@mdbase-dev/connect 0.1.0-beta.21

package/dist/crypto.js

@@ -0,0 +1,391 @@
+import { ENCRYPTED_RELAY_PROTOCOL_VERSION, AUTHORITY_PROOF_DOMAIN, AUTHORITY_PROOF_HEADERS, AUTHORITY_PROOF_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
+const DATABASE_NAME = "mdbase-connect-keys";
+const STORE_NAME = "grant-keys";
+const MAX_U64 = 18446744073709551615n;
+const REQUEST_INFO = "mdbase-connect relay request key v1";
+const RESPONSE_INFO = "mdbase-connect relay response key v1";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/** Origin-scoped storage for non-extractable grant keys and atomic counters. */
+export class IndexedDbGrantKeyStore {
+    database = null;
+    async create(handle) {
+        const record = await generateGrantKey(handle);
+        const database = await this.open();
+        await idbWrite(database, (store) => store.add({ ...record, counter: "0" }));
+        return record;
+    }
+    async get(handle) {
+        const database = await this.open();
+        const value = await idbRequest(database.transaction(STORE_NAME).objectStore(STORE_NAME).get(handle));
+        return value ? {
+            handle: value.handle,
+            agreementPrivateKey: value.agreementPrivateKey,
+            agreementPublicKey: value.agreementPublicKey,
+            signingPrivateKey: value.signingPrivateKey,
+            signingPublicKey: value.signingPublicKey
+        } : null;
+    }
+    async nextCounter(handle) {
+        const database = await this.open();
+        return new Promise((resolve, reject) => {
+            const transaction = database.transaction(STORE_NAME, "readwrite");
+            const store = transaction.objectStore(STORE_NAME);
+            const request = store.get(handle);
+            let next = null;
+            request.onerror = () => reject(request.error);
+            request.onsuccess = () => {
+                const record = request.result;
+                if (!record) {
+                    transaction.abort();
+                    reject(new RelayCryptoError("missing_grant_key", "The encrypted grant key is unavailable."));
+                    return;
+                }
+                const counter = BigInt(record.counter) + 1n;
+                if (counter > MAX_U64) {
+                    transaction.abort();
+                    reject(new RelayCryptoError("counter_exhausted", "The encrypted grant must be authorized again."));
+                    return;
+                }
+                next = counter.toString();
+                store.put({ ...record, counter: next });
+            };
+            transaction.onerror = () => reject(transaction.error);
+            transaction.onabort = () => reject(transaction.error ?? new Error("Key counter transaction aborted."));
+            transaction.oncomplete = () => {
+                if (next)
+                    resolve(next);
+            };
+        });
+    }
+    async delete(handle) {
+        const database = await this.open();
+        await idbWrite(database, (store) => store.delete(handle));
+    }
+    open() {
+        if (typeof indexedDB === "undefined") {
+            throw new RelayCryptoError("key_storage_unavailable", "Encrypted relay authorization requires browser IndexedDB or an injected grant key store.");
+        }
+        if (!this.database) {
+            this.database = new Promise((resolve, reject) => {
+                const request = indexedDB.open(DATABASE_NAME, 1);
+                request.onupgradeneeded = () => {
+                    if (!request.result.objectStoreNames.contains(STORE_NAME)) {
+                        request.result.createObjectStore(STORE_NAME, { keyPath: "handle" });
+                    }
+                };
+                request.onerror = () => reject(request.error);
+                request.onsuccess = () => resolve(request.result);
+            });
+        }
+        return this.database;
+    }
+}
+/** Deterministic process-local storage for tests, CLIs, and non-browser adapters. */
+export class MemoryGrantKeyStore {
+    records = new Map();
+    sequence = Promise.resolve();
+    async create(handle) {
+        if (this.records.has(handle))
+            throw new Error(`Grant key already exists: ${handle}`);
+        const record = await generateGrantKey(handle);
+        this.records.set(handle, { ...record, counter: "0" });
+        return record;
+    }
+    async get(handle) {
