@mdbase-dev/connect 0.1.0-beta.100

package/dist/grant-key-leases.js

@@ -0,0 +1,144 @@
+export class GrantKeyLeaseRegistry {
+    namespace;
+    onFinalRelease;
+    leases = new Map();
+    locks = webLockManager();
+    retainAutomaticallyRetiredKeys = this.locks === null;
+    constructor(namespace, onFinalRelease) {
+        this.namespace = namespace;
+        this.onFinalRelease = onFinalRelease;
+    }
+    async acquire(collectionId, keyHandle, signal) {
+        const releaseLocal = this.acquireLocal(collectionId, keyHandle);
+        if (!this.locks)
+            return releaseLocal;
+        try {
+            const releaseWeb = await acquireSharedWebLock(this.locks, this.lockName(collectionId, keyHandle), signal);
+            return once(() => {
+                releaseWeb();
+                releaseLocal();
+            });
+        }
+        catch (error) {
+            releaseLocal();
+            throw error;
+        }
+    }
+    deleteExclusive(collectionId, keyHandle, action) {
+        if (this.retainAutomaticallyRetiredKeys)
+            return;
+        if (this.locks) {
+            void this.locks.request(this.lockName(collectionId, keyHandle), { mode: "exclusive" }, action).catch(() => undefined);
+        }
+        else if (!this.has(collectionId, keyHandle)) {
+            void Promise.resolve().then(action).catch(() => undefined);
+        }
+    }
+    has(collectionId, keyHandle) {
+        return this.leases.get(collectionId)?.has(keyHandle) ?? false;
+    }
+    handles(collectionId) {
+        return this.leases.get(collectionId)?.keys() ?? [];
+    }
+    acquireLocal(collectionId, keyHandle) {
+        const collection = this.leases.get(collectionId) ?? new Map();
+        collection.set(keyHandle, (collection.get(keyHandle) ?? 0) + 1);
+        this.leases.set(collectionId, collection);
+        return once(() => {
+            const remaining = (collection.get(keyHandle) ?? 1) - 1;
+            if (remaining > 0)
+                collection.set(keyHandle, remaining);
+            else {
+                collection.delete(keyHandle);
+                if (collection.size === 0)
+                    this.leases.delete(collectionId);
+                this.onFinalRelease(collectionId, keyHandle);
+            }
+        });
+    }
+    lockName(collectionId, keyHandle) {
+        return `mdbase-connect:grant-key:${this.namespace}:${collectionId}:${keyHandle}`;
+    }
+}
+export class GrantKeyLeaseSet {
+    collectionId;
+    acquire;
+    releases = new Map();
+    constructor(collectionId, acquire) {
+        this.collectionId = collectionId;
+        this.acquire = acquire;
+    }
+    async retain(tokenOrHandle, signal) {
+        const handle = typeof tokenOrHandle === "string" ? tokenOrHandle : tokenOrHandle?.keyHandle;
+        if (!handle)
+            return;
+        let lease = this.releases.get(handle);
+        if (!lease) {
+            lease = this.acquire(this.collectionId, handle, signal);
+            this.releases.set(handle, lease);
+        }
+        try {
+            await lease;
+        }
+        catch (error) {
+            if (this.releases.get(handle) === lease)
+                this.releases.delete(handle);
+            this.release();
+            throw error;
+        }
+    }
+    release() {
+        for (const lease of this.releases.values())
+            void lease.then((release) => release());
+        this.releases.clear();
+    }
+}
+export async function retainCurrentGrantToken(readCurrent, leases, signal) {
+    while (true) {
+        const snapshot = readCurrent();
+        if (!snapshot)
+            return null;
+        await leases.retain(snapshot, signal);
+        const current = readCurrent();
+        if (!current)
+            return null;
+        if (current.keyHandle === snapshot.keyHandle)
+            return current;
+    }
+}
+function webLockManager() {
+    const locks = typeof navigator === "undefined"
+        ? undefined
+        : navigator.locks;
+    if (locks)
+        return locks;
+    const browser = typeof window !== "undefined"
+        || typeof globalThis.importScripts === "function";
+    return browser ? null : undefined;
+}
+async function acquireSharedWebLock(locks, name, signal) {
+    let acquired;
+    let rejectAcquisition;
+    let release;
+    const ready = new Promise((resolve, reject) => {
+        acquired = resolve;
+        rejectAcquisition = reject;
+    });
+    const held = new Promise((resolve) => { release = resolve; });
+    const request = locks.request(name, { mode: "shared", ...(signal ? { signal } : {}) }, async () => {
+        acquired();
+        await held;
+    });
+    void request.catch(rejectAcquisition);
+    await ready;
+    return once(release);
+}
+function once(action) {
+    let called = false;
+    return () => {
+        if (called)
+            return;
+        called = true;
+        action();
+    };
+}

