@mdbase-dev/connect 0.1.0-beta.100

package/dist/connection.js

@@ -0,0 +1,606 @@
+import { capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
+import { retainedCapabilities, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
+import { MdbaseCollectionClient } from "./collection-client.js";
+import { ConnectionNotifications } from "./connection-notifications.js";
+import { ConnectionTransport } from "./connection-transport.js";
+import { MdbaseConnectError, connectProblem, operationProblem } from "./errors.js";
+import { MdbaseFileClient } from "./files.js";
+import { DEFAULT_OPERATIONS } from "./internal-types.js";
+import { assertDeletePreview, assertRenamePreview, deleteEstimate, isCancellation, renameEstimate, throwIfCancelled, uniqueOperations } from "./operation-helpers.js";
+import { AUTHORIZATION_PROBLEM_CODES, COLLECTION_CHANGES_PROBLEM_CODES, COLLECTION_MUTATION_PROBLEM_CODES, DIRECT_ACCESS_PROBLEM_CODES, NOTIFICATION_PROBLEM_CODES, REGISTRATION_PROBLEM_CODES, captureConnectOutcome, connectFailure, connectSuccess } from "./outcomes.js";
+import { withCooperativeRequestBudget, withRequestBudget } from "./request-budget.js";
+import { CollectionRequestCoordinator } from "./request-coordinator.js";
+export class MdbaseConnection {
+    internals;
+    collectionId;
+    collectionClient;
+    notifications;
+    transport;
+    files;
+    connectionListeners = new Set();
+    constructor(internals, collectionId) {
+        this.internals = internals;
+        this.collectionId = collectionId;
+        this.transport = new ConnectionTransport({
+            serverUrl: internals.serverUrl,
+            storage: internals.storage,
+            keyStore: internals.keyStore,
+            directAccessMode: internals.directAccessMode,
+            loopbackUrl: internals.loopbackUrl,
+            collectionId,
+            internals,
+            timeouts: internals.timeouts,
+            onChange: () => this.emitConnection()
+        });
+        this.files = new MdbaseFileClient(() => this.fileCapability, (method, path, input, signal) => this.transport.files.control(method, path, input, signal), {
+            uploadChunk: (session, chunkIndex, bytes, signal) => this.transport.files.uploadChunk(session, chunkIndex, bytes, signal),
+            downloadChunk: (session, chunkIndex, signal) => this.transport.files.downloadChunk(session, chunkIndex, signal)
+        }, {
+            downloadPart: (session, partIndex, expectedLength, signal) => this.transport.files.downloadHostedPart(session, partIndex, expectedLength, signal)
+        }, internals.timeouts);
+        this.collectionClient = new MdbaseCollectionClient(new CollectionRequestCoordinator({
+            operation: (operation, input, requestOptions) => this.transport.performOperation(operation, input, requestOptions)
+        }, internals.timeouts.requestMs), internals.timeouts.requestMs);
+        this.notifications = new ConnectionNotifications({
+            serverUrl: internals.serverUrl,
+            storage: internals.storage,
+            authorizedToken: (signal) => this.transport.authorizedToken({ signal, timeoutMs: null }),
+            register: (signal) => this.internals.register({ signal, timeoutMs: null }),
+            notificationKey: (transport) => internals.notificationKey(collectionId, transport),
+            requestTimeoutMs: internals.timeouts.requestMs
+        });
+    }
+    get displayName() {
+        return this.transport.currentToken()?.collectionName
+            ?? `Collection ${this.collectionId.slice(0, 8)}`;
+    }
+    get operations() {
+        return [...(this.transport.currentToken()?.operations ?? [])];
+    }
+    get scope() {
+        return this.transport.currentToken()?.scope ?? null;
+    }
+    get fileCapability() {
+        return this.transport.currentToken()?.fileCapability ?? null;
+    }
+    get directAccess() {
+        return this.transport.directAccess;
+    }
+    get route() {
+        return this.transport.route;
+    }
+    register(options) {
+        return captureConnectOutcome(() => this.internals.register(options), REGISTRATION_PROBLEM_CODES);
+    }
+    info() {
+        const token = this.transport.currentToken();
+        return token ? {
+            collectionId: token.collectionId,
