@mdbase-dev/connect 0.1.0-beta.21

package/dist/connection-types.d.ts

@@ -0,0 +1,29 @@
+import type { CollectionOperation, GrantScope, JsonObject, SyncChangesPage, SyncMutation, SyncMutationReceipt, SyncSession, SyncSnapshotPage } from "@mdbase-dev/connect-protocol";
+export type MdbaseConnectionRoute = "remote" | "direct" | "relay";
+export type DirectAccessStatus = "disabled" | "permission_required" | "checking" | "available" | "unavailable" | "denied";
+export interface MdbaseConnectionInfo {
+    collectionId: string;
+    displayName: string;
+    operations: CollectionOperation[];
+    scope: GrantScope;
+    route: MdbaseConnectionRoute;
+    directAccess: DirectAccessStatus;
+}
+export interface MdbaseAuthorizationCapabilities {
+    authorized: boolean;
+    sufficient: boolean;
+    collectionId?: string;
+    grantedOperations: CollectionOperation[];
+    missingOperations: CollectionOperation[];
+}
+export interface MdbaseSyncTransport<Frontmatter extends JsonObject = JsonObject> {
+    openSession(): Promise<SyncSession>;
+    snapshot(snapshotId: string, page?: string): Promise<SyncSnapshotPage<Frontmatter>>;
+    changes(after: number, limit?: number): Promise<SyncChangesPage<Frontmatter>>;
+    mutate(mutation: SyncMutation): Promise<SyncMutationReceipt<Frontmatter>>;
+}
+export interface MdbaseSyncConnection<Frontmatter extends JsonObject = JsonObject> {
+    collectionId: string;
+    replicaId: string;
+    transport: MdbaseSyncTransport<Frontmatter>;
+}

package/dist/connection-types.js

@@ -0,0 +1 @@
+export {};

package/dist/connection.d.ts

@@ -0,0 +1,154 @@
+import type { CollectionChange, CollectionChangesPage, CollectionDescription, CollectionOperation, CollectionTypeDocument, CreateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, GrantScope, JsonObject, MdbaseOperationEnvelope, ReadViewSourceInput, RecordDocument, SavedViewExecution, SavedViewList, SavedViewSourceDocument, TypePackInstallResult, TypePackProvision, UpdateViewSourceInput } from "@mdbase-dev/connect-protocol";
+import { type ConnectionTransportInternals } from "./connection-transport.js";
+import type { DirectAccessStatus, MdbaseAuthorizationCapabilities, MdbaseConnectionInfo, MdbaseConnectionRoute, MdbaseSyncConnection } from "./connection-types.js";
+import type { GrantKeyStore } from "./crypto.js";
+import { type Application } from "./internal-types.js";
+import type { MdbaseNativeNotificationRegistration, MdbaseNativeNotificationRegistrationOptions, MdbaseNotificationRegistration, MdbaseNotificationRegistrationOptions } from "./notifications.js";
+import type { ChangesInput, CreateInput, CreateTypeInput, DeleteInput, DeletePreflightResult, DeleteProgressOptions, DeleteResult, MdbaseDesiredTimer, MdbaseTimer, MdbaseTimerList, MdbaseTimerReconciliation, OperationRequestOptions, PendingMutationSummary, QueryInput, QueryPage, QueryPagesOptions, QueryResult, ReadInput, ReadTypeInput, RenameInput, RenamePreflightResult, RenameProgressOptions, RenameResult, UpdateInput, UpdateTypeInput, WatchOptions } from "./operation-types.js";
+import type { MdbaseDeviceAuthorization } from "./authorization-types.js";
+export type MdbaseAuthorizationTarget = {
+    kind: "choose";
+} | {
+    kind: "collection";
+    collectionId: string;
+};
+export interface MdbaseAuthorizeOptions {
+    operations?: CollectionOperation[];
+    /** Choose any compatible collection, or require one exact collection. */
+    target?: MdbaseAuthorizationTarget;
+    /** App-local location to restore after the authorization callback. */
+    returnTo?: string;
+    /** Receives the short code even when the SDK also opens the approval page. */
+    onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