package/dist/hosted-file-request.d.ts

@@ -0,0 +1,6 @@
+import type { StoredToken } from "./internal-types.js";
+type ProofHeaders = (token: StoredToken, method: "GET" | "POST" | "DELETE", url: string, body: string | undefined, credential: string) => Promise<Record<string, string>>;
+export declare function sendHostedFileRequest(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal: AbortSignal | undefined, proofHeaders: ProofHeaders): Promise<Response>;
+export declare function performHostedFileRequest<Result>(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal: AbortSignal | undefined, refresh: (signal?: AbortSignal) => Promise<StoredToken>, proofHeaders: ProofHeaders, retain?: (token: StoredToken) => Promise<StoredToken>): Promise<Result>;
+export declare function performHostedFilePartRequest(token: StoredToken, path: string, expectedLength: number, signal: AbortSignal | undefined, refresh: (signal?: AbortSignal) => Promise<StoredToken>, proofHeaders: ProofHeaders, retain?: (token: StoredToken) => Promise<StoredToken>): Promise<ReadableStream<Uint8Array>>;
+export {};

package/dist/hosted-file-request.js

@@ -0,0 +1,63 @@
+import { connectError } from "./errors.js";
+import { apiError, decodeJsonResponse } from "./runtime-utils.js";
+export async function sendHostedFileRequest(token, method, path, input, signal, proofHeaders) {
+    if (!token.authority) {
+        throw connectError("not_remote_authority", "This authorization has no remote authority endpoint.");
+    }
+    const suffix = path === "" || path.startsWith("?") ? path : `/${path}`;
+    const url = `${token.authority.filesUrl}${suffix}`;
+    const body = input === undefined ? undefined : JSON.stringify(input);
+    const proof = await proofHeaders(token, method, url, body, token.authority.accessToken);
+    return fetch(url, {
+        method,
+        redirect: "error",
+        headers: {
+            authorization: `Bearer ${token.authority.accessToken}`,
+            ...(body === undefined ? {} : { "content-type": "application/json" }),
+            ...proof
+        },
+        ...(body === undefined ? {} : { body }),
+        ...(signal ? { signal } : {})
+    });
+}
+export async function performHostedFileRequest(token, method, path, input, signal, refresh, proofHeaders, retain = async (token) => token) {
+    let active = token;
+    let response = await sendHostedFileRequest(active, method, path, input, signal, proofHeaders);
+    if (response.status === 401 && active.refreshToken) {
+        active = await retain(await refresh(signal));
+        if (!active.authority || !active.fileCapability) {
+            throw connectError("authority_authorization_changed", "Reconnect this collection before accessing its files.");
+        }
+        response = await sendHostedFileRequest(active, method, path, input, signal, proofHeaders);
+    }
+    const body = await decodeJsonResponse(response, "invalid_operation_response", "The hosted authority returned an invalid file response.");
+    if (!response.ok) {
+        throw apiError(body, "operation_failed", "Collection file request failed.", response.status);
+    }
+    return body;
+}
+export async function performHostedFilePartRequest(token, path, expectedLength, signal, refresh, proofHeaders, retain = async (token) => token) {
+    let active = token;
+    let response = await sendHostedFileRequest(active, "GET", path, undefined, signal, proofHeaders);
+    if (response.status === 401 && active.refreshToken) {
+        active = await retain(await refresh(signal));
+        if (!active.authority || !active.fileCapability) {
+            throw connectError("authority_authorization_changed", "Reconnect this collection before accessing its files.");
+        }
+        response = await sendHostedFileRequest(active, "GET", path, undefined, signal, proofHeaders);
+    }
+    if (!response.ok) {
+        const body = await decodeJsonResponse(response, "invalid_operation_response", "The hosted authority returned an invalid file range error response.");
+        throw apiError(body, "operation_failed", "Collection file range request failed.", response.status);
+    }
+    const contentLength = response.headers.get("content-length");
+    if (contentLength === null || !/^(0|[1-9][0-9]*)$/u.test(contentLength)
+        || Number(contentLength) !== expectedLength) {
+        await response.body?.cancel().catch(() => undefined);
+        throw connectError("invalid_operation_response", "The hosted file response declared an unexpected byte length.");
+    }
+    if (!response.body) {
+        throw connectError("invalid_operation_response", "The hosted file response did not contain a byte stream.");
+    }
+    return response.body;
+}