+            displayName: token.collectionName,
+            operations: [...token.operations],
+            scope: token.scope,
+            ...(token.fileCapability ? { fileCapability: token.fileCapability } : {}),
+            authority: token.authority
+                ? { kind: "hosted", durability: "provider" }
+                : { kind: "connector", durability: "computer" },
+            route: this.transport.route,
+            directAccess: this.transport.directAccess
+        } : null;
+    }
+    authorizationCapabilities(requiredOperations = DEFAULT_OPERATIONS) {
+        const grantedOperations = this.operations;
+        const missingOperations = uniqueOperations(requiredOperations)
+            .filter((operation) => !grantedOperations.includes(operation));
+        return {
+            authorized: this.info() !== null,
+            sufficient: this.info() !== null && missingOperations.length === 0,
+            collectionId: this.collectionId,
+            grantedOperations,
+            missingOperations
+        };
+    }
+    hasOperations(requiredOperations) {
+        return this.authorizationCapabilities(requiredOperations).sufficient;
+    }
+    authorize(options = {}) {
+        return captureConnectOutcome(() => this.internals.authorize({
+            ...options,
+            target: { kind: "collection", collectionId: this.collectionId }
+        }), AUTHORIZATION_PROBLEM_CODES);
+    }
+    async requestCapabilities(capabilities, options = {}) {
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, capabilities });
+            const sufficient = this.info() !== null && capabilities.every((capability) => (capabilityOperationsForContractVersion(semanticContractVersion(application.requirements), capability) ?? [])
+                .every((operation) => this.operations.includes(operation)));
+            if (sufficient)
+                return { kind: "unchanged", connection: this };
+            if (semanticContractVersion(application.requirements) === 1) {
+                const { capabilities: _selection, ...legacyOptions } = options;
+                return this.internals.authorize({
+                    ...legacyOptions,
+                    target: { kind: "collection", collectionId: this.collectionId },
+                    operations: [...new Set([...this.operations, ...capabilities.flatMap((id) => capabilityOperationsForContractVersion(1, id) ?? [])])]
+                });
+            }
+            const retained = retainedCapabilities(application.requirements, this.operations);
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                capabilities: [...new Set([...retained, ...capabilities])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
+    }
+    async requestOperations(requiredOperations, options = {}) {
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, operations: requiredOperations });
+            const authorization = this.authorizationCapabilities(requiredOperations);
+            if (authorization.sufficient)
+                return { kind: "unchanged", connection: this };
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                operations: [...new Set([...authorization.grantedOperations, ...requiredOperations])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
+    }
+    onConnectionChange(listener) {
+        this.connectionListeners.add(listener);
+        listener(this.info());
+        return () => this.connectionListeners.delete(listener);
+    }
+    notifyStorageChanged() {
+        this.transport.notifyStorageChanged();
+    }
+    checkDirectAccess(options) {
+        return captureConnectOutcome(() => this.transport.checkDirectAccess(options), DIRECT_ACCESS_PROBLEM_CODES);
+    }
+    /** Call from a user gesture to request browser permission for direct local access. */
+    requestDirectAccess(options) {
+        return captureConnectOutcome(() => this.transport.requestDirectAccess(options), DIRECT_ACCESS_PROBLEM_CODES);
+    }
+    disableDirectAccess() {
+        this.transport.disableDirectAccess();
+    }
+    /**
+     * Return one offline-replication transport regardless of whether the
+     * authority is remote, directly connected, or relay connected.
+     * Authority credentials and routing stay private inside the SDK.
