@mdbase-dev/connect 0.1.0-beta.27 → 0.1.0-beta.29

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-DjJkmk65xgvpJONlTzVuGLRLNCDOhbOdcG4xoq+le2zjOf+cYDEiN4Ctdl+HyrCL
+sha384-Cw/OpEwBlbmIBjDZ/JDyh1HiQoKqitRwVSPaYpNCg33rNDYZr/EdSxv5oRa4jP+I

package/dist/capabilities.d.ts

@@ -0,0 +1,23 @@
+import { type ApplicationCapabilityId, type ApplicationCapabilityRequirements, type MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { MdbaseConnectionInfo } from "./connection-types.js";
+export type MdbaseCapabilityState = "available" | "requires_authorization" | "requires_setup" | "temporarily_unavailable" | "unsupported";
+export interface MdbaseCapabilityEvidence {
+    source: "application" | "authorization" | "authority" | "runtime";
+    fact: string;
+}
+export interface MdbaseEffectiveCapability {
+    id: ApplicationCapabilityId;
+    requirement: "required" | "optional";
+    state: MdbaseCapabilityState;
+    operations: string[];
+    missingOperations: string[];
+    evidence: MdbaseCapabilityEvidence[];
+    reason?: string;
+    details?: Record<string, unknown>;
+}
+export interface MdbaseEffectiveCapabilities {
+    contractVersion: 1;
+    values: Partial<Record<ApplicationCapabilityId, MdbaseEffectiveCapability>>;
+    requiredAvailable: boolean;
+}
+export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;

package/dist/capabilities.js

@@ -0,0 +1,112 @@
+import { capabilityOperations } from "@mdbase-dev/connect-protocol";
+export function effectiveCapabilities(requirements, manifest, connection) {
+    const required = new Set(requirements.required);
+    const declared = [...new Set([...requirements.required, ...(requirements.optional ?? [])])];
+    const values = {};
+    for (const id of declared) {
+        values[id] = effectiveCapability(id, required.has(id), manifest, connection);
+    }
+    return {
+        contractVersion: 1,
+        values,
+        requiredAvailable: requirements.required.every((id) => values[id]?.state === "available")
+    };
+}
+function effectiveCapability(id, required, manifest, connection) {
+    const operations = capabilityOperations(id);
+    const missingOperations = operations.filter((operation) => !connection.operations.includes(operation));
+    const base = {
+        id,
+        requirement: required ? "required" : "optional",
+        operations,
+        missingOperations,
+        evidence: [{
+                source: "application",
+                fact: `${required ? "Required" : "Optional"} in capability contract v1.`
+            }]
+    };
+    if (missingOperations.length > 0) {
+        return {
+            ...base,
+            state: "requires_authorization",
+            evidence: [...base.evidence, {
+                    source: "authorization",
+                    fact: `Missing ${missingOperations.join(", ")}.`
+                }],
+            reason: "The current grant does not include every operation for this capability."
+        };
+    }
+    if (id === "definitions.contracts.current") {
+        const approved = new Set(connection.scope.contracts.map(({ id, version, digest }) => `${id}@${version}:${digest}`));
+        const missingContracts = (manifest.requirements?.contracts ?? []).filter(({ id, version, digest }) => !approved.has(`${id}@${version}:${digest}`));
+        if (missingContracts.length > 0) {
+            return {
+                ...base,
+                state: "requires_authorization",
+                reason: "The current grant does not approve the exact required contract definitions.",
+                evidence: [...base.evidence, {
+                        source: "authorization",
+                        fact: `Missing ${missingContracts.map(({ id, version }) => `${id}@${version}`).join(", ")}.`
+                    }],
+                details: { missingContracts }
+            };
+        }
+    }
+    if (id.startsWith("files.")) {
+        const action = id.slice("files.".length);
+        if (!connection.fileCapability?.actions.includes(action)) {
+            return {
+                ...base,
+                state: connection.fileCapability ? "requires_authorization" : "unsupported",
+                reason: connection.fileCapability
+                    ? `The current file grant does not include ${action}.`
+                    : "This connection has no file capability.",
+                evidence: [...base.evidence, {
+                        source: "authorization",
+                        fact: connection.fileCapability
+                            ? `Granted file actions: ${connection.fileCapability.actions.join(", ")}.`
+                            : "No file capability was granted."
+                    }]
+            };
+        }
+    }
+    if (id === "notifications.background-delivery"
+        && (manifest.notifications?.criteria.length ?? 0) === 0) {
+        return {
+            ...base,
+            state: "requires_setup",
+            reason: "The application manifest declares no notification criteria.",
+            evidence: [...base.evidence, {
+                    source: "application",
+                    fact: "No authority notification criteria are declared."
+                }]
+        };
+    }
+    return {
+        ...base,
+        state: "available",
+        evidence: [...base.evidence, {
+                source: "authorization",
+                fact: operations.length > 0
+                    ? `Granted operations: ${operations.join(", ")}.`
+                    : "No record operation is required."
+            }, {
+                source: "authority",
+                fact: connection.authority.kind === "hosted"
+                    ? "Backed by a durable hosted mdbase authority."
+                    : "Backed by a user-operated mdbase connector."
+            }],
+        ...(id === "sync.offline-replica"
+            ? {
+                details: {
+                    durability: "device",
+                    writes: "queued",
+                    authority: connection.authority.kind
+                }
+            }
+            : {}),
+        ...(id === "notifications.background-delivery"
+            ? { details: { delivery: "authority", payload: "opaque" } }
+            : {})
+    };
+}

