@mdbase-dev/connect 0.1.0-beta.26 → 0.1.0-beta.28

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-Rejwyx0zN9iv54K0UaKMWs09sQLXcxnOBtKT574KVKlC7aR4FZ7CqpPRMd7mKlNl
+sha384-F1O89BbCjA89Uv9ARtbs7XDJ4AITt+2tUQE574UdH73CaBSOZPhgI9Z8UdC8AN5P

package/dist/capabilities.d.ts

@@ -0,0 +1,23 @@
+import { type ApplicationCapabilityId, type ApplicationCapabilityRequirements, type MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { MdbaseConnectionInfo } from "./connection-types.js";
+export type MdbaseCapabilityState = "available" | "requires_authorization" | "requires_setup" | "temporarily_unavailable" | "unsupported";
+export interface MdbaseCapabilityEvidence {
+    source: "application" | "authorization" | "authority" | "runtime";
+    fact: string;
+}
+export interface MdbaseEffectiveCapability {
+    id: ApplicationCapabilityId;
+    requirement: "required" | "optional";
+    state: MdbaseCapabilityState;
+    operations: string[];
+    missingOperations: string[];
+    evidence: MdbaseCapabilityEvidence[];
+    reason?: string;
+    details?: Record<string, unknown>;
+}
+export interface MdbaseEffectiveCapabilities {
+    contractVersion: 1;
+    values: Partial<Record<ApplicationCapabilityId, MdbaseEffectiveCapability>>;
+    requiredAvailable: boolean;
+}
+export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;

package/dist/capabilities.js

@@ -0,0 +1,112 @@
+import { capabilityOperations } from "@mdbase-dev/connect-protocol";
+export function effectiveCapabilities(requirements, manifest, connection) {
+    const required = new Set(requirements.required);
+    const declared = [...new Set([...requirements.required, ...(requirements.optional ?? [])])];
+    const values = {};
+    for (const id of declared) {
+        values[id] = effectiveCapability(id, required.has(id), manifest, connection);
+    }
+    return {
+        contractVersion: 1,
+        values,
+        requiredAvailable: requirements.required.every((id) => values[id]?.state === "available")
+    };
+}
+function effectiveCapability(id, required, manifest, connection) {
+    const operations = capabilityOperations(id);
+    const missingOperations = operations.filter((operation) => !connection.operations.includes(operation));
+    const base = {
+        id,
+        requirement: required ? "required" : "optional",
+        operations,
+        missingOperations,
+        evidence: [{
+                source: "application",
+                fact: `${required ? "Required" : "Optional"} in capability contract v1.`
+            }]
+    };
+    if (missingOperations.length > 0) {
+        return {
+            ...base,
+            state: "requires_authorization",
+            evidence: [...base.evidence, {
+                    source: "authorization",
+                    fact: `Missing ${missingOperations.join(", ")}.`
+                }],
+            reason: "The current grant does not include every operation for this capability."
+        };
+    }
+    if (id === "definitions.contracts.current") {
+        const approved = new Set(connection.scope.contracts.map(({ id, version, digest }) => `${id}@${version}:${digest}`));
+        const missingContracts = (manifest.requirements?.contracts ?? []).filter(({ id, version, digest }) => !approved.has(`${id}@${version}:${digest}`));
+        if (missingContracts.length > 0) {
+            return {
+                ...base,
+                state: "requires_authorization",
+                reason: "The current grant does not approve the exact required contract definitions.",
+                evidence: [...base.evidence, {
+                        source: "authorization",
+                        fact: `Missing ${missingContracts.map(({ id, version }) => `${id}@${version}`).join(", ")}.`
+                    }],
+                details: { missingContracts }
+            };
+        }
+    }
+    if (id.startsWith("files.")) {
+        const action = id.slice("files.".length);
+        if (!connection.fileCapability?.actions.includes(action)) {
+            return {
+                ...base,
+                state: connection.fileCapability ? "requires_authorization" : "unsupported",
+                reason: connection.fileCapability
+                    ? `The current file grant does not include ${action}.`
+                    : "This connection has no file capability.",
+                evidence: [...base.evidence, {
+                        source: "authorization",
+                        fact: connection.fileCapability
+                            ? `Granted file actions: ${connection.fileCapability.actions.join(", ")}.`
+                            : "No file capability was granted."
+                    }]
+            };
+        }
+    }
+    if (id === "notifications.background-delivery"
+        && (manifest.notifications?.criteria.length ?? 0) === 0) {
+        return {
+            ...base,
+            state: "requires_setup",
+            reason: "The application manifest declares no notification criteria.",
+            evidence: [...base.evidence, {
+                    source: "application",
+                    fact: "No authority notification criteria are declared."
+                }]
+        };
+    }
+    return {
+        ...base,
+        state: "available",
+        evidence: [...base.evidence, {
+                source: "authorization",
+                fact: operations.length > 0
+                    ? `Granted operations: ${operations.join(", ")}.`
+                    : "No record operation is required."
+            }, {
+                source: "authority",
+                fact: connection.authority.kind === "hosted"
+                    ? "Backed by a durable hosted mdbase authority."
+                    : "Backed by a user-operated mdbase connector."
+            }],
+        ...(id === "sync.offline-replica"
+            ? {
+                details: {
+                    durability: "device",
+                    writes: "queued",
+                    authority: connection.authority.kind
+                }
+            }
+            : {}),
+        ...(id === "notifications.background-delivery"
+            ? { details: { delivery: "authority", payload: "opaque" } }
+            : {})
+    };
+}