+        const value = this.records.get(handle);
+        return value ? {
+            handle: value.handle,
+            agreementPrivateKey: value.agreementPrivateKey,
+            agreementPublicKey: value.agreementPublicKey,
+            signingPrivateKey: value.signingPrivateKey,
+            signingPublicKey: value.signingPublicKey
+        } : null;
+    }
+    nextCounter(handle) {
+        let resolve;
+        let reject;
+        const result = new Promise((res, rej) => { resolve = res; reject = rej; });
+        this.sequence = this.sequence.then(() => {
+            const record = this.records.get(handle);
+            if (!record)
+                throw new RelayCryptoError("missing_grant_key", "The encrypted grant key is unavailable.");
+            const counter = BigInt(record.counter) + 1n;
+            if (counter > MAX_U64)
+                throw new RelayCryptoError("counter_exhausted", "The encrypted grant must be authorized again.");
+            record.counter = counter.toString();
+            resolve(record.counter);
+        }).catch((error) => {
+            reject(error);
+        });
+        return result;
+    }
+    async delete(handle) {
+        this.records.delete(handle);
+    }
+}
+/** Sign one remote-authority or token-refresh request with the approved grant key. */
+export async function signAuthorityRequest(store, handle, expectedPublicKey, input) {
+    const record = await requireSigningKey(store, handle, expectedPublicKey);
+    const timestamp = input.timestamp ?? Math.floor(Date.now() / 1_000);
+    const nonce = input.nonce ?? crypto.randomUUID();
+    const message = await authorityProofMessage({ ...input, timestamp, nonce });
+    const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, record.signingPrivateKey, new TextEncoder().encode(message));
+    return {
+        [AUTHORITY_PROOF_HEADERS.version]: String(AUTHORITY_PROOF_VERSION),
+        [AUTHORITY_PROOF_HEADERS.timestamp]: String(timestamp),
+        [AUTHORITY_PROOF_HEADERS.nonce]: nonce,
+        [AUTHORITY_PROOF_HEADERS.signature]: bytesToBase64Url(new Uint8Array(signature))
+    };
+}
+export async function authorityProofMessage(input) {
+    const method = input.method.toUpperCase();
+    const bodyHash = await sha256Base64Url(input.body ?? "");
+    const credentialHash = await sha256Base64Url(input.credential);
+    for (const value of [method, input.target, String(input.timestamp), input.nonce]) {
+        if (!value || value.includes("\n") || value.includes("\r")) {
+            throw new RelayCryptoError("invalid_proof_input", "Authority request proof metadata is invalid.");
+        }
+    }
+    return [
+        AUTHORITY_PROOF_DOMAIN,
+        AUTHORITY_PROOF_VERSION,
+        method,
+        input.target,
+        bodyHash,
+        credentialHash,
+        input.timestamp,
+        input.nonce
+    ].join("\n");
+}
+export async function encryptRelayRequest(store, handle, binding, operation, input, requestId = crypto.randomUUID()) {
+    validateGrantEncryption(binding.encryption);
+    const record = await requireAgreementKey(store, handle, binding.encryption.application_agreement_public_key);
+    const counter = await store.nextCounter(handle);
+    const metadata = { binding, requestId, operation, counter };
+    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, "request");
+    const plaintext = new TextEncoder().encode(JSON.stringify(input ?? {}));
+    const ciphertext = await crypto.subtle.encrypt({
+        name: "AES-GCM",
+        iv: nonce(counter),
+        additionalData: new TextEncoder().encode(aad(metadata, "request")),
+        tagLength: 128
+    }, key, plaintext);
+    return {
+        type: "encrypted_operation_request",
+        ...envelopeMetadata(metadata),
+        ciphertext: bytesToBase64Url(new Uint8Array(ciphertext))
+    };
+}
+export async function decryptRelayResponse(store, handle, binding, request, response) {
+    if (!sameEnvelopeMetadata(request, response)) {
+        throw new RelayCryptoError("invalid_encrypted_response", "Encrypted response metadata does not match its request.");
+    }
+    const record = await requireAgreementKey(store, handle, binding.encryption.application_agreement_public_key);
+    const metadata = {
+        binding,
+        requestId: request.request_id,
+        operation: request.operation,
+        counter: request.counter
+    };
+    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, "response");
