@mdbase-dev/connect 0.1.0-beta.100

package/dist/connect.js

@@ -0,0 +1,711 @@
+import { APPLICATION_AUTHORIZATION_PROTOCOL_VERSION, authorizationContractRequirements, DEFAULT_LOOPBACK_PORT, GRANT_ENCRYPTION_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
+import { authorizationOperations, authorizationFiles, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
+import { abortableDelay } from "./async.js";
+import { authorizationCallbackState } from "./authorization-url.js";
+import { randomBase64Url } from "./base64.js";
+import { ApplicationIdentityStoreError, IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, applicationIdentity, applicationInstallationId, signApplicationAuthorization } from "./application-identity.js";
+import { MdbaseConnection } from "./connection.js";
+import { addConnectionId, connectionIds, removeConnectionId } from "./connection-index.js";
+import { assertFreshV2AuthorizationSupport, authorizationAbort, declarationIdFromFamilyIdentity } from "./connect-authorization-helpers.js";
+import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
+import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
+import { prepareAuthorizationWindow, publishPopupAuthorizationCompletion, waitForPopupAuthorization } from "./popup-authorization.js";
+import { pendingRecoveryTransports, removePendingMutations } from "./pending-recovery-transports.js";
+import { GrantKeyLeaseRegistry } from "./grant-key-leases.js";
+import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
+import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, resolveManifestSource, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
+import { storedTokenFromResponse } from "./token-response.js";
+import { deleteUnusedGrantKey, planRetiredGrantKeys, storedTokenKeyHandles } from "./retired-grant-keys.js";
+import { SharedOperationMap } from "./shared-operation.js";
+export class MdbaseConnectInternals {
+    serverUrl;
+    manifest;
+    manifestSource;
+    redirectUri;
+    storage;
+    relayEncryption;
+    keyStore;
+    identityStore;
+    directAccessMode;
+    loopbackUrl;
+    navigate;
+    timeouts;
+    credentialStorage;
+    application = null;
+    manifestPromise = null;
+    completionPromises = new SharedOperationMap();
+    grantKeyLeases;
+    connectionCache = new Map();
+    listeners = new Set();
+    invalidatedConnections = new Map();
+    constructor(options) {
+        this.serverUrl = stripTrailingSlash(String(options.serverUrl));
+        const declaration = resolveManifestSource(options.manifest, options.redirectUri);
+        this.manifest = declaration.manifest;
+        this.manifestSource = declaration.manifestSource;
+        const opaquePortable = isOpaquePortableManifest(this.manifest);
+        this.redirectUri = declaration.redirectUri;
+        this.storage = options.storage ?? defaultStorage(opaquePortable);
+        this.relayEncryption = options.relayEncryption ?? "required";
+        this.keyStore = options.keyStore ?? (opaquePortable ? new MemoryGrantKeyStore() : new IndexedDbGrantKeyStore());
+        this.identityStore = options.identityStore ?? (opaquePortable
+            ? new MemoryApplicationIdentityStore()
+            : new IndexedDbApplicationIdentityStore());
+        this.credentialStorage = options.storage || options.keyStore || options.identityStore
+            ? "custom"
+            : this.storage instanceof MemoryStorage ? "memory" : "persistent";
+        this.directAccessMode = options.directAccess ?? "auto";
+        this.loopbackUrl = canonicalLoopbackUrl(String(options.loopbackUrl ?? `http://127.0.0.1:${DEFAULT_LOOPBACK_PORT}`));
+        this.navigate = options.navigate;
+        this.timeouts = resolveConnectTimeouts(options.timeouts);
+        this.grantKeyLeases = new GrantKeyLeaseRegistry(this.storagePrefix(), (collectionId, keyHandle) => this.deleteGrantKeyWhenUnused(collectionId, keyHandle));
+        if (typeof window !== "undefined" && this.storage === window.localStorage) {
+            window.addEventListener("storage", (event) => {
+                if (event.storageArea !== this.storage || !event.key?.startsWith(this.storagePrefix()))
+                    return;
+                this.connectionCache.get(collectionIdFromTokenKey(event.key))?.notifyStorageChanged();
+                this.emitConnections();
+            });
+        }
+    }
+    environment() {
+        const distribution = typeof this.manifest !== "string"
+            && this.manifest.distribution === "portable"
+            ? "portable"
+            : this.application?.distribution ?? "web";
+        return {
+            distribution,
+            applicationOrigin: distribution === "portable"
+                ? "null"
+                : this.defaultApplicationOrigin(),
+            credentialStorage: this.credentialStorage
+        };
+    }
+    register(options = {}) {
+        return withRequestBudget(options, this.timeouts.requestMs, (budget) => this.registerWithinBudget(budget.signal));
+    }
+    async registerWithinBudget(signal) {
+        if (this.application)
+            return this.application;