package/dist/connect-options.d.ts

@@ -1,5 +1,6 @@
 import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
 import type { GrantKeyStore } from "./crypto.js";
+import type { ApplicationIdentityStore } from "./application-identity.js";
 export interface MdbaseConnectOptions {
     serverUrl: string;
     /**
@@ -12,6 +13,8 @@ export interface MdbaseConnectOptions {
     /** Encrypted relay is required by default for newly authorized grants. */
     relayEncryption?: "required" | "disabled";
     keyStore?: GrantKeyStore;
+    /** Persistent installation signing identity; separate from disposable grant keys. */
+    identityStore?: ApplicationIdentityStore;
     /** Prefer same-computer connector access when the browser permits it. */
     directAccess?: "auto" | "disabled";
     /** Loopback origin override for development and automated testing. */

package/dist/connect.d.ts

@@ -1,4 +1,5 @@
 import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import { type ApplicationIdentityStore } from "./application-identity.js";
 import { MdbaseConnection, type MdbaseAuthorizationOutcome, type MdbaseAuthorizationResult, type MdbaseAuthorizeOptions, type MdbaseConnectEnvironment } from "./connection.js";
 import type { MdbaseConnectOptions } from "./connect-options.js";
 import type { MdbaseConnectionInfo } from "./connection-types.js";
@@ -13,11 +14,13 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     readonly storage: Storage;
     readonly relayEncryption: "required" | "disabled";
     readonly keyStore: GrantKeyStore;
+    readonly identityStore: ApplicationIdentityStore;
     readonly directAccessMode: "auto" | "disabled";
     readonly loopbackUrl: string;
     readonly navigate?: (url: string) => void | Promise<void>;
     readonly credentialStorage: MdbaseConnectEnvironment["credentialStorage"];
     private application;
+    private manifestPromise;
     private readonly completionPromises;
     private readonly connectionCache;
     private readonly listeners;
@@ -25,6 +28,7 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     constructor(options: MdbaseConnectOptions);
     environment(): MdbaseConnectEnvironment;
     register(): Promise<Application>;
+    manifestDeclaration(): Promise<MdbaseAppManifest>;
     private loadManifest;
     authorize(options?: MdbaseAuthorizeOptions): Promise<MdbaseAuthorizationOutcome<Frontmatter>>;
     private authorizeWeb;
@@ -36,6 +40,10 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     unavailableReason(collectionId: string): MdbaseUnavailableReason | null;
     onConnectionsChange(listener: (connections: MdbaseConnectionInfo[]) => void): () => void;
     storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
+    forgetConnectorIdentity(connectorId: string): void;
+    private pinConnectorIdentity;
+    private connectorPinKey;
+    private loadApplicationIdentity;
     removeToken(collectionId: string, keyHandle?: string, reason?: MdbaseUnavailableReason): void;
     tokenKey(collectionId: string): string;
     pendingMutationKey(collectionId: string): string;

