@mdbase-dev/connect 0.1.0-beta.32 → 0.1.0-beta.33

package/README.md

@@ -7,6 +7,13 @@ applications. See the [portable application guide](../../docs/portable-apps.md)
 for the v1 manifest, device-code flow, version-pinned CDN URL, SRI metadata,
 and `file://` storage boundary.
 
+Ordinary applications install only `@mdbase-dev/connect`. Add
+`@mdbase-dev/connect-dev` for declaration/type-pack authoring,
+`@mdbase-dev/connect-testing` for supported test fixtures,
+`@mdbase-dev/connect-sync` for an offline mirror, or the Pickle package only
+when the application uses that feature. Wire and authority implementations use
+`@mdbase-dev/connect-protocol`; ordinary application code does not.
+
 The complete developer guide covers
 [setup](https://mdbase.dev/sdk/quickstart/),
 [manifests and contracts](https://mdbase.dev/sdk/manifest/),
@@ -33,7 +40,8 @@ const session = mdbase.application({
 });
 const unsubscribeSession = session.subscribe(() => render(session.getSnapshot()));
 
-const started = await session.start();
+const startup = new AbortController();
+const started = await session.start({ signal: startup.signal, timeoutMs: 20_000 });
 if (!started.ok) {
   renderProblem(started.problem);
   return;
@@ -56,10 +64,15 @@ if (!queried.ok) {
   return;
 }
 const workouts = queried.value;
+const current = await connection.read({ path: workouts.results[0].path });
+if (!current.ok) {
+  renderProblem(current.problem);
+  return;
+}
 const updated = await connection.update({
-  path: "workouts/monday.md",
+  path: current.value.path,
   patch: { completed: true },
-  if_revision: workouts.results[0].revision
+  ifRevision: current.value.revision
 });
 if (!updated.ok) renderProblem(updated.problem);
 
@@ -85,6 +98,12 @@ reserved for programming errors and broken SDK invariants. See
 [typed outcomes and recovery](../../docs/sdk-outcomes.md) for the complete
 problem model, setup failures, mutation uncertainty, and UI guidance.
 
+SDK call options, operation inputs, results, descriptors, and progress events
+use camelCase. The client translates canonical snake_case protocol payloads at
+the authority boundary. Versioned JSON documents such as `MdbaseAppManifest`
+and `TypePackProvision`, problem detail objects, diagnostics, and user-owned
+frontmatter retain the exact field names defined by their own schemas.
+
 React applications can use the same session without introducing another state
 owner:
 
@@ -132,16 +151,16 @@ versioned capabilities in their manifest; they never maintain a parallel array
 of protocol operations. Use `getSnapshot()` and `subscribe()` directly or
 through your framework's external-store integration.
 
-The session distinguishes `authorization_required`, `checking_definitions`,
-`definition_review_required`, `ready`, `unavailable`, and `blocked`. Definition
+The session distinguishes `authorization_required`, `checking_setup`,
+`setup_review_required`, `ready`, `unavailable`, and `blocked`. Setup
 inspection is read-only. If an update is needed, render the supplied plan and
 apply the exact assessment the user reviewed:
 
 ```ts
 const snapshot = session.getSnapshot();
-if (snapshot.status === "definition_review_required") {
-  renderDefinitionChanges(snapshot.updates);
-  const applied = await session.applyDefinitionUpdates();
+if (snapshot.status === "setup_review_required") {
+  renderCollectionSetup(snapshot.update);
+  const applied = await session.applyCollectionSetup({ timeoutMs: 30_000 });
   if (!applied.ok) renderProblem(applied.problem);
 }
 ```
@@ -267,10 +286,10 @@ one-shot reminders at the collection authority:
 ```ts
 await connection.reconcileTimers({
   namespace: "workout-reminders",
-  criterion_id: "workout.reminder",
+  criterionId: "workout.reminder",
   timers: [{
     id: "workout-42",
-    fire_at: new Date("2026-07-25T10:00:00Z").toISOString()
+    fireAt: new Date("2026-07-25T10:00:00Z").toISOString()
   }]
 });
 ```
@@ -311,7 +330,7 @@ if (!current.ok) return renderProblem(current.problem);
 const updatedType = await connection.updateType({
   path: current.value.path,
   document: current.value.document.replace("version: 1", "version: 2"),
-  if_revision: current.value.revision
+  ifRevision: current.value.revision
 });
 if (!updatedType.ok) renderProblem(updatedType.problem);
 ```
@@ -329,15 +348,15 @@ const provision = await response.json();
 const installedBy = "dev.example.catalog";
 const assessment = await connection.assessTypePack({
   provision,
-  installed_by: installedBy
+  installedBy
 });
 if (!assessment.ok) return renderProblem(assessment.problem);
 
 renderDefinitionChanges(assessment.value);
 const applied = await connection.applyTypePack({
   provision,
-  installed_by: installedBy,
-  expected_assessment_digest: assessment.value.assessment_digest
+  installedBy,
+  expectedAssessmentDigest: assessment.value.assessmentDigest
 });
 if (!applied.ok) return renderProblem(applied.problem);
 ```
@@ -467,10 +486,13 @@ is not granted collection-wide type-management access.
 