+        const response = await connectFetch(`${this.serverUrl}/v1/apps/register`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ manifest: await this.manifestDeclaration({ signal, timeoutMs: null }) }),
+            signal
+        }, "temporarily_unavailable", "Application registration is temporarily unavailable.");
+        const body = await decodeJsonResponse(response, "invalid_operation_response", "Connect returned an invalid application registration response.");
+        if (!response.ok)
+            throw apiError(body, "discovery_failed", "Application discovery failed.", response.status);
+        this.application = body.application;
+        return this.application;
+    }
+    manifestDeclaration(options = {}) {
+        if (this.manifestPromise)
+            return this.manifestPromise;
+        const loading = withRequestBudget(options, this.timeouts.requestMs, (budget) => this.loadManifest(budget.signal));
+        const shared = loading.catch((error) => {
+            if (this.manifestPromise === shared)
+                this.manifestPromise = null;
+            throw error;
+        });
+        this.manifestPromise = shared;
+        return this.manifestPromise;
+    }
+    async loadManifest(signal) {
+        if (typeof this.manifest !== "string")
+            return this.manifest;
+        const source = this.manifest;
+        let response;
+        try {
+            response = await fetch(source, {
+                headers: { accept: "application/json" },
+                signal
+            });
+        }
+        catch (cause) {
+            throw connectError("manifest_load_failed", "The bundled application declaration could not be loaded.", { cause });
+        }
+        if (!response.ok) {
+            throw connectError("manifest_load_failed", `The bundled application declaration returned HTTP ${response.status}.`, { status: response.status });
+        }
+        try {
+            return await decodeJsonResponse(response, "invalid_application_manifest", "The bundled application declaration is not valid JSON.");
+        }
+        catch (cause) {
+            throw connectError("invalid_application_manifest", "The bundled application declaration is not valid JSON.", {
+                cause,
+                details: {
+                    issues: [{
+                            path: "/",
+                            keyword: "json",
+                            message: "must be valid JSON",
+                            params: {}
+                        }]
+                }
+            });
+        }
+    }
+    async authorize(options = {}) {
+        const authorizationTimeout = options.presentation === "popup"
+            ? 10 * 60 * 1_000
+            : this.timeouts.requestMs;
+        return withRequestBudget(options, authorizationTimeout, (budget) => this.authorizeWithinBudget({ ...options, signal: budget.signal, timeoutMs: null }));
+    }
+    async authorizeWithinBudget(options) {
+        const portableDeclared = typeof this.manifest !== "string"
+            && this.manifest.distribution === "portable";
+        const { application, popup } = await prepareAuthorizationWindow({
+            options,
+            portableDeclared,
+            navigate: this.navigate,
+            register: (signal) => this.registerWithinBudget(signal)
+        });
+        try {
+            validateAuthorizationSelection(application.requirements, options);
+            if (application.requirements.capabilities?.contract_version === 2) {
+                await assertFreshV2AuthorizationSupport(this.serverUrl, options.signal);
+            }
+        }
+        catch (error) {
+            popup?.close();
+            throw error;
+        }
+        if (application.distribution === "portable") {
+            if (options.openVerification)
+                popup?.close();
+            return this.authorizePortable(application, options, options.openVerification ? null : popup);
+        }
+        return this.authorizeWeb(application, options, popup);
+    }
+    async authorizeWeb(application, options, popup) {
+        const { verifier, challenge } = await createPkce();
+        const state = randomBase64Url(24);
+        const authorizationId = crypto.randomUUID();
+        const targetCollectionId = options.target?.kind === "collection"
+            ? options.target.collectionId
+            : undefined;
+        const keyHandle = `grant:${application.id}:${state}`;
+        const grantKey = await this.keyStore.create(keyHandle);
+        let installation;
+        try {
+            installation = await this.loadApplicationIdentity(application);
+        }
+        catch (error) {
+            await this.keyStore.delete(keyHandle);
+            throw error;
+        }
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
+        const issuedAt = new Date();
+        const proof = await signApplicationAuthorization({
+            protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
+            authorization_id: authorizationId,
+            application_id: application.id,
+            application_declaration_id: declarationIdFromFamilyIdentity(application.family_identity),
+            application_manifest_digest: application.manifest_digest,
