@mdbase-dev/connect 0.1.0-beta.31 → 0.1.0-beta.33

package/dist/application-session.js

@@ -3,6 +3,8 @@ import { capabilityOperations, operationsForApplicationCapabilities } from "@mdb
 import { effectiveCapabilities } from "./capabilities.js";
 import { connectProblem } from "./errors.js";
 import { connectFailure, connectSuccess } from "./outcomes.js";
+import { createRequestBudget, requestAbortReason, resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
+import { defaultCallbackUrl } from "./runtime-utils.js";
 import { MdbaseSession } from "./session.js";
 export class MdbaseMemoryVerificationStore {
     values = new Map();
@@ -19,26 +21,67 @@ export class MdbaseMemoryVerificationStore {
 /**
  * The application-level lifecycle boundary. It derives authorization from the
  * bundled manifest, exposes semantic capabilities, and never mutates collection
- * definitions without an explicit `applyDefinitionUpdates` call.
+ * setup without an explicit `applyCollectionSetup` call.
  */
 export class MdbaseApplicationSession {
     connect;
     options;
+    timeouts;
     listeners = new Set();
     verificationStore;
     snapshot = { status: "opening", connections: [] };
     manifest = null;
+    application = null;
     base = null;
     stopBase;
-    reviewEntries = [];
+    setupAssessment = null;
     verificationGeneration = 0;
-    constructor(connect, options) {
+    lifecycleGeneration = 0;
+    startOperation = null;
+    constructor(connect, options, timeouts = resolveConnectTimeouts()) {
         this.connect = connect;
         this.options = options;
+        this.timeouts = timeouts;
         this.verificationStore = options.verificationStore ?? defaultVerificationStore();
     }
-    async start() {
-        const manifest = await this.connect.manifest();
+    start(options) {
+        if (this.base && !this.startOperation)
+            return Promise.resolve(connectSuccess(this.snapshot));
+        const operation = this.startOperation ?? this.beginStart();
+        operation.waiters += 1;
+        return withRequestBudget(options, this.timeouts.watchStartMs, () => operation.promise)
+            .finally(() => {
+            operation.waiters -= 1;
+            if (operation.waiters === 0 && this.startOperation === operation) {
+                operation.controller.abort();
+                this.startOperation = null;
+                this.lifecycleGeneration += 1;
+            }
+        });
+    }
+    beginStart() {
+        this.snapshot = { status: "opening", connections: [] };
+        const controller = new AbortController();
+        const generation = ++this.lifecycleGeneration;
+        const operation = {
+            promise: this.startWithinBudget({ signal: controller.signal, timeoutMs: null }, generation),
+            controller,
+            waiters: 0,
+            generation
+        };
+        this.startOperation = operation;
+        const settled = () => {
+            if (this.startOperation === operation)
+                this.startOperation = null;
+        };
+        operation.promise.then(settled, settled);
+        return operation;
+    }
+    async startWithinBudget(options, generation) {
+        const registration = await this.connect.register(options);
+        if (!registration.ok)
+            return registration;
+        const manifest = await this.connect.manifest(options);
         if (!manifest.ok)
             return manifest;
         const capabilities = manifest.value.requirements?.capabilities;
@@ -54,24 +97,60 @@ export class MdbaseApplicationSession {
                 }
             }));
         }
+        if (generation !== this.lifecycleGeneration || options.signal?.aborted) {
+            throw requestAbortReason(options.signal ?? new AbortController().signal);
+        }
+        this.application = registration.value;
         this.manifest = manifest.value;
-        this.base = new MdbaseSession(this.connect, {
+        const base = new MdbaseSession(this.connect, {
             selection: this.options.selection,
             autoSelect: this.options.autoSelect,
             operations: operationsForSession(capabilities)
         });
-        this.stopBase = this.base.subscribe(() => this.refresh());
-        const started = await this.base.start();
-        if (!started.ok)
-            return started;
-        await this.refresh(true);
-        return connectSuccess(this.snapshot);
+        this.base = base;
+        this.stopBase = base.subscribe(() => {
+            if (this.base === base)
+                void this.refresh();
+        });
+        try {
+            const started = await base.start(options);
+            if (!started.ok) {
+                this.cleanupBase(base);
+                return started;
+            }
