@mdbase-dev/connect-protocol 0.1.0-beta.94 → 0.1.0-beta.95

package/dist/application-authorization.d.ts

@@ -1,4 +1,4 @@
-import type { ApplicationFileRequirement } from "./files.js";
+import type { ApplicationFileRequest } from "./files.js";
 import { type CollectionOperation } from "./operations.js";
 import type { AuthorizationBindingProtocolVersion, ConnectContractRequirements } from "./compatibility.js";
 export type ApplicationAuthorizationFlow = "authorization_code" | "device_code";
@@ -21,7 +21,7 @@ export interface ApplicationAuthorizationBinding {
     code_challenge: string;
     contracts: ConnectContractRequirements;
     requested_operations: CollectionOperation[];
-    requested_files?: ApplicationFileRequirement;
+    requested_files?: ApplicationFileRequest;
     collection_id?: string;
 }
 export interface ApplicationAuthorizationProof {

package/dist/capabilities.d.ts

@@ -1,10 +1,29 @@
 import type { CollectionOperation } from "./operations.js";
-export declare const APPLICATION_CAPABILITY_CONTRACT_VERSION: 1;
-/**
- * Stable application-facing abilities. Applications declare intent in these
- * terms; Connect alone translates them into wire-level collection operations.
- */
+export declare const APPLICATION_CAPABILITY_CONTRACT_VERSION: 2;
 export declare const APPLICATION_CAPABILITY_DEFINITIONS: {
+    readonly "collection.read": readonly ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "validate", "read_type"];
+    readonly "records.create": readonly ["create"];
+    readonly "records.edit": readonly ["update", "rename"];
+    readonly "records.delete": readonly ["delete"];
+    readonly "views.manage": readonly ["create_view_source", "update_view_source", "delete_view_source"];
+    readonly "definitions.manage": readonly ["create_type", "update_type", "assess_type_pack", "apply_type_pack"];
+    readonly "background.schedule": readonly ["list_timers", "put_timer", "cancel_timer", "reconcile_timers"];
+    readonly "offline.replica": readonly ["sync"];
+};
+export declare const APPLICATION_SETUP_OPERATIONS: readonly ["assess_collection_setup", "apply_collection_setup"];
+export type ApplicationCapabilityId = keyof typeof APPLICATION_CAPABILITY_DEFINITIONS;
+export interface ApplicationCapabilityRequirements {
+    contract_version: typeof APPLICATION_CAPABILITY_CONTRACT_VERSION;
+    required: ApplicationCapabilityId[];
+    optional?: ApplicationCapabilityId[];
+}
+export declare function operationsForApplicationCapabilities(requirements: ApplicationCapabilityRequirements, options?: {
+    includeOptional?: boolean;
+}): CollectionOperation[];
+export declare function capabilityOperations(capability: ApplicationCapabilityId): CollectionOperation[];
+export declare function applicationOperationSelectionIsAtomic(requirements: ApplicationCapabilityRequirements, operations: readonly string[]): boolean;
+export declare const APPLICATION_CAPABILITY_V1_CONTRACT_VERSION: 1;
+export declare const APPLICATION_CAPABILITY_V1_DEFINITIONS: Readonly<{
     readonly "collection.inspect": readonly ["describe"];
     readonly "records.watch": readonly ["changes"];
     readonly "records.read": readonly ["read"];
@@ -39,14 +58,14 @@ export declare const APPLICATION_CAPABILITY_DEFINITIONS: {
     readonly "files.replace": readonly [];
     readonly "files.move": readonly [];
     readonly "files.delete": readonly [];
-};
-export type ApplicationCapabilityId = keyof typeof APPLICATION_CAPABILITY_DEFINITIONS;
-export interface ApplicationCapabilityRequirements {
-    contract_version: typeof APPLICATION_CAPABILITY_CONTRACT_VERSION;
-    required: ApplicationCapabilityId[];
-    optional?: ApplicationCapabilityId[];
+}>;
+export type LegacyApplicationCapabilityId = keyof typeof APPLICATION_CAPABILITY_V1_DEFINITIONS;
+export interface LegacyApplicationCapabilityRequirements {
+    contract_version: typeof APPLICATION_CAPABILITY_V1_CONTRACT_VERSION;
+    required: LegacyApplicationCapabilityId[];
+    optional?: LegacyApplicationCapabilityId[];
 }
-export declare function operationsForApplicationCapabilities(requirements: ApplicationCapabilityRequirements, options?: {
-    includeOptional?: boolean;
-}): CollectionOperation[];
-export declare function capabilityOperations(capability: ApplicationCapabilityId): CollectionOperation[];
+export declare function capabilityOperationsForContractVersion(contractVersion: number, capability: string): CollectionOperation[] | undefined;
+/** Fresh issuance only; never use this ceiling to reject retained authority or terminal replay. */
+export declare const FRESH_APPLICATION_AUTHORIZATION_VERSIONS: readonly [1];
+export declare function permitsFreshApplicationAuthorization(version: number): boolean;