+    /** Replace the default popup for a downloaded application's approval page. */
+    openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
+    /** Stop polling and discard the unapproved, in-memory key. */
+    signal?: AbortSignal;
+}
+export interface MdbaseConnectionAuthorizeOptions {
+    operations?: CollectionOperation[];
+    returnTo?: string;
+    onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
+    openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
+    signal?: AbortSignal;
+}
+export interface MdbaseConnectEnvironment {
+    distribution: "web" | "portable";
+    applicationOrigin: string;
+    credentialStorage: "persistent" | "memory" | "custom";
+}
+export interface MdbaseAuthorizationResult<Frontmatter extends JsonObject = JsonObject> {
+    connection: MdbaseConnection<Frontmatter>;
+    returnTo?: string;
+}
+export type MdbaseAuthorizationOutcome<Frontmatter extends JsonObject = JsonObject> = {
+    kind: "redirecting";
+} | ({
+    kind: "connected";
+} & MdbaseAuthorizationResult<Frontmatter>);
+export interface MdbaseConnectionInternals<Frontmatter extends JsonObject> extends ConnectionTransportInternals {
+    readonly serverUrl: string;
+    readonly storage: Storage;
+    readonly keyStore: GrantKeyStore;
+    readonly directAccessMode: "auto" | "disabled";
+    readonly loopbackUrl: string;
+    register(): Promise<Application>;
+    authorize(options?: MdbaseAuthorizeOptions): Promise<MdbaseAuthorizationOutcome<Frontmatter>>;
+    notificationKey(collectionId: string, transport?: "web_push" | "fcm"): string;
+}
+export declare class MdbaseConnection<Frontmatter extends JsonObject = JsonObject> {
+    private readonly internals;
+    readonly collectionId: string;
+    private readonly collectionClient;
+    private readonly notifications;
+    private readonly transport;
+    private readonly connectionListeners;
+    constructor(internals: MdbaseConnectionInternals<Frontmatter>, collectionId: string);
+    get displayName(): string;
+    get operations(): CollectionOperation[];
+    get scope(): GrantScope;
+    get directAccess(): DirectAccessStatus;
+    get route(): MdbaseConnectionRoute;
+    register(): Promise<Application>;
+    info(): MdbaseConnectionInfo | null;
+    authorizationCapabilities(requiredOperations?: CollectionOperation[]): MdbaseAuthorizationCapabilities;
+    hasOperations(requiredOperations: CollectionOperation[]): boolean;
+    authorize(options?: MdbaseConnectionAuthorizeOptions): Promise<MdbaseAuthorizationOutcome<Frontmatter>>;
+    requestOperations(requiredOperations: CollectionOperation[], options?: Pick<MdbaseConnectionAuthorizeOptions, "returnTo">): Promise<MdbaseAuthorizationOutcome<Frontmatter> | {
+        kind: "unchanged";
+        connection: MdbaseConnection<Frontmatter>;
+    }>;
+    onConnectionChange(listener: (connection: MdbaseConnectionInfo | null) => void): () => void;
+    notifyStorageChanged(): void;
+    checkDirectAccess(): Promise<DirectAccessStatus>;
+    /** Call from a user gesture to request browser permission for direct local access. */
+    requestDirectAccess(): Promise<DirectAccessStatus>;
+    disableDirectAccess(): void;
+    /**
+     * Return one offline-replication transport regardless of whether the
+     * authority is remote, directly connected, or relay connected.
+     * Authority credentials and routing stay private inside the SDK.
+     */
+    sync(): MdbaseSyncConnection<Frontmatter> | null;
+    /**
+     * Register this browser installation for manifest-declared Web Push.
+     *
+     * Criteria are evaluated by the collection authority. Push payloads contain
+     * only an opaque cursor and static presentation copy.