+            if (generation !== this.lifecycleGeneration || options.signal?.aborted) {
+                throw requestAbortReason(options.signal ?? new AbortController().signal);
+            }
+            await this.refresh(true, options);
+            if (generation !== this.lifecycleGeneration || options.signal?.aborted) {
+                throw requestAbortReason(options.signal ?? new AbortController().signal);
+            }
+            return connectSuccess(this.snapshot);
+        }
+        catch (error) {
+            this.cleanupBase(base);
+            throw error;
+        }
     }
     destroy() {
+        this.lifecycleGeneration += 1;
         this.verificationGeneration += 1;
+        this.startOperation?.controller.abort();
+        this.startOperation = null;
+        if (this.base)
+            this.cleanupBase(this.base);
+        this.application = null;
+        this.manifest = null;
+        this.setupAssessment = null;
+        this.snapshot = { status: "opening", connections: [] };
+        this.listeners.clear();
+    }
+    cleanupBase(base) {
+        if (this.base !== base)
+            return;
         this.stopBase?.();
         this.stopBase = undefined;
-        this.base?.destroy();
+        base.destroy();
         this.base = null;
     }
     getSnapshot() {
@@ -97,10 +176,13 @@ export class MdbaseApplicationSession {
     authorize(target, options = {}) {
         return this.requireBase().authorize(target, options);
     }
-    handleAuthorizationCallback(callbackUrl) {
-        return this.requireBase().handleAuthorizationCallback(callbackUrl);
+    handleAuthorizationCallback(callbackUrl, options) {
+        return this.requireBase().handleAuthorizationCallback(String(callbackUrl), options);
+    }
+    completeAuthorization(callbackUrl, options) {
+        return this.requireBase().handleAuthorizationCallback(callbackUrl === undefined ? defaultCallbackUrl() : String(callbackUrl), options);
     }
-    ensureCapabilities(capabilities) {
+    ensureCapabilities(capabilities, options) {
         const manifestRequirements = this.requireManifest().requirements?.capabilities;
         const declared = new Set([
             ...(manifestRequirements?.required ?? []),
@@ -121,40 +203,50 @@ export class MdbaseApplicationSession {
                 }
             })));
         }
-        return this.requireBase().ensureOperations(operationsForIds(capabilities));
+        return this.requireBase().ensureOperations(operationsForIds(capabilities), options);
     }
-    async applyDefinitionUpdates() {
-        if (this.snapshot.status !== "definition_review_required" || this.reviewEntries.length === 0) {
-            return connectFailure(connectProblem("collection_not_ready", "There are no reviewed definition updates to apply."));
+    async applyCollectionSetup(options) {
+        if (this.snapshot.status !== "setup_review_required" || !this.setupAssessment) {
+            return connectFailure(connectProblem("collection_not_ready", "There is no reviewed collection setup to apply."));
         }
-        if (this.reviewEntries.some(({ assessment }) => !assessment.applicable)) {
-            return connectFailure(connectProblem("collection_not_ready", "Resolve the definition conflicts before applying this update."));
+        if (!this.setupAssessment.applicable) {
+            return connectFailure(connectProblem("collection_not_ready", "Resolve the collection setup conflicts before applying this update."));
         }
         const connection = this.connection();
         if (!connection) {
             return connectFailure(connectProblem("collection_not_ready", "The collection is not ready."));
         }
-        for (const { provision, assessment } of this.reviewEntries) {
-            const applied = await connection.applyTypePack({
-                provision,
-                installed_by: this.requireManifest().id,
-                expected_assessment_digest: assessment.assessment_digest,
-                ...(assessment.status === "downgrade" ? { allow_downgrade: true } : {})
-            });
+        const assessment = this.setupAssessment;
+        const input = {
+            ...this.collectionSetupInput(),
+            expectedAssessmentDigest: assessment.assessmentDigest,
+            expectedCollectionRevision: assessment.collectionRevision,
+            expectedProvisionDigest: assessment.provisionDigest,
+            allowTypePackDowngrades: assessment.typePacks
+                .filter((pack) => pack.status === "downgrade")
+                .map((pack) => pack.desired.id)
+        };
+        const budget = createRequestBudget(options, this.timeouts.requestMs);
+        const requestOptions = { signal: budget.signal, timeoutMs: null };
+        try {
+            const applied = await connection.applyCollectionSetup(input, requestOptions);
