@mdbase-dev/connect 0.1.0-beta.92 → 0.1.0-beta.94

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-G9S7H692RFcmy7JJ8CrePVKzJb4fvERv7ZfJfsbaNMtdu0ffE1SRdTgZAyhrMtJk
+sha384-kDjazWo3W17cBn4WByvZ0jGGc1aqQxNTWglefSAMrEoEzGRgo8YNzRYSI3sQb8tx

package/dist/capabilities.js

@@ -36,22 +36,16 @@ function effectiveCapability(id, required, manifest, connection) {
             reason: "The current grant does not include every operation for this capability."
         };
     }
-    if (id === "definitions.contracts.current"
-        && connection.scope.access !== "full_collection") {
-        const approved = new Set(connection.scope.contracts.map(({ id, version, digest }) => `${id}@${version}:${digest}`));
-        const missingContracts = (manifest.requirements?.contracts ?? []).filter(({ id, version, digest }) => !approved.has(`${id}@${version}:${digest}`));
-        if (missingContracts.length > 0) {
-            return {
-                ...base,
-                state: "requires_authorization",
-                reason: "The current grant does not approve the exact required contract definitions.",
-                evidence: [...base.evidence, {
-                        source: "authorization",
-                        fact: `Missing ${missingContracts.map(({ id, version }) => `${id}@${version}`).join(", ")}.`
-                    }],
-                details: { missingContracts }
-            };
-        }
+    if (connection.scope.access !== "full_collection") {
+        return {
+            ...base,
+            state: "requires_authorization",
+            reason: "The current grant uses legacy contract scope and must be reauthorized for the entire collection.",
+            evidence: [...base.evidence, {
+                    source: "authorization",
+                    fact: "Legacy contract scope is compatibility evidence, not active data authority."
+                }]
+        };
     }
     if (id.startsWith("files.")) {
         const action = id.slice("files.".length);

package/dist/connect.js

@@ -7,7 +7,7 @@ import { MdbaseConnection } from "./connection.js";
 import { addConnectionId, connectionIds, removeConnectionId } from "./connection-index.js";
 import { authorizationAbort, declarationIdFromFamilyIdentity } from "./connect-authorization-helpers.js";
 import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
-import { connectError, serverConnectError } from "./errors.js";
+import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
 import { DEFAULT_OPERATIONS } from "./internal-types.js";
 import { prepareAuthorizationWindow, publishPopupAuthorizationCompletion, waitForPopupAuthorization } from "./popup-authorization.js";
 import { uniqueOperations } from "./operation-helpers.js";
@@ -607,15 +607,25 @@ export class MdbaseConnectInternals {
         }
         const previous = parseStored(this.storage.getItem(this.tokenKey(collectionId)));
         const retirement = planRetiredGrantKeys(this.storage, this.pendingMutationKey(collectionId), previous, keyHandle, this.grantKeyLeases.handles(collectionId), this.grantKeyLeases.retainAutomaticallyRetiredKeys);
-        const token = storedTokenFromResponse({
-            body,
-            clientId,
-            keyHandle,
-            previous,
-            retiredKeyHandles: retirement.retained,
-            defaultApplicationOrigin: this.defaultApplicationOrigin(),
-            pinConnectorIdentity: (connectorId, publicKey) => this.pinConnectorIdentity(connectorId, publicKey)
-        });
+        let token;
+        try {
+            token = storedTokenFromResponse({
+                body,
+                clientId,
+                keyHandle,
+                previous,
+                retiredKeyHandles: retirement.retained,
+                defaultApplicationOrigin: this.defaultApplicationOrigin(),
+                pinConnectorIdentity: (connectorId, publicKey) => this.pinConnectorIdentity(connectorId, publicKey)
+            });
+        }
+        catch (error) {
+            if (error instanceof MdbaseConnectError
+                && error.code === "legacy_scope_reauthorization_required") {
+                this.removeToken(collectionId, keyHandle, error.code);
+            }
+            throw error;
+        }
         this.storage.setItem(this.tokenKey(collectionId), JSON.stringify(token));
         for (const handle of retirement.disposable)
             this.deleteGrantKeyWhenUnused(collectionId, handle);