 The SDK returns typed outcomes, carries successful mdbase diagnostics alongside
 the value, carries revision tokens in typed record results, and accepts
-`if_revision` on mutations. `describe()` exposes
+`ifRevision` on mutations. `describe()` exposes
 JSON Schemas, portable type definitions, canonical collection settings, and
 first-class data contracts. `watch()` resumes from a local collection cursor;
 the Connect server does not store the change feed.
+`queryAll()` treats `timeoutMs` as one deadline for the complete paginated
+query. The caller-driven `queryPages()` iterator instead accepts
+`pageTimeoutMs`, an independent budget for each page, plus a lifetime `signal`.
 `preflightRename()` and `preflightDelete()` run the canonical collection
 operation without changing records or advancing the change cursor, so an app
 can show authoritative reference impact before asking for confirmation.

package/dist/advanced.d.ts

@@ -2,6 +2,8 @@
 export { MdbaseCollectionClient } from "./collection-client.js";
 export type { MdbaseCollectionTransport } from "./operation-types.js";
 export { createPkce } from "./runtime-utils.js";
+export { connectError, connectProblem, operationProblem } from "./errors.js";
+export { connectFailure, connectSuccess } from "./outcomes.js";
 export type { MdbaseApplicationVerificationStore, MdbaseApplicationSessionConnect } from "./application-session.js";
 export { MdbaseSession } from "./session.js";
 export type { MdbaseSessionConnect, MdbaseSessionOptions } from "./session.js";

package/dist/advanced.js

@@ -1,4 +1,6 @@
 /** Low-level construction and test seams. Ordinary applications use the root package. */
 export { MdbaseCollectionClient } from "./collection-client.js";
 export { createPkce } from "./runtime-utils.js";
+export { connectError, connectProblem, operationProblem } from "./errors.js";
+export { connectFailure, connectSuccess } from "./outcomes.js";
 export { MdbaseSession } from "./session.js";