+    try {
+        const plaintext = await crypto.subtle.decrypt({
+            name: "AES-GCM",
+            iv: nonce(request.counter),
+            additionalData: new TextEncoder().encode(aad(metadata, "response")),
+            tagLength: 128
+        }, key, toArrayBuffer(base64UrlToBytes(response.ciphertext)));
+        const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(plaintext));
+        if (value?.ok === true && "result" in value)
+            return value;
+        if (value?.ok === false
+            && typeof value.error?.code === "string"
+            && typeof value.error?.message === "string")
+            return value;
+        throw new Error("invalid response body");
+    }
+    catch (error) {
+        if (error instanceof RelayCryptoError)
+            throw error;
+        throw new RelayCryptoError("encrypted_response_rejected", "The encrypted connector response could not be authenticated.");
+    }
+}
+export class RelayCryptoError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+async function generateGrantKey(handle) {
+    const agreement = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    const agreementPublicKey = bytesToBase64Url(new Uint8Array(await crypto.subtle.exportKey("raw", agreement.publicKey)));
+    const agreementPkcs8 = await crypto.subtle.exportKey("pkcs8", agreement.privateKey);
+    const agreementPrivateKey = await crypto.subtle.importKey("pkcs8", agreementPkcs8, { name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
+    const signing = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+    const signingPublicKey = bytesToBase64Url(new Uint8Array(await crypto.subtle.exportKey("raw", signing.publicKey)));
+    const signingPkcs8 = await crypto.subtle.exportKey("pkcs8", signing.privateKey);
+    const signingPrivateKey = await crypto.subtle.importKey("pkcs8", signingPkcs8, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+    return {
+        handle,
+        agreementPrivateKey,
+        agreementPublicKey,
+        signingPrivateKey,
+        signingPublicKey
+    };
+}
+async function requireAgreementKey(store, handle, expectedPublicKey) {
+    const record = await store.get(handle);
+    if (!record || record.agreementPublicKey !== expectedPublicKey) {
+        throw new RelayCryptoError("missing_grant_key", "The encrypted grant key is unavailable or does not match the grant.");
+    }
+    return record;
+}
+async function requireSigningKey(store, handle, expectedPublicKey) {
+    const record = await store.get(handle);
+    if (!record || record.signingPublicKey !== expectedPublicKey) {
+        throw new RelayCryptoError("missing_grant_key", "The remote authority signing key is unavailable or does not match the grant.");
+    }
+    return record;
+}
+async function deriveDirectionalKey(privateKey, binding, direction) {
+    let peer;
+    let shared;
+    try {
+        peer = await crypto.subtle.importKey("raw", toArrayBuffer(p256PublicKey(binding.encryption.connector_agreement_public_key)), { name: "ECDH", namedCurve: "P-256" }, false, []);
+        shared = await crypto.subtle.deriveBits({ name: "ECDH", public: peer }, privateKey, 256);
+    }
+    catch {
+        throw new RelayCryptoError("invalid_public_key", "The connector relay public key is invalid.");
+    }
+    const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+    const contextBytes = new TextEncoder().encode(context(binding));
+    const salt = await crypto.subtle.digest("SHA-256", contextBytes);
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt,
+        info: new TextEncoder().encode(direction === "request" ? REQUEST_INFO : RESPONSE_INFO)
+    }, material, { name: "AES-GCM", length: 256 }, false, direction === "request" ? ["encrypt"] : ["decrypt"]);
+}
+function context(binding) {
+    const value = binding.encryption;
+    return [
+        "mdbase-connect",
+        ENCRYPTED_RELAY_PROTOCOL_VERSION,
+        value.suite,
+        binding.grantId,
+        binding.applicationId,
+        value.connector_id,
+        value.collection_id,
+        value.scope_epoch,
+        value.key_id
+    ].join("|");
+}
+function aad(metadata, direction) {
+    return [context(metadata.binding), metadata.requestId, direction, metadata.operation, metadata.counter].join("|");
+}
+function envelopeMetadata(metadata) {
+    const encryption = metadata.binding.encryption;
+    return {
