy N-1 grants-only snapshots. */
+    connector_id?: string;
+    sequence?: number;
+    lease_issued_at_ms?: number;
+    lease_expires_at_ms?: number;
     grants: GrantPolicy[];
 }
 export interface RelayHello {

package/dist/index.js

@@ -37,7 +37,9 @@ export const HOSTED_PROVIDER_CAPABILITIES = [
     "mutation-replay-after-credential-retirement-v1",
     HOSTED_CANDIDATE_B_ACTIVATION_CAPABILITY
 ];
+export const APPLICATION_DECLARATION_EVIDENCE_CAPABILITY = "application-declaration-evidence-v1";
 export const RELAY_CAPABILITIES = [
+    APPLICATION_DECLARATION_EVIDENCE_CAPABILITY,
     ...RELAY_REQUIRED_CAPABILITIES,
     POLICY_FRESHNESS_LEASE_CAPABILITY,
     "application-authorization-v5",

package/dist/manifest.d.ts

@@ -1,3 +1,5 @@
+import type { LegacyMdbaseAppManifest } from "./index.js";
+export type { LegacyApplicationFileRequirement, LegacyApplicationRequirements, LegacyMdbaseWebAppManifest, LegacyMdbasePortableAppManifest, LegacyMdbaseAppManifest } from "./index.js";
 import { type ApplicationNotifications, type ApplicationProvisions, type ApplicationRequirements, type MdbasePortableAppManifest, type MdbaseWebAppManifest } from "./index.js";
 export declare const APPLICATION_MANIFEST_MAX_BYTES = 524288;
 export interface ManifestValidationIssue {
@@ -27,6 +29,18 @@ interface ValidatedManifestFields {
 export type ValidatedWebAppManifest = Omit<MdbaseWebAppManifest, keyof ValidatedManifestFields> & ValidatedManifestFields;
 export type ValidatedPortableAppManifest = Omit<MdbasePortableAppManifest, keyof ValidatedManifestFields> & ValidatedManifestFields;
 export type ValidatedAppManifest = ValidatedWebAppManifest | ValidatedPortableAppManifest;
+export type ValidatedLegacyAppManifest = LegacyMdbaseAppManifest & {
+    provisions: ApplicationProvisions;
+    notifications: ApplicationNotifications;
+};
+/** The discriminator describes the original declaration, not a translation. */
+export type VersionedAppManifest = {
+    contractVersion: 1;
+    manifest: ValidatedLegacyAppManifest;
+} | {
+    contractVersion: 2;
+    manifest: ValidatedAppManifest;
+};
 export declare class AppManifestValidationError extends Error {
     readonly issues: ManifestValidationIssue[];
     constructor(issues: ManifestValidationIssue[]);
@@ -39,7 +53,10 @@ export declare class AppManifestValidationError extends Error {
  * rules here; consumers must not maintain parallel manifest validators.
  */
 export declare function validateAppManifest(value: unknown, options?: ManifestValidationOptions): ManifestValidationResult;
+/** Explicit opt-in to predecessor declarations; omission defaults to v1. */
+export declare function validateVersionedAppManifest(value: unknown, options?: ManifestValidationOptions): ManifestValidationResult;
 /** Validate, normalize optional sections, and return an isolated declaration. */
 export declare function parseAppManifest(value: unknown, options?: ManifestValidationOptions): ValidatedAppManifest;
+/** Validate and clone without changing capability IDs, file aliases, or version. */
+export declare function parseVersionedAppManifest(value: unknown, options?: ManifestValidationOptions): VersionedAppManifest;
 export declare function formatManifestValidationIssues(issues: readonly ManifestValidationIssue[]): string;
-export {};