             if (!applied.ok)
                 return applied;
+            this.setupAssessment = null;
+            await this.verifySetup(this.context(connection), ++this.verificationGeneration, requestOptions);
+            return connectSuccess(this.snapshot);
+        }
+        finally {
+            budget.dispose();
         }
-        this.reviewEntries = [];
-        await this.verifyDefinitions(this.context(connection), ++this.verificationGeneration);
-        return connectSuccess(this.snapshot);
     }
-    async refresh(awaitVerification = false) {
+    async refresh(awaitVerification = false, options) {
         if (!this.base || !this.manifest)
             return;
         const current = this.base.getSnapshot();
         this.verificationGeneration += 1;
         const generation = this.verificationGeneration;
-        this.reviewEntries = [];
+        this.setupAssessment = null;
         if (current.status === "unselected") {
             this.publish({ status: "unselected", connections: current.connections });
             return;
@@ -168,12 +260,9 @@ export class MdbaseApplicationSession {
             this.publish({ status: "authorization_required", ...context });
             return;
         }
-        const managesDefinitions = this.manifest.requirements?.capabilities?.required
-            .includes("definitions.type-pack.apply") ?? false;
-        const provisions = managesDefinitions
-            ? this.manifest.provisions?.type_packs ?? []
-            : [];
-        if (provisions.length === 0) {
+        const managesSetup = this.manifest.requirements?.capabilities?.required
+            .includes("collection.setup.apply") ?? false;
+        if (!managesSetup) {
             this.publish({ status: "ready", verification: "verified", ...context });
             return;
         }
@@ -182,43 +271,34 @@ export class MdbaseApplicationSession {
             this.publish({ status: "ready", verification: "cached", ...context });
         }
         else {
-            this.publish({ status: "checking_definitions", ...context });
+            this.publish({ status: "checking_setup", ...context });
         }
-        const verification = this.verifyDefinitions(context, generation);
+        const verification = this.verifySetup(context, generation, options);
         if (awaitVerification)
             await verification;
     }
-    async verifyDefinitions(context, generation) {
+    async verifySetup(context, generation, options) {
         const connection = this.connection();
         const manifest = this.requireManifest();
         if (!connection || connection.collectionId !== context.collectionId)
             return;
-        const entries = [];
-        const managesDefinitions = manifest.requirements?.capabilities?.required
-            .includes("definitions.type-pack.apply") ?? false;
-        for (const provision of managesDefinitions ? manifest.provisions?.type_packs ?? [] : []) {
-            const outcome = await connection.assessTypePack({
-                provision,
-                installed_by: manifest.id
-            });
-            if (generation !== this.verificationGeneration)
-                return;
-            if (!outcome.ok) {
-                this.publish({ status: "blocked", problem: outcome.problem, ...context });
-                return;
-            }
-            if (outcome.value.status !== "current") {
-                entries.push({ provision, assessment: outcome.value });
-            }
+        const outcome = options
+            ? await connection.assessCollectionSetup(this.collectionSetupInput(), options)
+            : await connection.assessCollectionSetup(this.collectionSetupInput());
+        if (generation !== this.verificationGeneration)
+            return;
+        if (!outcome.ok) {
+            this.publish({ status: "blocked", problem: outcome.problem, ...context });
+            return;
         }
         if (generation !== this.verificationGeneration)
             return;
-        if (entries.length > 0) {
-            this.reviewEntries = entries;
+        if (outcome.value.status !== "current") {
+            this.setupAssessment = outcome.value;
             this.verificationStore.remove(verificationKey(manifest, context.collectionId));
             this.publish({
-                status: "definition_review_required",
-                updates: entries.map(definitionUpdate),
+                status: "setup_review_required",
+                update: collectionSetupUpdate(outcome.value, manifest.provisions?.type_packs ?? []),
                 ...context
             });
             return;
@@ -226,6 +306,21 @@ export class MdbaseApplicationSession {
         this.verificationStore.write(verificationKey(manifest, context.collectionId), verificationValue(manifest));