package/dist/application-session.d.ts

@@ -1,13 +1,15 @@
-import { type ApplicationCapabilityId, type JsonObject, type MdbaseAppManifest, type TypePackAssessment } from "@mdbase-dev/connect-protocol";
+import { type ApplicationCapabilityId, type JsonObject, type MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
 import { type MdbaseEffectiveCapabilities } from "./capabilities.js";
 import type { MdbaseAuthorizationOutcome, MdbaseAuthorizeOptions, MdbaseConnection } from "./connection.js";
 import type { MdbaseConnectionInfo } from "./connection-types.js";
 import { type ConnectOutcome, type CollectionTypeProblemCode, type AuthorizationProblemCode, type RegistrationProblemCode, type SessionProblemCode } from "./outcomes.js";
 import type { MdbaseApplicationSelection, MdbaseSelectionHistory } from "./selection.js";
-import type { ConnectRequestOptions } from "./operation-types.js";
+import type { CollectionSetupAssessment, ConfigurationSetupAssessment, ConnectRequestOptions, TypePackAssessment } from "./operation-types.js";
 import { type ResolvedConnectTimeouts } from "./request-budget.js";
+import type { Application } from "./internal-types.js";
 import { type MdbaseSessionConnect, type MdbaseUnavailableReason } from "./session.js";
 export interface MdbaseApplicationSessionConnect<Frontmatter extends JsonObject = JsonObject> extends MdbaseSessionConnect<Frontmatter> {
+    register(options?: ConnectRequestOptions): Promise<ConnectOutcome<Application, RegistrationProblemCode>>;
     manifest(options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAppManifest, RegistrationProblemCode>>;
 }
 export interface MdbaseApplicationSessionOptions {
@@ -35,7 +37,18 @@ export interface MdbaseDefinitionUpdate {
     currentVersion?: string;
     desiredVersion: string;
     resources: TypePackAssessment["resources"];
-    contractSetups: TypePackAssessment["contract_setups"];
+    contractSetups: TypePackAssessment["contractSetups"];
+    canApply: boolean;
+    reason: string;
+}
+export interface MdbaseCollectionSetupUpdate {
+    status: CollectionSetupAssessment["status"];
+    applicable: boolean;
+    assessmentDigest: string;
+    collectionRevision: string;
+    provisionDigest: string;
+    configuration: ConfigurationSetupAssessment[];
+    typePacks: MdbaseDefinitionUpdate[];
     canApply: boolean;
     reason: string;
 }
@@ -54,10 +67,10 @@ export type MdbaseApplicationSessionSnapshot = {
 } | ({
     status: "authorization_required";
 } & ApplicationSessionContext) | ({
-    status: "checking_definitions";
+    status: "checking_setup";
 } & ApplicationSessionContext) | ({
-    status: "definition_review_required";
-    updates: MdbaseDefinitionUpdate[];
+    status: "setup_review_required";
+    update: MdbaseCollectionSetupUpdate;
 } & ApplicationSessionContext) | ({
     status: "ready";
     verification: "cached" | "verified";
@@ -77,7 +90,7 @@ export type MdbaseApplicationSessionSnapshot = {
 /**
  * The application-level lifecycle boundary. It derives authorization from the
  * bundled manifest, exposes semantic capabilities, and never mutates collection
- * definitions without an explicit `applyDefinitionUpdates` call.
+ * setup without an explicit `applyCollectionSetup` call.
  */
 export declare class MdbaseApplicationSession<Frontmatter extends JsonObject = JsonObject> {
     private readonly connect;
@@ -87,14 +100,19 @@ export declare class MdbaseApplicationSession<Frontmatter extends JsonObject = J
     private readonly verificationStore;
     private snapshot;
     private manifest;
+    private application;
     private base;
     private stopBase?;
-    private reviewEntries;
+    private setupAssessment;
     private verificationGeneration;
+    private lifecycleGeneration;
+    private startOperation;
     constructor(connect: MdbaseApplicationSessionConnect<Frontmatter>, options: MdbaseApplicationSessionOptions, timeouts?: ResolvedConnectTimeouts);
     start(options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseApplicationSessionSnapshot, SessionProblemCode>>;
+    private beginStart;
     private startWithinBudget;
     destroy(): void;
+    private cleanupBase;
     getSnapshot(): MdbaseApplicationSessionSnapshot;
     subscribe(listener: () => void): () => void;
     connection(): MdbaseConnection<Frontmatter> | null;
@@ -110,16 +128,18 @@ export declare class MdbaseApplicationSession<Frontmatter extends JsonObject = J
     }, options?: Omit<MdbaseAuthorizeOptions, "operations" | "returnTo" | "target">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
     handleAuthorizationCallback(callbackUrl: string | URL, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseConnection<Frontmatter>, AuthorizationProblemCode>>;
     completeAuthorization(callbackUrl?: string | URL, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseConnection<Frontmatter>, AuthorizationProblemCode>>;
-    ensureCapabilities(capabilities: ApplicationCapabilityId[]): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
+    ensureCapabilities(capabilities: ApplicationCapabilityId[], options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
         kind: "unchanged";
         connection: MdbaseConnection<Frontmatter>;
     }, SessionProblemCode>>;
-    applyDefinitionUpdates(options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseApplicationSessionSnapshot, CollectionTypeProblemCode | "collection_not_ready">>;
+    applyCollectionSetup(options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseApplicationSessionSnapshot, CollectionTypeProblemCode | "collection_not_ready">>;
     private refresh;
-    private verifyDefinitions;
+    private verifySetup;
+    private collectionSetupInput;
     private context;
     private publish;
     private requireBase;
     private requireManifest;
+    private requireApplication;
 }
 export {};

