@mdbase-dev/connect 0.1.0-beta.56 → 0.1.0-beta.57

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-fZeP3Z5L7qaOmLPO0ST72DyQgwJCq0XaamP4LFUHOTWxA2MTeF4eerxdIfULZkEq
+sha384-4Lyda0FLrTi1k549p7spkiOUvz9jT9v7sm+BUgVC4uwPVgyZgY8o6aJlDd+H45xY

package/dist/connect.d.ts

@@ -53,8 +53,6 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     removeToken(collectionId: string, keyHandle?: string, reason?: MdbaseUnavailableReason, discardPending?: boolean): void;
     tokenKey(collectionId: string): string;
     pendingMutationKey(collectionId: string): string;
-    private removePendingMutations;
-    private pendingMutationsUseKey;
     notificationKey(collectionId: string, transport?: "web_push" | "fcm"): string;
     directPreferenceKey(): string;
     defaultApplicationOrigin(): string;

package/dist/connect.js

@@ -8,6 +8,7 @@ import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
 import { connectError, serverConnectError } from "./errors.js";
 import { DEFAULT_OPERATIONS } from "./internal-types.js";
 import { uniqueOperations } from "./operation-helpers.js";
+import { pendingMutationsUseKey, pendingRecoveryTransports, removePendingMutations } from "./pending-recovery-transports.js";
 import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
 import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
 import { storedTokenFromResponse } from "./token-response.js";
@@ -211,7 +212,7 @@ export class MdbaseConnectInternals {
             redirect_uri: this.redirectUri,
             state,
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files),
+            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId)),
             requested_operations: operations,
             ...(application.requirements?.files
                 ? { requested_files: application.requirements.files }
@@ -312,7 +313,7 @@ export class MdbaseConnectInternals {
             issued_at: issuedAt.toISOString(),
             expires_at: new Date(issuedAt.getTime() + 10 * 60 * 1_000).toISOString(),
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files),
+            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined)),
             requested_operations: operations,
             ...(application.requirements?.files
                 ? { requested_files: application.requirements.files }
@@ -631,12 +632,14 @@ export class MdbaseConnectInternals {
     }
     removeToken(collectionId, keyHandle, reason = "authorization_lost", discardPending = false) {
         this.invalidatedConnections.set(collectionId, reason);
-        if (keyHandle && (discardPending || !this.pendingMutationsUseKey(collectionId, keyHandle))) {
+        if (keyHandle && (discardPending || !pendingMutationsUseKey(this.storage, this.pendingMutationKey(collectionId), keyHandle))) {
             void this.keyStore.delete(keyHandle).catch(() => undefined);
         }
         this.storage.removeItem(this.tokenKey(collectionId));
         if (discardPending)
-            this.removePendingMutations(collectionId);
+            removePendingMutations(this.storage, this.pendingMutationKey(collectionId), (pendingKeyHandle) => {
+                void this.keyStore.delete(pendingKeyHandle).catch(() => undefined);
+            });
         for (const transport of ["web_push", "fcm"]) {
             this.storage.removeItem(this.notificationKey(collectionId, transport));
         }
@@ -653,33 +656,6 @@ export class MdbaseConnectInternals {
     pendingMutationKey(collectionId) {
         return `${this.storagePrefix()}:pending-mutation:${collectionId}`;
     }
-    removePendingMutations(collectionId) {
-        const baseKey = this.pendingMutationKey(collectionId);
-        const keys = [baseKey];
-        for (let index = 0; index < this.storage.length; index += 1) {
-            const key = this.storage.key(index);
-            if (key?.startsWith(`${baseKey}:`))
-                keys.push(key);
-        }
-        for (const key of keys) {
-            const pending = parseStored(this.storage.getItem(key));
-            if (pending?.keyHandle)
-                void this.keyStore.delete(pending.keyHandle).catch(() => undefined);
-            this.storage.removeItem(key);
-        }
-    }
-    pendingMutationsUseKey(collectionId, keyHandle) {
-        const baseKey = this.pendingMutationKey(collectionId);
-        for (let index = 0; index < this.storage.length; index += 1) {
-            const key = this.storage.key(index);
-            if (key !== baseKey && !key?.startsWith(`${baseKey}:`))
-                continue;
-            const pending = parseStored(this.storage.getItem(key));
-            if (pending?.keyHandle === keyHandle)
-                return true;
-        }
-        return false;
-    }
     notificationKey(collectionId, transport = "web_push") {
         return `${this.storagePrefix()}:notifications:${collectionId}:${transport}`;
     }

package/dist/connection-transport.js

@@ -266,7 +266,9 @@ export class ConnectionTransport {
                 throw error;
             }
         }
-        if (body?.protocol_version !== OPERATION_TRANSPORT_PROTOCOL_VERSION
+        const expectedProtocol = attempt.pendingMutationRecord?.request?.protocol_version
+            ?? OPERATION_TRANSPORT_PROTOCOL_VERSION;
+        if (body?.protocol_version !== expectedProtocol
             || body?.request_id !== attempt.requestId) {
             if (attempt.pendingMutation)
                 throw unknownMutationOutcome(attempt.requestId, new Error("Operation response protocol or request ID did not match."));