package/dist/connect.js

@@ -1,14 +1,13 @@
-import { FIRST_CONTACT_PROTOCOL_VERSION, DEFAULT_LOOPBACK_PORT, ENCRYPTED_RELAY_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
+import { APPLICATION_AUTHORIZATION_PROTOCOL_VERSION, DEFAULT_LOOPBACK_PORT, ENCRYPTED_RELAY_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
 import { abortableDelay } from "./async.js";
 import { randomBase64Url } from "./base64.js";
-import { applicationInstallationId, signApplicationAuthorization } from "./application-identity.js";
+import { ApplicationIdentityStoreError, IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, applicationIdentity, applicationInstallationId, signApplicationAuthorization } from "./application-identity.js";
 import { MdbaseConnection } from "./connection.js";
 import { IndexedDbGrantKeyStore, MemoryGrantKeyStore, validateGrantEncryption } from "./crypto.js";
-import { applicationIdentity, presentFirstContact } from "./first-contact-presentation.js";
 import { connectError, serverConnectError } from "./errors.js";
 import { DEFAULT_OPERATIONS } from "./internal-types.js";
 import { uniqueOperations } from "./operation-helpers.js";
-import { MemoryStorage, apiError, canonicalLoopbackUrl, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseGrantScope, parseStored, stripTrailingSlash, validFileCapability, validAuthorityTokenResponse } from "./runtime-utils.js";
+import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseGrantScope, parseStored, stripTrailingSlash, validFileCapability, validAuthorityTokenResponse } from "./runtime-utils.js";
 export class MdbaseConnectInternals {
     serverUrl;
     manifest;
@@ -17,11 +16,13 @@ export class MdbaseConnectInternals {
     storage;
     relayEncryption;
     keyStore;
+    identityStore;
     directAccessMode;
     loopbackUrl;
     navigate;
     credentialStorage;
     application = null;
+    manifestPromise = null;
     completionPromises = new Map();
     connectionCache = new Map();
     listeners = new Set();
@@ -41,7 +42,10 @@ export class MdbaseConnectInternals {
         this.storage = options.storage ?? defaultStorage(opaquePortable);
         this.relayEncryption = options.relayEncryption ?? "required";
         this.keyStore = options.keyStore ?? (opaquePortable ? new MemoryGrantKeyStore() : new IndexedDbGrantKeyStore());
-        this.credentialStorage = options.storage || options.keyStore
+        this.identityStore = options.identityStore ?? (opaquePortable
+            ? new MemoryApplicationIdentityStore()
+            : new IndexedDbApplicationIdentityStore());
+        this.credentialStorage = options.storage || options.keyStore || options.identityStore
             ? "custom"
             : this.storage instanceof MemoryStorage ? "memory" : "persistent";
         this.directAccessMode = options.directAccess ?? "auto";
@@ -75,7 +79,7 @@ export class MdbaseConnectInternals {
         const response = await connectFetch(`${this.serverUrl}/v1/apps/register`, {
             method: "POST",
             headers: { "content-type": "application/json" },
-            body: JSON.stringify({ manifest: await this.loadManifest() })
+            body: JSON.stringify({ manifest: await this.manifestDeclaration() })
         }, "temporarily_unavailable", "Application registration is temporarily unavailable.");
         const body = await response.json();
         if (!response.ok)
@@ -83,6 +87,12 @@ export class MdbaseConnectInternals {
         this.application = body.application;
         return this.application;
     }
+    manifestDeclaration() {
+        if (this.manifestPromise)
+            return this.manifestPromise;
+        this.manifestPromise = this.loadManifest();
+        return this.manifestPromise;
+    }
     async loadManifest() {
         if (typeof this.manifest !== "string")
             return this.manifest;
@@ -103,7 +113,17 @@ export class MdbaseConnectInternals {
             return await response.json();
         }
         catch (cause) {
-            throw connectError("invalid_application_manifest", "The bundled application declaration is not valid JSON.", { cause });
+            throw connectError("invalid_application_manifest", "The bundled application declaration is not valid JSON.", {
+                cause,
+                details: {
+                    issues: [{
+                            path: "/",
+                            keyword: "json",