package/dist/hosted-operation-response.d.ts

@@ -0,0 +1,5 @@
+import { type MdbaseConnectError } from "./errors.js";
+export declare function decodeHostedOperationResponse(response: Response, hosted: boolean): Promise<{
+    body: any;
+    httpError?: MdbaseConnectError;
+}>;

package/dist/hosted-operation-response.js

@@ -0,0 +1,26 @@
+import { connectError, serverConnectError } from "./errors.js";
+import { decodeJsonResponse } from "./runtime-utils.js";
+export async function decodeHostedOperationResponse(response, hosted) {
+    try {
+        return {
+            body: await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned a response that is not valid JSON.")
+        };
+    }
+    catch (cause) {
+        if (!response.ok && hosted && isDefinitiveHostedHttpRejection(response.status)) {
+            return {
+                body: undefined,
+                httpError: serverConnectError("operation_failed", "Collection operation failed.", {
+                    status: response.status,
+                    operationOutcome: "rejected"
+                })
+            };
+        }
+        throw connectError("invalid_operation_response", "The collection authority returned a response that is not valid JSON.", { cause });
+    }
+}
+function isDefinitiveHostedHttpRejection(status) {
+    return status >= 400
+        && status < 500
+        && ![408, 425, 429].includes(status);
+}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+export type { MdbaseDeviceAuthorization } from "./authorization-types.js";
+export { MdbaseApplicationSession, MdbaseMemoryVerificationStore } from "./application-session.js";
+export type { MdbaseApplicationSessionOptions, MdbaseApplicationVerificationStore, MdbaseDefinitionUpdate, MdbaseCollectionSetupUpdate, MdbaseApplicationSessionSnapshot } from "./application-session.js";
+export type { MdbaseConnectOptions, MdbaseConnectTimeouts, MdbaseFrontmatter } from "./connect-options.js";
+export { MdbaseConnect } from "./mdbase-connect.js";
+export { MdbaseConnection } from "./connection.js";
+export type { MdbaseAuthorizationTarget, MdbaseAuthorizeOptions, MdbaseConnectionAuthorizeOptions, MdbaseConnectEnvironment, MdbaseAuthorizationResult, MdbaseAuthorizationOutcome } from "./connection.js";
+export type { MdbaseConnectionRoute, DirectAccessStatus, MdbaseConnectionInfo, MdbaseAuthorizationCapabilities, MdbaseSyncTransport, MdbaseSyncConnection } from "./connection-types.js";
+export { effectiveCapabilities } from "./capabilities.js";
+export type { MdbaseStructuredReadiness } from "./structured-readiness.js";
+export type { MdbaseCapabilityState, MdbaseCapabilityEvidence, MdbaseEffectiveCapability, MdbaseEffectiveCapabilities } from "./capabilities.js";
+export { MdbaseConnectError, isRetryableConnectError } from "./errors.js";
+export type { ConnectErrorContext } from "./errors.js";
+export { MdbaseFileClient } from "./files.js";
+export type { MdbaseFileSource, CollectionFileDescriptor, MdbaseFileDeleteReceipt, MdbaseFileStreamSource, MdbaseFileProgress, MdbaseFileListOptions, MdbaseFileUploadOptions, MdbaseFileStreamUploadOptions, MdbaseFileDownloadOptions, MdbaseFileMoveOptions, MdbaseFileDeleteOptions } from "./files.js";
+export { parseMdbasePushPayload, parseMdbaseNativeNotificationData, showMdbasePushNotification } from "./notifications.js";
+export type { MdbaseNotificationRegistrationOptions, MdbaseNotificationRegistration, MdbaseNativeNotificationRegistrationOptions, MdbaseNativeNotificationRegistration, MdbaseNativeNotificationData, MdbasePushPayload } from "./notifications.js";