package/dist/capabilities.js

@@ -1,44 +1,19 @@
-export const APPLICATION_CAPABILITY_CONTRACT_VERSION = 1;
-/**
- * Stable application-facing abilities. Applications declare intent in these
- * terms; Connect alone translates them into wire-level collection operations.
- */
+// Generated by scripts/generate-application-capabilities.mjs. Do not edit directly.
+export const APPLICATION_CAPABILITY_CONTRACT_VERSION = 2;
 export const APPLICATION_CAPABILITY_DEFINITIONS = {
-    "collection.inspect": ["describe"],
-    "records.watch": ["changes"],
-    "records.read": ["read"],
-    "records.query": ["query"],
-    "records.validate": ["validate"],
+    "collection.read": ["describe", "changes", "read", "query", "list_views", "execute_view", "read_view_source", "validate", "read_type"],
     "records.create": ["create"],
-    "records.update": ["update"],
+    "records.edit": ["update", "rename"],
     "records.delete": ["delete"],
-    "records.rename": ["rename"],
-    "views.list": ["list_views"],
-    "views.execute": ["execute_view"],
-    "views.source.read": ["read_view_source"],
-    "views.source.create": ["create_view_source"],
-    "views.source.update": ["update_view_source"],
-    "views.source.delete": ["delete_view_source"],
-    "definitions.contracts.current": [],
-    "definitions.read": ["read_type"],
-    "definitions.create": ["create_type"],
-    "definitions.update": ["update_type"],
-    "definitions.type-pack.inspect": ["assess_type_pack"],
-    "definitions.type-pack.apply": ["assess_type_pack", "apply_type_pack"],
-    "collection.setup.apply": ["assess_collection_setup", "apply_collection_setup"],
-    "timers.list": ["list_timers"],
-    "timers.put": ["put_timer"],
-    "timers.cancel": ["cancel_timer"],
-    "timers.reconcile": ["reconcile_timers"],
-    "sync.offline-replica": ["sync"],
-    "notifications.background-delivery": [],
-    "files.list": [],
-    "files.read": [],
-    "files.add": [],
-    "files.replace": [],
-    "files.move": [],
-    "files.delete": []
+    "views.manage": ["create_view_source", "update_view_source", "delete_view_source"],
+    "definitions.manage": ["create_type", "update_type", "assess_type_pack", "apply_type_pack"],
+    "background.schedule": ["list_timers", "put_timer", "cancel_timer", "reconcile_timers"],
+    "offline.replica": ["sync"]
 };
+export const APPLICATION_SETUP_OPERATIONS = [
+    "assess_collection_setup",
+    "apply_collection_setup"
+];
 export function operationsForApplicationCapabilities(requirements, options = {}) {
     const capabilities = options.includeOptional === false
         ? requirements.required
@@ -48,3 +23,68 @@ export function operationsForApplicationCapabilities(requirements, options = {})
 export function capabilityOperations(capability) {
     return [...APPLICATION_CAPABILITY_DEFINITIONS[capability]];
 }
+export function applicationOperationSelectionIsAtomic(requirements, operations) {
+    const selected = new Set(operations);
+    const declared = [...requirements.required, ...(requirements.optional ?? [])];
+    const allowed = new Set(declared.flatMap((capability) => APPLICATION_CAPABILITY_DEFINITIONS[capability]));
+    if ([...selected].some((operation) => !allowed.has(operation))) {
+        return false;
+    }
+    return declared.every((capability) => {
+        const capabilityOperations = APPLICATION_CAPABILITY_DEFINITIONS[capability];
+        const count = capabilityOperations.filter((operation) => selected.has(operation)).length;
+        return requirements.required.includes(capability)
+            ? count === capabilityOperations.length
+            : count === 0 || count === capabilityOperations.length;
+    });
+}
+// Frozen predecessor catalog. Lookup availability does not imply declaration acceptance.
+export const APPLICATION_CAPABILITY_V1_CONTRACT_VERSION = 1;
+export const APPLICATION_CAPABILITY_V1_DEFINITIONS = Object.freeze({
+    "collection.inspect": Object.freeze(["describe"]),
+    "records.watch": Object.freeze(["changes"]),
+    "records.read": Object.freeze(["read"]),
+    "records.query": Object.freeze(["query"]),
+    "records.validate": Object.freeze(["validate"]),
+    "records.create": Object.freeze(["create"]),
+    "records.update": Object.freeze(["update"]),
+    "records.delete": Object.freeze(["delete"]),
+    "records.rename": Object.freeze(["rename"]),
+    "views.list": Object.freeze(["list_views"]),
+    "views.execute": Object.freeze(["execute_view"]),
+    "views.source.read": Object.freeze(["read_view_source"]),
+    "views.source.create": Object.freeze(["create_view_source"]),
+    "views.source.update": Object.freeze(["update_view_source"]),
+    "views.source.delete": Object.freeze(["delete_view_source"]),
+    "definitions.contracts.current": Object.freeze([]),
+    "definitions.read": Object.freeze(["read_type"]),
+    "definitions.create": Object.freeze(["create_type"]),
+    "definitions.update": Object.freeze(["update_type"]),
+    "definitions.type-pack.inspect": Object.freeze(["assess_type_pack"]),
+    "definitions.type-pack.apply": Object.freeze(["assess_type_pack", "apply_type_pack"]),
+    "collection.setup.apply": Object.freeze(["assess_collection_setup", "apply_collection_setup"]),
+    "timers.list": Object.freeze(["list_timers"]),
+    "timers.put": Object.freeze(["put_timer"]),
+    "timers.cancel": Object.freeze(["cancel_timer"]),
+    "timers.reconcile": Object.freeze(["reconcile_timers"]),
+    "sync.offline-replica": Object.freeze(["sync"]),
+    "notifications.background-delivery": Object.freeze([]),
+    "files.list": Object.freeze([]),
+    "files.read": Object.freeze([]),
+    "files.add": Object.freeze([]),
+    "files.replace": Object.freeze([]),
+    "files.move": Object.freeze([]),
+    "files.delete": Object.freeze([])
+});
+export function capabilityOperationsForContractVersion(contractVersion, capability) {
+    const definitions = contractVersion === 1 ? APPLICATION_CAPABILITY_V1_DEFINITIONS
+        : contractVersion === 2 ? APPLICATION_CAPABILITY_DEFINITIONS : undefined;
+    if (!definitions || !Object.hasOwn(definitions, capability))
+        return undefined;
+    return [...definitions[capability]];
+}
+/** Fresh issuance only; never use this ceiling to reject retained authority or terminal replay. */
+export const FRESH_APPLICATION_AUTHORIZATION_VERSIONS = Object.freeze([1]);
+export function permitsFreshApplicationAuthorization(version) {
+    return FRESH_APPLICATION_AUTHORIZATION_VERSIONS.some((supported) => supported === version);
+}