+        protocol_version: ENCRYPTED_RELAY_PROTOCOL_VERSION,
+        suite: RELAY_ENCRYPTION_SUITE,
+        request_id: metadata.requestId,
+        grant_id: metadata.binding.grantId,
+        application_id: metadata.binding.applicationId,
+        connector_id: encryption.connector_id,
+        collection_id: encryption.collection_id,
+        operation: metadata.operation,
+        scope_epoch: encryption.scope_epoch,
+        key_id: encryption.key_id,
+        counter: metadata.counter
+    };
+}
+function sameEnvelopeMetadata(request, response) {
+    return response.type === "encrypted_operation_response"
+        && typeof response.ciphertext === "string"
+        && request.protocol_version === response.protocol_version
+        && request.suite === response.suite
+        && request.request_id === response.request_id
+        && request.grant_id === response.grant_id
+        && request.application_id === response.application_id
+        && request.connector_id === response.connector_id
+        && request.collection_id === response.collection_id
+        && request.operation === response.operation
+        && request.scope_epoch === response.scope_epoch
+        && request.key_id === response.key_id
+        && request.counter === response.counter;
+}
+export function validateGrantEncryption(encryption) {
+    if (encryption.protocol_version !== ENCRYPTED_RELAY_PROTOCOL_VERSION
+        || encryption.suite !== RELAY_ENCRYPTION_SUITE
+        || !Number.isSafeInteger(encryption.scope_epoch)
+        || encryption.scope_epoch <= 0
+        || typeof encryption.key_id !== "string"
+        || encryption.key_id.length === 0
+        || encryption.key_id.length > 200
+        || encryption.key_id.includes("|")) {
+        throw new RelayCryptoError("unsupported_encryption", "The grant uses an unsupported relay encryption profile.");
+    }
+    if (typeof encryption.connector_id !== "string"
+        || !UUID_PATTERN.test(encryption.connector_id)
+        || typeof encryption.collection_id !== "string"
+        || !UUID_PATTERN.test(encryption.collection_id)) {
+        throw new RelayCryptoError("unsupported_encryption", "The grant uses invalid encrypted relay identities.");
+    }
+    p256PublicKey(encryption.application_agreement_public_key);
+    p256PublicKey(encryption.connector_agreement_public_key);
+}
+function nonce(counter) {
+    const value = BigInt(counter);
+    if (value <= 0n || value > MAX_U64 || value.toString() !== counter) {
+        throw new RelayCryptoError("invalid_counter", "The encrypted relay counter is invalid.");
+    }
+    const result = new Uint8Array(new ArrayBuffer(12));
+    const view = new DataView(result.buffer);
+    view.setBigUint64(4, value, false);
+    return result;
+}
+function bytesToBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+async function sha256Base64Url(value) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return bytesToBase64Url(new Uint8Array(digest));
+}
+function base64UrlToBytes(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new RelayCryptoError("invalid_base64", "Encrypted relay data is malformed.");
+    const padding = "=".repeat((4 - value.length % 4) % 4);
+    const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/") + padding);
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function p256PublicKey(value) {
+    const bytes = base64UrlToBytes(value);
+    if (bytes.length !== 65 || bytes[0] !== 4) {
+        throw new RelayCryptoError("invalid_public_key", "Encrypted relay public keys must be uncompressed P-256 points.");
+    }
+    return bytes;
+}
+function toArrayBuffer(value) {
+    return Uint8Array.from(value).buffer;
+}
+function idbRequest(request) {
+    return new Promise((resolve, reject) => {
+        request.onerror = () => reject(request.error);
+        request.onsuccess = () => resolve(request.result);
+    });
+}
+function idbWrite(database, operation) {
+    return new Promise((resolve, reject) => {
+        const transaction = database.transaction(STORE_NAME, "readwrite");
+        const request = operation(transaction.objectStore(STORE_NAME));
+        request.onerror = () => reject(request.error);
+        transaction.onerror = () => reject(transaction.error);
+        transaction.onabort = () => reject(transaction.error ?? new Error("Grant key transaction aborted."));
+        transaction.oncomplete = () => resolve();
+    });
+}