package/dist/connection-transport-internals.d.ts

@@ -3,7 +3,7 @@ import type { StoredToken } from "./internal-types.js";
 import type { ResolvedConnectTimeouts } from "./request-budget.js";
 export interface ConnectionTransportInternals {
     readonly relayEncryption: "required" | "disabled";
-    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant", discardPending?: boolean): void;
+    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant" | "legacy_scope_reauthorization_required", discardPending?: boolean): void;
     storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
     acquireGrantKeyLease(collectionId: string, keyHandle: string, signal?: AbortSignal): Promise<() => void>;
     deleteGrantKeyWhenUnused(collectionId: string, keyHandle: string): void;

package/dist/connection-transport.js

@@ -650,7 +650,7 @@ export class ConnectionTransport {
             stored: this.storage.getItem(this.internals.tokenKey(this.collectionId)),
             collectionId: this.collectionId,
             relayEncryption: this.internals.relayEncryption,
-            invalidate: (keyHandle) => this.internals.removeToken(this.collectionId, keyHandle, "invalid_stored_grant"),
+            invalidate: (keyHandle, reason = "invalid_stored_grant") => this.internals.removeToken(this.collectionId, keyHandle, reason),
             directCapable: (token) => this.directCapable(token)
         });
     }

package/dist/operation-types.d.ts

@@ -138,8 +138,9 @@ export interface QuerySummary {
 /** Application-facing form of the canonical mdbase v0.3 query schema. */
 export interface QueryInput {
     /**
-     * Contract-scoped queries accept only `types`, `timezone`, pagination,
-     * `frontmatterMode`, and `contract`; filter normalized fields in the app.
+     * Queries using a semantic contract view accept only `types`, `timezone`,
+     * pagination, `frontmatterMode`, and `contract`; filter normalized fields in
+     * the app.
      */
     types?: string[];
     /** IANA timezone used for calendar semantics in this invocation. */
@@ -166,7 +167,7 @@ export interface QueryInput {
     snapshot?: string;
     includeBody?: boolean;
     frontmatterMode?: "effective" | "persisted" | "both";
-    /** Narrow a contract-scoped query to one exact contract/provider view. */
+    /** Select one exact semantic contract/provider view for this query. */
     contract?: DataContractSelector;
 }
 export interface QueryResult<Record extends JsonObject = JsonObject> {