+     */
+    registerNotifications(options: MdbaseNotificationRegistrationOptions): Promise<MdbaseNotificationRegistration>;
+    registerNativeNotifications(options: MdbaseNativeNotificationRegistrationOptions): Promise<MdbaseNativeNotificationRegistration>;
+    unregisterNativeNotifications(): Promise<void>;
+    unregisterNotifications(serviceWorker?: ServiceWorkerRegistration): Promise<void>;
+    forget(): void;
+    describe(): Promise<CollectionDescription>;
+    changes(input?: ChangesInput, options?: OperationRequestOptions): Promise<CollectionChangesPage>;
+    read(input: ReadInput): Promise<MdbaseOperationEnvelope<RecordDocument<Frontmatter>>>;
+    query(input?: QueryInput, options?: OperationRequestOptions): Promise<MdbaseOperationEnvelope<QueryResult<Frontmatter>>>;
+    queryPages(input?: QueryInput, options?: QueryPagesOptions<Frontmatter>): AsyncGenerator<QueryPage<Frontmatter>>;
+    queryAll(input?: QueryInput, options?: QueryPagesOptions<Frontmatter>): Promise<QueryResult<Frontmatter>>;
+    listViews(): Promise<MdbaseOperationEnvelope<SavedViewList>>;
+    executeView(input: ExecuteViewInput): Promise<MdbaseOperationEnvelope<SavedViewExecution<Frontmatter>>>;
+    readViewSource(input: ReadViewSourceInput): Promise<MdbaseOperationEnvelope<SavedViewSourceDocument>>;
+    createViewSource(input: CreateViewSourceInput): Promise<MdbaseOperationEnvelope<SavedViewSourceDocument>>;
+    updateViewSource(input: UpdateViewSourceInput): Promise<MdbaseOperationEnvelope<SavedViewSourceDocument>>;
+    deleteViewSource(input: DeleteViewSourceInput): Promise<MdbaseOperationEnvelope<DeleteViewSourceResult>>;
+    create(input: CreateInput<Frontmatter>): Promise<MdbaseOperationEnvelope<RecordDocument<Frontmatter>>>;
+    update(input: UpdateInput<Frontmatter>): Promise<MdbaseOperationEnvelope<RecordDocument<Frontmatter>>>;
+    delete(input: DeleteInput, options?: OperationRequestOptions): Promise<MdbaseOperationEnvelope<DeleteResult>>;
+    preflightDelete(input: DeleteInput, options?: OperationRequestOptions): Promise<MdbaseOperationEnvelope<DeletePreflightResult>>;
+    rename(input: RenameInput, options?: OperationRequestOptions): Promise<MdbaseOperationEnvelope<RenameResult>>;
+    preflightRename(input: RenameInput, options?: OperationRequestOptions): Promise<MdbaseOperationEnvelope<RenamePreflightResult>>;
+    renameWithProgress(input: RenameInput, options?: RenameProgressOptions): Promise<MdbaseOperationEnvelope<RenameResult>>;
+    deleteWithProgress(input: DeleteInput, options?: DeleteProgressOptions): Promise<MdbaseOperationEnvelope<DeleteResult>>;
+    pendingMutation(): PendingMutationSummary | null;
+    resumePendingMutation<Result>(input: unknown, options?: OperationRequestOptions): Promise<Result>;
+    validate(input?: JsonObject): Promise<MdbaseOperationEnvelope>;
+    readType(input: ReadTypeInput): Promise<MdbaseOperationEnvelope<CollectionTypeDocument>>;
+    createType(input: CreateTypeInput): Promise<MdbaseOperationEnvelope<CollectionTypeDocument>>;
+    updateType(input: UpdateTypeInput): Promise<MdbaseOperationEnvelope<CollectionTypeDocument>>;
+    installTypePack(input: TypePackProvision): Promise<MdbaseOperationEnvelope<TypePackInstallResult>>;
+    listTimers(namespace: string): Promise<MdbaseTimerList>;
+    putTimer(input: {
+        namespace: string;
+        criterion_id: string;
+        timer: MdbaseDesiredTimer;
+    }): Promise<MdbaseTimer>;
+    cancelTimer(input: {
+        namespace: string;
+        id: string;
+        generation?: number;
+    }): Promise<{
+        namespace: string;
+        id: string;
+        cancelled: boolean;
+    }>;
+    reconcileTimers(input: {
+        namespace: string;
+        criterion_id: string;
+        timers: MdbaseDesiredTimer[];
+    }): Promise<MdbaseTimerReconciliation>;
+    watch(options?: WatchOptions): AsyncGenerator<CollectionChange>;
+    operation<Result>(operation: CollectionOperation, input: unknown, options?: OperationRequestOptions): Promise<Result>;
+    private emitConnection;
+}

package/dist/connection.js

@@ -0,0 +1,371 @@
+import { MdbaseCollectionClient } from "./collection-client.js";
+import { ConnectionNotifications } from "./connection-notifications.js";
+import { ConnectionTransport } from "./connection-transport.js";
+import { MdbaseConnectError, unwrapOperation } from "./errors.js";
+import { DEFAULT_OPERATIONS } from "./internal-types.js";
+import { assertDeletePreview, assertRenamePreview, deleteEstimate, isCancellation, renameEstimate, throwIfCancelled, uniqueOperations } from "./operation-helpers.js";