+            application_installation_id: await applicationInstallationId(installation),
+            installation_signing_public_key: installation.signingPublicKey,
+            grant_agreement_public_key: grantKey.agreementPublicKey,
+            grant_signing_public_key: grantKey.signingPublicKey,
+            flow: "authorization_code",
+            authorization_nonce: randomBase64Url(32),
+            issued_at: issuedAt.toISOString(),
+            expires_at: new Date(issuedAt.getTime() + 10 * 60 * 1_000).toISOString(),
+            redirect_uri: this.redirectUri,
+            state,
+            code_challenge: challenge,
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId), semanticContractVersion(application.requirements)),
+            requested_operations: operations,
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
+            ...(targetCollectionId ? { collection_id: targetCollectionId } : {})
+        }, installation);
+        const pending = {
+            version: 1,
+            verifier,
+            state,
+            clientId: application.id,
+            redirectUri: this.redirectUri,
+            relayEncryption: this.relayEncryption,
+            collectionId: targetCollectionId,
+            returnTo: options.returnTo,
+            keyHandle,
+            authorizationId,
+            applicationAgreementPublicKey: grantKey.agreementPublicKey,
+            applicationSigningPublicKey: grantKey.signingPublicKey,
+            ...(options.presentation === "popup" && popup ? { presentation: "popup" } : {})
+        };
+        this.storage.setItem(this.pendingKey(state), JSON.stringify(pending));
+        try {
+            const response = await fetch(`${this.serverUrl}/oauth/authorization_request`, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({
+                    client_id: application.id,
+                    redirect_uri: this.redirectUri,
+                    code_challenge: challenge,
+                    code_challenge_method: "S256",
+                    state,
+                    operations: operations.join(","),
+                    ...(targetCollectionId ? { collection_id: targetCollectionId } : {}),
+                    application_authorization: JSON.stringify(proof)
+                }),
+                signal: options.signal
+            });
+            const body = await decodeJsonResponse(response, "invalid_device_authorization_response", "The authorization service returned an invalid authorization response.");
+            if (!response.ok) {
+                throw apiError(body, "device_authorization_failed", "Application authorization could not be started.", response.status);
+            }
+            if (typeof body.authorization_uri !== "string"
+                || body.authorization_id !== authorizationId
+                || !Number.isInteger(body.expires_in)
+                || body.expires_in <= 0) {
+                throw connectError("invalid_device_authorization_response", "The authorization service returned an invalid authorization response.");
+            }
+            if (options.presentation === "popup" && popup) {
+                popup.location.href = body.authorization_uri;
+                return await waitForPopupAuthorization({
+                    storage: this.storage,
+                    storagePrefix: this.storagePrefix(),
+                    state,
+                    pending,
+                    popup,
+                    signal: options.signal,
+                    keyStore: this.keyStore,
+                    connection: (collectionId) => this.connection(collectionId)
+                });
+            }
+            popup?.close();
+            if (this.navigate)
+                await this.navigate(body.authorization_uri);
+            else if (typeof location !== "undefined")
+                location.assign(body.authorization_uri);
+            else {
+                throw connectError("browser_required", "Authorization navigation requires a browser environment.");
+            }
+            return { kind: "redirecting" };
+        }
+        catch (error) {
+            popup?.close();
+            this.storage.removeItem(this.pendingKey(state));
+            await this.keyStore.delete(keyHandle);
+            if (options.signal?.aborted) {
+                throw authorizationAbort(options.signal, "Application authorization was cancelled.", error);
+            }
+            throw error;
+        }
+    }
+    async authorizePortable(application, options, popup) {
+        if (this.relayEncryption !== "required") {
+            popup?.close();
+            throw connectError("encryption_required", "Downloaded applications require encrypted relay authorization.");
+        }
+        const { verifier, challenge } = await createPkce();
+        const keyHandle = `grant:${application.id}:${randomBase64Url(24)}`;
+        const grantKey = await this.keyStore.create(keyHandle);
+        let installation;
+        try {
+            installation = await this.loadApplicationIdentity(application);
+        }
+        catch (error) {
+            popup?.close();
+            await this.keyStore.delete(keyHandle);
+            throw error;