+                            message: "must be valid JSON",
+                            params: {}
+                        }]
+                }
+            });
         }
     }
     async authorize(options = {}) {
@@ -112,7 +132,8 @@ export class MdbaseConnectInternals {
         }
         const portableDeclared = typeof this.manifest !== "string"
             && this.manifest.distribution === "portable";
-        const popup = !(portableDeclared && options.openVerification)
+        const popup = portableDeclared
+            && !options.openVerification
             && !this.navigate
             && typeof window !== "undefined"
             ? window.open("", "mdbase-connect-authorization", "popup,width=620,height=760")
@@ -130,9 +151,10 @@ export class MdbaseConnectInternals {
                 popup?.close();
             return this.authorizePortable(application, options, options.openVerification ? null : popup);
         }
-        return this.authorizeWeb(application, options, popup);
+        popup?.close();
+        return this.authorizeWeb(application, options);
     }
-    async authorizeWeb(application, options, popup) {
+    async authorizeWeb(application, options) {
         const { verifier, challenge } = await createPkce();
         const state = randomBase64Url(24);
         const authorizationId = crypto.randomUUID();
@@ -141,16 +163,22 @@ export class MdbaseConnectInternals {
             : undefined;
         const keyHandle = `grant:${application.id}:${state}`;
         const grantKey = await this.keyStore.create(keyHandle);
-        const installation = await applicationIdentity(this.keyStore, this.serverUrl, application);
+        let installation;
+        try {
+            installation = await this.loadApplicationIdentity(application);
+        }
+        catch (error) {
+            await this.keyStore.delete(keyHandle);
+            throw error;
+        }
         const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
-            protocol_version: FIRST_CONTACT_PROTOCOL_VERSION,
+            protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
             authorization_id: authorizationId,
             application_id: application.id,
             application_manifest_digest: application.manifest_digest,
             application_installation_id: await applicationInstallationId(installation),
-            installation_agreement_public_key: installation.agreementPublicKey,
             installation_signing_public_key: installation.signingPublicKey,
             grant_agreement_public_key: grantKey.agreementPublicKey,
             grant_signing_public_key: grantKey.signingPublicKey,
@@ -177,7 +205,6 @@ export class MdbaseConnectInternals {
             collectionId: targetCollectionId,
             returnTo: options.returnTo,
             keyHandle,
-            installationKeyHandle: installation.handle,
             authorizationId,
             applicationAgreementPublicKey: grantKey.agreementPublicKey,
             applicationSigningPublicKey: grantKey.signingPublicKey
@@ -206,71 +233,19 @@ export class MdbaseConnectInternals {
             if (typeof body.authorization_uri !== "string"
                 || body.authorization_id !== authorizationId
                 || !Number.isInteger(body.expires_in)
-                || !Number.isInteger(body.interval)
-                || body.expires_in <= 0
-                || body.interval <= 0) {
-                throw connectError("invalid_device_authorization_response", "The authorization service returned an invalid polling response.");
+                || body.expires_in <= 0) {
+                throw connectError("invalid_device_authorization_response", "The authorization service returned an invalid authorization response.");
             }
             if (this.navigate)
                 await this.navigate(body.authorization_uri);
-            else if (popup)
-                popup.location.href = body.authorization_uri;
+            else if (typeof location !== "undefined")
+                location.assign(body.authorization_uri);
             else {
-                throw connectError("browser_required", "The approval window was blocked. Allow popups for this application and try again.");
+                throw connectError("browser_required", "Authorization navigation requires a browser environment.");
             }
-            const expiresAt = Date.now() + body.expires_in * 1_000;