         this.publish({ status: "ready", verification: "verified", ...context });
     }
+    collectionSetupInput() {
+        const manifest = this.requireManifest();
+        const application = this.requireApplication();
+        return {
+            applicationId: declarationIdFromFamilyIdentity(application.family_identity),
+            declarationDigest: `sha256:${application.manifest_digest}`,
+            requirements: {
+                configuration: manifest.requirements?.configuration ?? []
+            },
+            provisions: {
+                configuration: manifest.provisions?.configuration ?? [],
+                typePacks: manifest.provisions?.type_packs ?? []
+            }
+        };
+    }
     context(connection) {
         const info = connection.info();
         return {
@@ -252,6 +347,11 @@ export class MdbaseApplicationSession {
             throw new Error("Start the application session before using it.");
         return this.manifest;
     }
+    requireApplication() {
+        if (!this.application)
+            throw new Error("Start the application session before using it.");
+        return this.application;
+    }
 }
 function operationsForSession(requirements) {
     return operationsForApplicationCapabilities(requirements);
@@ -260,8 +360,7 @@ function operationsForIds(capabilities) {
     const definitions = capabilities.flatMap((id) => capabilityOperations(id));
     return [...new Set(definitions)];
 }
-function definitionUpdate(entry) {
-    const { assessment } = entry;
+function definitionUpdate(provision, assessment) {
     const statusReason = assessment.status === "conflict"
         ? "Existing user-owned resources conflict with this application definition pack."
         : assessment.status === "install"
@@ -269,27 +368,59 @@ function definitionUpdate(entry) {
             : `This collection has a ${assessment.status} definition change to review.`;
     return {
         id: assessment.desired.id,
-        name: entry.provision.manifest.name ?? assessment.desired.id,
+        name: provision.manifest.name ?? assessment.desired.id,
         status: assessment.status,
         applicable: assessment.applicable,
-        assessmentDigest: assessment.assessment_digest,
+        assessmentDigest: assessment.assessmentDigest,
         ...(assessment.current ? { currentVersion: assessment.current.version } : {}),
         desiredVersion: assessment.desired.version,
         resources: assessment.resources,
-        contractSetups: assessment.contract_setups,
+        contractSetups: assessment.contractSetups,
         canApply: assessment.applicable,
         reason: statusReason
     };
 }
+function collectionSetupUpdate(assessment, provisions) {
+    const typePacks = assessment.typePacks.map((pack) => {
+        const provision = provisions.find((candidate) => candidate.manifest.id === pack.desired.id);
+        if (!provision) {
+            throw new Error(`Collection setup returned undeclared type pack '${pack.desired.id}'.`);
+        }
+        return definitionUpdate(provision, pack);
+    });
+    const configurationChanges = assessment.configuration.filter((entry) => entry.action !== "current").length;
+    const reason = assessment.status === "conflict"
+        ? "Existing collection policy conflicts with this application's required setup."
+        : `This application requires ${configurationChanges} configuration change${configurationChanges === 1 ? "" : "s"} and ${typePacks.length} definition update${typePacks.length === 1 ? "" : "s"}.`;
+    return {
+        status: assessment.status,
+        applicable: assessment.applicable,
+        assessmentDigest: assessment.assessmentDigest,
+        collectionRevision: assessment.collectionRevision,
+        provisionDigest: assessment.provisionDigest,
+        configuration: assessment.configuration,
+        typePacks,
+        canApply: assessment.applicable,
+        reason
+    };
+}
 function verificationKey(manifest, collectionId) {
     return `mdbase-application-session:v1:${manifest.id}:${collectionId}`;
 }
 function verificationValue(manifest) {
     return JSON.stringify({
         capabilities: manifest.requirements?.capabilities,
-        provisions: manifest.provisions?.type_packs ?? []
+        requirements: manifest.requirements?.configuration ?? [],
+        provisions: manifest.provisions ?? {}
     });
 }
+function declarationIdFromFamilyIdentity(familyIdentity) {
+    const prefix = "bundle:";
+    if (!familyIdentity.startsWith(prefix) || familyIdentity.length === prefix.length) {
+        throw new Error("The registered application has no valid declaration identity.");
+    }
+    return familyIdentity.slice(prefix.length);
+}
 function defaultVerificationStore() {
     if (typeof localStorage !== "undefined") {
         return {