+export class MdbaseConnection {
+    internals;
+    collectionId;
+    collectionClient;
+    notifications;
+    transport;
+    connectionListeners = new Set();
+    constructor(internals, collectionId) {
+        this.internals = internals;
+        this.collectionId = collectionId;
+        this.transport = new ConnectionTransport({
+            serverUrl: internals.serverUrl,
+            storage: internals.storage,
+            keyStore: internals.keyStore,
+            directAccessMode: internals.directAccessMode,
+            loopbackUrl: internals.loopbackUrl,
+            collectionId,
+            internals,
+            onChange: () => this.emitConnection()
+        });
+        this.collectionClient = new MdbaseCollectionClient({
+            operation: (operation, input, requestOptions) => this.transport.performOperation(operation, input, requestOptions)
+        });
+        this.notifications = new ConnectionNotifications({
+            serverUrl: internals.serverUrl,
+            storage: internals.storage,
+            authorizedToken: () => this.transport.authorizedToken(),
+            register: () => this.register(),
+            notificationKey: (transport) => internals.notificationKey(collectionId, transport)
+        });
+    }
+    get displayName() {
+        return this.transport.currentToken()?.collectionName
+            ?? `Collection ${this.collectionId.slice(0, 8)}`;
+    }
+    get operations() {
+        return [...(this.transport.currentToken()?.operations ?? [])];
+    }
+    get scope() {
+        const scope = this.transport.currentToken()?.scope;
+        if (!scope) {
+            throw new MdbaseConnectError("not_authorized", "This collection is no longer authorized for this application.");
+        }
+        return scope;
+    }
+    get directAccess() {
+        return this.transport.directAccess;
+    }
+    get route() {
+        return this.transport.route;
+    }
+    register() {
+        return this.internals.register();
+    }
+    info() {
+        const token = this.transport.currentToken();
+        return token ? {
+            collectionId: token.collectionId,
+            displayName: token.collectionName,
+            operations: [...token.operations],
+            scope: token.scope,
+            route: this.transport.route,
+            directAccess: this.transport.directAccess
+        } : null;
+    }
+    authorizationCapabilities(requiredOperations = DEFAULT_OPERATIONS) {
+        const grantedOperations = this.operations;
+        const missingOperations = uniqueOperations(requiredOperations)
+            .filter((operation) => !grantedOperations.includes(operation));
+        return {
+            authorized: this.info() !== null,
+            sufficient: this.info() !== null && missingOperations.length === 0,
+            collectionId: this.collectionId,
+            grantedOperations,
+            missingOperations
+        };
+    }
+    hasOperations(requiredOperations) {
+        return this.authorizationCapabilities(requiredOperations).sufficient;
+    }
+    authorize(options = {}) {
+        return this.internals.authorize({
+            ...options,
+            target: { kind: "collection", collectionId: this.collectionId }
+        });
+    }
+    async requestOperations(requiredOperations, options = {}) {
+        const capabilities = this.authorizationCapabilities(requiredOperations);
+        if (capabilities.sufficient)
+            return { kind: "unchanged", connection: this };
+        return this.authorize({
+            ...options,
+            operations: uniqueOperations([
+                ...capabilities.grantedOperations,
+                ...capabilities.missingOperations
+            ])
+        });
+    }
+    onConnectionChange(listener) {
+        this.connectionListeners.add(listener);
+        listener(this.info());
+        return () => this.connectionListeners.delete(listener);
+    }
+    notifyStorageChanged() {
+        this.transport.notifyStorageChanged();
+    }
+    checkDirectAccess() {
+        return this.transport.checkDirectAccess();
+    }
+    /** Call from a user gesture to request browser permission for direct local access. */
+    requestDirectAccess() {
+        return this.transport.requestDirectAccess();
+    }
+    disableDirectAccess() {
+        this.transport.disableDirectAccess();
+    }
+    /**
+     * Return one offline-replication transport regardless of whether the
+     * authority is remote, directly connected, or relay connected.