+export type { ConnectSuccess, ConnectFailure, ConnectOutcome, CommonOperationProblemCode, RegistrationProblemCode, AuthorizationProblemCode, NotificationProblemCode, DirectAccessProblemCode, SessionProblemCode, CollectionSetupProblemCode, CollectionDescriptionProblemCode, CollectionReadProblemCode, CollectionQueryProblemCode, CollectionMutationProblemCode, CollectionChangesProblemCode, CollectionTypeProblemCode } from "./outcomes.js";
+export type { MdbaseDesiredTimer, MdbaseTimer, MdbaseTimerList, MdbaseTimerReconciliation, ReadInput, DataContractSelector, CollectionFileMetadata, DataContractViewIdentity, QueryRecord, RecordDocument, QueryInput, QueryProjection, QuerySelectionExpression, QueryOrder, QuerySummary, QueryResult, QueryPagesOptions, QueryAllOptions, QueryPage, ConnectRequestOptions, MutationEstimate, MutationProgressState, MutationProgress, MutationProgressOptions, RequestCoordinationOptions, RenameProgressOptions, DeleteProgressOptions, PendingMutationSummary, PendingMutation, CreateInput, UpdateInput, DeleteInput, DeleteResult, DeletePreflightResult, RenameInput, RenameResult, RenamePreflightResult, ReadTypeInput, CreateTypeInput, UpdateTypeInput, ReadViewSourceInput, CreateViewSourceInput, UpdateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, SavedViewPresentation, SavedViewSource, SavedViewProperty, SavedNamedView, SavedViewDocument, SavedViewList, SavedViewSourceDocument, SavedViewExecution, SavedViewPage, SavedViewPagesOptions, ContractSetupChoice, TypePackResourceDiff, TypePackReceipt, TypePackAssessment, TypePackApplyResult, ConfigurationContributionValue, ConfigurationRequirement, ConfigurationProvision, ApplicationCollectionSetupRequirements, ApplicationCollectionSetupProvisions, ConfigurationSetupConflict, ConfigurationSetupAssessment, CollectionSetupAssessment, CollectionSetupReceipt, CollectionSetupApplyResult, AssessTypePackInput, ApplyTypePackInput, AssessCollectionSetupInput, ApplyCollectionSetupInput, ChangesInput, WatchOptions, WatchRetryOptions, WatchStatus, WatchInput, MdbaseWatchSubscription, CollectionChange, CollectionChangesPage, CollectionDescription, CollectionContractDescriptor, CollectionContractImplementationDescriptor, CollectionTypeDescriptor } from "./operation-types.js";
+export { externalStore } from "./external-store.js";
+export type { MdbaseExternalStore } from "./external-store.js";
+export { MdbaseBrowserSelection, MdbaseMemorySelection } from "./selection.js";
+export type { MdbaseSelectionHistory, MdbaseApplicationSelection, MdbaseBrowserSelectionOptions } from "./selection.js";
+export type { MdbaseUnavailableReason } from "./session.js";
+export { MDBASE_RECORD_CREATED_CONTRACT, MDBASE_TIMER_FIRED_CONTRACT, operationsForApplicationCapabilities } from "@mdbase-dev/connect-protocol";
+export type { MdbaseApplicationManifest, MdbaseApplicationManifest as MdbaseAppManifest, MdbaseApplicationRequirements, MdbaseApplicationCapabilityId as ApplicationCapabilityId, MdbaseApplicationCapabilityRequirements as ApplicationCapabilityRequirements } from "./application-contract.js";
+export type { ApplicationProvisions, ApplicationRequirements, LegacyApplicationRequirements, LegacyApplicationCapabilityId, LegacyApplicationCapabilityRequirements, LegacyMdbaseAppManifest, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, FileAction, FileCapability, CollectionOperation as MdbaseOperation, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, GrantScope, JsonObject, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, TypePackManifest, TypePackManifestResource, TypePackProvision, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";