package/dist/collection-client.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionChange, CollectionChangesPage, CollectionDescription, CollectionOperation, CollectionTypeDocument, CreateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, JsonObject, ReadViewSourceInput, RecordDocument, SavedViewExecution, SavedViewList, SavedViewSourceDocument, TypePackInstallResult, TypePackProvision, UpdateViewSourceInput } from "@mdbase-dev/connect-protocol";
+import type { CollectionChange, CollectionChangesPage, CollectionDescription, CollectionOperation, CollectionTypeDocument, ApplyTypePackInput, AssessTypePackInput, CreateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, JsonObject, ReadViewSourceInput, RecordDocument, SavedViewExecution, SavedViewList, SavedViewSourceDocument, TypePackApplyResult, TypePackAssessment, UpdateViewSourceInput } from "@mdbase-dev/connect-protocol";
 import { type CollectionChangesProblemCode, type CollectionDescriptionProblemCode, type CollectionMutationProblemCode, type CollectionQueryProblemCode, type CollectionReadProblemCode, type CollectionTypeProblemCode, type ConnectOutcome } from "./outcomes.js";
 import type { ChangesInput, CreateInput, CreateTypeInput, DeleteInput, DeletePreflightResult, DeleteResult, MdbaseCollectionTransport, MdbaseDesiredTimer, MdbaseTimer, MdbaseTimerList, MdbaseTimerReconciliation, OperationRequestOptions, QueryInput, QueryPage, QueryPagesOptions, QueryResult, ReadInput, ReadTypeInput, RenameInput, RenamePreflightResult, RenameResult, UpdateInput, UpdateTypeInput, WatchOptions } from "./operation-types.js";
 /**
@@ -33,7 +33,8 @@ export declare class MdbaseCollectionClient<Frontmatter extends JsonObject = Jso
     readType(input: ReadTypeInput): Promise<ConnectOutcome<CollectionTypeDocument, CollectionTypeProblemCode>>;
     createType(input: CreateTypeInput): Promise<ConnectOutcome<CollectionTypeDocument, CollectionTypeProblemCode>>;
     updateType(input: UpdateTypeInput): Promise<ConnectOutcome<CollectionTypeDocument, CollectionTypeProblemCode>>;
-    installTypePack(input: TypePackProvision): Promise<ConnectOutcome<TypePackInstallResult, CollectionTypeProblemCode>>;
+    assessTypePack(input: AssessTypePackInput): Promise<ConnectOutcome<TypePackAssessment, CollectionTypeProblemCode>>;
+    applyTypePack(input: ApplyTypePackInput): Promise<ConnectOutcome<TypePackApplyResult, CollectionTypeProblemCode>>;
     listTimers(namespace: string): Promise<ConnectOutcome<MdbaseTimerList, CollectionReadProblemCode>>;
     putTimer(input: {
         namespace: string;