package/dist/application-session.js

@@ -3,7 +3,7 @@ import { capabilityOperations, operationsForApplicationCapabilities } from "@mdb
 import { effectiveCapabilities } from "./capabilities.js";
 import { connectProblem } from "./errors.js";
 import { connectFailure, connectSuccess } from "./outcomes.js";
-import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
+import { createRequestBudget, requestAbortReason, resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
 import { defaultCallbackUrl } from "./runtime-utils.js";
 import { MdbaseSession } from "./session.js";
 export class MdbaseMemoryVerificationStore {
@@ -21,7 +21,7 @@ export class MdbaseMemoryVerificationStore {
 /**
  * The application-level lifecycle boundary. It derives authorization from the
  * bundled manifest, exposes semantic capabilities, and never mutates collection
- * definitions without an explicit `applyDefinitionUpdates` call.
+ * setup without an explicit `applyCollectionSetup` call.
  */
 export class MdbaseApplicationSession {
     connect;
@@ -31,10 +31,13 @@ export class MdbaseApplicationSession {
     verificationStore;
     snapshot = { status: "opening", connections: [] };
     manifest = null;
+    application = null;
     base = null;
     stopBase;
-    reviewEntries = [];
+    setupAssessment = null;
     verificationGeneration = 0;
+    lifecycleGeneration = 0;
+    startOperation = null;
     constructor(connect, options, timeouts = resolveConnectTimeouts()) {
         this.connect = connect;
         this.options = options;
@@ -42,9 +45,42 @@ export class MdbaseApplicationSession {
         this.verificationStore = options.verificationStore ?? defaultVerificationStore();
     }
     start(options) {
-        return withRequestBudget(options, this.timeouts.watchStartMs, (budget) => this.startWithinBudget({ signal: budget.signal, timeoutMs: null }));
+        if (this.base && !this.startOperation)
+            return Promise.resolve(connectSuccess(this.snapshot));
+        const operation = this.startOperation ?? this.beginStart();
+        operation.waiters += 1;
+        return withRequestBudget(options, this.timeouts.watchStartMs, () => operation.promise)
+            .finally(() => {
+            operation.waiters -= 1;
+            if (operation.waiters === 0 && this.startOperation === operation) {
+                operation.controller.abort();
+                this.startOperation = null;
+                this.lifecycleGeneration += 1;
+            }
+        });
+    }
+    beginStart() {
+        this.snapshot = { status: "opening", connections: [] };
+        const controller = new AbortController();
+        const generation = ++this.lifecycleGeneration;
+        const operation = {
+            promise: this.startWithinBudget({ signal: controller.signal, timeoutMs: null }, generation),
+            controller,
+            waiters: 0,
+            generation
+        };
+        this.startOperation = operation;
+        const settled = () => {
+            if (this.startOperation === operation)
+                this.startOperation = null;
+        };
+        operation.promise.then(settled, settled);
+        return operation;
     }
-    async startWithinBudget(options) {
+    async startWithinBudget(options, generation) {
+        const registration = await this.connect.register(options);
+        if (!registration.ok)
+            return registration;
         const manifest = await this.connect.manifest(options);
         if (!manifest.ok)
             return manifest;
@@ -61,24 +97,60 @@ export class MdbaseApplicationSession {
                 }
             }));
         }
+        if (generation !== this.lifecycleGeneration || options.signal?.aborted) {
+            throw requestAbortReason(options.signal ?? new AbortController().signal);
+        }
+        this.application = registration.value;
         this.manifest = manifest.value;
-        this.base = new MdbaseSession(this.connect, {
+        const base = new MdbaseSession(this.connect, {
             selection: this.options.selection,
             autoSelect: this.options.autoSelect,
             operations: operationsForSession(capabilities)
         });
-        this.stopBase = this.base.subscribe(() => this.refresh());
-        const started = await this.base.start(options);
-        if (!started.ok)
-            return started;
-        await this.refresh(true, options);
-        return connectSuccess(this.snapshot);
+        this.base = base;
+        this.stopBase = base.subscribe(() => {
+            if (this.base === base)
+                void this.refresh();
+        });
+        try {
+            const started = await base.start(options);
+            if (!started.ok) {
+                this.cleanupBase(base);
+                return started;