package/dist/compatibility.d.ts

@@ -1,4 +1,4 @@
-import type { ApplicationFileRequirement } from "./files.js";
+import type { ApplicationFileRequest } from "./files.js";
 import { type CollectionOperation } from "./operations.js";
 export declare const OPERATION_TRANSPORT_PROTOCOL_VERSION: 3;
 export declare const LEGACY_OPERATION_TRANSPORT_PROTOCOL_VERSION: 2;
@@ -8,7 +8,7 @@ export declare const AUTHORIZATION_BINDING_PROTOCOL_VERSION: 5;
 export declare const LEGACY_AUTHORIZATION_BINDING_PROTOCOL_VERSION: 4;
 export declare const SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS: readonly [5, 4];
 export type AuthorizationBindingProtocolVersion = typeof SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS[number];
-export declare const SEMANTIC_CAPABILITY_CONTRACT_VERSION: 1;
+export declare const SEMANTIC_CAPABILITY_CONTRACT_VERSION: 2;
 export declare const DURABLE_MUTATION_CONTRACT_VERSION: 1;
 export interface ConnectContractRequirements {
     operation_transport: number;
@@ -30,7 +30,7 @@ export declare const CONNECT_CONTRACT_SUPPORT: ConnectContractSupport;
  * Produce the exact contract ceiling signed during authorization. `sync` is
  * conservatively mutation-capable because its action is selected per request.
  */
-export declare function authorizationContractRequirements(operations: readonly CollectionOperation[], files?: ApplicationFileRequirement, operationTransportRecovery?: readonly OperationTransportProtocolVersion[]): ConnectContractRequirements;
+export declare function authorizationContractRequirements(operations: readonly CollectionOperation[], files?: ApplicationFileRequest, operationTransportRecovery?: readonly OperationTransportProtocolVersion[], semanticCapabilityContractVersion?: 1 | 2): ConnectContractRequirements;
 export declare function supportsContractRequirements(required: ConnectContractRequirements, supported: ConnectContractSupport, durableMutation: boolean): boolean;
 export declare function isSupportedOperationTransport(version: number): version is OperationTransportProtocolVersion;
 export declare function isSupportedAuthorizationBinding(version: number): version is AuthorizationBindingProtocolVersion;

package/dist/compatibility.js

@@ -1,3 +1,4 @@
+import { APPLICATION_CAPABILITY_CONTRACT_VERSION } from "./capabilities.js";
 import { isMutatingOperation } from "./operations.js";
 export const OPERATION_TRANSPORT_PROTOCOL_VERSION = 3;
 export const LEGACY_OPERATION_TRANSPORT_PROTOCOL_VERSION = 2;
@@ -11,23 +12,23 @@ export const SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS = [
     AUTHORIZATION_BINDING_PROTOCOL_VERSION,
     LEGACY_AUTHORIZATION_BINDING_PROTOCOL_VERSION
 ];
-export const SEMANTIC_CAPABILITY_CONTRACT_VERSION = 1;
+export const SEMANTIC_CAPABILITY_CONTRACT_VERSION = APPLICATION_CAPABILITY_CONTRACT_VERSION;
 export const DURABLE_MUTATION_CONTRACT_VERSION = 1;
 export const CONNECT_CONTRACT_SUPPORT = {
     operation_transport: [...SUPPORTED_OPERATION_TRANSPORT_PROTOCOL_VERSIONS],
     authorization_binding: [...SUPPORTED_AUTHORIZATION_BINDING_PROTOCOL_VERSIONS],
-    semantic_capabilities: [SEMANTIC_CAPABILITY_CONTRACT_VERSION],
+    semantic_capabilities: [SEMANTIC_CAPABILITY_CONTRACT_VERSION, 1],
     durable_mutation: [DURABLE_MUTATION_CONTRACT_VERSION]
 };
 /**
  * Produce the exact contract ceiling signed during authorization. `sync` is
  * conservatively mutation-capable because its action is selected per request.
  */
-export function authorizationContractRequirements(operations, files, operationTransportRecovery = []) {
+export function authorizationContractRequirements(operations, files, operationTransportRecovery = [], semanticCapabilityContractVersion = APPLICATION_CAPABILITY_CONTRACT_VERSION) {
     const requirements = {
         operation_transport: OPERATION_TRANSPORT_PROTOCOL_VERSION,
         authorization_binding: AUTHORIZATION_BINDING_PROTOCOL_VERSION,
-        semantic_capabilities: 1
+        semantic_capabilities: semanticCapabilityContractVersion
     };
     const recovery = [...new Set(operationTransportRecovery)]
         .filter((version) => version !== OPERATION_TRANSPORT_PROTOCOL_VERSION)

package/dist/files.d.ts

@@ -1,3 +1,8 @@
+/** Frozen predecessor file declaration; never translate this into v2 intent. */
+export interface LegacyApplicationFileRequirement {
+    actions: FileAction[];
+    scope: FileScope;
+}
 export declare const FILE_PROTOCOL_VERSION: 1;
 export declare const FILE_TRANSFER_PROTOCOL_VERSION: 1;
 export declare const DEFAULT_FILE_CHUNK_BYTES: number;
@@ -43,9 +48,18 @@ export type FileScope = {
 };
 /** File intent declared by an application before an authority is selected. */
 export interface ApplicationFileRequirement {
+    required: FileAction[];
+    optional?: FileAction[];
+    scope: FileScope;
+}
+/** Exact file actions signed into an authorization request. */
+export interface ApplicationFileRequest {
     actions: FileAction[];
     scope: FileScope;
 }
+export declare function applicationFileRequest(requirement: ApplicationFileRequirement, options?: {
+    includeOptional?: boolean;
+}): ApplicationFileRequest;
 export interface FileCapability {
     kind: "files";
     protocol_version: 1;

package/dist/files.js

@@ -21,6 +21,15 @@ const RELAY_FILE_MAGIC_BYTES = new Uint8Array([0x4d, 0x44, 0x42, 0x52]);
 const RELAY_FILE_FRAME_VERSION = 1;
 const RELAY_FILE_FRAME_FLAGS = 0;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function applicationFileRequest(requirement, options = {}) {
+    return {
+        actions: [...new Set([
+                ...requirement.required,
+                ...(options.includeOptional === false ? [] : requirement.optional ?? [])
+            ])],
+        scope: structuredClone(requirement.scope)
+    };
+}
 export class FileFrameError extends Error {
     code;
     constructor(code, message) {