package/dist/collection-client.js

@@ -143,8 +143,11 @@ export class MdbaseCollectionClient {
     updateType(input) {
         return this.envelopeOperation("update_type", input, COLLECTION_TYPE_PROBLEM_CODES);
     }
-    installTypePack(input) {
-        return this.envelopeOperation("install_type_pack", input, COLLECTION_TYPE_PROBLEM_CODES);
+    assessTypePack(input) {
+        return this.envelopeOperation("assess_type_pack", input, COLLECTION_TYPE_PROBLEM_CODES);
+    }
+    applyTypePack(input) {
+        return this.envelopeOperation("apply_type_pack", input, COLLECTION_TYPE_PROBLEM_CODES);
     }
     listTimers(namespace) {
         return this.rawOperation("list_timers", { namespace }, COLLECTION_READ_PROBLEM_CODES);

package/dist/connect-options.d.ts

@@ -1,5 +1,6 @@
 import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
 import type { GrantKeyStore } from "./crypto.js";
+import type { ApplicationIdentityStore } from "./application-identity.js";
 export interface MdbaseConnectOptions {
     serverUrl: string;
     /**
@@ -12,6 +13,8 @@ export interface MdbaseConnectOptions {
     /** Encrypted relay is required by default for newly authorized grants. */
     relayEncryption?: "required" | "disabled";
     keyStore?: GrantKeyStore;
+    /** Persistent installation signing identity; separate from disposable grant keys. */
+    identityStore?: ApplicationIdentityStore;
     /** Prefer same-computer connector access when the browser permits it. */
     directAccess?: "auto" | "disabled";
     /** Loopback origin override for development and automated testing. */

package/dist/connect.d.ts

@@ -1,4 +1,5 @@
 import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import { type ApplicationIdentityStore } from "./application-identity.js";
 import { MdbaseConnection, type MdbaseAuthorizationOutcome, type MdbaseAuthorizationResult, type MdbaseAuthorizeOptions, type MdbaseConnectEnvironment } from "./connection.js";
 import type { MdbaseConnectOptions } from "./connect-options.js";
 import type { MdbaseConnectionInfo } from "./connection-types.js";
@@ -13,11 +14,13 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     readonly storage: Storage;
     readonly relayEncryption: "required" | "disabled";
     readonly keyStore: GrantKeyStore;
+    readonly identityStore: ApplicationIdentityStore;
     readonly directAccessMode: "auto" | "disabled";
     readonly loopbackUrl: string;
     readonly navigate?: (url: string) => void | Promise<void>;
     readonly credentialStorage: MdbaseConnectEnvironment["credentialStorage"];
     private application;
+    private manifestPromise;
     private readonly completionPromises;
     private readonly connectionCache;
     private readonly listeners;
@@ -25,6 +28,7 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     constructor(options: MdbaseConnectOptions);
     environment(): MdbaseConnectEnvironment;
     register(): Promise<Application>;
+    manifestDeclaration(): Promise<MdbaseAppManifest>;
     private loadManifest;
     authorize(options?: MdbaseAuthorizeOptions): Promise<MdbaseAuthorizationOutcome<Frontmatter>>;
     private authorizeWeb;
@@ -36,6 +40,10 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     unavailableReason(collectionId: string): MdbaseUnavailableReason | null;
     onConnectionsChange(listener: (connections: MdbaseConnectionInfo[]) => void): () => void;
     storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
+    forgetConnectorIdentity(connectorId: string): void;
+    private pinConnectorIdentity;
+    private connectorPinKey;
+    private loadApplicationIdentity;
     removeToken(collectionId: string, keyHandle?: string, reason?: MdbaseUnavailableReason): void;
     tokenKey(collectionId: string): string;
     pendingMutationKey(collectionId: string): string;