+     */
+    sync() {
+        const token = this.transport.currentToken();
+        if (!token)
+            return null;
+        const collectionId = token.collectionId;
+        if (!token.authority) {
+            if (!token.grantId || !token.operations.includes("sync"))
+                return null;
+            const replicaId = token.grantId;
+            return {
+                collectionId,
+                replicaId,
+                transport: {
+                    openSession: (options) => this.transport.performOperation("sync", { action: "open_session" }, syncRequestOptions(options, this.internals.timeouts.syncMs)),
+                    snapshot: (snapshotId, page, options) => this.transport.performOperation("sync", {
+                        action: "snapshot",
+                        snapshot_id: snapshotId,
+                        ...(page ? { page } : {})
+                    }, syncRequestOptions(options, this.internals.timeouts.syncMs)),
+                    changes: (after, limit = 200, options) => this.transport.performOperation("sync", {
+                        action: "changes",
+                        after,
+                        limit
+                    }, syncRequestOptions(options, this.internals.timeouts.syncMs)),
+                    mutate: (mutation, options) => this.transport.performOperation("sync", {
+                        action: "mutate",
+                        mutation
+                    }, syncRequestOptions(options, this.internals.timeouts.syncMs))
+                }
+            };
+        }
+        const replicaId = token.authority.replicaId;
+        return {
+            collectionId,
+            replicaId,
+            transport: {
+                openSession: (options) => this.transport.performAuthoritySyncRequest(collectionId, replicaId, "POST", "sessions", undefined, options),
+                snapshot: (snapshotId, page, options) => {
+                    const query = new URLSearchParams({ snapshot_id: snapshotId });
+                    if (page)
+                        query.set("page", page);
+                    return this.transport.performAuthoritySyncRequest(collectionId, replicaId, "GET", `snapshot?${query}`, undefined, options);
+                },
+                changes: (after, limit = 200, options) => this.transport.performAuthoritySyncRequest(collectionId, replicaId, "GET", `changes?${new URLSearchParams({ after: String(after), limit: String(limit) })}`, undefined, options),
+                mutate: (mutation, options) => this.transport.performAuthoritySyncRequest(collectionId, replicaId, "POST", "mutations", mutation, options)
+            }
+        };
+    }
+    /**
+     * Register this browser installation for manifest-declared Web Push.
+     *
+     * Criteria are evaluated by the collection authority. Push payloads contain
+     * only an opaque cursor and static presentation copy.
+     */
+    registerNotifications(options) {
+        return captureConnectOutcome(() => this.notifications.registerNotifications(options), NOTIFICATION_PROBLEM_CODES);
+    }
+    registerNativeNotifications(options) {
+        return captureConnectOutcome(() => this.notifications.registerNativeNotifications(options), NOTIFICATION_PROBLEM_CODES);
+    }
+    unregisterNativeNotifications(options) {
+        return captureConnectOutcome(() => this.notifications.unregisterNativeNotifications(options), NOTIFICATION_PROBLEM_CODES);
+    }
+    unregisterNotifications(serviceWorker, options) {
+        return captureConnectOutcome(() => this.notifications.unregisterNotifications(serviceWorker, options), NOTIFICATION_PROBLEM_CODES);
+    }
+    forget() {
+        const token = this.transport.currentToken();
+        this.internals.removeToken(this.collectionId, token?.keyHandle, "not_authorized", true);
+        this.transport.notifyStorageChanged();
+    }
+    describe(options) {
+        return this.collectionClient.describe(options);
+    }
+    changes(input = {}, options) {
+        return this.collectionClient.changes(input, options);
+    }
+    read(input, options) {
+        return this.collectionClient.read(input, options);
+    }
+    query(input = {}, options) {
+        return this.collectionClient.query(input, options);
+    }
+    queryPages(input = {}, options = {}) {
+        return this.collectionClient.queryPages(input, options);
+    }
+    queryAll(input = {}, options = {}) {
+        return this.collectionClient.queryAll(input, options);
+    }
+    listViews(options) {
+        return this.collectionClient.listViews(options);
+    }
+    executeView(input, options) {