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import type { ConnectProblem } from "./connect-problems.generated.js";
-import type { ApplicationFileRequirement, CollectionFileDescriptor, FileCapability } from "./files.js";
+import type { ApplicationFileRequirement, LegacyApplicationFileRequirement, CollectionFileDescriptor, FileCapability } from "./files.js";
 import type { CollectionOperation } from "./operations.js";
-import type { ApplicationCapabilityRequirements } from "./capabilities.js";
+import type { ApplicationCapabilityRequirements, LegacyApplicationCapabilityRequirements } from "./capabilities.js";
 import type { ContractRequirement, ContractSetupChoice, TypePackProvision } from "./type-packs.js";
 import type { ConfigurationProvision, ConfigurationRequirement } from "./collection-setup.js";
 import type { ApplicationAuthorizationProof } from "./application-authorization.js";
@@ -32,7 +32,8 @@ export declare const POLICY_FRESHNESS_LEASE_MINIMUM_CONNECTOR_VERSION: "0.1.0-be
 export declare const HOSTED_PROVIDER_REQUIRED_CAPABILITIES: readonly ["durable-mutation-journal-v1", "durable-file-lifecycle-v1"];
 export declare const HOSTED_CANDIDATE_B_ACTIVATION_CAPABILITY: "candidate-b-activation-v1";
 export declare const HOSTED_PROVIDER_CAPABILITIES: readonly ["durable-mutation-journal-v1", "durable-file-lifecycle-v1", "mutation-replay-after-credential-retirement-v1", "candidate-b-activation-v1"];
-export declare const RELAY_CAPABILITIES: readonly ["application-authorization-v4", "authorization-activation", "encrypted-relay", "policy-ack", "policy-freshness-lease-v1", "application-authorization-v5", "contract-setup-v1", "file-relay-v1", "protocol-usage-report-v1"];
+export declare const APPLICATION_DECLARATION_EVIDENCE_CAPABILITY: "application-declaration-evidence-v1";
+export declare const RELAY_CAPABILITIES: readonly ["application-declaration-evidence-v1", "application-authorization-v4", "authorization-activation", "encrypted-relay", "policy-ack", "policy-freshness-lease-v1", "application-authorization-v5", "contract-setup-v1", "file-relay-v1", "protocol-usage-report-v1"];
 export declare const AUTHORITY_PROOF_VERSION: 1;
 export declare const AUTHORITY_PROOF_ALGORITHM: "P256-SHA256";
 export declare const AUTHORITY_PROOF_DOMAIN: "mdbase-authority-request-proof-v1";
@@ -179,6 +180,18 @@ export interface ApplicationRequirements {
     /** First-class non-Markdown file access requested independently of records. */
     files?: ApplicationFileRequirement;
 }
+export type LegacyApplicationRequirements = Omit<ApplicationRequirements, "capabilities" | "files" | "access"> & {
+    access: "full_collection";
+    capabilities?: LegacyApplicationCapabilityRequirements;
+    files?: LegacyApplicationFileRequirement;
+};
+export type LegacyMdbaseWebAppManifest = Omit<MdbaseWebAppManifest, "requirements"> & {
+    requirements: LegacyApplicationRequirements;
+};
+export type LegacyMdbasePortableAppManifest = Omit<MdbasePortableAppManifest, "requirements"> & {
+    requirements: LegacyApplicationRequirements;
+};
+export type LegacyMdbaseAppManifest = LegacyMdbaseWebAppManifest | LegacyMdbasePortableAppManifest;
 export interface ApplicationProvisions {
     type_packs: TypePackProvision[];
     /** Narrow semantic changes that may satisfy configuration requirements. */
@@ -234,6 +247,8 @@ export type MdbaseOperationResponse<Result = unknown> = {
     problem: ConnectProblem;
 };
 export interface GrantPolicy {
+    /** Complete normalized JSON evidence; never independent operation authority. */
+    application_declaration?: unknown;
     id: string;
     application_id: string;
     /** Stable declaration identity bound into the exact application authorization. */

package/dist/index.js

@@ -37,7 +37,9 @@ export const HOSTED_PROVIDER_CAPABILITIES = [
     "mutation-replay-after-credential-retirement-v1",
     HOSTED_CANDIDATE_B_ACTIVATION_CAPABILITY
 ];
+export const APPLICATION_DECLARATION_EVIDENCE_CAPABILITY = "application-declaration-evidence-v1";
 export const RELAY_CAPABILITIES = [
+    APPLICATION_DECLARATION_EVIDENCE_CAPABILITY,
     ...RELAY_REQUIRED_CAPABILITIES,
     POLICY_FRESHNESS_LEASE_CAPABILITY,
     "application-authorization-v5",