package/dist/outcomes.d.ts

@@ -18,14 +18,14 @@ export declare const COMMON_OPERATION_PROBLEM_CODES: readonly ["access_denied",
 export declare const ALL_CONNECT_PROBLEM_CODES: ConnectProblemCode[];
 export type RegistrationProblemCode = "discovery_failed" | "invalid_operation_response" | "invalid_application_manifest" | "invalid_request" | "manifest_load_failed" | "rate_limited" | "temporarily_unavailable" | "timeout";
 export declare const REGISTRATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout"];
-export type AuthorizationProblemCode = RegistrationProblemCode | "access_denied" | "application_declaration_mismatch" | "application_identity_unavailable" | "approval_window_blocked" | "authorization_binding_incompatible" | "authorization_cancelled" | "authorization_replayed" | "browser_required" | "capability_contract_incompatible" | "collection_access_denied" | "collection_configuration_invalid" | "collection_contracts_missing" | "collection_incompatible" | "collection_invalid" | "collection_kind_unsupported" | "collection_mismatch" | "collection_not_found" | "collection_type_registry_invalid" | "collection_version_unsupported" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "device_authorization_failed" | "durable_mutation_unsupported" | "encryption_required" | "expired_token" | "invalid_application_authorization" | "invalid_callback" | "invalid_device_authorization_response" | "invalid_token_response" | "scope_denied" | "reconnect_required" | "token_exchange_failed" | "transport_protocol_incompatible";
-export declare const AUTHORIZATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible"];
+export type AuthorizationProblemCode = RegistrationProblemCode | "access_denied" | "application_declaration_mismatch" | "application_identity_unavailable" | "approval_window_blocked" | "authorization_binding_incompatible" | "authorization_cancelled" | "authorization_replayed" | "browser_required" | "capability_contract_incompatible" | "collection_access_denied" | "collection_configuration_invalid" | "collection_contracts_missing" | "collection_incompatible" | "collection_invalid" | "collection_kind_unsupported" | "collection_mismatch" | "collection_not_found" | "collection_type_registry_invalid" | "collection_version_unsupported" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "device_authorization_failed" | "durable_mutation_unsupported" | "encryption_required" | "expired_token" | "invalid_application_authorization" | "invalid_callback" | "invalid_device_authorization_response" | "invalid_token_response" | "legacy_scope_reauthorization_required" | "scope_denied" | "reconnect_required" | "token_exchange_failed" | "transport_protocol_incompatible";
+export declare const AUTHORIZATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "legacy_scope_reauthorization_required", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible"];
 export type NotificationProblemCode = RegistrationProblemCode | "authorization_expired" | "invalid_operation_response" | "invalid_push_subscription" | "managed_fcm_not_declared" | "not_authorized" | "notification_criterion_not_declared" | "notification_reauthorization_required" | "notification_registration_failed" | "notification_unregistration_failed" | "notifications_not_declared" | "notifications_unavailable";
 export declare const NOTIFICATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "authorization_expired", "invalid_operation_response", "invalid_push_subscription", "managed_fcm_not_declared", "not_authorized", "notification_criterion_not_declared", "notification_reauthorization_required", "notification_registration_failed", "notification_unregistration_failed", "notifications_not_declared", "notifications_unavailable"];
 export type DirectAccessProblemCode = "connector_offline" | "connector_upgrade_required" | "invalid_operation_response" | "not_authorized" | "operation_failed" | "temporarily_unavailable" | "timeout";
 export declare const DIRECT_ACCESS_PROBLEM_CODES: readonly ["connector_offline", "connector_upgrade_required", "invalid_operation_response", "not_authorized", "operation_failed", "temporarily_unavailable", "timeout"];
 export type SessionProblemCode = AuthorizationProblemCode | "collection_not_ready" | "collection_not_selected" | "operation_cancelled" | "session_destroyed" | "session_not_started" | "session_starting" | "unknown_collection";
-export declare const SESSION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible", "collection_not_ready", "collection_not_selected", "operation_cancelled", "session_destroyed", "session_not_started", "session_starting", "unknown_collection"];
+export declare const SESSION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "legacy_scope_reauthorization_required", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible", "collection_not_ready", "collection_not_selected", "operation_cancelled", "session_destroyed", "session_not_started", "session_starting", "unknown_collection"];
 export type CollectionSetupProblemCode = "collection_configuration_invalid" | "collection_invalid" | "collection_type_registry_invalid" | "collection_version_unsupported";
 export type CollectionDescriptionProblemCode = CommonOperationProblemCode | CollectionSetupProblemCode;
 export type CollectionReadProblemCode = CollectionDescriptionProblemCode | "invalid_path" | "operation_invalid";

package/dist/outcomes.js

@@ -78,6 +78,7 @@ export const AUTHORIZATION_PROBLEM_CODES = [
     "invalid_callback",
     "invalid_device_authorization_response",
     "invalid_token_response",
+    "legacy_scope_reauthorization_required",
     "scope_denied",
     "reconnect_required",
     "token_exchange_failed",

package/dist/runtime-utils.d.ts

@@ -20,7 +20,10 @@ export declare function validFileCapability(value: unknown): value is FileCapabi
 export declare function validStoredEncryption(encryption: StoredToken["encryption"], collectionId: string): encryption is GrantEncryption;
 export declare function parseDeviceAuthorization(body: any): MdbaseDeviceAuthorization;
 export declare function parseStored<T>(value: string | null): T | null;
+/** Parse both canonical and N-1 grant shapes so callers can diagnose legacy grants. */
 export declare function parseGrantScope(value: unknown): GrantScope | null;
+/** Only this scope authorizes application data access. */
+export declare function isCanonicalGrantScope(scope: GrantScope): boolean;
 export declare function stripTrailingSlash(value: string): string;
 export declare function defaultManifestSource(): string;
 export declare function defaultRedirectUri(): string;

package/dist/runtime-utils.js

@@ -215,6 +215,7 @@ export function parseStored(value) {
         return null;
     }
 }
+/** Parse both canonical and N-1 grant shapes so callers can diagnose legacy grants. */
 export function parseGrantScope(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return null;
@@ -246,6 +247,10 @@ export function parseGrantScope(value) {
         return null;
     return scope;
 }
+/** Only this scope authorizes application data access. */
+export function isCanonicalGrantScope(scope) {
+    return scope.access === "full_collection" && scope.contracts.length === 0;
+}
 export function stripTrailingSlash(value) {
     return value.endsWith("/") ? value.slice(0, -1) : value;
 }