package/dist/errors.d.ts

@@ -0,0 +1,31 @@
+import type { MdbaseDiagnostic, MdbaseOperationEnvelope } from "@mdbase-dev/connect-protocol";
+export type MdbaseRecoveryAction = "retry" | "reauthorize" | "refresh" | "resolve_outcome" | "fix_request" | "none";
+export interface MdbaseConnectErrorOptions {
+    status?: number;
+    retryable?: boolean;
+    requiresAuthorization?: boolean;
+    outcomeUnknown?: boolean;
+    recovery?: MdbaseRecoveryAction;
+    details?: unknown;
+    cause?: unknown;
+}
+export declare class MdbaseConnectError extends Error {
+    readonly code: string;
+    readonly status?: number;
+    readonly retryable: boolean;
+    readonly requiresAuthorization: boolean;
+    readonly outcomeUnknown: boolean;
+    readonly recovery: MdbaseRecoveryAction;
+    readonly details?: unknown;
+    constructor(code: string, message: string, options?: MdbaseConnectErrorOptions);
+}
+export declare class MdbaseOperationValidationError<Result = unknown> extends Error {
+    readonly diagnostics: MdbaseDiagnostic[];
+    readonly result: Result;
+    readonly code = "operation_invalid";
+    constructor(diagnostics: MdbaseDiagnostic[], result: Result);
+}
+/** Return a valid operation result or throw while preserving every diagnostic. */
+export declare function unwrapOperation<Result>(envelope: MdbaseOperationEnvelope<Result>): Result;
+/** True only when repeating a read/poll is safe without asking the user. */
+export declare function isRetryableConnectError(error: unknown): boolean;