package/dist/manifest.d.ts

@@ -1,3 +1,5 @@
+import type { LegacyMdbaseAppManifest } from "./index.js";
+export type { LegacyApplicationFileRequirement, LegacyApplicationRequirements, LegacyMdbaseWebAppManifest, LegacyMdbasePortableAppManifest, LegacyMdbaseAppManifest } from "./index.js";
 import { type ApplicationNotifications, type ApplicationProvisions, type ApplicationRequirements, type MdbasePortableAppManifest, type MdbaseWebAppManifest } from "./index.js";
 export declare const APPLICATION_MANIFEST_MAX_BYTES = 524288;
 export interface ManifestValidationIssue {
@@ -27,6 +29,18 @@ interface ValidatedManifestFields {
 export type ValidatedWebAppManifest = Omit<MdbaseWebAppManifest, keyof ValidatedManifestFields> & ValidatedManifestFields;
 export type ValidatedPortableAppManifest = Omit<MdbasePortableAppManifest, keyof ValidatedManifestFields> & ValidatedManifestFields;
 export type ValidatedAppManifest = ValidatedWebAppManifest | ValidatedPortableAppManifest;
+export type ValidatedLegacyAppManifest = LegacyMdbaseAppManifest & {
+    provisions: ApplicationProvisions;
+    notifications: ApplicationNotifications;
+};
+/** The discriminator describes the original declaration, not a translation. */
+export type VersionedAppManifest = {
+    contractVersion: 1;
+    manifest: ValidatedLegacyAppManifest;
+} | {
+    contractVersion: 2;
+    manifest: ValidatedAppManifest;
+};
 export declare class AppManifestValidationError extends Error {
     readonly issues: ManifestValidationIssue[];
     constructor(issues: ManifestValidationIssue[]);
@@ -39,7 +53,10 @@ export declare class AppManifestValidationError extends Error {
  * rules here; consumers must not maintain parallel manifest validators.
  */
 export declare function validateAppManifest(value: unknown, options?: ManifestValidationOptions): ManifestValidationResult;
+/** Explicit opt-in to predecessor declarations; omission defaults to v1. */
+export declare function validateVersionedAppManifest(value: unknown, options?: ManifestValidationOptions): ManifestValidationResult;
 /** Validate, normalize optional sections, and return an isolated declaration. */
 export declare function parseAppManifest(value: unknown, options?: ManifestValidationOptions): ValidatedAppManifest;
+/** Validate and clone without changing capability IDs, file aliases, or version. */
+export declare function parseVersionedAppManifest(value: unknown, options?: ManifestValidationOptions): VersionedAppManifest;
 export declare function formatManifestValidationIssues(issues: readonly ManifestValidationIssue[]): string;
-export {};

package/dist/manifest.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { Ajv2020 } from "ajv/dist/2020.js";
 import addFormatsModule from "ajv-formats";
 import appManifestSchema from "../schemas/mdbase-app.schema.json" with { type: "json" };
+import legacyAppManifestSchema from "../schemas/mdbase-app.legacy-v1.schema.json" with { type: "json" };
 import { isNativeRedirectUri } from "./index.js";
 export const APPLICATION_MANIFEST_MAX_BYTES = 524_288;
 export class AppManifestValidationError extends Error {
@@ -22,6 +23,8 @@ const addFormats = addFormatsModule;
 addFormats(ajv);
 ajv.addSchema(appManifestSchema);
 const appManifestValidator = requiredValidator(String(appManifestSchema.$id));
+ajv.addSchema(legacyAppManifestSchema);
+const legacyAppManifestValidator = requiredValidator(String(legacyAppManifestSchema.$id));
 /**
  * Validate the complete bundled application declaration accepted by Connect.
  *
@@ -30,16 +33,35 @@ const appManifestValidator = requiredValidator(String(appManifestSchema.$id));
  * rules here; consumers must not maintain parallel manifest validators.
  */
 export function validateAppManifest(value, options = {}) {
+    return validateManifest(value, options, false);
+}
+/** Explicit opt-in to predecessor declarations; omission defaults to v1. */
+export function validateVersionedAppManifest(value, options = {}) {
+    return validateManifest(value, options, true);
+}
+function declaredContractVersion(value) {
+    const requirements = asObject(asObject(value).requirements);
+    return requirements.capabilities === undefined
+        ? 1
+        : asObject(requirements.capabilities).contract_version;
+}
+function validateManifest(value, options, versioned) {
     const sizeIssue = validateSerializedSize(value, options.maxBytes ?? APPLICATION_MANIFEST_MAX_BYTES);
     if (sizeIssue)
         return invalid([sizeIssue]);
+    const version = versioned ? declaredContractVersion(value) : 2;
+    if (version !== 1 && version !== 2) {
+        return invalid([issue("/requirements/capabilities/contract_version", "contractVersion", "must declare supported contract version 1 or 2")]);
+    }
     const candidate = options.allowLocal ? localManifestSchemaCandidate(value) : value;
-    const schemaResult = validationResult(appManifestValidator, candidate);
+    const schemaResult = validationResult(version === 1 ? legacyAppManifestValidator : appManifestValidator, candidate);
     if (!schemaResult.valid)
         return schemaResult;
     const issues = [
         ...validateManifestOrigins(value, options.allowLocal === true),
-        ...validateCapabilityRequirements(value),
+        ...(version === 1
+            ? validateLegacyCapabilityRequirements(value)
+            : validateCapabilityRequirements(value)),
         ...validateProvisionRequirements(value),
         ...validateConfigurationSetup(value)
     ];
@@ -50,6 +72,18 @@ export function parseAppManifest(value, options = {}) {
     const result = validateAppManifest(value, options);
     if (!result.valid)
         throw new AppManifestValidationError(result.issues);
+    return normalizeManifest(value);
+}
+/** Validate and clone without changing capability IDs, file aliases, or version. */
+export function parseVersionedAppManifest(value, options = {}) {
+    const result = validateVersionedAppManifest(value, options);
+    if (!result.valid)
+        throw new AppManifestValidationError(result.issues);
+    return declaredContractVersion(value) === 1
+        ? { contractVersion: 1, manifest: normalizeManifest(value) }
+        : { contractVersion: 2, manifest: normalizeManifest(value) };
+}
+function normalizeManifest(value) {
     const manifest = structuredClone(value);
     return {
         ...manifest,
@@ -351,6 +385,35 @@ function configurationPointerError(path) {
         : "must be inside a top-level x-* extension namespace";
 }
 function validateCapabilityRequirements(value) {
+    const manifest = asObject(value);
+    const requirements = asObject(manifest.requirements);
+    const capabilities = asObject(requirements.capabilities);
+    const issues = [];
+    if (requirements.access !== "full_collection") {
+        issues.push(issue("/requirements/access", "collectionAccess", "must explicitly request full_collection; legacy or omitted access is not widened"));
+    }
+    const required = Array.isArray(capabilities.required)
+        ? capabilities.required.map(String)
+        : [];
+    const optional = Array.isArray(capabilities.optional)
+        ? capabilities.optional.map(String)
+        : [];
+    const overlap = optional.find((capability) => required.includes(capability));
+    if (overlap) {
+        issues.push(issue("/requirements/capabilities/optional", "disjoint", `must not repeat required capability ${overlap}`));
+    }
+    const files = asObject(requirements.files);
+    const requiredFiles = Array.isArray(files.required) ? files.required.map(String) : [];
+    const optionalFiles = Array.isArray(files.optional) ? files.optional.map(String) : [];
+    const fileOverlap = optionalFiles.find((action) => requiredFiles.includes(action));
+    if (fileOverlap) {
+        issues.push(issue("/requirements/files/optional", "disjoint", `must not repeat required file action ${fileOverlap}`));
+    }
+    return issues;
+}
+// Frozen cross-field rules from c2596a6e; notably, absent capabilities skip
+// alias/setup checks rather than inventing or widening a declaration.
+function validateLegacyCapabilityRequirements(value) {
     const manifest = asObject(value);
     const requirements = asObject(manifest.requirements);
     const capabilities = asObject(requirements.capabilities);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect-protocol",
-  "version": "0.1.0-beta.94",
+  "version": "0.1.0-beta.95",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -36,7 +36,7 @@
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
-    "test": "node --test test/*.test.mjs && node ../../scripts/generate-connect-problems.mjs --check && node ../../scripts/generate-operation-catalog.mjs --check",
+    "test": "node --test test/*.test.mjs && node ../../scripts/generate-connect-problems.mjs --check && node ../../scripts/generate-operation-catalog.mjs --check && node ../../scripts/generate-application-capabilities.mjs --check",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   }
 }