package/dist/session.d.ts

@@ -17,7 +17,7 @@ export interface MdbaseSessionOptions {
     operations?: CollectionOperation[];
     autoSelect?: "only" | "never";
 }
-export type MdbaseUnavailableReason = "not_authorized" | "authorization_lost" | "invalid_stored_grant";
+export type MdbaseUnavailableReason = "not_authorized" | "authorization_lost" | "invalid_stored_grant" | "legacy_scope_reauthorization_required";
 export type MdbaseSessionSnapshot<Frontmatter extends JsonObject = JsonObject> = {
     status: "not_started";
     connections: MdbaseConnectionInfo[];

package/dist/stored-token.d.ts

@@ -3,7 +3,7 @@ interface ReadStoredTokenOptions {
     stored: string | null;
     collectionId: string;
     relayEncryption: "required" | "disabled";
-    invalidate(keyHandle?: string): void;
+    invalidate(keyHandle?: string, reason?: "invalid_stored_grant" | "legacy_scope_reauthorization_required"): void;
     directCapable(token: StoredToken): boolean;
 }
 export declare function readStoredToken({ stored, collectionId, relayEncryption, invalidate, directCapable }: ReadStoredTokenOptions): StoredToken | null;

package/dist/stored-token.js

@@ -1,8 +1,8 @@
-import { parseGrantScope, parseStored, validFileCapability, validStoredAuthority, validStoredEncryption } from "./runtime-utils.js";
+import { isCanonicalGrantScope, parseGrantScope, parseStored, validFileCapability, validStoredAuthority, validStoredEncryption } from "./runtime-utils.js";
 export function readStoredToken({ stored, collectionId, relayEncryption, invalidate, directCapable }) {
     const token = parseStored(stored);
-    const reject = (keyHandle) => {
-        invalidate(typeof keyHandle === "string" ? keyHandle : undefined);
+    const reject = (keyHandle, reason = "invalid_stored_grant") => {
+        invalidate(typeof keyHandle === "string" ? keyHandle : undefined, reason);
         return null;
     };
     if (!token) {
@@ -27,8 +27,12 @@ export function readStoredToken({ stored, collectionId, relayEncryption, invalid
         || (token.refreshExpiresAt !== undefined
             && (typeof token.refreshExpiresAt !== "number" || !Number.isFinite(token.refreshExpiresAt))))
         return reject(token.keyHandle);
-    if (!parseGrantScope(token.scope))
+    const scope = parseGrantScope(token.scope);
+    if (!scope)
         return reject(token.keyHandle);
+    if (!isCanonicalGrantScope(scope)) {
+        return reject(token.keyHandle, "legacy_scope_reauthorization_required");
+    }
     if (token.fileCapability && !validFileCapability(token.fileCapability)) {
         return reject(token.keyHandle);
     }

package/dist/token-response.js

@@ -1,6 +1,6 @@
 import { validateGrantEncryption } from "./crypto.js";
 import { connectError } from "./errors.js";
-import { parseGrantScope, validAuthorityTokenResponse, validFileCapability } from "./runtime-utils.js";
+import { isCanonicalGrantScope, parseGrantScope, validAuthorityTokenResponse, validFileCapability } from "./runtime-utils.js";
 export function storedTokenFromResponse({ body, clientId, keyHandle, previous, retiredKeyHandles, defaultApplicationOrigin, pinConnectorIdentity }) {
     const collectionId = body.collection_id;
     if (typeof collectionId !== "string") {
@@ -10,6 +10,9 @@ export function storedTokenFromResponse({ body, clientId, keyHandle, previous, r
     if (!scope) {
         throw connectError("invalid_token_response", "Authorization returned no valid collection scope.");
     }
+    if (!isCanonicalGrantScope(scope)) {
+        throw connectError("legacy_scope_reauthorization_required", "Authorization returned a legacy contract-scoped grant. Reauthorize for the entire collection.");
+    }
     if (body.authority && !validAuthorityTokenResponse(body.authority, collectionId)) {
         throw connectError("invalid_token_response", "Authorization returned an invalid remote authority capability.");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.92",
+  "version": "0.1.0-beta.94",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.92"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.94"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",