+        return this.collectionClient.executeView(input, options);
+    }
+    executeViewPages(input, options = {}) {
+        return this.collectionClient.executeViewPages(input, options);
+    }
+    readViewSource(input, options) {
+        return this.collectionClient.readViewSource(input, options);
+    }
+    createViewSource(input, options) {
+        return this.collectionClient.createViewSource(input, options);
+    }
+    updateViewSource(input, options) {
+        return this.collectionClient.updateViewSource(input, options);
+    }
+    deleteViewSource(input, options) {
+        return this.collectionClient.deleteViewSource(input, options);
+    }
+    create(input, options) {
+        return this.collectionClient.create(input, options);
+    }
+    update(input, options) {
+        return this.collectionClient.update(input, options);
+    }
+    delete(input, options) {
+        return this.collectionClient.delete(input, options);
+    }
+    preflightDelete(input, options) {
+        return this.collectionClient.preflightDelete(input, options);
+    }
+    rename(input, options) {
+        return this.collectionClient.rename(input, options);
+    }
+    preflightRename(input, options) {
+        return this.collectionClient.preflightRename(input, options);
+    }
+    async renameWithProgress(input, options = {}) {
+        return withCooperativeRequestBudget(options, this.internals.timeouts.requestMs, async (budget) => {
+            const started = Date.now();
+            const resumed = false;
+            let estimate;
+            const emit = (state, cancellable, completedUnits = 0) => {
+                options.onProgress?.({
+                    operation: "rename",
+                    state,
+                    elapsedMs: Date.now() - started,
+                    cancellable,
+                    resumed,
+                    completedUnits,
+                    ...(estimate ? { estimate } : {})
+                });
+            };
+            try {
+                throwIfCancelled(budget.signal);
+                emit("preflighting", true);
+                const previewOutcome = options.preflight
+                    ? connectSuccess(options.preflight)
+                    : await this.preflightRename(input, { signal: budget.signal, timeoutMs: null });
+                if (!previewOutcome.ok)
+                    return previewOutcome;
+                const preview = previewOutcome.value;
+                try {
+                    assertRenamePreview(input, preview);
+                }
+                catch (error) {
+                    if (error instanceof MdbaseConnectError) {
+                        return connectFailure(error.problem);
+                    }
+                    throw error;
+                }
+                estimate = renameEstimate(input, preview);
+                emit("ready", true);
+                throwIfCancelled(budget.signal);
+                const cancellable = this.transport.hasResumableMutationTransport();
+                emit("applying", cancellable);
+                const result = await this.rename(input, cancellable
+                    ? { signal: budget.signal, timeoutMs: null }
+                    : { timeoutMs: remainingTimeout(budget.remainingMs()) });
+                if (result.ok)
+                    emit("completed", false, estimate.totalUnits);
+                return result;
+            }
+            catch (error) {
+                if (isCancellation(error, budget.signal))
+                    emit("cancelled", false);
+                if (error instanceof MdbaseConnectError) {
+                    return connectFailure(error.problem);
+                }
+                throw error;
+            }
+        });
+    }
+    async deleteWithProgress(input, options = {}) {
+        return withCooperativeRequestBudget(options, this.internals.timeouts.requestMs, async (budget) => {
+            const started = Date.now();
+            const resumed = false;
+            let estimate;
+            const emit = (state, cancellable, completedUnits = 0) => {
+                options.onProgress?.({
+                    operation: "delete",
+                    state,
+                    elapsedMs: Date.now() - started,
+                    cancellable,
+                    resumed,
+                    completedUnits,
+                    ...(estimate ? { estimate } : {})
+                });
+            };
+            try {
+                throwIfCancelled(budget.signal);
+                emit("preflighting", true);
+                const previewOutcome = options.preflight
+                    ? connectSuccess(options.preflight)
