@mdbase-dev/connect 0.1.0-beta.110 → 0.1.0-beta.111

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-87GfQ8HHeR0B68yJLi01ycH5DHMGUf0jbXDsLhhpaYD8jpF/qvol4yQtP7hdPExh
+sha384-/62JQssTDGRQGVQwcO5KLWO7BOqrDVxB0ne307QlEFVO3/MzYMBJfjmbz/OdCRWP

package/dist/connection-transport.js

@@ -5,7 +5,7 @@ import { ConnectionFileTransport } from "./connection-file-transport.js";
 import { authorityProofHeaders } from "./authority-proof.js";
 import { performAuthorizationRefresh } from "./authorization-refresh.js";
 import { PendingMutationStore } from "./pending-mutation-store.js";
-import { directFallbackStatus, encryptedOperationError, fetchOperationRequest, isMutation, localNetworkPermission, loopbackRequest, operationFingerprint, operationTransportError, sameAuthorization, throwIfCancelled, unknownMutationOutcome, withOperationDeadline } from "./operation-helpers.js";
+import { directFallbackResponse, encryptedOperationError, fetchOperationRequest, isMutation, localNetworkPermission, loopbackRequest, operationFingerprint, operationTransportError, sameAuthorization, throwIfCancelled, unknownMutationOutcome, withOperationDeadline } from "./operation-helpers.js";
 import { apiError, decodeJsonResponse, parseStored, } from "./runtime-utils.js";
 import { readStoredToken } from "./stored-token.js";
 import { requestOptionsWithinBudget, withCooperativeRequestBudget, withRequestBudget } from "./request-budget.js";
@@ -467,7 +467,7 @@ export class ConnectionTransport {
                     body: JSON.stringify(encryptedRequest),
                     signal: options.signal
                 }));
-                if (!directFallbackStatus(response.status)
+                if (!await directFallbackResponse(response)
                     || await isExplicitConnectorBusyResponse(response)) {
                     if (response.ok) {
                         this.markDirectAvailable();
@@ -603,9 +603,15 @@ export class ConnectionTransport {
     }
     async probeDirectAccess(signal) {
         this.setDirectStatus("checking");
-        if (await probeLoopbackAccess(this.loopbackUrl, OPERATION_TRANSPORT_PROTOCOL_VERSION, signal)) {
-            this.markDirectAvailable();
-            return "available";
+        try {
+            if (await probeLoopbackAccess(this.loopbackUrl, OPERATION_TRANSPORT_PROTOCOL_VERSION, signal)) {
+                this.markDirectAvailable();
+                return "available";
+            }
+        }
+        catch (error) {
+            this.markDirectUnavailable();
+            throw error;
         }
         if ((await localNetworkPermission()) === "denied")
             return this.setDirectStatus("denied");

package/dist/direct-access.js

@@ -1,5 +1,6 @@
 import { loopbackRequest } from "./operation-helpers.js";
-import { decodeJsonResponse } from "./runtime-utils.js";
+import { decodeJsonResponse, portableApplicationOrigin } from "./runtime-utils.js";
+import { serverConnectError } from "./errors.js";
 export function tokenSupportsDirectAccess(token, mode) {
     if (!token || token.authority || !token.encryption || !token.grantId || !token.keyHandle) {
         return false;
@@ -8,22 +9,26 @@ export function tokenSupportsDirectAccess(token, mode) {
         return false;
     return typeof location === "undefined"
         || !token.applicationOrigin
-        || token.applicationOrigin === location.origin;
+        || token.applicationOrigin === portableApplicationOrigin();
 }
 export async function probeLoopbackAccess(loopbackUrl, expectedOperationProtocol, signal) {
+    let response;
     try {
-        const response = await fetch(`${loopbackUrl}/v1/ready`, loopbackRequest({
+        response = await fetch(`${loopbackUrl}/v1/ready`, loopbackRequest({
             method: "GET",
             cache: "no-store",
             signal
         }));
-        const body = await decodeJsonResponse(response, "invalid_operation_response", "The connector returned an invalid readiness response.").catch(() => null);
-        return response.ok
-            && body?.service === "mdbase-connect"
-            && body?.loopback_protocol_version === 1
-            && body?.operation_transport_protocol_version === expectedOperationProtocol;
     }
     catch {
         return false;
     }
+    if (response.status === 403) {
+        throw serverConnectError("operation_failed", "The connector rejected direct access from this application. Relay access remains available.", { status: response.status });
+    }
+    const body = await decodeJsonResponse(response, "invalid_operation_response", "The connector returned an invalid readiness response.").catch(() => null);
+    return response.ok
+        && body?.service === "mdbase-connect"
+        && body?.loopback_protocol_version === 1
+        && body?.operation_transport_protocol_version === expectedOperationProtocol;
 }