-            let intervalSeconds = body.interval;
-            let shownFirstContact = "";
-            while (Date.now() < expiresAt) {
-                await abortableDelay(intervalSeconds * 1_000, options.signal);
-                if (options.signal?.aborted) {
-                    throw connectError("authorization_cancelled", "Application authorization was cancelled.");
-                }
-                let statusResponse;
-                try {
-                    statusResponse = await fetch(`${this.serverUrl}/oauth/authorization_status`, {
-                        method: "POST",
-                        headers: { "content-type": "application/x-www-form-urlencoded" },
-                        body: new URLSearchParams({
-                            client_id: application.id,
-                            authorization_id: authorizationId,
-                            code_verifier: verifier
-                        }),
-                        signal: options.signal
-                    });
-                }
-                catch (cause) {
-                    if (options.signal?.aborted) {
-                        throw connectError("authorization_cancelled", "Application authorization was cancelled.", { cause });
-                    }
-                    continue;
-                }
-                const statusBody = await statusResponse.json();
-                if (!statusResponse.ok) {
-                    const code = oauthErrorCode(statusBody);
-                    if (code === "authorization_pending") {
-                        if (statusBody.first_contact) {
-                            shownFirstContact = await presentFirstContact(statusBody.first_contact, application, installation, options, shownFirstContact);
-                        }
-                        continue;
-                    }
-                    if (code === "slow_down") {
-                        intervalSeconds += 2;
-                        continue;
-                    }
-                    throw apiError(statusBody, "token_exchange_failed", "Application authorization could not be completed.", statusResponse.status);
-                }
-                if (typeof statusBody.authorization_redirect !== "string") {
-                    throw connectError("invalid_token_response", "The authorization service returned an invalid completion response.");
-                }
-                const result = await this.performAuthorizationCompletion(statusBody.authorization_redirect, state);
-                popup?.close();
-                return { kind: "connected", ...result };
-            }
-            throw connectError("expired_token", "The application authorization expired.");
+            return { kind: "redirecting" };
         }
         catch (error) {
-            popup?.close();
             this.storage.removeItem(this.pendingKey(state));
             await this.keyStore.delete(keyHandle);
             if (options.signal?.aborted) {
@@ -287,17 +262,24 @@ export class MdbaseConnectInternals {
         const { verifier, challenge } = await createPkce();
         const keyHandle = `grant:${application.id}:${randomBase64Url(24)}`;
         const grantKey = await this.keyStore.create(keyHandle);
-        const installation = await applicationIdentity(this.keyStore, this.serverUrl, application);
+        let installation;
+        try {
+            installation = await this.loadApplicationIdentity(application);
+        }
+        catch (error) {
+            popup?.close();
+            await this.keyStore.delete(keyHandle);
+            throw error;
+        }
         const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
         const authorizationId = crypto.randomUUID();
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
-            protocol_version: FIRST_CONTACT_PROTOCOL_VERSION,
+            protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
             authorization_id: authorizationId,
             application_id: application.id,
             application_manifest_digest: application.manifest_digest,
             application_installation_id: await applicationInstallationId(installation),
-            installation_agreement_public_key: installation.agreementPublicKey,
             installation_signing_public_key: installation.signingPublicKey,
             grant_agreement_public_key: grantKey.agreementPublicKey,
             grant_signing_public_key: grantKey.signingPublicKey,