+                    : await this.preflightDelete(input, { signal: budget.signal, timeoutMs: null });
+                if (!previewOutcome.ok)
+                    return previewOutcome;
+                const preview = previewOutcome.value;
+                try {
+                    assertDeletePreview(input, preview);
+                }
+                catch (error) {
+                    if (error instanceof MdbaseConnectError) {
+                        return connectFailure(error.problem);
+                    }
+                    throw error;
+                }
+                estimate = deleteEstimate(preview);
+                emit("ready", true);
+                throwIfCancelled(budget.signal);
+                const cancellable = this.transport.hasResumableMutationTransport();
+                emit("applying", cancellable);
+                const result = await this.delete(input, cancellable
+                    ? { signal: budget.signal, timeoutMs: null }
+                    : { timeoutMs: remainingTimeout(budget.remainingMs()) });
+                if (result.ok)
+                    emit("completed", false, estimate.totalUnits);
+                return result;
+            }
+            catch (error) {
+                if (isCancellation(error, budget.signal))
+                    emit("cancelled", false);
+                if (error instanceof MdbaseConnectError) {
+                    return connectFailure(error.problem);
+                }
+                throw error;
+            }
+        });
+    }
+    pendingMutations() {
+        return this.transport.pendingMutations().map((summary) => ({
+            ...summary,
+            recover: (options) => captureConnectOutcome(() => this.recoverPendingMutation(summary.requestId, options), COLLECTION_MUTATION_PROBLEM_CODES)
+        }));
+    }
+    pendingMutation(requestId) {
+        const summary = this.transport.pendingMutation(requestId);
+        if (!summary)
+            return null;
+        return {
+            ...summary,
+            recover: (options) => captureConnectOutcome(() => this.recoverPendingMutation(requestId, options), COLLECTION_MUTATION_PROBLEM_CODES)
+        };
+    }
+    async recoverPendingMutation(requestId, options) {
+        const result = await this.transport.recoverPendingMutation(requestId, options);
+        if (result && typeof result === "object" && "valid" in result) {
+            const envelope = result;
+            if (!envelope.valid)
+                throw new MdbaseConnectError(operationProblem(envelope));
+            return envelope.result;
+        }
+        return result;
+    }
+    validate(input = {}, options) {
+        return this.collectionClient.validate(input, options);
+    }
+    readType(input, options) {
+        return this.collectionClient.readType(input, options);
+    }
+    createType(input, options) {
+        return this.collectionClient.createType(input, options);
+    }
+    updateType(input, options) {
+        return this.collectionClient.updateType(input, options);
+    }
+    assessTypePack(input, options) {
+        return this.collectionClient.assessTypePack(input, options);
+    }
+    applyTypePack(input, options) {
+        return this.collectionClient.applyTypePack(input, options);
+    }
+    assessCollectionSetup(input, options) {
+        return this.collectionClient.assessCollectionSetup(input, options);
+    }
+    applyCollectionSetup(input, options) {
+        return this.collectionClient.applyCollectionSetup(input, options);
+    }
+    listTimers(namespace, options) {
+        return this.collectionClient.listTimers(namespace, options);
+    }
+    putTimer(input, options) {
+        return this.collectionClient.putTimer(input, options);
+    }
+    cancelTimer(input, options) {
+        return this.collectionClient.cancelTimer(input, options);
+    }
+    reconcileTimers(input, options) {
+        return this.collectionClient.reconcileTimers(input, options);
+    }
+    watch(input = {}, options = {}) {
+        return captureConnectOutcome(() => withRequestBudget(options, this.internals.timeouts.watchStartMs, async (budget) => {
+            const initial = await this.collectionClient.changes(input.cursor === undefined ? {} : { after: input.cursor, limit: 200 }, { signal: budget.signal, timeoutMs: null });
+            if (!initial.ok)
+                throw new MdbaseConnectError(initial.problem);
+            if (initial.value.reset) {
+                throw new MdbaseConnectError(connectProblem("change_cursor_reset", "The collection change cursor expired. Refresh collection state before subscribing again."));