+            }
+            if (generation !== this.lifecycleGeneration || options.signal?.aborted) {
+                throw requestAbortReason(options.signal ?? new AbortController().signal);
+            }
+            await this.refresh(true, options);
+            if (generation !== this.lifecycleGeneration || options.signal?.aborted) {
+                throw requestAbortReason(options.signal ?? new AbortController().signal);
+            }
+            return connectSuccess(this.snapshot);
+        }
+        catch (error) {
+            this.cleanupBase(base);
+            throw error;
+        }
     }
     destroy() {
+        this.lifecycleGeneration += 1;
         this.verificationGeneration += 1;
+        this.startOperation?.controller.abort();
+        this.startOperation = null;
+        if (this.base)
+            this.cleanupBase(this.base);
+        this.application = null;
+        this.manifest = null;
+        this.setupAssessment = null;
+        this.snapshot = { status: "opening", connections: [] };
+        this.listeners.clear();
+    }
+    cleanupBase(base) {
+        if (this.base !== base)
+            return;
         this.stopBase?.();
         this.stopBase = undefined;
-        this.base?.destroy();
+        base.destroy();
         this.base = null;
     }
     getSnapshot() {
@@ -110,7 +182,7 @@ export class MdbaseApplicationSession {
     completeAuthorization(callbackUrl, options) {
         return this.requireBase().handleAuthorizationCallback(callbackUrl === undefined ? defaultCallbackUrl() : String(callbackUrl), options);
     }
-    ensureCapabilities(capabilities) {
+    ensureCapabilities(capabilities, options) {
         const manifestRequirements = this.requireManifest().requirements?.capabilities;
         const declared = new Set([
             ...(manifestRequirements?.required ?? []),
@@ -131,35 +203,42 @@ export class MdbaseApplicationSession {
                 }
             })));
         }
-        return this.requireBase().ensureOperations(operationsForIds(capabilities));
+        return this.requireBase().ensureOperations(operationsForIds(capabilities), options);
     }
-    async applyDefinitionUpdates(options) {
-        if (this.snapshot.status !== "definition_review_required" || this.reviewEntries.length === 0) {
-            return connectFailure(connectProblem("collection_not_ready", "There are no reviewed definition updates to apply."));
+    async applyCollectionSetup(options) {
+        if (this.snapshot.status !== "setup_review_required" || !this.setupAssessment) {
+            return connectFailure(connectProblem("collection_not_ready", "There is no reviewed collection setup to apply."));
         }
-        if (this.reviewEntries.some(({ assessment }) => !assessment.applicable)) {
-            return connectFailure(connectProblem("collection_not_ready", "Resolve the definition conflicts before applying this update."));
+        if (!this.setupAssessment.applicable) {
+            return connectFailure(connectProblem("collection_not_ready", "Resolve the collection setup conflicts before applying this update."));
         }
         const connection = this.connection();
         if (!connection) {
             return connectFailure(connectProblem("collection_not_ready", "The collection is not ready."));
         }
-        for (const { provision, assessment } of this.reviewEntries) {
-            const input = {
-                provision,
-                installed_by: this.requireManifest().id,
-                expected_assessment_digest: assessment.assessment_digest,
-                ...(assessment.status === "downgrade" ? { allow_downgrade: true } : {})
-            };
-            const applied = options
-                ? await connection.applyTypePack(input, options)
-                : await connection.applyTypePack(input);
+        const assessment = this.setupAssessment;
+        const input = {
+            ...this.collectionSetupInput(),
+            expectedAssessmentDigest: assessment.assessmentDigest,
+            expectedCollectionRevision: assessment.collectionRevision,
+            expectedProvisionDigest: assessment.provisionDigest,
+            allowTypePackDowngrades: assessment.typePacks
+                .filter((pack) => pack.status === "downgrade")
+                .map((pack) => pack.desired.id)
+        };
+        const budget = createRequestBudget(options, this.timeouts.requestMs);
+        const requestOptions = { signal: budget.signal, timeoutMs: null };
+        try {
+            const applied = await connection.applyCollectionSetup(input, requestOptions);
             if (!applied.ok)
                 return applied;
+            this.setupAssessment = null;
+            await this.verifySetup(this.context(connection), ++this.verificationGeneration, requestOptions);