package/dist/connect.js

@@ -1,14 +1,13 @@
-import { FIRST_CONTACT_PROTOCOL_VERSION, DEFAULT_LOOPBACK_PORT, ENCRYPTED_RELAY_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
+import { APPLICATION_AUTHORIZATION_PROTOCOL_VERSION, DEFAULT_LOOPBACK_PORT, ENCRYPTED_RELAY_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
 import { abortableDelay } from "./async.js";
 import { randomBase64Url } from "./base64.js";
-import { applicationInstallationId, signApplicationAuthorization } from "./application-identity.js";
+import { ApplicationIdentityStoreError, IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, applicationIdentity, applicationInstallationId, signApplicationAuthorization } from "./application-identity.js";
 import { MdbaseConnection } from "./connection.js";
 import { IndexedDbGrantKeyStore, MemoryGrantKeyStore, validateGrantEncryption } from "./crypto.js";
-import { applicationIdentity, presentFirstContact } from "./first-contact-presentation.js";
 import { connectError, serverConnectError } from "./errors.js";
 import { DEFAULT_OPERATIONS } from "./internal-types.js";
 import { uniqueOperations } from "./operation-helpers.js";
-import { MemoryStorage, apiError, canonicalLoopbackUrl, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseGrantScope, parseStored, stripTrailingSlash, validFileCapability, validAuthorityTokenResponse } from "./runtime-utils.js";
+import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseGrantScope, parseStored, stripTrailingSlash, validFileCapability, validAuthorityTokenResponse } from "./runtime-utils.js";
 export class MdbaseConnectInternals {
     serverUrl;
     manifest;
@@ -17,11 +16,13 @@ export class MdbaseConnectInternals {
     storage;
     relayEncryption;
     keyStore;
+    identityStore;
     directAccessMode;
     loopbackUrl;
     navigate;
     credentialStorage;
     application = null;
+    manifestPromise = null;
     completionPromises = new Map();
     connectionCache = new Map();
     listeners = new Set();
@@ -41,7 +42,10 @@ export class MdbaseConnectInternals {
         this.storage = options.storage ?? defaultStorage(opaquePortable);
         this.relayEncryption = options.relayEncryption ?? "required";
         this.keyStore = options.keyStore ?? (opaquePortable ? new MemoryGrantKeyStore() : new IndexedDbGrantKeyStore());
-        this.credentialStorage = options.storage || options.keyStore
+        this.identityStore = options.identityStore ?? (opaquePortable
+            ? new MemoryApplicationIdentityStore()
+            : new IndexedDbApplicationIdentityStore());
+        this.credentialStorage = options.storage || options.keyStore || options.identityStore
             ? "custom"
             : this.storage instanceof MemoryStorage ? "memory" : "persistent";
         this.directAccessMode = options.directAccess ?? "auto";
@@ -75,7 +79,7 @@ export class MdbaseConnectInternals {
         const response = await connectFetch(`${this.serverUrl}/v1/apps/register`, {
             method: "POST",
             headers: { "content-type": "application/json" },
-            body: JSON.stringify({ manifest: await this.loadManifest() })
+            body: JSON.stringify({ manifest: await this.manifestDeclaration() })
         }, "temporarily_unavailable", "Application registration is temporarily unavailable.");
         const body = await response.json();
         if (!response.ok)
@@ -83,6 +87,12 @@ export class MdbaseConnectInternals {
         this.application = body.application;
         return this.application;
     }
+    manifestDeclaration() {
+        if (this.manifestPromise)
+            return this.manifestPromise;
+        this.manifestPromise = this.loadManifest();
+        return this.manifestPromise;
+    }
     async loadManifest() {
         if (typeof this.manifest !== "string")
             return this.manifest;
@@ -112,7 +122,8 @@ export class MdbaseConnectInternals {
         }
         const portableDeclared = typeof this.manifest !== "string"
             && this.manifest.distribution === "portable";
-        const popup = !(portableDeclared && options.openVerification)
+        const popup = portableDeclared
+            && !options.openVerification
             && !this.navigate