+        }
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
+        const authorizationId = crypto.randomUUID();
+        const issuedAt = new Date();
+        const proof = await signApplicationAuthorization({
+            protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
+            authorization_id: authorizationId,
+            application_id: application.id,
+            application_declaration_id: declarationIdFromFamilyIdentity(application.family_identity),
+            application_manifest_digest: application.manifest_digest,
+            application_installation_id: await applicationInstallationId(installation),
+            installation_signing_public_key: installation.signingPublicKey,
+            grant_agreement_public_key: grantKey.agreementPublicKey,
+            grant_signing_public_key: grantKey.signingPublicKey,
+            flow: "device_code",
+            authorization_nonce: randomBase64Url(32),
+            issued_at: issuedAt.toISOString(),
+            expires_at: new Date(issuedAt.getTime() + 10 * 60 * 1_000).toISOString(),
+            code_challenge: challenge,
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined), semanticContractVersion(application.requirements)),
+            requested_operations: operations,
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
+            ...(options.target?.kind === "collection"
+                ? { collection_id: options.target.collectionId }
+                : {})
+        }, installation);
+        let response;
+        let body;
+        try {
+            response = await fetch(`${this.serverUrl}/oauth/device_authorization`, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({
+                    client_id: application.id,
+                    operations: operations.join(","),
+                    ...(options.target?.kind === "collection"
+                        ? { collection_id: options.target.collectionId }
+                        : {}),
+                    code_challenge: challenge,
+                    code_challenge_method: "S256",
+                    application_authorization: JSON.stringify(proof)
+                }),
+                signal: options.signal
+            });
+            body = await decodeJsonResponse(response, "invalid_device_authorization_response", "The authorization service returned an invalid device authorization response.");
+        }
+        catch (cause) {
+            popup?.close();
+            await this.keyStore.delete(keyHandle);
+            throw connectError("device_authorization_failed", "Downloaded application authorization could not be started.", { cause });
+        }
+        if (!response.ok) {
+            popup?.close();
+            await this.keyStore.delete(keyHandle);
+            throw apiError(body, "device_authorization_failed", "Downloaded application authorization could not be started.", response.status);
+        }
+        let authorization;
+        try {
+            authorization = parseDeviceAuthorization(body);
+        }
+        catch (error) {
+            popup?.close();
+            await this.keyStore.delete(keyHandle);
+            if (options.signal?.aborted) {
+                throw authorizationAbort(options.signal, "Downloaded application authorization was cancelled.", error);
+            }
+            throw error;
+        }
+        options.onDeviceCode?.(authorization);
+        if (options.openVerification) {
+            await options.openVerification(authorization);
+        }
+        else if (popup) {
+            try {
+                popup.location.href = authorization.verificationUriComplete;
+            }
+            catch {
+                // The already-open verification page still accepts the displayed code.
+            }
+        }
+        else {
+            await this.keyStore.delete(keyHandle);
+            throw connectError("approval_window_blocked", "The approval window was blocked. Show the provided verification link and code, then try again.", {
+                details: {
+                    user_code: authorization.userCode,
+                    verification_uri: authorization.verificationUri,
+                    verification_uri_complete: authorization.verificationUriComplete,
+                    expires_at: authorization.expiresAt,
+                    interval_seconds: authorization.intervalSeconds
+                }
+            });
+        }
+        let intervalSeconds = authorization.intervalSeconds;
+        try {
+            while (Date.now() < authorization.expiresAt) {
+                await abortableDelay(intervalSeconds * 1_000, options.signal);
+                if (options.signal?.aborted) {
+                    throw authorizationAbort(options.signal, "Downloaded application authorization was cancelled.");
+                }
+                let tokenResponse;
+                try {
+                    tokenResponse = await fetch(`${this.serverUrl}/oauth/token`, {
+                        method: "POST",
+                        headers: { "content-type": "application/x-www-form-urlencoded" },
+                        body: new URLSearchParams({