package/schemas/application-capability-catalog.v1.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "catalog_version": 1,
+  "capabilities": [
+    { "id": "collection.inspect", "operations": ["describe"] },
+    { "id": "records.watch", "operations": ["changes"] },
+    { "id": "records.read", "operations": ["read"] },
+    { "id": "records.query", "operations": ["query"] },
+    { "id": "records.validate", "operations": ["validate"] },
+    { "id": "records.create", "operations": ["create"] },
+    { "id": "records.update", "operations": ["update"] },
+    { "id": "records.delete", "operations": ["delete"] },
+    { "id": "records.rename", "operations": ["rename"] },
+    { "id": "views.list", "operations": ["list_views"] },
+    { "id": "views.execute", "operations": ["execute_view"] },
+    { "id": "views.source.read", "operations": ["read_view_source"] },
+    { "id": "views.source.create", "operations": ["create_view_source"] },
+    { "id": "views.source.update", "operations": ["update_view_source"] },
+    { "id": "views.source.delete", "operations": ["delete_view_source"] },
+    { "id": "definitions.contracts.current", "operations": [] },
+    { "id": "definitions.read", "operations": ["read_type"] },
+    { "id": "definitions.create", "operations": ["create_type"] },
+    { "id": "definitions.update", "operations": ["update_type"] },
+    { "id": "definitions.type-pack.inspect", "operations": ["assess_type_pack"] },
+    { "id": "definitions.type-pack.apply", "operations": ["assess_type_pack", "apply_type_pack"] },
+    { "id": "collection.setup.apply", "operations": ["assess_collection_setup", "apply_collection_setup"] },
+    { "id": "timers.list", "operations": ["list_timers"] },
+    { "id": "timers.put", "operations": ["put_timer"] },
+    { "id": "timers.cancel", "operations": ["cancel_timer"] },
+    { "id": "timers.reconcile", "operations": ["reconcile_timers"] },
+    { "id": "sync.offline-replica", "operations": ["sync"] },
+    { "id": "notifications.background-delivery", "operations": [] },
+    { "id": "files.list", "operations": [] },
+    { "id": "files.read", "operations": [] },
+    { "id": "files.add", "operations": [] },
+    { "id": "files.replace", "operations": [] },
+    { "id": "files.move", "operations": [] },
+    { "id": "files.delete", "operations": [] }
+  ]
+}

package/schemas/application-capability-catalog.v2.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "catalog_version": 2,
+  "capabilities": [
+    {
+      "id": "collection.read",
+      "operations": [
+        "describe",
+        "changes",
+        "read",
+        "query",
+        "list_views",
+        "execute_view",
+        "read_view_source",
+        "validate",
+        "read_type"
+      ]
+    },
+    {
+      "id": "records.create",
+      "operations": ["create"]
+    },
+    {
+      "id": "records.edit",
+      "operations": ["update", "rename"]
+    },
+    {
+      "id": "records.delete",
+      "operations": ["delete"]
+    },
+    {
+      "id": "views.manage",
+      "operations": [
+        "create_view_source",
+        "update_view_source",
+        "delete_view_source"
+      ]
+    },
+    {
+      "id": "definitions.manage",
+      "operations": [
+        "create_type",
+        "update_type",
+        "assess_type_pack",
+        "apply_type_pack"
+      ]
+    },
+    {
+      "id": "background.schedule",
+      "operations": [
+        "list_timers",
+        "put_timer",
+        "cancel_timer",
+        "reconcile_timers"
+      ]
+    },
+    {
+      "id": "offline.replica",
+      "operations": ["sync"]
+    }
+  ],
+  "structured_authorities": {
+    "application_setup": [
+      "assess_collection_setup",
+      "apply_collection_setup"
+    ]
+  }
+}