             && typeof window !== "undefined"
             ? window.open("", "mdbase-connect-authorization", "popup,width=620,height=760")
@@ -130,9 +141,10 @@ export class MdbaseConnectInternals {
                 popup?.close();
             return this.authorizePortable(application, options, options.openVerification ? null : popup);
         }
-        return this.authorizeWeb(application, options, popup);
+        popup?.close();
+        return this.authorizeWeb(application, options);
     }
-    async authorizeWeb(application, options, popup) {
+    async authorizeWeb(application, options) {
         const { verifier, challenge } = await createPkce();
         const state = randomBase64Url(24);
         const authorizationId = crypto.randomUUID();
@@ -141,16 +153,22 @@ export class MdbaseConnectInternals {
             : undefined;
         const keyHandle = `grant:${application.id}:${state}`;
         const grantKey = await this.keyStore.create(keyHandle);
-        const installation = await applicationIdentity(this.keyStore, this.serverUrl, application);
+        let installation;
+        try {
+            installation = await this.loadApplicationIdentity(application);
+        }
+        catch (error) {
+            await this.keyStore.delete(keyHandle);
+            throw error;
+        }
         const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
-            protocol_version: FIRST_CONTACT_PROTOCOL_VERSION,
+            protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
             authorization_id: authorizationId,
             application_id: application.id,
             application_manifest_digest: application.manifest_digest,
             application_installation_id: await applicationInstallationId(installation),
-            installation_agreement_public_key: installation.agreementPublicKey,
             installation_signing_public_key: installation.signingPublicKey,
             grant_agreement_public_key: grantKey.agreementPublicKey,
             grant_signing_public_key: grantKey.signingPublicKey,
@@ -177,7 +195,6 @@ export class MdbaseConnectInternals {
             collectionId: targetCollectionId,
             returnTo: options.returnTo,
             keyHandle,
-            installationKeyHandle: installation.handle,
             authorizationId,
             applicationAgreementPublicKey: grantKey.agreementPublicKey,
             applicationSigningPublicKey: grantKey.signingPublicKey
@@ -206,71 +223,19 @@ export class MdbaseConnectInternals {
             if (typeof body.authorization_uri !== "string"
                 || body.authorization_id !== authorizationId
                 || !Number.isInteger(body.expires_in)
-                || !Number.isInteger(body.interval)
-                || body.expires_in <= 0
-                || body.interval <= 0) {
-                throw connectError("invalid_device_authorization_response", "The authorization service returned an invalid polling response.");
+                || body.expires_in <= 0) {
+                throw connectError("invalid_device_authorization_response", "The authorization service returned an invalid authorization response.");
             }
             if (this.navigate)
                 await this.navigate(body.authorization_uri);
-            else if (popup)
-                popup.location.href = body.authorization_uri;
+            else if (typeof location !== "undefined")
+                location.assign(body.authorization_uri);
             else {
-                throw connectError("browser_required", "The approval window was blocked. Allow popups for this application and try again.");
-            }
-            const expiresAt = Date.now() + body.expires_in * 1_000;
-            let intervalSeconds = body.interval;
-            let shownFirstContact = "";
-            while (Date.now() < expiresAt) {
-                await abortableDelay(intervalSeconds * 1_000, options.signal);
-                if (options.signal?.aborted) {
-                    throw connectError("authorization_cancelled", "Application authorization was cancelled.");
-                }
-                let statusResponse;
-                try {
-                    statusResponse = await fetch(`${this.serverUrl}/oauth/authorization_status`, {