+     * Authority credentials and routing stay private inside the SDK.
+     */
+    sync() {
+        const token = this.transport.currentToken();
+        if (!token)
+            return null;
+        const collectionId = token.collectionId;
+        if (!token.authority) {
+            if (!token.grantId || !token.operations.includes("sync"))
+                return null;
+            const replicaId = token.grantId;
+            return {
+                collectionId,
+                replicaId,
+                transport: {
+                    openSession: () => this.transport.performOperation("sync", { action: "open_session" }),
+                    snapshot: (snapshotId, page) => this.transport.performOperation("sync", {
+                        action: "snapshot",
+                        snapshot_id: snapshotId,
+                        ...(page ? { page } : {})
+                    }),
+                    changes: (after, limit = 200) => this.transport.performOperation("sync", {
+                        action: "changes",
+                        after,
+                        limit
+                    }),
+                    mutate: (mutation) => this.transport.performOperation("sync", {
+                        action: "mutate",
+                        mutation
+                    })
+                }
+            };
+        }
+        const replicaId = token.authority.replicaId;
+        return {
+            collectionId,
+            replicaId,
+            transport: {
+                openSession: () => this.transport.performAuthoritySyncRequest(collectionId, replicaId, "POST", "sessions"),
+                snapshot: (snapshotId, page) => {
+                    const query = new URLSearchParams({ snapshot_id: snapshotId });
+                    if (page)
+                        query.set("page", page);
+                    return this.transport.performAuthoritySyncRequest(collectionId, replicaId, "GET", `snapshot?${query}`);
+                },
+                changes: (after, limit = 200) => this.transport.performAuthoritySyncRequest(collectionId, replicaId, "GET", `changes?${new URLSearchParams({ after: String(after), limit: String(limit) })}`),
+                mutate: (mutation) => this.transport.performAuthoritySyncRequest(collectionId, replicaId, "POST", "mutations", mutation)
+            }
+        };
+    }
+    /**
+     * Register this browser installation for manifest-declared Web Push.
+     *
+     * Criteria are evaluated by the collection authority. Push payloads contain
+     * only an opaque cursor and static presentation copy.