+                            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                            device_code: body.device_code,
+                            client_id: application.id,
+                            code_verifier: verifier
+                        }),
+                        signal: options.signal
+                    });
+                }
+                catch (cause) {
+                    if (options.signal?.aborted) {
+                        throw authorizationAbort(options.signal, "Downloaded application authorization was cancelled.", cause);
+                    }
+                    continue;
+                }
+                const tokenBody = await decodeJsonResponse(tokenResponse, "invalid_token_response", "The authorization service returned an invalid token response.");
+                if (!tokenResponse.ok) {
+                    const code = oauthErrorCode(tokenBody);
+                    if (code === "authorization_pending") {
+                        continue;
+                    }
+                    if (code === "slow_down") {
+                        intervalSeconds += 5;
+                        continue;
+                    }
+                    throw apiError(tokenBody, "token_exchange_failed", "Downloaded application authorization could not be completed.", tokenResponse.status);
+                }
+                const authority = validAuthorityTokenResponse(tokenBody.authority, tokenBody.collection_id);
+                const localEncryption = tokenBody.encryption
+                    && tokenBody.encryption.protocol_version === GRANT_ENCRYPTION_PROTOCOL_VERSION
+                    && tokenBody.encryption.suite === RELAY_ENCRYPTION_SUITE
+                    && tokenBody.encryption.application_agreement_public_key
+                        === grantKey.agreementPublicKey;
+                if (tokenBody.application_origin !== "null") {
+                    throw connectError("invalid_token_response", "Authorization did not bind the portable grant to its opaque application origin.");
+                }
+                if (tokenBody.authority
+                    && (!authority
+                        || tokenBody.encryption != null
+                        || tokenBody.authority.proof_public_key !== grantKey.signingPublicKey)) {
+                    throw connectError("invalid_token_response", "Authorization returned a remote authority capability that is not bound to this portable grant key.");
+                }
+                if (!tokenBody.authority && !localEncryption) {
+                    throw connectError("encryption_required", "Authorization did not establish the expected key-bound local portable grant.");
+                }
+                const token = this.storeTokenResponse(tokenBody, application.id, keyHandle);
+                if (options.target?.kind === "collection"
+                    && options.target.collectionId !== token.collectionId) {
+                    this.removeToken(token.collectionId, token.keyHandle);
+                    throw connectError("collection_mismatch", "The approved collection does not match the collection requested by this link.");
+                }
+                popup?.close();
+                return {
+                    kind: "connected",
+                    connection: this.connection(token.collectionId),
+                    ...(options.returnTo ? { returnTo: options.returnTo } : {})
+                };
+            }
+            throw connectError("expired_token", "The downloaded application authorization code expired.");
+        }
+        catch (error) {
+            popup?.close();
+            await this.keyStore.delete(keyHandle);
+            if (options.signal?.aborted) {
+                throw authorizationAbort(options.signal, "Downloaded application authorization was cancelled.", error);
+            }
+            throw error;
+        }
+    }
+    completeAuthorization(callbackUrl, options = {}) {
+        const state = authorizationCallbackState(callbackUrl);
+        if (!state) {
+            return Promise.reject(connectError("invalid_callback", "Authorization callback is missing its state."));
+        }
+        const pending = parseStored(this.storage.getItem(this.pendingKey(state)));
+        const popupAttempt = pending?.presentation === "popup";
+        return this.completionPromises.run(state, options, this.timeouts.requestMs, (signal) => publishPopupAuthorizationCompletion({
+            storage: this.storage,
+            storagePrefix: this.storagePrefix(),
+            state,
+            pending,
+            popupAttempt,
+            completion: this.performAuthorizationCompletion(callbackUrl, state, signal)
+        }));
+    }
+    async performAuthorizationCompletion(callbackUrl, state, signal) {
+        const callback = new URL(callbackUrl);
+        const code = callback.searchParams.get("code");
+        const pendingKey = this.pendingKey(state);
+        const pending = parseStored(this.storage.getItem(pendingKey));
+        if (!pending || pending.version !== 1 || state !== pending.state) {
+            throw connectError("invalid_callback", "Authorization callback is missing or does not match this browser session.");