+            return connectSuccess(this.snapshot);
+        }
+        finally {
+            budget.dispose();
         }
-        this.reviewEntries = [];
-        await this.verifyDefinitions(this.context(connection), ++this.verificationGeneration, options);
-        return connectSuccess(this.snapshot);
     }
     async refresh(awaitVerification = false, options) {
         if (!this.base || !this.manifest)
@@ -167,7 +246,7 @@ export class MdbaseApplicationSession {
         const current = this.base.getSnapshot();
         this.verificationGeneration += 1;
         const generation = this.verificationGeneration;
-        this.reviewEntries = [];
+        this.setupAssessment = null;
         if (current.status === "unselected") {
             this.publish({ status: "unselected", connections: current.connections });
             return;
@@ -181,12 +260,9 @@ export class MdbaseApplicationSession {
             this.publish({ status: "authorization_required", ...context });
             return;
         }
-        const managesDefinitions = this.manifest.requirements?.capabilities?.required
-            .includes("definitions.type-pack.apply") ?? false;
-        const provisions = managesDefinitions
-            ? this.manifest.provisions?.type_packs ?? []
-            : [];
-        if (provisions.length === 0) {
+        const managesSetup = this.manifest.requirements?.capabilities?.required
+            .includes("collection.setup.apply") ?? false;
+        if (!managesSetup) {
             this.publish({ status: "ready", verification: "verified", ...context });
             return;
         }
@@ -195,46 +271,34 @@ export class MdbaseApplicationSession {
             this.publish({ status: "ready", verification: "cached", ...context });
         }
         else {
-            this.publish({ status: "checking_definitions", ...context });
+            this.publish({ status: "checking_setup", ...context });
         }
-        const verification = this.verifyDefinitions(context, generation, options);
+        const verification = this.verifySetup(context, generation, options);
         if (awaitVerification)
             await verification;
     }
-    async verifyDefinitions(context, generation, options) {
+    async verifySetup(context, generation, options) {
         const connection = this.connection();
         const manifest = this.requireManifest();
         if (!connection || connection.collectionId !== context.collectionId)
             return;
-        const entries = [];
-        const managesDefinitions = manifest.requirements?.capabilities?.required
-            .includes("definitions.type-pack.apply") ?? false;
-        for (const provision of managesDefinitions ? manifest.provisions?.type_packs ?? [] : []) {
-            const input = {
-                provision,
-                installed_by: manifest.id
-            };
-            const outcome = options
-                ? await connection.assessTypePack(input, options)
-                : await connection.assessTypePack(input);
-            if (generation !== this.verificationGeneration)
-                return;
-            if (!outcome.ok) {
-                this.publish({ status: "blocked", problem: outcome.problem, ...context });
-                return;
-            }
-            if (outcome.value.status !== "current") {
-                entries.push({ provision, assessment: outcome.value });
-            }
+        const outcome = options
+            ? await connection.assessCollectionSetup(this.collectionSetupInput(), options)
+            : await connection.assessCollectionSetup(this.collectionSetupInput());
+        if (generation !== this.verificationGeneration)
+            return;
+        if (!outcome.ok) {
+            this.publish({ status: "blocked", problem: outcome.problem, ...context });
+            return;
         }
         if (generation !== this.verificationGeneration)
             return;
-        if (entries.length > 0) {
-            this.reviewEntries = entries;
+        if (outcome.value.status !== "current") {
+            this.setupAssessment = outcome.value;
             this.verificationStore.remove(verificationKey(manifest, context.collectionId));
             this.publish({
-                status: "definition_review_required",
-                updates: entries.map(definitionUpdate),
+                status: "setup_review_required",
+                update: collectionSetupUpdate(outcome.value, manifest.provisions?.type_packs ?? []),
                 ...context
             });
             return;
@@ -242,6 +306,21 @@ export class MdbaseApplicationSession {
         this.verificationStore.write(verificationKey(manifest, context.collectionId), verificationValue(manifest));