+     */
+    registerNotifications(options) {
+        return this.notifications.registerNotifications(options);
+    }
+    registerNativeNotifications(options) {
+        return this.notifications.registerNativeNotifications(options);
+    }
+    unregisterNativeNotifications() {
+        return this.notifications.unregisterNativeNotifications();
+    }
+    unregisterNotifications(serviceWorker) {
+        return this.notifications.unregisterNotifications(serviceWorker);
+    }
+    forget() {
+        const token = this.transport.currentToken();
+        this.internals.removeToken(this.collectionId, token?.keyHandle, "not_authorized");
+        this.transport.notifyStorageChanged();
+    }
+    describe() {
+        return this.collectionClient.describe();
+    }
+    changes(input = {}, options) {
+        return this.collectionClient.changes(input, options);
+    }
+    read(input) {
+        return this.collectionClient.read(input);
+    }
+    query(input = {}, options) {
+        return this.collectionClient.query(input, options);
+    }
+    queryPages(input = {}, options = {}) {
+        return this.collectionClient.queryPages(input, options);
+    }
+    queryAll(input = {}, options = {}) {
+        return this.collectionClient.queryAll(input, options);
+    }
+    listViews() {
+        return this.collectionClient.listViews();
+    }
+    executeView(input) {
+        return this.collectionClient.executeView(input);
+    }
+    readViewSource(input) {
+        return this.collectionClient.readViewSource(input);
+    }
+    createViewSource(input) {
+        return this.collectionClient.createViewSource(input);
+    }
+    updateViewSource(input) {
+        return this.collectionClient.updateViewSource(input);
+    }
+    deleteViewSource(input) {
+        return this.collectionClient.deleteViewSource(input);
+    }
+    create(input) {
+        return this.collectionClient.create(input);
+    }
+    update(input) {
+        return this.collectionClient.update(input);
+    }
+    delete(input, options) {
+        return this.collectionClient.delete(input, options);
+    }
+    preflightDelete(input, options) {
+        return this.collectionClient.preflightDelete(input, options);
+    }
+    rename(input, options) {
+        return this.collectionClient.rename(input, options);
+    }
+    preflightRename(input, options) {
+        return this.collectionClient.preflightRename(input, options);
+    }
+    async renameWithProgress(input, options = {}) {
+        const started = Date.now();
+        const resumed = this.pendingMutation()?.operation === "rename";
+        let estimate;
+        const emit = (state, cancellable, completedUnits = 0) => {
+            options.onProgress?.({
+                operation: "rename",
+                state,
+                elapsedMs: Date.now() - started,
+                cancellable,
+                resumed,
+                completedUnits,
+                ...(estimate ? { estimate } : {})
+            });
+        };
+        try {
+            throwIfCancelled(options.signal);
+            emit("preflighting", true);
+            const preview = options.preflight ?? unwrapOperation(await this.preflightRename(input, {
+                signal: options.signal
+            }));
+            assertRenamePreview(input, preview);
+            estimate = renameEstimate(input, preview);
+            emit("ready", true);
+            throwIfCancelled(options.signal);
+            const cancellable = this.transport.hasResumableMutationTransport();
+            emit("applying", cancellable);
+            const result = await this.rename(input, cancellable ? { signal: options.signal } : undefined);
+            emit("completed", false, estimate.totalUnits);
+            return result;
+        }
+        catch (error) {
+            if (isCancellation(error, options.signal))
+                emit("cancelled", false);
+            throw error;
+        }
+    }
+    async deleteWithProgress(input, options = {}) {
+        const started = Date.now();
+        const resumed = this.pendingMutation()?.operation === "delete";
+        let estimate;
+        const emit = (state, cancellable, completedUnits = 0) => {
+            options.onProgress?.({
+                operation: "delete",
+                state,
+                elapsedMs: Date.now() - started,
+                cancellable,
+                resumed,
+                completedUnits,
+                ...(estimate ? { estimate } : {})
+            });
+        };
+        try {
+            throwIfCancelled(options.signal);
+            emit("preflighting", true);
+            const preview = options.preflight ?? unwrapOperation(await this.preflightDelete(input, {
+                signal: options.signal
+            }));
+            assertDeletePreview(input, preview);
+            estimate = deleteEstimate(preview);
