@mdbase-dev/connect 0.1.0-beta.31 → 0.1.0-beta.33

package/dist/token-response.js

@@ -0,0 +1,77 @@
+import { validateGrantEncryption } from "./crypto.js";
+import { connectError } from "./errors.js";
+import { parseGrantScope, validAuthorityTokenResponse, validFileCapability } from "./runtime-utils.js";
+export function storedTokenFromResponse({ body, clientId, keyHandle, previous, defaultApplicationOrigin, pinConnectorIdentity }) {
+    const collectionId = body.collection_id;
+    if (typeof collectionId !== "string") {
+        throw connectError("invalid_token_response", "Authorization returned no collection ID.");
+    }
+    const scope = parseGrantScope(body.scope);
+    if (!scope) {
+        throw connectError("invalid_token_response", "Authorization returned no valid collection scope.");
+    }
+    if (body.authority && !validAuthorityTokenResponse(body.authority, collectionId)) {
+        throw connectError("invalid_token_response", "Authorization returned an invalid remote authority capability.");
+    }
+    if (body.authority && body.encryption) {
+        throw connectError("invalid_token_response", "Authorization returned conflicting collection transports.");
+    }
+    if (body.file_capability !== null && body.file_capability !== undefined
+        && !validFileCapability(body.file_capability)) {
+        throw connectError("invalid_token_response", "Authorization returned an invalid file capability.");
+    }
+    if (body.encryption) {
+        try {
+            validateGrantEncryption(body.encryption);
+        }
+        catch {
+            throw connectError("invalid_token_response", "Authorization returned an invalid encrypted relay binding.");
+        }
+        pinConnectorIdentity(body.encryption.connector_id, body.encryption.connector_agreement_public_key);
+        if (body.encryption.collection_id !== collectionId
+            || typeof body.grant_id !== "string"
+            || body.grant_id.length === 0) {
+            throw connectError("invalid_token_response", "Authorization returned an encrypted relay binding for another grant.");
+        }
+    }
+    if (previous?.encryption
+        && body.encryption
+        && previous.keyHandle
+        && previous.keyHandle === keyHandle
+        && (previous.grantId !== body.grant_id
+            || previous.encryption.connector_id !== body.encryption.connector_id
+            || previous.encryption.connector_agreement_public_key
+                !== body.encryption.connector_agreement_public_key
+            || previous.encryption.application_agreement_public_key
+                !== body.encryption.application_agreement_public_key)) {
+        throw connectError("connector_identity_changed", "The connector identity changed during authorization renewal. Reauthorize before sending collection data.");
+    }
+    return {
+        version: 1,
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        clientId,
+        collectionId,
+        collectionName: body.collection_name ?? `Collection ${collectionId.slice(0, 8)}`,
+        operations: body.operations,
+        scope,
+        expiresAt: Date.now() + body.expires_in * 1_000,
+        refreshExpiresAt: body.refresh_expires_in
+            ? Date.now() + body.refresh_expires_in * 1_000
+            : undefined,
+        grantId: body.grant_id,
+        encryption: body.encryption ?? undefined,
+        fileCapability: body.file_capability ?? undefined,
+        applicationOrigin: body.application_origin ?? defaultApplicationOrigin,
+        keyHandle,
+        savedAt: Date.now(),
+        authority: body.authority ? {
+            operationsUrl: body.authority.operations_url,
+            syncUrl: body.authority.sync_url,
+            filesUrl: body.authority.files_url,
+            replicaId: body.authority.replica_id,
+            accessToken: body.authority.access_token,
+            proofPublicKey: body.authority.proof_public_key
+        } : undefined
+    };
+}

package/dist/watch-policy.d.ts

@@ -0,0 +1,8 @@
+import type { WatchOptions } from "./operation-types.js";
+export interface ResolvedWatchRetryOptions {
+    initialDelayMs: number;
+    maxDelayMs: number;
+    multiplier: number;
+    maxAttempts?: number;
+}
+export declare function watchRetryPolicy(options: WatchOptions["retry"]): ResolvedWatchRetryOptions | undefined;

package/dist/watch-policy.js

@@ -0,0 +1,12 @@
+export function watchRetryPolicy(options) {
+    if (options === false)
+        return undefined;
+    return {
+        initialDelayMs: Math.max(0, options?.initialDelayMs ?? 500),
+        maxDelayMs: Math.max(0, options?.maxDelayMs ?? 15_000),
+        multiplier: Math.max(1, options?.multiplier ?? 2),
+        ...(options?.maxAttempts === undefined
+            ? {}
+            : { maxAttempts: Math.max(0, options.maxAttempts) })
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.31",
+  "version": "0.1.0-beta.33",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -18,6 +18,14 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./advanced": {
+      "types": "./dist/advanced.d.ts",
+      "import": "./dist/advanced.js"
+    },
+    "./crypto": {
+      "types": "./dist/crypto-entry.d.ts",
+      "import": "./dist/crypto-entry.js"
     }
   },
   "files": [
@@ -25,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.31"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.33"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",
@@ -36,6 +44,8 @@
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && node scripts/build-browser.mjs",
     "test": "vitest run",
     "test:browser-storage": "pnpm build && node scripts/browser-storage.test.mjs",
+    "test:consumer-spikes": "tsc -p tsconfig.consumer-spikes.json",
+    "test:public-api": "pnpm build && pnpm --filter @mdbase-dev/connect-protocol build && pnpm --filter @mdbase-dev/connect-testing build && tsc -p tsconfig.public-api.json && node scripts/check-public-api.mjs && node scripts/test-packed-api.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   }
 }