package/dist/local-file-transport.js

@@ -3,7 +3,7 @@ import { decryptRelayResponse, encryptRelayRequest } from "./crypto.js";
 import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
 import { GrantFileTransferCipher } from "./file-crypto.js";
 import { GrantKeyLeaseSet, retainCurrentGrantToken } from "./grant-key-leases.js";
-import { directFallbackStatus, loopbackRequest } from "./operation-helpers.js";
+import { directFallbackResponse, loopbackRequest } from "./operation-helpers.js";
 import { apiError, decodeJsonResponse } from "./runtime-utils.js";
 import { isConnectorBusy, isExplicitConnectorBusyResponse, MAX_CONNECTOR_BUSY_RETRIES, waitForConnectorAvailability } from "./transient-retry.js";
 /** Keeps grant-bound file crypto and loopback framing out of the operation transport. */
@@ -42,7 +42,7 @@ export class LocalFileTransport {
                     throw error;
                 this.options.onDirectUnavailable();
             }
-            if (response && (!directFallbackStatus(response.status)
+            if (response && (!await directFallbackResponse(response)
                 || await isExplicitConnectorBusyResponse(response))) {
                 if (response.ok)
                     this.options.onDirectAvailable();
@@ -134,7 +134,7 @@ export class LocalFileTransport {
                     throw error;
                 this.options.onDirectUnavailable();
             }
-            if (response && (!directFallbackStatus(response.status)
+            if (response && (!await directFallbackResponse(response)
                 || await isExplicitConnectorBusyResponse(response))) {
                 if (response.ok)
                     this.options.onDirectAvailable();
@@ -180,7 +180,7 @@ export class LocalFileTransport {
                     throw error;
                 this.options.onDirectUnavailable();
             }
-            if (response && (!directFallbackStatus(response.status)
+            if (response && (!await directFallbackResponse(response)
                 || await isExplicitConnectorBusyResponse(response))) {
                 if (response.ok)
                     this.options.onDirectAvailable();

package/dist/operation-helpers.d.ts

@@ -7,7 +7,7 @@ export type LoopbackRequestInit = RequestInit & {
 };
 export declare function loopbackRequest(init: RequestInit): LoopbackRequestInit;
 export declare function localNetworkPermission(): Promise<PermissionState | null>;
-export declare function directFallbackStatus(status: number): boolean;
+export declare function directFallbackResponse(response: Response): Promise<boolean>;
 export declare function isMutation(operation: CollectionOperation, input?: unknown): boolean;
 export declare function withOperationDeadline(request: EncryptedRelayOperationRequest, deadlineUnixMs?: number): EncryptedRelayOperationRequest;
 export declare function uniqueOperations(operations: CollectionOperation[]): CollectionOperation[];

package/dist/operation-helpers.js

@@ -16,8 +16,13 @@ export async function localNetworkPermission() {
         return null;
     }
 }
-export function directFallbackStatus(status) {
-    return status === 404 || status === 405 || status === 426 || status >= 500;
+export async function directFallbackResponse(response) {
+    const { status } = response;
+    if (status === 404 || status === 405 || status === 426 || status >= 500)
+        return true;
+    // Loopback rejects browser requests before execution with an empty 403.
+    // Structured grant/policy rejections must remain terminal, not route failures.
+    return status === 403 && (await response.clone().text()).trim() === "";
 }
 export function isMutation(operation, input) {
     return isMutatingOperation(operation, input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.110",
+  "version": "0.1.0-beta.111",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.110"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.111"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",