         this.publish({ status: "ready", verification: "verified", ...context });
     }
+    collectionSetupInput() {
+        const manifest = this.requireManifest();
+        const application = this.requireApplication();
+        return {
+            applicationId: declarationIdFromFamilyIdentity(application.family_identity),
+            declarationDigest: `sha256:${application.manifest_digest}`,
+            requirements: {
+                configuration: manifest.requirements?.configuration ?? []
+            },
+            provisions: {
+                configuration: manifest.provisions?.configuration ?? [],
+                typePacks: manifest.provisions?.type_packs ?? []
+            }
+        };
+    }
     context(connection) {
         const info = connection.info();
         return {
@@ -268,6 +347,11 @@ export class MdbaseApplicationSession {
             throw new Error("Start the application session before using it.");
         return this.manifest;
     }
+    requireApplication() {
+        if (!this.application)
+            throw new Error("Start the application session before using it.");
+        return this.application;
+    }
 }
 function operationsForSession(requirements) {
     return operationsForApplicationCapabilities(requirements);
@@ -276,8 +360,7 @@ function operationsForIds(capabilities) {
     const definitions = capabilities.flatMap((id) => capabilityOperations(id));
     return [...new Set(definitions)];
 }
-function definitionUpdate(entry) {
-    const { assessment } = entry;
+function definitionUpdate(provision, assessment) {
     const statusReason = assessment.status === "conflict"
         ? "Existing user-owned resources conflict with this application definition pack."
         : assessment.status === "install"
@@ -285,27 +368,59 @@ function definitionUpdate(entry) {
             : `This collection has a ${assessment.status} definition change to review.`;
     return {
         id: assessment.desired.id,
-        name: entry.provision.manifest.name ?? assessment.desired.id,
+        name: provision.manifest.name ?? assessment.desired.id,
         status: assessment.status,
         applicable: assessment.applicable,
-        assessmentDigest: assessment.assessment_digest,
+        assessmentDigest: assessment.assessmentDigest,
         ...(assessment.current ? { currentVersion: assessment.current.version } : {}),
         desiredVersion: assessment.desired.version,
         resources: assessment.resources,
-        contractSetups: assessment.contract_setups,
+        contractSetups: assessment.contractSetups,
         canApply: assessment.applicable,
         reason: statusReason
     };
 }
+function collectionSetupUpdate(assessment, provisions) {
+    const typePacks = assessment.typePacks.map((pack) => {
+        const provision = provisions.find((candidate) => candidate.manifest.id === pack.desired.id);
+        if (!provision) {
+            throw new Error(`Collection setup returned undeclared type pack '${pack.desired.id}'.`);
+        }
+        return definitionUpdate(provision, pack);
+    });
+    const configurationChanges = assessment.configuration.filter((entry) => entry.action !== "current").length;
+    const reason = assessment.status === "conflict"
+        ? "Existing collection policy conflicts with this application's required setup."
+        : `This application requires ${configurationChanges} configuration change${configurationChanges === 1 ? "" : "s"} and ${typePacks.length} definition update${typePacks.length === 1 ? "" : "s"}.`;
+    return {
+        status: assessment.status,
+        applicable: assessment.applicable,
+        assessmentDigest: assessment.assessmentDigest,
+        collectionRevision: assessment.collectionRevision,
+        provisionDigest: assessment.provisionDigest,
+        configuration: assessment.configuration,
+        typePacks,
+        canApply: assessment.applicable,
+        reason
+    };
+}
 function verificationKey(manifest, collectionId) {
     return `mdbase-application-session:v1:${manifest.id}:${collectionId}`;
 }
 function verificationValue(manifest) {
     return JSON.stringify({
         capabilities: manifest.requirements?.capabilities,
-        provisions: manifest.provisions?.type_packs ?? []
+        requirements: manifest.requirements?.configuration ?? [],
+        provisions: manifest.provisions ?? {}
     });
 }
+function declarationIdFromFamilyIdentity(familyIdentity) {
+    const prefix = "bundle:";
+    if (!familyIdentity.startsWith(prefix) || familyIdentity.length === prefix.length) {
+        throw new Error("The registered application has no valid declaration identity.");
+    }
+    return familyIdentity.slice(prefix.length);
+}
 function defaultVerificationStore() {
     if (typeof localStorage !== "undefined") {
         return {