package/schemas/connect-protocol.v1.schema.json

@@ -274,6 +274,7 @@
         "file_capability": {
           "$ref": "https://mdbase.dev/connect/schemas/files.v1.json#/$defs/fileCapability"
         },
+        "application_declaration": {},
         "application_authorization": { "$ref": "#/$defs/applicationAuthorizationProof" }
       }
     },

package/schemas/mdbase-app.legacy-v1.schema.json

@@ -0,0 +1,405 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mdbase.dev/connect/schemas/mdbase-app.legacy-v1.json",
+  "title": "mdbase connect bundled application manifest v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["manifest_version", "id", "name"],
+  "properties": {
+    "manifest_version": { "const": 1 },
+    "distribution": {
+      "enum": ["web", "portable"],
+      "description": "Portable declarations use device authorization and do not claim a browser origin."
+    },
+    "id": {
+      "type": "string",
+      "minLength": 5,
+      "maxLength": 150,
+      "pattern": "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*){2,}$",
+      "description": "Stable reverse-domain application identifier. This is presentation metadata, not publisher authentication."
+    },
+    "name": { "type": "string", "minLength": 1, "maxLength": 100 },
+    "homepage": { "type": "string", "format": "uri", "pattern": "^https://" },
+    "project_url": { "type": "string", "format": "uri", "pattern": "^https://" },
+    "icon": { "type": "string", "format": "uri", "pattern": "^https://" },
+    "redirect_uris": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 10,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "format": "uri",
+        "description": "An HTTPS URI on the homepage origin or a private-use scheme derived from the application ID."
+      }
+    },
+    "requirements": { "$ref": "#/$defs/requirements" },
+    "provisions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type_packs"],
+      "properties": {
+        "configuration": {
+          "type": "array",
+          "maxItems": 50,
+          "items": { "$ref": "#/$defs/configurationProvision" }
+        },
+        "type_packs": {
+          "type": "array",
+          "maxItems": 20,
+          "items": { "$ref": "#/$defs/typePackProvision" }
+        }
+      }
+    },
+    "notifications": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["criteria"],
+      "properties": {
+        "criteria": {
+          "type": "array",
+          "maxItems": 50,
+          "items": { "$ref": "#/$defs/notificationCriterion" }
+        },
+        "native_delivery": { "$ref": "#/$defs/nativeNotificationDelivery" }
+      }
+    }
+  },
+  "oneOf": [
+    {
+      "required": ["homepage", "redirect_uris"],
+      "properties": {
+        "distribution": { "const": "web" },
+        "homepage": true,
+        "redirect_uris": true,
+        "project_url": false
+      }
+    },
+    {
+      "required": ["distribution"],
+      "properties": {
+        "distribution": { "const": "portable" },
+        "homepage": false,
+        "redirect_uris": false
+      }
+    }
+  ],
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-z0-9]+(?:[._-][a-z0-9]+)*$"
+    },
+    "duration": {
+      "type": "string",
+      "pattern": "^[0-9]+(ms|s|m|h|d)$"
+    },
+    "contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "version", "digest"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "version": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+        },
+        "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+      }
+    },
+    "requirements": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["access", "contracts"],
+      "properties": {
+        "capabilities": { "$ref": "#/$defs/capabilityRequirements" },
+        "access": {
+          "const": "full_collection",
+          "description": "Compatibility declaration for collection-level application authorization."
+        },
+      "collection_kind": {
+          "const": "hosted",
+          "description": "Require a durable provider-backed collection with direct sync support."
+        },
+        "files": { "$ref": "#/$defs/fileRequirement" },
+        "configuration": {
+          "type": "array",
+          "maxItems": 50,
+          "items": { "$ref": "#/$defs/configurationRequirement" }
+        },
+        "contracts": {
+          "type": "array",
+          "maxItems": 20,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/contract" }
+        }
+      }
+    },
+    "capabilityRequirements": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["contract_version", "required"],
+      "properties": {
+        "contract_version": { "const": 1 },
+        "required": {
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/applicationCapability" }
+        },
+        "optional": {
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/applicationCapability" }
+        }
+      }
+    },
+    "configurationValue": {
+      "anyOf": [
+        { "type": "string" },
+        { "type": "number" },
+        { "type": "boolean" },
+        { "type": "null" }
+      ]
+    },
+    "configurationRequirement": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "path", "predicate", "value"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100,
+          "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$"
+        },
+        "path": { "type": "string", "minLength": 1, "maxLength": 1024 },
+        "predicate": { "const": "contains" },
+        "value": { "$ref": "#/$defs/configurationValue" }
+      }
+    },
+    "configurationProvision": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["requirement", "operation", "path", "value"],
+      "properties": {
+        "requirement": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100,
+          "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$"
+        },
+        "operation": { "const": "set_add" },
+        "path": { "type": "string", "minLength": 1, "maxLength": 1024 },
+        "value": { "$ref": "#/$defs/configurationValue" }
+      }
+    },
+    "applicationCapability": {
+      "enum": [
+        "collection.inspect",
+        "records.watch",
+        "records.read",
+        "records.query",
+        "records.validate",
+        "records.create",
+        "records.update",
+        "records.delete",
+        "records.rename",
+        "views.list",
+        "views.execute",
+        "views.source.read",
+        "views.source.create",
+        "views.source.update",
+            "views.source.delete",
+            "definitions.contracts.current",
+            "definitions.read",
+        "definitions.create",
+        "definitions.update",
+        "definitions.type-pack.inspect",
+        "definitions.type-pack.apply",
+        "collection.setup.apply",
+        "timers.list",
+        "timers.put",
+        "timers.cancel",
+        "timers.reconcile",
+        "sync.offline-replica",
+        "notifications.background-delivery",
+        "files.list",
+        "files.read",
+        "files.add",
+        "files.replace",
+        "files.move",
+        "files.delete"
+      ]
+    },
+    "fileRequirement": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["actions", "scope"],
+      "properties": {
+        "actions": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 6,
+          "uniqueItems": true,
+          "items": {
+            "enum": ["list", "read", "add", "replace", "move", "delete"]
+          }
+        },
+        "scope": { "$ref": "#/$defs/fileScope" }
+      }
+    },
+    "fileScope": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "folders"],
+          "properties": {
+            "kind": { "const": "selected_folders" },
+            "folders": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 100,
+              "uniqueItems": true,
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 1024,
+                "pattern": "^(?!/)(?!\\.)(?!.*//)(?!.*\\\\)(?!.*/\\.)(?!(?:_contracts|_schemas|_types|_views|node_modules)(?:/|$))(?!.*\\/(?:_contracts|_schemas|_types|_views|node_modules)(?:/|$))(?!.*/$).+$"
+              }
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind"],
+          "properties": { "kind": { "const": "collection" } }
+        }
+      ]
+    },
+    "typePackProvision": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["manifest", "resources", "provides"],
+      "properties": {
+        "manifest": { "$ref": "#/$defs/typePackManifest" },
+        "resources": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 100,
+          "items": { "$ref": "#/$defs/typePackSourceResource" }
+        },
+        "provides": {
+          "type": "array",
+          "maxItems": 20,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/contract" }
+        }
+      }
+    },
+    "typePackManifest": {
+      "type": "object",
+      "required": ["kind", "id", "version", "resources"],
+      "properties": {
+        "kind": { "const": "mdbase.type-pack" },
+        "id": { "$ref": "#/$defs/identifier" },
+        "version": { "$ref": "#/$defs/contract/properties/version" },
+        "name": { "type": "string", "minLength": 1, "maxLength": 100 },
+        "description": { "type": "string", "maxLength": 500 },
+        "resources": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 100,
+          "items": { "$ref": "#/$defs/typePackManifestResource" }
+        }
+      },
+      "patternProperties": { "^x-[A-Za-z][A-Za-z0-9._:-]{0,127}$": true },
+      "additionalProperties": false
+    },
+    "typePackManifestResource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "mode", "source", "target", "digest"],
+      "properties": {
+        "kind": { "enum": ["contract", "type", "schema"] },
+        "mode": { "enum": ["managed", "seed"] },
+        "source": { "type": "string", "minLength": 1, "maxLength": 240 },
+        "target": { "type": "string", "minLength": 1, "maxLength": 240 },
+        "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+      }
+    },
+    "typePackSourceResource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "document"],
+      "properties": {
+        "source": { "type": "string", "minLength": 1, "maxLength": 240 },
+        "document": { "type": "string", "maxLength": 262144 }
+      }
+    },
+    "notificationCriterion": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "event", "presentation"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "event": { "$ref": "#/$defs/contract" },
+        "if": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["$expr"],
+          "properties": {
+            "$expr": { "type": "string", "minLength": 1, "maxLength": 4096 }
+          }
+        },
+        "debounce": { "$ref": "#/$defs/duration" },
+        "minimum_interval": { "$ref": "#/$defs/duration" },
+        "presentation": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["title"],
+          "properties": {
+            "title": { "type": "string", "minLength": 1, "maxLength": 80 },
+            "body": { "type": "string", "maxLength": 160 },
+            "tag": { "type": "string", "minLength": 1, "maxLength": 80 }
+          }
+        }
+      }
+    },
+    "nativeNotificationDelivery": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode", "firebase_project_id"],
+          "properties": {
+            "mode": { "const": "managed_fcm" },
+            "firebase_project_id": {
+              "type": "string",
+              "minLength": 6,
+              "maxLength": 63,
+              "pattern": "^[a-z][a-z0-9-]*[a-z0-9]$"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode", "url"],
+          "properties": {
+            "mode": { "const": "webhook" },
+            "url": {
+              "type": "string",
+              "format": "uri",
+              "pattern": "^https://"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/schemas/mdbase-app.schema.json