package/dist/manifest.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { Ajv2020 } from "ajv/dist/2020.js";
 import addFormatsModule from "ajv-formats";
 import appManifestSchema from "../schemas/mdbase-app.schema.json" with { type: "json" };
+import legacyAppManifestSchema from "../schemas/mdbase-app.legacy-v1.schema.json" with { type: "json" };
 import { isNativeRedirectUri } from "./index.js";
 export const APPLICATION_MANIFEST_MAX_BYTES = 524_288;
 export class AppManifestValidationError extends Error {
@@ -22,6 +23,8 @@ const addFormats = addFormatsModule;
 addFormats(ajv);
 ajv.addSchema(appManifestSchema);
 const appManifestValidator = requiredValidator(String(appManifestSchema.$id));
+ajv.addSchema(legacyAppManifestSchema);
+const legacyAppManifestValidator = requiredValidator(String(legacyAppManifestSchema.$id));
 /**
  * Validate the complete bundled application declaration accepted by Connect.
  *
@@ -30,16 +33,35 @@ const appManifestValidator = requiredValidator(String(appManifestSchema.$id));
  * rules here; consumers must not maintain parallel manifest validators.
  */
 export function validateAppManifest(value, options = {}) {
+    return validateManifest(value, options, false);
+}
+/** Explicit opt-in to predecessor declarations; omission defaults to v1. */
+export function validateVersionedAppManifest(value, options = {}) {
+    return validateManifest(value, options, true);
+}
+function declaredContractVersion(value) {
+    const requirements = asObject(asObject(value).requirements);
+    return requirements.capabilities === undefined
+        ? 1
+        : asObject(requirements.capabilities).contract_version;
+}
+function validateManifest(value, options, versioned) {
     const sizeIssue = validateSerializedSize(value, options.maxBytes ?? APPLICATION_MANIFEST_MAX_BYTES);
     if (sizeIssue)
         return invalid([sizeIssue]);
+    const version = versioned ? declaredContractVersion(value) : 2;
+    if (version !== 1 && version !== 2) {
+        return invalid([issue("/requirements/capabilities/contract_version", "contractVersion", "must declare supported contract version 1 or 2")]);
+    }
     const candidate = options.allowLocal ? localManifestSchemaCandidate(value) : value;
-    const schemaResult = validationResult(appManifestValidator, candidate);
+    const schemaResult = validationResult(version === 1 ? legacyAppManifestValidator : appManifestValidator, candidate);
     if (!schemaResult.valid)
         return schemaResult;
     const issues = [
         ...validateManifestOrigins(value, options.allowLocal === true),
-        ...validateCapabilityRequirements(value),
+        ...(version === 1
+            ? validateLegacyCapabilityRequirements(value)
+            : validateCapabilityRequirements(value)),
         ...validateProvisionRequirements(value),
         ...validateConfigurationSetup(value)
     ];
@@ -50,11 +72,22 @@ export function parseAppManifest(value, options = {}) {
     const result = validateAppManifest(value, options);
     if (!result.valid)
         throw new AppManifestValidationError(result.issues);
+    return normalizeManifest(value);
+}
+/** Validate and clone without changing capability IDs, file aliases, or version. */
+export function parseVersionedAppManifest(value, options = {}) {
+    const result = validateVersionedAppManifest(value, options);
+    if (!result.valid)
+        throw new AppManifestValidationError(result.issues);
+    return declaredContractVersion(value) === 1
+        ? { contractVersion: 1, manifest: normalizeManifest(value) }
+        : { contractVersion: 2, manifest: normalizeManifest(value) };
+}
+function normalizeManifest(value) {
     const manifest = structuredClone(value);
     return {
         ...manifest,
         requirements: {
-            contracts: [],
             configuration: [],
             ...manifest.requirements
         },
@@ -355,27 +388,53 @@ function validateCapabilityRequirements(value) {
     const manifest = asObject(value);
     const requirements = asObject(manifest.requirements);
     const capabilities = asObject(requirements.capabilities);
-    if (Object.keys(capabilities).length === 0)
-        return [];
+    const issues = [];
+    if (requirements.access !== "full_collection") {
+        issues.push(issue("/requirements/access", "collectionAccess", "must explicitly request full_collection; legacy or omitted access is not widened"));
+    }
     const required = Array.isArray(capabilities.required)
         ? capabilities.required.map(String)
         : [];
     const optional = Array.isArray(capabilities.optional)
         ? capabilities.optional.map(String)
         : [];
+    const overlap = optional.find((capability) => required.includes(capability));
+    if (overlap) {
+        issues.push(issue("/requirements/capabilities/optional", "disjoint", `must not repeat required capability ${overlap}`));
+    }
+    const files = asObject(requirements.files);
+    const requiredFiles = Array.isArray(files.required) ? files.required.map(String) : [];
+    const optionalFiles = Array.isArray(files.optional) ? files.optional.map(String) : [];
+    const fileOverlap = optionalFiles.find((action) => requiredFiles.includes(action));
+    if (fileOverlap) {
+        issues.push(issue("/requirements/files/optional", "disjoint", `must not repeat required file action ${fileOverlap}`));
+    }
+    return issues;
+}
+// Frozen cross-field rules from c2596a6e; notably, absent capabilities skip
+// alias/setup checks rather than inventing or widening a declaration.
+function validateLegacyCapabilityRequirements(value) {
+    const manifest = asObject(value);
+    const requirements = asObject(manifest.requirements);
+    const capabilities = asObject(requirements.capabilities);
     const issues = [];
+    if (requirements.access !== "full_collection") {
+        issues.push(issue("/requirements/access", "collectionAccess", "must explicitly request full_collection; legacy or omitted access is not widened"));
+    }
+    if (Object.keys(capabilities).length === 0)
+        return issues;
+    const required = Array.isArray(capabilities.required)
+        ? capabilities.required.map(String)
+        : [];
+    const optional = Array.isArray(capabilities.optional)
+        ? capabilities.optional.map(String)
+        : [];
     const overlap = optional.find((capability) => required.includes(capability));
     if (overlap) {
         issues.push(issue("/requirements/capabilities/optional", "disjoint", `must not repeat required capability ${overlap}`));
     }
     const declared = new Set([...required, ...optional]);
     const provisions = asObject(manifest.provisions);
-    if (Array.isArray(requirements.contracts)
-        && requirements.contracts.length > 0
-        && requirements.access !== "full_collection"
-        && !required.includes("definitions.contracts.current")) {
-        issues.push(issue("/requirements/capabilities/required", "contractCapability", "must require definitions.contracts.current for contract-scoped requirements"));
-    }
     if (declared.has("definitions.type-pack.apply")) {
         if (requirements.access !== "full_collection") {
             issues.push(issue("/requirements/access", "typePackAccess", "must be full_collection for definitions.type-pack.apply"));