@@ -380,7 +362,6 @@ export class MdbaseConnectInternals {
             });
         }
         let intervalSeconds = authorization.intervalSeconds;
-        let shownFirstContact = "";
         try {
             while (Date.now() < authorization.expiresAt) {
                 await abortableDelay(intervalSeconds * 1_000, options.signal);
@@ -411,9 +392,6 @@ export class MdbaseConnectInternals {
                 if (!tokenResponse.ok) {
                     const code = oauthErrorCode(tokenBody);
                     if (code === "authorization_pending") {
-                        if (tokenBody.first_contact) {
-                            shownFirstContact = await presentFirstContact(tokenBody.first_contact, application, installation, options, shownFirstContact);
-                        }
                         continue;
                     }
                     if (code === "slow_down") {
@@ -598,6 +576,7 @@ export class MdbaseConnectInternals {
             catch {
                 throw connectError("invalid_token_response", "Authorization returned an invalid encrypted relay binding.");
             }
+            this.pinConnectorIdentity(body.encryption.connector_id, body.encryption.connector_agreement_public_key);
             if (body.encryption.collection_id !== collectionId
                 || typeof body.grant_id !== "string"
                 || body.grant_id.length === 0) {
@@ -655,6 +634,31 @@ export class MdbaseConnectInternals {
         this.emitConnections();
         return token;
     }
+    forgetConnectorIdentity(connectorId) {
+        this.storage.removeItem(this.connectorPinKey(connectorId));
+    }
+    pinConnectorIdentity(connectorId, publicKey) {
+        const key = this.connectorPinKey(connectorId);
+        const previous = parseStored(this.storage.getItem(key));
+        if (previous && (previous.version !== 1 || previous.publicKey !== publicKey)) {
+            throw connectError("connector_identity_changed", "The connector identity changed since this application first connected. Forget the saved connector identity only after verifying the computer, then authorize again.");
+        }
+        if (!previous)
+            this.storage.setItem(key, JSON.stringify({ version: 1, publicKey }));
+    }
+    connectorPinKey(connectorId) {
+        return `mdbase-connect:${this.serverUrl}:connector-pin:${connectorId}`;
+    }
+    async loadApplicationIdentity(application) {
+        try {
+            return await applicationIdentity(this.identityStore, this.serverUrl, application);
+        }
+        catch (cause) {
+            throw connectError("application_identity_unavailable", cause instanceof ApplicationIdentityStoreError
+                ? cause.message
+                : "The application installation identity is unavailable.", { cause });
+        }
+    }
     removeToken(collectionId, keyHandle, reason = "authorization_lost") {
         this.invalidatedConnections.set(collectionId, reason);
         if (keyHandle)
@@ -684,25 +688,7 @@ export class MdbaseConnectInternals {
         return `mdbase-connect:direct:${this.defaultApplicationOrigin()}`;
     }
     defaultApplicationOrigin() {
-        if ((typeof this.manifest !== "string" && this.manifest.distribution === "portable")
-            || this.application?.distribution === "portable") {
-            return "null";
-        }
-        const redirect = new URL(this.redirectUri);
-        if (["http:", "https:"].includes(redirect.protocol))
-            return redirect.origin;
-        if (typeof location !== "undefined")
-            return location.origin;
-        if (this.manifest
-            && typeof this.manifest !== "string") {
-            return new URL(this.manifest.homepage).origin;
-        }
-        try {
-            return new URL(this.manifestSource).origin;
-        }
-        catch {
-            return "";
-        }
+        return applicationStorageOrigin(this.manifest, this.manifestSource, this.redirectUri, this.application?.distribution === "portable");
     }
     pendingKey(state) {
         return `${this.storagePrefix()}:pending:${state}`;
@@ -732,8 +718,3 @@ export class MdbaseConnectInternals {
             listener(connections);
     }
 }
-function collectionIdFromTokenKey(key) {
-    const marker = ":token:";
-    const index = key.lastIndexOf(marker);
-    return index < 0 ? "" : key.slice(index + marker.length);
-}