+            }
+            return new CollectionWatchSubscription(this.collectionClient, initial.value.cursor, input, input.cursor === undefined ? [] : initial.value.events, this.internals.timeouts.watchStartMs);
+        }), COLLECTION_CHANGES_PROBLEM_CODES);
+    }
+    emitConnection() {
+        const connection = this.info();
+        for (const listener of this.connectionListeners)
+            listener(connection);
+    }
+}
+class CollectionWatchSubscription {
+    client;
+    input;
+    watchStartTimeoutMs;
+    changes = new Set();
+    statuses = new Set();
+    problems = new Set();
+    controller = new AbortController();
+    removeLifetimeAbort;
+    currentStatus;
+    currentProblem = null;
+    pendingChanges;
+    constructor(client, cursor, input, pendingChanges, watchStartTimeoutMs) {
+        this.client = client;
+        this.input = input;
+        this.watchStartTimeoutMs = watchStartTimeoutMs;
+        this.pendingChanges = [...pendingChanges];
+        this.currentStatus = { state: "connected", cursor, recovered: false };
+        const lifetimeSignal = input.lifetimeSignal;
+        if (lifetimeSignal?.aborted)
+            this.close();
+        else if (lifetimeSignal) {
+            const close = () => this.close();
+            lifetimeSignal.addEventListener("abort", close, { once: true });
+            this.removeLifetimeAbort = () => lifetimeSignal.removeEventListener("abort", close);
+        }
+        if (!this.controller.signal.aborted)
+            void this.run(cursor);
+    }
+    get status() {
+        return this.currentStatus;
+    }
+    get problem() {
+        return this.currentProblem;
+    }
+    subscribe(listener, onStatus, onProblem) {
+        this.changes.add(listener);
+        if (onStatus) {
+            this.statuses.add(onStatus);
+            onStatus(this.currentStatus);
+        }
+        if (onProblem) {
+            this.problems.add(onProblem);
+            if (this.currentProblem)
+                onProblem(this.currentProblem);
+        }
+        for (const change of this.pendingChanges)
+            listener(change);
+        this.pendingChanges = [];
+        return () => {
+            this.changes.delete(listener);
+            if (onStatus)
+                this.statuses.delete(onStatus);
+            if (onProblem)
+                this.problems.delete(onProblem);
+        };
+    }
+    close() {
+        if (this.controller.signal.aborted)
+            return;
+        this.controller.abort();
+        this.removeLifetimeAbort?.();
+        this.removeLifetimeAbort = undefined;
+        const cursor = "cursor" in this.currentStatus ? this.currentStatus.cursor : undefined;
+        this.publishStatus({ state: "closed", ...(cursor === undefined ? {} : { cursor }) });
+    }
+    async run(cursor) {
+        let firstStatus = true;
+        const iterator = this.client.watch({
+            cursor,
+            pollIntervalMs: this.input.pollIntervalMs,
+            retry: this.input.retry,
+            signal: this.controller.signal,
+            timeoutMs: this.watchStartTimeoutMs,
+            onStatus: (status) => {
+                if (firstStatus && status.state === "connecting") {
+                    firstStatus = false;
+                    return;
+                }
+                firstStatus = false;
+                this.publishStatus(status);
+            }
+        });
+        try {
+            for await (const outcome of iterator) {
+                if (this.controller.signal.aborted)
+                    return;
+                if (!outcome.ok) {
+                    this.currentProblem = outcome.problem;
+                    for (const listener of this.problems)
+                        listener(outcome.problem);
+                    return;
+                }
+                for (const listener of this.changes)
+                    listener(outcome.value);
+            }
+        }
+        finally {
+            if (!this.controller.signal.aborted)
+                this.close();
+        }
+    }
+    publishStatus(status) {
+        this.currentStatus = status;
+        for (const listener of this.statuses)
+            listener(status);
+    }
+}
+function syncRequestOptions(options, defaultTimeoutMs) {
+    return {
+        ...options,
+        timeoutMs: options?.timeoutMs === undefined ? defaultTimeoutMs : options.timeoutMs
+    };
+}
+function remainingTimeout(remainingMs) {
+    return remainingMs === null ? null : Math.max(1, Math.ceil(remainingMs));
+}

package/dist/crypto-entry.d.ts

@@ -0,0 +1,7 @@
+/** Opt-in cryptographic storage and transport primitives. */