-                        method: "POST",
-                        headers: { "content-type": "application/x-www-form-urlencoded" },
-                        body: new URLSearchParams({
-                            client_id: application.id,
-                            authorization_id: authorizationId,
-                            code_verifier: verifier
-                        }),
-                        signal: options.signal
-                    });
-                }
-                catch (cause) {
-                    if (options.signal?.aborted) {
-                        throw connectError("authorization_cancelled", "Application authorization was cancelled.", { cause });
-                    }
-                    continue;
-                }
-                const statusBody = await statusResponse.json();
-                if (!statusResponse.ok) {
-                    const code = oauthErrorCode(statusBody);
-                    if (code === "authorization_pending") {
-                        if (statusBody.first_contact) {
-                            shownFirstContact = await presentFirstContact(statusBody.first_contact, application, installation, options, shownFirstContact);
-                        }
-                        continue;
-                    }
-                    if (code === "slow_down") {
-                        intervalSeconds += 2;
-                        continue;
-                    }
-                    throw apiError(statusBody, "token_exchange_failed", "Application authorization could not be completed.", statusResponse.status);
-                }
-                if (typeof statusBody.authorization_redirect !== "string") {
-                    throw connectError("invalid_token_response", "The authorization service returned an invalid completion response.");
-                }
-                const result = await this.performAuthorizationCompletion(statusBody.authorization_redirect, state);
-                popup?.close();
-                return { kind: "connected", ...result };
+                throw connectError("browser_required", "Authorization navigation requires a browser environment.");
             }
-            throw connectError("expired_token", "The application authorization expired.");
+            return { kind: "redirecting" };
         }
         catch (error) {
-            popup?.close();
             this.storage.removeItem(this.pendingKey(state));
             await this.keyStore.delete(keyHandle);
             if (options.signal?.aborted) {
@@ -287,17 +252,24 @@ export class MdbaseConnectInternals {
         const { verifier, challenge } = await createPkce();
         const keyHandle = `grant:${application.id}:${randomBase64Url(24)}`;
         const grantKey = await this.keyStore.create(keyHandle);
-        const installation = await applicationIdentity(this.keyStore, this.serverUrl, application);
+        let installation;
+        try {
+            installation = await this.loadApplicationIdentity(application);
+        }
+        catch (error) {
+            popup?.close();
+            await this.keyStore.delete(keyHandle);
+            throw error;
+        }
         const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
         const authorizationId = crypto.randomUUID();
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
-            protocol_version: FIRST_CONTACT_PROTOCOL_VERSION,
+            protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
             authorization_id: authorizationId,
             application_id: application.id,
             application_manifest_digest: application.manifest_digest,
             application_installation_id: await applicationInstallationId(installation),
-            installation_agreement_public_key: installation.agreementPublicKey,
             installation_signing_public_key: installation.signingPublicKey,
             grant_agreement_public_key: grantKey.agreementPublicKey,
             grant_signing_public_key: grantKey.signingPublicKey,
@@ -380,7 +352,6 @@ export class MdbaseConnectInternals {
             });
         }
         let intervalSeconds = authorization.intervalSeconds;
-        let shownFirstContact = "";