package/dist/errors.js

@@ -0,0 +1,83 @@
+export class MdbaseConnectError extends Error {
+    code;
+    status;
+    retryable;
+    requiresAuthorization;
+    outcomeUnknown;
+    recovery;
+    details;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.code = code;
+        this.name = "MdbaseConnectError";
+        const classification = classifyConnectError(code, options.status);
+        this.status = options.status;
+        this.retryable = options.retryable ?? classification.retryable;
+        this.requiresAuthorization = options.requiresAuthorization ?? classification.requiresAuthorization;
+        this.outcomeUnknown = options.outcomeUnknown ?? classification.outcomeUnknown;
+        this.recovery = options.recovery ?? classification.recovery;
+        this.details = options.details;
+        if (options.cause !== undefined)
+            Object.defineProperty(this, "cause", { value: options.cause, configurable: true });
+    }
+}
+export class MdbaseOperationValidationError extends Error {
+    diagnostics;
+    result;
+    code = "operation_invalid";
+    constructor(diagnostics, result) {
+        super(diagnostics.filter((item) => item.severity === "error").map((item) => item.message).join(" ")
+            || diagnostics.map((item) => item.message).join(" ")
+            || "The collection rejected this operation.");
+        this.diagnostics = diagnostics;
+        this.result = result;
+        this.name = "MdbaseOperationValidationError";
+    }
+}
+/** Return a valid operation result or throw while preserving every diagnostic. */
+export function unwrapOperation(envelope) {
+    if (!envelope.valid)
+        throw new MdbaseOperationValidationError(envelope.diagnostics, envelope.result);
+    return envelope.result;
+}
+/** True only when repeating a read/poll is safe without asking the user. */
+export function isRetryableConnectError(error) {
+    if (error instanceof MdbaseConnectError)
+        return error.retryable && !error.outcomeUnknown;
+    return error instanceof TypeError;
+}
+function classifyConnectError(code, status) {
+    const authorizationCodes = new Set([
+        "authorization_expired",
+        "direct_operation_rejected",
+        "encryption_required",
+        "insufficient_access",
+        "missing_grant_key",
+        "not_authorized",
+        "relay_authorization_expired"
+    ]);
+    const outcomeUnknown = code === "direct_outcome_unknown" || code === "pending_mutation_unresolved";
+    const requiresAuthorization = authorizationCodes.has(code) || status === 401;
+    const retryableCodes = new Set([
+        "connector_offline",
+        "discovery_failed",
+        "relay_unavailable",
+        "sync_failed",
+        "temporarily_unavailable",
+        "timeout"
+    ]);
+    const retryableStatus = status === 408 || status === 425 || status === 429 || (status !== undefined && status >= 500);
+    const retryable = !outcomeUnknown && !requiresAuthorization && (retryableCodes.has(code) || retryableStatus);
+    const recovery = outcomeUnknown
+        ? "resolve_outcome"
+        : requiresAuthorization
+            ? "reauthorize"
+            : code === "change_cursor_reset"
+                ? "refresh"
+                : retryable
+                    ? "retry"
+                    : status !== undefined && status >= 400 && status < 500
+                        ? "fix_request"
+                        : "none";
+    return { retryable, requiresAuthorization, outcomeUnknown, recovery };
+}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export { decryptRelayResponse, encryptRelayRequest, IndexedDbGrantKeyStore, MemoryGrantKeyStore, RelayCryptoError, type RelayBinding, type GrantKeyRecord, type GrantKeyStore } from "./crypto.js";
+export * from "./authorization-types.js";
+export * from "./collection-client.js";
+export * from "./connect.js";
+export * from "./connection.js";
+export * from "./connection-types.js";
+export * from "./errors.js";
+export * from "./notifications.js";
+export * from "./operation-types.js";
+export * from "./selection.js";
+export * from "./session.js";
+export { createPkce } from "./runtime-utils.js";
+export type { ApplicationProvisions, ApplicationRequirements, ApplicationNotifications, CollectionChange, CollectionChangesPage, CollectionContractDescriptor, CollectionDescription, CollectionFileMetadata, CollectionOperation as MdbaseOperation, CollectionTypeDescriptor, CollectionTypeDocument, ContractRequirement, DataContractViewIdentity, GrantScope, JsonObject, MdbaseAppManifest, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, RecordDocument, QueryRecord, SavedNamedView, SavedViewDocument, SavedViewExecution, SavedViewList, SavedViewPresentation, SavedViewProperty, SavedViewSource, SavedViewSourceDocument, ReadViewSourceInput, CreateViewSourceInput, UpdateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, TypePackManifest, TypePackManifestResource, TypePackInstallResult, TypePackProvision, TypePackResourceDiff, TypePackSourceResource } from "@mdbase-dev/connect-protocol";

package/dist/index.js

@@ -0,0 +1,12 @@
+export { decryptRelayResponse, encryptRelayRequest, IndexedDbGrantKeyStore, MemoryGrantKeyStore, RelayCryptoError } from "./crypto.js";
+export * from "./authorization-types.js";
+export * from "./collection-client.js";
+export * from "./connect.js";
+export * from "./connection.js";
+export * from "./connection-types.js";
+export * from "./errors.js";
+export * from "./notifications.js";
+export * from "./operation-types.js";
+export * from "./selection.js";
+export * from "./session.js";
+export { createPkce } from "./runtime-utils.js";