package/dist/connection-types.d.ts

@@ -7,6 +7,13 @@ export interface MdbaseConnectionInfo {
     operations: CollectionOperation[];
     scope: GrantScope;
     fileCapability?: FileCapability;
+    authority: {
+        kind: "hosted";
+        durability: "provider";
+    } | {
+        kind: "connector";
+        durability: "computer";
+    };
     route: MdbaseConnectionRoute;
     directAccess: DirectAccessStatus;
 }

package/dist/connection.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionChange, CollectionChangesPage, CollectionDescription, CollectionOperation, FirstContactBinding, CollectionTypeDocument, CreateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, FileCapability, GrantScope, JsonObject, ReadViewSourceInput, RecordDocument, SavedViewExecution, SavedViewList, SavedViewSourceDocument, ApplyTypePackInput, AssessTypePackInput, TypePackApplyResult, TypePackAssessment, UpdateViewSourceInput } from "@mdbase-dev/connect-protocol";
+import type { CollectionChange, CollectionChangesPage, CollectionDescription, CollectionOperation, CollectionTypeDocument, CreateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, FileCapability, GrantScope, JsonObject, ReadViewSourceInput, RecordDocument, SavedViewExecution, SavedViewList, SavedViewSourceDocument, ApplyTypePackInput, AssessTypePackInput, TypePackApplyResult, TypePackAssessment, UpdateViewSourceInput } from "@mdbase-dev/connect-protocol";
 import { type ConnectionTransportInternals } from "./connection-transport.js";
 import type { DirectAccessStatus, MdbaseAuthorizationCapabilities, MdbaseConnectionInfo, MdbaseConnectionRoute, MdbaseSyncConnection } from "./connection-types.js";
 import type { GrantKeyStore } from "./crypto.js";
@@ -22,11 +22,6 @@ export interface MdbaseAuthorizeOptions {
     returnTo?: string;
     /** Receives the short code even when the SDK also opens the approval page. */
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
-    /**
-     * Displays the independently derived first-contact code. Keep it visible
-     * while the user compares and accepts the same code on the connector.
-     */
-    onFirstContact?: (challenge: MdbaseFirstContactChallenge) => void | Promise<void>;
     /** Replace the default popup for a downloaded application's approval page. */
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
     /** Stop polling and discard the unapproved, in-memory key. */
@@ -36,16 +31,9 @@ export interface MdbaseConnectionAuthorizeOptions {
     operations?: CollectionOperation[];
     returnTo?: string;
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
-    onFirstContact?: (challenge: MdbaseFirstContactChallenge) => void | Promise<void>;
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
     signal?: AbortSignal;
 }
-export interface MdbaseFirstContactChallenge {
-    binding: FirstContactBinding;
-    authenticationString: string;
-    applicationId: string;
-    connectorId: string;
-}
 export interface MdbaseConnectEnvironment {
     distribution: "web" | "portable";
     applicationOrigin: string;

package/dist/connection.js

@@ -74,6 +74,9 @@ export class MdbaseConnection {
             operations: [...token.operations],
             scope: token.scope,
             ...(token.fileCapability ? { fileCapability: token.fileCapability } : {}),
+            authority: token.authority
+                ? { kind: "hosted", durability: "provider" }
+                : { kind: "connector", durability: "computer" },
             route: this.transport.route,
             directAccess: this.transport.directAccess
         } : null;