package/dist/crypto.js

@@ -161,8 +161,14 @@ export async function encryptRelayRequest(store, handle, binding, operation, inp
     validateGrantEncryption(binding.encryption);
     const record = await requireAgreementKey(store, handle, binding.encryption.application_agreement_public_key);
     const counter = await store.nextCounter(handle);
-    const metadata = { binding, requestId, operation, counter };
-    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, "request");
+    const metadata = {
+        binding,
+        protocolVersion: OPERATION_TRANSPORT_PROTOCOL_VERSION,
+        requestId,
+        operation,
+        counter
+    };
+    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, metadata.protocolVersion, "request");
     const plaintext = new TextEncoder().encode(JSON.stringify(input ?? {}));
     const ciphertext = await crypto.subtle.encrypt({
         name: "AES-GCM",
@@ -183,11 +189,12 @@ export async function decryptRelayResponse(store, handle, binding, request, resp
     const record = await requireAgreementKey(store, handle, binding.encryption.application_agreement_public_key);
     const metadata = {
         binding,
+        protocolVersion: request.protocol_version,
         requestId: request.request_id,
         operation: request.operation,
         counter: request.counter
     };
-    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, "response");
+    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, request.protocol_version, "response");
     try {
         const plaintext = await crypto.subtle.decrypt({
             name: "AES-GCM",
@@ -246,10 +253,10 @@ async function requireSigningKey(store, handle, expectedPublicKey) {
     }
     return record;
 }
-async function deriveDirectionalKey(privateKey, binding, direction) {
+async function deriveDirectionalKey(privateKey, binding, protocolVersion, direction) {
     const shared = await deriveP256SharedSecret(privateKey, binding.encryption.connector_agreement_public_key);
     const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
-    const contextBytes = new TextEncoder().encode(context(binding));
+    const contextBytes = new TextEncoder().encode(context(binding, protocolVersion));
     const salt = await crypto.subtle.digest("SHA-256", contextBytes);
     return crypto.subtle.deriveKey({
         name: "HKDF",
@@ -268,11 +275,11 @@ export async function deriveP256SharedSecret(privateKey, peerPublicKey) {
         throw new RelayCryptoError("invalid_public_key", "The connector relay public key is invalid.");
     }
 }
-function context(binding) {
+function context(binding, protocolVersion) {
     const value = binding.encryption;
     return [
         "mdbase-connect",
-        OPERATION_TRANSPORT_PROTOCOL_VERSION,
+        protocolVersion,
         value.suite,
         binding.grantId,
         binding.applicationId,
@@ -283,12 +290,18 @@ function context(binding) {
     ].join("|");
 }
 function aad(metadata, direction) {
-    return [context(metadata.binding), metadata.requestId, direction, metadata.operation, metadata.counter].join("|");
+    return [
+        context(metadata.binding, metadata.protocolVersion),
+        metadata.requestId,
+        direction,
+        metadata.operation,
+        metadata.counter
+    ].join("|");
 }
 function envelopeMetadata(metadata) {
     const encryption = metadata.binding.encryption;
     return {
-        protocol_version: OPERATION_TRANSPORT_PROTOCOL_VERSION,
+        protocol_version: metadata.protocolVersion,
         suite: RELAY_ENCRYPTION_SUITE,
         request_id: metadata.requestId,
         grant_id: metadata.binding.grantId,

package/dist/pending-recovery-transports.d.ts

@@ -0,0 +1,4 @@
+import type { CollectionOperation, OperationTransportProtocolVersion } from "@mdbase-dev/connect-protocol";
+export declare function pendingRecoveryTransports(storage: Storage, storagePrefix: string, operations: readonly CollectionOperation[], collectionId?: string): OperationTransportProtocolVersion[];
+export declare function pendingMutationsUseKey(storage: Storage, baseKey: string, keyHandle: string): boolean;
+export declare function removePendingMutations(storage: Storage, baseKey: string, removeKey: (keyHandle: string) => void): void;

package/dist/pending-recovery-transports.js

@@ -0,0 +1,48 @@
+import { isSupportedOperationTransport, OPERATION_TRANSPORT_PROTOCOL_VERSION } from "@mdbase-dev/connect-protocol";
+import { parseStored } from "./runtime-utils.js";
+export function pendingRecoveryTransports(storage, storagePrefix, operations, collectionId) {
+    const prefix = `${storagePrefix}:pending-mutation:`;
+    const versions = new Set();
+    for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index);
+        if (!key?.startsWith(prefix))
+            continue;
+        const pending = parseStored(storage.getItem(key));
+        if (!pending
+            || !operations.includes(pending.operation)
+            || (collectionId && pending.collectionId !== collectionId))
+            continue;
+        const version = pending.envelope?.protocol_version ?? pending.request?.protocol_version;
+        if (version !== undefined
+            && version !== OPERATION_TRANSPORT_PROTOCOL_VERSION
+            && isSupportedOperationTransport(version)) {
+            versions.add(version);
+        }
+    }
+    return [...versions].sort((left, right) => right - left);
+}
+export function pendingMutationsUseKey(storage, baseKey, keyHandle) {
+    for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index);
+        if (key !== baseKey && !key?.startsWith(`${baseKey}:`))
+            continue;
+        const pending = parseStored(storage.getItem(key));
+        if (pending?.keyHandle === keyHandle)
+            return true;
+    }
+    return false;
+}
+export function removePendingMutations(storage, baseKey, removeKey) {
+    const keys = [baseKey];
+    for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index);
+        if (key?.startsWith(`${baseKey}:`))
+            keys.push(key);
+    }
+    for (const key of keys) {
+        const pending = parseStored(storage.getItem(key));
+        if (pending?.keyHandle)
+            removeKey(pending.keyHandle);
+        storage.removeItem(key);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.56",
+  "version": "0.1.0-beta.57",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.56"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.57"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",