package/dist/internal-types.d.ts

@@ -0,0 +1,70 @@
+import type { ApplicationNotifications, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, GrantScope } from "@mdbase-dev/connect-protocol";
+import { encryptRelayRequest } from "./crypto.js";
+export interface Application {
+    id: string;
+    name: string;
+    distribution?: "web" | "portable";
+    homepage?: string;
+    project_url?: string;
+    notifications?: ApplicationNotifications;
+}
+export interface StoredAuthorization {
+    version: 1;
+    verifier: string;
+    state: string;
+    clientId: string;
+    redirectUri: string;
+    relayEncryption: "required" | "disabled";
+    collectionId?: string;
+    returnTo?: string;
+    keyHandle?: string;
+    applicationAgreementPublicKey?: string;
+    applicationSigningPublicKey?: string;
+}
+export interface StoredToken {
+    version: 1;
+    accessToken: string;
+    refreshToken?: string;
+    clientId: string;
+    collectionId: string;
+    collectionName: string;
+    operations: CollectionOperation[];
+    scope: GrantScope;
+    expiresAt: number;
+    refreshExpiresAt?: number;
+    grantId?: string;
+    encryption?: GrantEncryption;
+    applicationOrigin?: string;
+    keyHandle?: string;
+    savedAt: number;
+    authority?: {
+        operationsUrl: string;
+        syncUrl: string;
+        replicaId: string;
+        accessToken: string;
+        proofPublicKey?: string;
+    };
+}
+export interface StoredConnectionIndex {
+    version: 1;
+    collectionIds: string[];
+}
+export interface PendingMutation {
+    collectionId: string;
+    grantId?: string;
+    keyId?: string;
+    operation: CollectionOperation;
+    inputFingerprint: string;
+    requestId: string;
+    envelope?: EncryptedRelayOperationRequest;
+    createdAt: number;
+}
+export interface OperationAttempt {
+    response: Response;
+    requestId: string;
+    encryptedRequest?: Awaited<ReturnType<typeof encryptRelayRequest>>;
+    directDeliveryUncertain?: boolean;
+    pendingMutation?: boolean;
+    resumingMutation?: boolean;
+}
+export declare const DEFAULT_OPERATIONS: CollectionOperation[];

package/dist/internal-types.js

@@ -0,0 +1 @@
+export const DEFAULT_OPERATIONS = ["describe", "changes", "read", "query"];

package/dist/notifications.d.ts

@@ -0,0 +1,47 @@
+export interface MdbaseNotificationRegistrationOptions {
+    serviceWorker: ServiceWorkerRegistration;
+    /** Manifest criterion IDs to enable. Omit to enable every declared criterion. */
+    criteria?: string[];
+    /** Stable per-installation ID. The SDK persists one when omitted. */
+    installationId?: string;
+}
+export interface MdbaseNotificationRegistration {
+    channelId: string;
+    installationId: string;
+    criteria: string[];
+}
+export interface MdbaseNativeNotificationRegistrationOptions {
+    /** Current FCM registration token. Refresh by calling this method again. */
+    token: string;
+    /** Manifest criterion IDs to enable. Omit to enable every declared criterion. */
+    criteria?: string[];
+    /** Stable per-installation ID. The SDK persists one when omitted. */
+    installationId?: string;
+}
+export interface MdbaseNativeNotificationRegistration extends MdbaseNotificationRegistration {
+    transport: "fcm";
+}
+export interface MdbaseNativeNotificationData {
+    type: "mdbase.notification";
+    version: 1;
+    signal_id: string;
+    criterion_id: string;
+    cursor: string;
+}
+export interface MdbasePushPayload {
+    type: "mdbase.notification";
+    version: 1;
+    signal_id: string;
+    criterion_id: string;
+    cursor: string;
+    presentation: {
+        title: string;
+        body?: string;
+        tag?: string;
+    };
+}
+export declare function parseMdbasePushPayload(value: unknown): MdbasePushPayload;
+/** Parse the string-valued data attached to an APNs/FCM notification. */
+export declare function parseMdbaseNativeNotificationData(value: unknown): MdbaseNativeNotificationData;
+/** Display a validated mdbase push from a service worker `push` handler. */
+export declare function showMdbasePushNotification(registration: Pick<ServiceWorkerRegistration, "showNotification">, value: unknown): Promise<void>;