package/dist/index.js

@@ -0,0 +1,10 @@
+export { MdbaseApplicationSession, MdbaseMemoryVerificationStore } from "./application-session.js";
+export { MdbaseConnect } from "./mdbase-connect.js";
+export { MdbaseConnection } from "./connection.js";
+export { effectiveCapabilities } from "./capabilities.js";
+export { MdbaseConnectError, isRetryableConnectError } from "./errors.js";
+export { MdbaseFileClient } from "./files.js";
+export { parseMdbasePushPayload, parseMdbaseNativeNotificationData, showMdbasePushNotification } from "./notifications.js";
+export { externalStore } from "./external-store.js";
+export { MdbaseBrowserSelection, MdbaseMemorySelection } from "./selection.js";
+export { MDBASE_RECORD_CREATED_CONTRACT, MDBASE_TIMER_FIRED_CONTRACT, operationsForApplicationCapabilities } from "@mdbase-dev/connect-protocol";

package/dist/internal-types.d.ts

@@ -0,0 +1,100 @@
+import type { ApplicationNotifications, ApplicationProvisions, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, FileCapability, GrantScope, MdbaseOperationRequest, MutationOperationIdentifier } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationRequirements as ApplicationRequirements } from "./application-contract.js";
+import { encryptRelayRequest } from "./crypto.js";
+export interface Application {
+    id: string;
+    family_identity: string;
+    manifest_digest: string;
+    name: string;
+    distribution?: "web" | "portable";
+    homepage?: string;
+    project_url?: string;
+    notifications?: ApplicationNotifications;
+    requirements: ApplicationRequirements;
+    provisions?: ApplicationProvisions;
+}
+export interface StoredAuthorization {
+    version: 1;
+    verifier: string;
+    state: string;
+    clientId: string;
+    redirectUri: string;
+    relayEncryption: "required" | "disabled";
+    collectionId?: string;
+    returnTo?: string;
+    keyHandle?: string;
+    authorizationId?: string;
+    applicationAgreementPublicKey?: string;
+    applicationSigningPublicKey?: string;
+    presentation?: "popup";
+}
+export type StoredAuthorizationCompletion = {
+    version: 1;
+    status: "connected";
+    collectionId: string;
+    returnTo?: string;
+} | {
+    version: 1;
+    status: "failed";
+    code: string;
+    message: string;
+    returnTo?: string;
+};
+export interface StoredToken {
+    version: 1;
+    accessToken: string;
+    refreshToken?: string;
+    clientId: string;
+    collectionId: string;
+    collectionName: string;
+    operations: CollectionOperation[];
+    scope: GrantScope;
+    expiresAt: number;
+    refreshExpiresAt?: number;
+    grantId?: string;
+    encryption?: GrantEncryption;
+    fileCapability?: FileCapability;
+    applicationOrigin?: string;
+    keyHandle?: string;
+    /** Previous grant keys retained for durable pending-mutation recovery. */
+    retiredKeyHandles?: string[];
+    savedAt: number;
+    authority?: {
+        operationsUrl: string;
+        syncUrl: string;
+        filesUrl: string;
+        replicaId: string;
+        accessToken: string;
+        proofPublicKey?: string;
+    };
+}
+export interface StoredConnectionIndex {
+    version: 1;
+    collectionIds: string[];
+}
+export interface PendingMutation {
+    collectionId: string;
+    grantId?: string;
+    keyId?: string;
+    keyHandle?: string;
+    applicationId?: string;
+    encryption?: GrantEncryption;
+    operation: CollectionOperation;
+    mutation?: MutationOperationIdentifier;
+    inputFingerprint: string;
+    requestId: string;
+    envelope?: EncryptedRelayOperationRequest;
+    /** Exact plaintext protocol request for transports that do not use a grant envelope. */
+    request?: MdbaseOperationRequest;
+    createdAt: number;
+}
+export interface OperationAttempt {
+    response: Response;
+    requestId: string;
+    encryptedRequest?: Awaited<ReturnType<typeof encryptRelayRequest>>;
+    directDeliveryUncertain?: boolean;
+    pendingMutation?: boolean;
+    pendingMutationRecord?: PendingMutation;
+    resumingMutation?: boolean;
+}
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/internal-types.js

@@ -0,0 +1 @@
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/local-file-transport.d.ts

@@ -0,0 +1,37 @@
+import type { FileTransferSession } from "@mdbase-dev/connect-protocol";
+import { type GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+interface LocalFileTransportOptions {
+    keyStore: GrantKeyStore;
+    serverUrl: string;
+    loopbackUrl: string;
+    currentToken?(): StoredToken | null;
+    authorizedToken(signal?: AbortSignal): Promise<StoredToken | null>;
+    refreshAuthorization(signal?: AbortSignal): Promise<StoredToken>;
+    shouldAttemptDirect(token: StoredToken): Promise<boolean>;
+    onDirectAvailable(): void;
+    onDirectUnavailable(): void;
+    onRelayAvailable(): void;
+    acquireGrantKeyLease?(collectionId: string, keyHandle: string, signal?: AbortSignal): Promise<() => void>;
+}
+/** Keeps grant-bound file crypto and loopback framing out of the operation transport. */
+export declare class LocalFileTransport {
+    private readonly options;
+    constructor(options: LocalFileTransportOptions);
+    control<Result>(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal?: AbortSignal): Promise<Result>;
+    private controlAttempt;
+    private decryptControlResponse;
+    uploadChunk(session: FileTransferSession, chunkIndex: number, bytes: Uint8Array, signal?: AbortSignal, authorizedToken?: StoredToken): Promise<void>;
+    private uploadChunkWithLease;
+    downloadChunk(session: FileTransferSession, chunkIndex: number, signal?: AbortSignal, authorizedToken?: StoredToken): Promise<Uint8Array>;
+    private downloadChunkWithLease;
+    private decryptDownloadResponse;
+    private encryptControl;
+    private sendRelayControl;
+    private sendRelayUpload;
+    private sendRelayDownload;
+    private localFileToken;
+    private grantKeyLeases;
+    private retainEntryToken;
+}
+export {};