+        }
+        if (callback.searchParams.has("error")) {
+            if (pending.keyHandle)
+                await this.keyStore.delete(pending.keyHandle);
+            this.storage.removeItem(pendingKey);
+            throw serverConnectError(callback.searchParams.get("error") ?? "access_denied", callback.searchParams.get("error_description") ?? "Collection access was not approved.", { details: pending.returnTo ? { return_to: pending.returnTo } : undefined });
+        }
+        if (!code) {
+            throw connectError("invalid_callback", "Authorization callback is missing its code.");
+        }
+        const response = await connectFetch(`${this.serverUrl}/oauth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "authorization_code",
+                code,
+                client_id: pending.clientId,
+                redirect_uri: pending.redirectUri,
+                code_verifier: pending.verifier
+            }),
+            signal
+        }, "temporarily_unavailable", "Authorization completion is temporarily unavailable.");
+        const body = await decodeJsonResponse(response, "invalid_token_response", "The authorization service returned an invalid token response.");
+        if (!response.ok)
+            throw apiError(body, "token_exchange_failed", "Authorization could not be completed.", response.status);
+        if (pending.relayEncryption === "required" && !body.authority && (!body.encryption
+            || !pending.keyHandle
+            || body.encryption.application_agreement_public_key
+                !== pending.applicationAgreementPublicKey)) {
+            if (pending.keyHandle)
+                await this.keyStore.delete(pending.keyHandle);
+            this.storage.removeItem(pendingKey);
+            throw connectError("encryption_required", "Authorization did not establish the required encrypted relay grant.");
+        }
+        if (body.authority?.proof_public_key) {
+            if (!pending.keyHandle
+                || !pending.applicationSigningPublicKey
+                || body.authority.proof_public_key !== pending.applicationSigningPublicKey) {
+                if (pending.keyHandle)
+                    await this.keyStore.delete(pending.keyHandle);
+                this.storage.removeItem(pendingKey);
+                throw connectError("invalid_token_response", "Authorization returned a remote authority capability bound to another application key.");
+            }
+        }
+        else if (body.authority && pending.keyHandle) {
+            await this.keyStore.delete(pending.keyHandle);
+        }
+        const token = this.storeTokenResponse(body, pending.clientId, body.authority?.proof_public_key ? pending.keyHandle : body.authority ? undefined : pending.keyHandle);
+        if (pending.collectionId && pending.collectionId !== token.collectionId) {
+            this.removeToken(token.collectionId, token.keyHandle);
+            this.storage.removeItem(pendingKey);
+            throw connectError("collection_mismatch", "The approved collection does not match the collection requested by this link.");
+        }
+        this.storage.removeItem(pendingKey);
+        return {
+            connection: this.connection(token.collectionId),
+            ...(pending.returnTo ? { returnTo: pending.returnTo } : {})
+        };
+    }
+    connections() {
+        const connections = [];
+        for (const collectionId of connectionIds(this.storage, this.storagePrefix())) {
+            const info = this.connection(collectionId)?.info();
+            if (info)
+                connections.push(info);
+        }
+        return connections.sort((left, right) => left.displayName.localeCompare(right.displayName) || left.collectionId.localeCompare(right.collectionId));
+    }
+    connection(collectionId) {
+        if (!this.storage.getItem(this.tokenKey(collectionId)))
+            return null;
+        let connection = this.connectionCache.get(collectionId);
+        if (!connection) {
+            connection = new MdbaseConnection(this, collectionId);
+            this.connectionCache.set(collectionId, connection);
+        }
+        return connection.info() ? connection : null;
+    }
+    unavailableReason(collectionId) {
+        return this.invalidatedConnections.get(collectionId) ?? null;
+    }
+    connectionApplicationId(collectionId) {
+        // Null deliberately means the application must reauthorize.
+        if (!this.connection(collectionId))
+            return null;
+        const token = parseStored(this.storage.getItem(this.tokenKey(collectionId)));
+        return typeof token?.clientId === "string" && token.clientId.length > 0 ? token.clientId : null;
+    }
+    onConnectionsChange(listener) {
+        this.listeners.add(listener);
+        listener(this.connections());
+        return () => this.listeners.delete(listener);
+    }
+    storeTokenResponse(body, clientId, keyHandle) {
+        const collectionId = body.collection_id;
+        if (typeof collectionId !== "string") {
+            throw connectError("invalid_token_response", "Authorization returned no collection ID.");
+        }