package/dist/index.d.ts

@@ -1,19 +1,20 @@
 export { decryptRelayResponse, encryptRelayRequest, IndexedDbGrantKeyStore, MemoryGrantKeyStore, RelayCryptoError, type RelayBinding, type GrantKeyRecord, type GrantKeyStore } from "./crypto.js";
 export { FileTransferCryptoError, GrantFileTransferCipher, type FileTransferBinding } from "./file-crypto.js";
-export { deriveFirstContactSas, FirstContactCryptoError, type FirstContactRole } from "./first-contact.js";
-export { applicationInstallationId, authorizationSigningMessage, signApplicationAuthorization } from "./application-identity.js";
+export { ApplicationIdentityStoreError, IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, applicationInstallationId, authorizationSigningMessage, signApplicationAuthorization, type ApplicationIdentity, type ApplicationIdentityStore } from "./application-identity.js";
 export * from "./authorization-types.js";
+export * from "./application-session.js";
 export * from "./collection-client.js";
 export * from "./connect-options.js";
 export * from "./mdbase-connect.js";
 export * from "./connection.js";
 export * from "./connection-types.js";
+export * from "./capabilities.js";
 export * from "./errors.js";
 export * from "./files.js";
 export * from "./notifications.js";
 export * from "./outcomes.js";
 export * from "./operation-types.js";
 export * from "./selection.js";
-export * from "./session.js";
+export type { MdbaseUnavailableReason } from "./session.js";
 export { createPkce } from "./runtime-utils.js";
-export type { ApplicationProvisions, ApplicationRequirements, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, CollectionChange, CollectionChangesPage, CollectionContractDescriptor, CollectionDescription, CollectionFileMetadata, CollectionOperation as MdbaseOperation, CollectionTypeDescriptor, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, DataContractViewIdentity, GrantScope, FirstContactBinding, JsonObject, MdbaseAppManifest, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, RecordDocument, QueryRecord, SavedNamedView, SavedViewDocument, SavedViewExecution, SavedViewList, SavedViewPresentation, SavedViewProperty, SavedViewSource, SavedViewSourceDocument, ReadViewSourceInput, CreateViewSourceInput, UpdateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, TypePackManifest, TypePackManifestResource, TypePackApplyResult, TypePackAssessment, TypePackReceipt, AssessTypePackInput, ApplyTypePackInput, TypePackProvision, TypePackResourceDiff, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";
+export type { ApplicationProvisions, ApplicationCapabilityId, ApplicationCapabilityRequirements, ApplicationRequirements, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, CollectionChange, CollectionChangesPage, CollectionContractDescriptor, CollectionDescription, CollectionFileMetadata, FileAction, CollectionOperation as MdbaseOperation, CollectionTypeDescriptor, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, DataContractViewIdentity, GrantScope, JsonObject, MdbaseAppManifest, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, RecordDocument, QueryRecord, SavedNamedView, SavedViewDocument, SavedViewExecution, SavedViewList, SavedViewPresentation, SavedViewProperty, SavedViewSource, SavedViewSourceDocument, ReadViewSourceInput, CreateViewSourceInput, UpdateViewSourceInput, DeleteViewSourceInput, DeleteViewSourceResult, ExecuteViewInput, TypePackManifest, TypePackManifestResource, TypePackApplyResult, TypePackAssessment, TypePackReceipt, AssessTypePackInput, ApplyTypePackInput, TypePackProvision, TypePackResourceDiff, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";

package/dist/index.js

@@ -1,18 +1,18 @@
 export { decryptRelayResponse, encryptRelayRequest, IndexedDbGrantKeyStore, MemoryGrantKeyStore, RelayCryptoError } from "./crypto.js";
 export { FileTransferCryptoError, GrantFileTransferCipher } from "./file-crypto.js";
-export { deriveFirstContactSas, FirstContactCryptoError } from "./first-contact.js";
-export { applicationInstallationId, authorizationSigningMessage, signApplicationAuthorization } from "./application-identity.js";
+export { ApplicationIdentityStoreError, IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, applicationInstallationId, authorizationSigningMessage, signApplicationAuthorization } from "./application-identity.js";
 export * from "./authorization-types.js";
+export * from "./application-session.js";
 export * from "./collection-client.js";
 export * from "./connect-options.js";
 export * from "./mdbase-connect.js";
 export * from "./connection.js";
 export * from "./connection-types.js";
+export * from "./capabilities.js";
 export * from "./errors.js";
 export * from "./files.js";
 export * from "./notifications.js";
 export * from "./outcomes.js";
 export * from "./operation-types.js";
 export * from "./selection.js";
-export * from "./session.js";
 export { createPkce } from "./runtime-utils.js";

package/dist/internal-types.d.ts

@@ -20,7 +20,6 @@ export interface StoredAuthorization {
     collectionId?: string;
     returnTo?: string;
     keyHandle?: string;
-    installationKeyHandle?: string;
     authorizationId?: string;
     applicationAgreementPublicKey?: string;
     applicationSigningPublicKey?: string;