package/dist/async.js

@@ -1,13 +1,19 @@
 export function abortableDelay(milliseconds, signal) {
     return new Promise((resolve, reject) => {
         if (signal?.aborted) {
-            reject(signal.reason ?? new DOMException("Aborted", "AbortError"));
+            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
             return;
         }
-        const timeout = setTimeout(resolve, milliseconds);
-        signal?.addEventListener("abort", () => {
+        const cleanup = () => signal?.removeEventListener("abort", abort);
+        const timeout = setTimeout(() => {
+            cleanup();
+            resolve();
+        }, milliseconds);
+        const abort = () => {
             clearTimeout(timeout);
-            reject(signal.reason ?? new DOMException("Aborted", "AbortError"));
-        }, { once: true });
+            cleanup();
+            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+        };
+        signal?.addEventListener("abort", abort, { once: true });
     });
 }

package/dist/authority-proof.d.ts

@@ -0,0 +1,3 @@
+import { type GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+export declare function authorityProofHeaders(keyStore: GrantKeyStore, token: StoredToken, method: string, url: string, body: string | undefined, credential: string): Promise<Record<string, string>>;

package/dist/authority-proof.js

@@ -0,0 +1,24 @@
+import { RelayCryptoError, signAuthorityRequest } from "./crypto.js";
+import { connectError, serverConnectError } from "./errors.js";
+export async function authorityProofHeaders(keyStore, token, method, url, body, credential) {
+    if (!token.authority?.proofPublicKey)
+        return {};
+    if (!token.keyHandle) {
+        throw connectError("missing_grant_key", "Reconnect this application to restore remote authority request signing.");
+    }
+    try {
+        const target = new URL(url);
+        return await signAuthorityRequest(keyStore, token.keyHandle, token.authority.proofPublicKey, {
+            method,
+            target: `${target.pathname}${target.search}`,
+            body,
+            credential
+        });
+    }
+    catch (error) {
+        if (error instanceof RelayCryptoError) {
+            throw serverConnectError(error.code, error.message);
+        }
+        throw error;
+    }
+}

package/dist/browser/integrity.json

@@ -1,4 +1,4 @@
 {
   "file": "mdbase-connect.min.js",
-  "integrity": "sha384-Cw/OpEwBlbmIBjDZ/JDyh1HiQoKqitRwVSPaYpNCg33rNDYZr/EdSxv5oRa4jP+I"
+  "integrity": "sha384-HW2jXcs5ImtJQfRZevV1z8rlK6ia+z6+OGvT3RPWqbWbbhX/KER95tEGgIHCHiyI"
 }