         try {
             while (Date.now() < authorization.expiresAt) {
                 await abortableDelay(intervalSeconds * 1_000, options.signal);
@@ -411,9 +382,6 @@ export class MdbaseConnectInternals {
                 if (!tokenResponse.ok) {
                     const code = oauthErrorCode(tokenBody);
                     if (code === "authorization_pending") {
-                        if (tokenBody.first_contact) {
-                            shownFirstContact = await presentFirstContact(tokenBody.first_contact, application, installation, options, shownFirstContact);
-                        }
                         continue;
                     }
                     if (code === "slow_down") {
@@ -598,6 +566,7 @@ export class MdbaseConnectInternals {
             catch {
                 throw connectError("invalid_token_response", "Authorization returned an invalid encrypted relay binding.");
             }
+            this.pinConnectorIdentity(body.encryption.connector_id, body.encryption.connector_agreement_public_key);
             if (body.encryption.collection_id !== collectionId
                 || typeof body.grant_id !== "string"
                 || body.grant_id.length === 0) {
@@ -655,6 +624,31 @@ export class MdbaseConnectInternals {
         this.emitConnections();
         return token;
     }
+    forgetConnectorIdentity(connectorId) {
+        this.storage.removeItem(this.connectorPinKey(connectorId));
+    }
+    pinConnectorIdentity(connectorId, publicKey) {
+        const key = this.connectorPinKey(connectorId);
+        const previous = parseStored(this.storage.getItem(key));
+        if (previous && (previous.version !== 1 || previous.publicKey !== publicKey)) {
+            throw connectError("connector_identity_changed", "The connector identity changed since this application first connected. Forget the saved connector identity only after verifying the computer, then authorize again.");
+        }
+        if (!previous)
+            this.storage.setItem(key, JSON.stringify({ version: 1, publicKey }));
+    }
+    connectorPinKey(connectorId) {
+        return `mdbase-connect:${this.serverUrl}:connector-pin:${connectorId}`;
+    }
+    async loadApplicationIdentity(application) {
+        try {
+            return await applicationIdentity(this.identityStore, this.serverUrl, application);
+        }
+        catch (cause) {
+            throw connectError("application_identity_unavailable", cause instanceof ApplicationIdentityStoreError
+                ? cause.message
+                : "The application installation identity is unavailable.", { cause });
+        }
+    }
     removeToken(collectionId, keyHandle, reason = "authorization_lost") {
         this.invalidatedConnections.set(collectionId, reason);
         if (keyHandle)
@@ -684,25 +678,7 @@ export class MdbaseConnectInternals {
         return `mdbase-connect:direct:${this.defaultApplicationOrigin()}`;
     }
     defaultApplicationOrigin() {
-        if ((typeof this.manifest !== "string" && this.manifest.distribution === "portable")
-            || this.application?.distribution === "portable") {
-            return "null";
-        }
-        const redirect = new URL(this.redirectUri);
-        if (["http:", "https:"].includes(redirect.protocol))
-            return redirect.origin;
-        if (typeof location !== "undefined")
-            return location.origin;
-        if (this.manifest
-            && typeof this.manifest !== "string") {
-            return new URL(this.manifest.homepage).origin;
-        }
-        try {
-            return new URL(this.manifestSource).origin;
-        }
-        catch {
-            return "";
-        }
+        return applicationStorageOrigin(this.manifest, this.manifestSource, this.redirectUri, this.application?.distribution === "portable");
     }
     pendingKey(state) {
         return `${this.storagePrefix()}:pending:${state}`;
@@ -732,8 +708,3 @@ export class MdbaseConnectInternals {
             listener(connections);
     }
 }
-function collectionIdFromTokenKey(key) {
-    const marker = ":token:";
-    const index = key.lastIndexOf(marker);
-    return index < 0 ? "" : key.slice(index + marker.length);
-}