+export { IndexedDbGrantKeyStore, MemoryGrantKeyStore, RelayCryptoError, signAuthorityRequest, authorityProofMessage, encryptRelayRequest, decryptRelayResponse, deriveP256SharedSecret, validateGrantEncryption } from "./crypto.js";
+export type { GrantKeyRecord, GrantKeyStore, RelayBinding, AuthorityProofInput } from "./crypto.js";
+export { FileTransferCryptoError, GrantFileTransferCipher, deriveFileTransferKey } from "./file-crypto.js";
+export type { FileTransferBinding } from "./file-crypto.js";
+export { IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, ApplicationIdentityStoreError, applicationInstallationId, signApplicationAuthorization, applicationIdentity } from "./application-identity.js";
+export type { ApplicationIdentity, ApplicationIdentityStore } from "./application-identity.js";

package/dist/crypto-entry.js

@@ -0,0 +1,4 @@
+/** Opt-in cryptographic storage and transport primitives. */
+export { IndexedDbGrantKeyStore, MemoryGrantKeyStore, RelayCryptoError, signAuthorityRequest, authorityProofMessage, encryptRelayRequest, decryptRelayResponse, deriveP256SharedSecret, validateGrantEncryption } from "./crypto.js";
+export { FileTransferCryptoError, GrantFileTransferCipher, deriveFileTransferKey } from "./file-crypto.js";
+export { IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, ApplicationIdentityStoreError, applicationInstallationId, signApplicationAuthorization, applicationIdentity } from "./application-identity.js";

package/dist/crypto.d.ts

@@ -0,0 +1,63 @@
+import { type ConnectProblem, type EncryptedRelayOperation, type EncryptedRelayOperationRequest, type EncryptedRelayOperationResponse, type GrantEncryption } from "@mdbase-dev/connect-protocol";
+export interface GrantKeyRecord {
+    handle: string;
+    agreementPrivateKey: CryptoKey;
+    agreementPublicKey: string;
+    signingPrivateKey: CryptoKey;
+    signingPublicKey: string;
+}
+export interface GrantKeyStore {
+    create(handle: string): Promise<GrantKeyRecord>;
+    get(handle: string): Promise<GrantKeyRecord | null>;
+    nextCounter(handle: string): Promise<string>;
+    delete(handle: string): Promise<void>;
+}
+/** Origin-scoped storage for non-extractable grant keys and atomic counters. */
+export declare class IndexedDbGrantKeyStore implements GrantKeyStore {
+    private database;
+    create(handle: string): Promise<GrantKeyRecord>;
+    get(handle: string): Promise<GrantKeyRecord | null>;
+    nextCounter(handle: string): Promise<string>;
+    delete(handle: string): Promise<void>;
+    private open;
+}
+/** Deterministic process-local storage for tests, CLIs, and non-browser adapters. */
+export declare class MemoryGrantKeyStore implements GrantKeyStore {
+    private readonly records;
+    private sequence;
+    create(handle: string): Promise<GrantKeyRecord>;
+    get(handle: string): Promise<GrantKeyRecord | null>;
+    nextCounter(handle: string): Promise<string>;
+    delete(handle: string): Promise<void>;
+}
+export interface RelayBinding {
+    grantId: string;
+    applicationId: string;
+    encryption: GrantEncryption;
+}
+export interface AuthorityProofInput {
+    method: string;
+    target: string;
+    body?: string;
+    credential: string;
+    timestamp?: number;
+    nonce?: string;
+}
+/** Sign one remote-authority or token-refresh request with the approved grant key. */
+export declare function signAuthorityRequest(store: GrantKeyStore, handle: string, expectedPublicKey: string, input: AuthorityProofInput): Promise<Record<string, string>>;
+export declare function authorityProofMessage(input: Required<Pick<AuthorityProofInput, "method" | "target" | "credential" | "timestamp" | "nonce">> & Pick<AuthorityProofInput, "body">): Promise<string>;
+export declare function encryptRelayRequest(store: GrantKeyStore, handle: string, binding: RelayBinding, operation: EncryptedRelayOperation, input: unknown, requestId?: string, deadlineUnixMs?: number): Promise<EncryptedRelayOperationRequest>;
+export declare function decryptRelayResponse<Result>(store: GrantKeyStore, handle: string, binding: RelayBinding, request: EncryptedRelayOperationRequest, response: EncryptedRelayOperationResponse): Promise<{
+    ok: true;
+    result: Result;
+} | {
+    ok: false;
+    problem: ConnectProblem;
+}>;
+export declare class RelayCryptoError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** @internal Shared ECDH primitive used by the independently keyed file data plane. */
+export declare function deriveP256SharedSecret(privateKey: CryptoKey, peerPublicKey: string): Promise<ArrayBuffer>;
+export declare function validateGrantEncryption(encryption: GrantEncryption): void;