+        const previous = parseStored(this.storage.getItem(this.tokenKey(collectionId)));
+        const retirement = planRetiredGrantKeys(this.storage, this.pendingMutationKey(collectionId), previous, keyHandle, this.grantKeyLeases.handles(collectionId), this.grantKeyLeases.retainAutomaticallyRetiredKeys);
+        let token;
+        try {
+            token = storedTokenFromResponse({
+                body,
+                clientId,
+                keyHandle,
+                previous,
+                retiredKeyHandles: retirement.retained,
+                defaultApplicationOrigin: this.defaultApplicationOrigin(),
+                pinConnectorIdentity: (connectorId, publicKey) => this.pinConnectorIdentity(connectorId, publicKey)
+            });
+        }
+        catch (error) {
+            if (error instanceof MdbaseConnectError
+                && error.code === "legacy_scope_reauthorization_required") {
+                this.removeToken(collectionId, keyHandle, error.code);
+            }
+            throw error;
+        }
+        this.storage.setItem(this.tokenKey(collectionId), JSON.stringify(token));
+        for (const handle of retirement.disposable)
+            this.deleteGrantKeyWhenUnused(collectionId, handle);
+        addConnectionId(this.storage, this.storagePrefix(), collectionId);
+        this.invalidatedConnections.delete(collectionId);
+        this.connectionCache.delete(collectionId);
+        this.emitConnections();
+        return token;
+    }
+    forgetConnectorIdentity(connectorId) {
+        this.storage.removeItem(this.connectorPinKey(connectorId));
+    }
+    pinConnectorIdentity(connectorId, publicKey) {
+        const key = this.connectorPinKey(connectorId);
+        const previous = parseStored(this.storage.getItem(key));
+        if (previous && (previous.version !== 1 || previous.publicKey !== publicKey)) {
+            throw connectError("connector_identity_changed", "The connector identity changed since this application first connected. Forget the saved connector identity only after verifying the computer, then authorize again.");
+        }
+        if (!previous)
+            this.storage.setItem(key, JSON.stringify({ version: 1, publicKey }));
+    }
+    connectorPinKey(connectorId) {
+        return `mdbase-connect:${this.serverUrl}:connector-pin:${connectorId}`;
+    }
+    async loadApplicationIdentity(application) {
+        try {
+            return await applicationIdentity(this.identityStore, this.serverUrl, application);
+        }
+        catch (cause) {
+            throw connectError("application_identity_unavailable", cause instanceof ApplicationIdentityStoreError
+                ? cause.message
+                : "The application installation identity is unavailable.", { cause });
+        }
+    }
+    removeToken(collectionId, keyHandle, reason = "authorization_lost", discardPending = false) {
+        this.invalidatedConnections.set(collectionId, reason);
+        const stored = parseStored(this.storage.getItem(this.tokenKey(collectionId)));
+        const handles = storedTokenKeyHandles(stored, keyHandle);
+        this.storage.removeItem(this.tokenKey(collectionId));
+        if (discardPending)
+            removePendingMutations(this.storage, this.pendingMutationKey(collectionId), (pendingKeyHandle) => handles.add(pendingKeyHandle));
+        for (const handle of handles)
+            this.deleteGrantKeyWhenUnused(collectionId, handle);
+        for (const transport of ["web_push", "fcm"]) {
+            this.storage.removeItem(this.notificationKey(collectionId, transport));
+        }
+        removeConnectionId(this.storage, this.storagePrefix(), collectionId);
+        this.connectionCache.delete(collectionId);
+        this.emitConnections();
+    }
+    acquireGrantKeyLease(collectionId, keyHandle, signal) {
+        return this.grantKeyLeases.acquire(collectionId, keyHandle, signal);
+    }
+    deleteGrantKeyWhenUnused(collectionId, keyHandle) {
+        this.grantKeyLeases.deleteExclusive(collectionId, keyHandle, () => deleteUnusedGrantKey(this.storage, this.keyStore, this.pendingMutationKey(collectionId), this.tokenKey(collectionId), keyHandle));
+    }
+    tokenKey(collectionId) {
+        return `${this.storagePrefix()}:token:${collectionId}`;
+    }
+    pendingMutationKey(collectionId) {
+        return `${this.storagePrefix()}:pending-mutation:${collectionId}`;
+    }
+    notificationKey(collectionId, transport = "web_push") {
+        return `${this.storagePrefix()}:notifications:${collectionId}:${transport}`;
+    }
+    directPreferenceKey() {
+        return `mdbase-connect:direct:${this.defaultApplicationOrigin()}`;
+    }
+    defaultApplicationOrigin() {
+        return applicationStorageOrigin(this.manifest, this.manifestSource, this.redirectUri, this.application?.distribution === "portable");
+    }
+    pendingKey(state) {
+        return `${this.storagePrefix()}:pending:${state}`;
+    }
+    storagePrefix() {
+        return `mdbase-connect:${this.serverUrl}:${this.manifestSource}`;
+    }
+    emitConnections() {
+        const connections = this.connections();
+        for (const listener of this.listeners)
+            listener(connections);
+    }
+}