+            emit("ready", true);
+            throwIfCancelled(options.signal);
+            const cancellable = this.transport.hasResumableMutationTransport();
+            emit("applying", cancellable);
+            const result = await this.delete(input, cancellable ? { signal: options.signal } : undefined);
+            emit("completed", false, estimate.totalUnits);
+            return result;
+        }
+        catch (error) {
+            if (isCancellation(error, options.signal))
+                emit("cancelled", false);
+            throw error;
+        }
+    }
+    pendingMutation() {
+        return this.transport.pendingMutation();
+    }
+    async resumePendingMutation(input, options) {
+        return this.transport.resumePendingMutation(input, options);
+    }
+    validate(input = {}) {
+        return this.collectionClient.validate(input);
+    }
+    readType(input) {
+        return this.collectionClient.readType(input);
+    }
+    createType(input) {
+        return this.collectionClient.createType(input);
+    }
+    updateType(input) {
+        return this.collectionClient.updateType(input);
+    }
+    installTypePack(input) {
+        return this.collectionClient.installTypePack(input);
+    }
+    listTimers(namespace) {
+        return this.collectionClient.listTimers(namespace);
+    }
+    putTimer(input) {
+        return this.collectionClient.putTimer(input);
+    }
+    cancelTimer(input) {
+        return this.collectionClient.cancelTimer(input);
+    }
+    reconcileTimers(input) {
+        return this.collectionClient.reconcileTimers(input);
+    }
+    async *watch(options = {}) {
+        yield* this.collectionClient.watch(options);
+    }
+    async operation(operation, input, options) {
+        return this.collectionClient.operation(operation, input, options);
+    }
+    emitConnection() {
+        const connection = this.info();
+        for (const listener of this.connectionListeners)
+            listener(connection);
+    }
+}

package/dist/crypto.d.ts

@@ -0,0 +1,64 @@
+import { type CollectionOperation, type EncryptedRelayOperationRequest, type EncryptedRelayOperationResponse, type GrantEncryption } from "@mdbase-dev/connect-protocol";
+export interface GrantKeyRecord {
+    handle: string;
+    agreementPrivateKey: CryptoKey;
+    agreementPublicKey: string;
+    signingPrivateKey: CryptoKey;
+    signingPublicKey: string;
+}
+export interface GrantKeyStore {
+    create(handle: string): Promise<GrantKeyRecord>;
+    get(handle: string): Promise<GrantKeyRecord | null>;
+    nextCounter(handle: string): Promise<string>;
+    delete(handle: string): Promise<void>;
+}
+/** Origin-scoped storage for non-extractable grant keys and atomic counters. */
+export declare class IndexedDbGrantKeyStore implements GrantKeyStore {
+    private database;
+    create(handle: string): Promise<GrantKeyRecord>;
+    get(handle: string): Promise<GrantKeyRecord | null>;
+    nextCounter(handle: string): Promise<string>;
+    delete(handle: string): Promise<void>;
+    private open;
+}
+/** Deterministic process-local storage for tests, CLIs, and non-browser adapters. */
+export declare class MemoryGrantKeyStore implements GrantKeyStore {
+    private readonly records;
+    private sequence;
+    create(handle: string): Promise<GrantKeyRecord>;
+    get(handle: string): Promise<GrantKeyRecord | null>;
+    nextCounter(handle: string): Promise<string>;
+    delete(handle: string): Promise<void>;
+}
+export interface RelayBinding {
+    grantId: string;
+    applicationId: string;
+    encryption: GrantEncryption;
+}
+export interface AuthorityProofInput {
+    method: string;
+    target: string;
+    body?: string;
+    credential: string;
+    timestamp?: number;
+    nonce?: string;
+}
+/** Sign one remote-authority or token-refresh request with the approved grant key. */
+export declare function signAuthorityRequest(store: GrantKeyStore, handle: string, expectedPublicKey: string, input: AuthorityProofInput): Promise<Record<string, string>>;
+export declare function authorityProofMessage(input: Required<Pick<AuthorityProofInput, "method" | "target" | "credential" | "timestamp" | "nonce">> & Pick<AuthorityProofInput, "body">): Promise<string>;
+export declare function encryptRelayRequest(store: GrantKeyStore, handle: string, binding: RelayBinding, operation: CollectionOperation, input: unknown, requestId?: string): Promise<EncryptedRelayOperationRequest>;
+export declare function decryptRelayResponse<Result>(store: GrantKeyStore, handle: string, binding: RelayBinding, request: EncryptedRelayOperationRequest, response: EncryptedRelayOperationResponse): Promise<{
+    ok: true;
+    result: Result;
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}>;
+export declare class RelayCryptoError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function validateGrantEncryption(encryption: GrantEncryption): void;