package/dist/connection-types.d.ts

@@ -7,6 +7,13 @@ export interface MdbaseConnectionInfo {
     operations: CollectionOperation[];
     scope: GrantScope;
     fileCapability?: FileCapability;
+    authority: {
+        kind: "hosted";
+        durability: "provider";
+    } | {
+        kind: "connector";
+        durability: "computer";
+    };
     route: MdbaseConnectionRoute;
     directAccess: DirectAccessStatus;
 }

package/dist/connection.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionChange, CollectionChangesPage, CollectionDescription, CollectionOperation, FirstContactBinding, CollectionTypeDocument, CreateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, FileCapability, GrantScope, JsonObject, ReadViewSourceInput, RecordDocument, SavedViewExecution, SavedViewList, SavedViewSourceDocument, TypePackInstallResult, TypePackProvision, UpdateViewSourceInput } from "@mdbase-dev/connect-protocol";
+import type { CollectionChange, CollectionChangesPage, CollectionDescription, CollectionOperation, CollectionTypeDocument, CreateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, FileCapability, GrantScope, JsonObject, ReadViewSourceInput, RecordDocument, SavedViewExecution, SavedViewList, SavedViewSourceDocument, ApplyTypePackInput, AssessTypePackInput, TypePackApplyResult, TypePackAssessment, UpdateViewSourceInput } from "@mdbase-dev/connect-protocol";
 import { type ConnectionTransportInternals } from "./connection-transport.js";
 import type { DirectAccessStatus, MdbaseAuthorizationCapabilities, MdbaseConnectionInfo, MdbaseConnectionRoute, MdbaseSyncConnection } from "./connection-types.js";
 import type { GrantKeyStore } from "./crypto.js";
@@ -22,11 +22,6 @@ export interface MdbaseAuthorizeOptions {
     returnTo?: string;
     /** Receives the short code even when the SDK also opens the approval page. */
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
-    /**
-     * Displays the independently derived first-contact code. Keep it visible
-     * while the user compares and accepts the same code on the connector.
-     */
-    onFirstContact?: (challenge: MdbaseFirstContactChallenge) => void | Promise<void>;
     /** Replace the default popup for a downloaded application's approval page. */
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
     /** Stop polling and discard the unapproved, in-memory key. */
@@ -36,16 +31,9 @@ export interface MdbaseConnectionAuthorizeOptions {
     operations?: CollectionOperation[];
     returnTo?: string;
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
-    onFirstContact?: (challenge: MdbaseFirstContactChallenge) => void | Promise<void>;
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
     signal?: AbortSignal;
 }
-export interface MdbaseFirstContactChallenge {
-    binding: FirstContactBinding;
-    authenticationString: string;
-    applicationId: string;
-    connectorId: string;
-}
 export interface MdbaseConnectEnvironment {
     distribution: "web" | "portable";
     applicationOrigin: string;
@@ -143,7 +131,8 @@ export declare class MdbaseConnection<Frontmatter extends JsonObject = JsonObjec
     readType(input: ReadTypeInput): Promise<ConnectOutcome<CollectionTypeDocument, CollectionTypeProblemCode>>;
     createType(input: CreateTypeInput): Promise<ConnectOutcome<CollectionTypeDocument, CollectionTypeProblemCode>>;
     updateType(input: UpdateTypeInput): Promise<ConnectOutcome<CollectionTypeDocument, CollectionTypeProblemCode>>;
-    installTypePack(input: TypePackProvision): Promise<ConnectOutcome<TypePackInstallResult, CollectionTypeProblemCode>>;
+    assessTypePack(input: AssessTypePackInput): Promise<ConnectOutcome<TypePackAssessment, CollectionTypeProblemCode>>;
+    applyTypePack(input: ApplyTypePackInput): Promise<ConnectOutcome<TypePackApplyResult, CollectionTypeProblemCode>>;
     listTimers(namespace: string): Promise<ConnectOutcome<MdbaseTimerList, CollectionReadProblemCode>>;
     putTimer(input: {
         namespace: string;

package/dist/connection.js

@@ -74,6 +74,9 @@ export class MdbaseConnection {
             operations: [...token.operations],
             scope: token.scope,
             ...(token.fileCapability ? { fileCapability: token.fileCapability } : {}),
+            authority: token.authority
+                ? { kind: "hosted", durability: "provider" }
+                : { kind: "connector", durability: "computer" },
             route: this.transport.route,
             directAccess: this.transport.directAccess
         } : null;
@@ -382,8 +385,11 @@ export class MdbaseConnection {
     updateType(input) {
         return this.collectionClient.updateType(input);
     }
-    installTypePack(input) {
-        return this.collectionClient.installTypePack(input);
+    assessTypePack(input) {
+        return this.collectionClient.assessTypePack(input);
+    }
+    applyTypePack(input) {
+        return this.collectionClient.applyTypePack(input);
     }
     listTimers(namespace) {
         return this.collectionClient.listTimers(namespace);