@@ -141,7 +141,7 @@
       "additionalProperties": false,
       "required": ["contract_version", "required"],
       "properties": {
-        "contract_version": { "const": 1 },
+        "contract_version": { "const": 2 },
         "required": {
           "type": "array",
           "maxItems": 32,
@@ -198,59 +198,35 @@
     },
     "applicationCapability": {
       "enum": [
-        "collection.inspect",
-        "records.watch",
-        "records.read",
-        "records.query",
-        "records.validate",
+        "collection.read",
         "records.create",
-        "records.update",
+        "records.edit",
         "records.delete",
-        "records.rename",
-        "views.list",
-        "views.execute",
-        "views.source.read",
-        "views.source.create",
-        "views.source.update",
-            "views.source.delete",
-            "definitions.contracts.current",
-            "definitions.read",
-        "definitions.create",
-        "definitions.update",
-        "definitions.type-pack.inspect",
-        "definitions.type-pack.apply",
-        "collection.setup.apply",
-        "timers.list",
-        "timers.put",
-        "timers.cancel",
-        "timers.reconcile",
-        "sync.offline-replica",
-        "notifications.background-delivery",
-        "files.list",
-        "files.read",
-        "files.add",
-        "files.replace",
-        "files.move",
-        "files.delete"
+        "views.manage",
+        "definitions.manage",
+        "background.schedule",
+        "offline.replica"
       ]
     },
     "fileRequirement": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["actions", "scope"],
+      "required": ["required", "scope"],
       "properties": {
-        "actions": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 6,
-          "uniqueItems": true,
-          "items": {
-            "enum": ["list", "read", "add", "replace", "move", "delete"]
-          }
-        },
+        "required": { "$ref": "#/$defs/fileActions" },
+        "optional": { "$ref": "#/$defs/fileActions" },
         "scope": { "$ref": "#/$defs/fileScope" }
       }
     },
+    "fileActions": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 6,
+      "uniqueItems": true,
+      "items": {
+        "enum": ["list", "read", "add", "replace", "move", "delete"]
+      }
+    },
     "fileScope": {
       "oneOf": [
         {