@mdbase-dev/connect 0.1.0-beta.93 → 0.1.0-beta.95

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-G9S7H692RFcmy7JJ8CrePVKzJb4fvERv7ZfJfsbaNMtdu0ffE1SRdTgZAyhrMtJk
+sha384-pt5qe5l2IuGgDjsId1oPNVT/zCR+0TLeEJNt6xKdZQSxAACXxaCqoxbZd37EriJh

package/dist/capabilities.d.ts

@@ -1,4 +1,5 @@
-import { type ApplicationCapabilityId, type ApplicationCapabilityRequirements, type MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import { type ApplicationCapabilityRequirements, type LegacyApplicationCapabilityRequirements } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationCapabilityId as ApplicationCapabilityId, MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import type { MdbaseConnectionInfo } from "./connection-types.js";
 export type MdbaseCapabilityState = "available" | "requires_authorization" | "requires_setup" | "temporarily_unavailable" | "unsupported";
 export interface MdbaseCapabilityEvidence {
@@ -16,8 +17,8 @@ export interface MdbaseEffectiveCapability {
     details?: Record<string, unknown>;
 }
 export interface MdbaseEffectiveCapabilities {
-    contractVersion: 1;
+    contractVersion: 1 | 2;
     values: Partial<Record<ApplicationCapabilityId, MdbaseEffectiveCapability>>;
     requiredAvailable: boolean;
 }
-export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;
+export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements | LegacyApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;

package/dist/capabilities.js

@@ -1,19 +1,19 @@
-import { capabilityOperations } from "@mdbase-dev/connect-protocol";
+import { capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
 export function effectiveCapabilities(requirements, manifest, connection) {
     const required = new Set(requirements.required);
     const declared = [...new Set([...requirements.required, ...(requirements.optional ?? [])])];
     const values = {};
     for (const id of declared) {
-        values[id] = effectiveCapability(id, required.has(id), manifest, connection);
+        values[id] = effectiveCapability(id, required.has(id), connection, requirements.contract_version, manifest);
     }
     return {
-        contractVersion: 1,
+        contractVersion: requirements.contract_version,
         values,
         requiredAvailable: requirements.required.every((id) => values[id]?.state === "available")
     };
 }
-function effectiveCapability(id, required, manifest, connection) {
-    const operations = capabilityOperations(id);
+function effectiveCapability(id, required, connection, version, manifest) {
+    const operations = capabilityOperationsForContractVersion(version, id) ?? [];
     const missingOperations = operations.filter((operation) => !connection.operations.includes(operation));
     const base = {
         id,
@@ -22,7 +22,7 @@ function effectiveCapability(id, required, manifest, connection) {
         missingOperations,
         evidence: [{
                 source: "application",
-                fact: `${required ? "Required" : "Optional"} in capability contract v1.`
+                fact: `${required ? "Required" : "Optional"} in capability contract v${version}.`
             }]
     };
     if (missingOperations.length > 0) {
@@ -36,52 +36,31 @@ function effectiveCapability(id, required, manifest, connection) {
             reason: "The current grant does not include every operation for this capability."
         };
     }
-    if (id === "definitions.contracts.current"
-        && connection.scope.access !== "full_collection") {
-        const approved = new Set(connection.scope.contracts.map(({ id, version, digest }) => `${id}@${version}:${digest}`));
-        const missingContracts = (manifest.requirements?.contracts ?? []).filter(({ id, version, digest }) => !approved.has(`${id}@${version}:${digest}`));
-        if (missingContracts.length > 0) {
-            return {
-                ...base,
-                state: "requires_authorization",
-                reason: "The current grant does not approve the exact required contract definitions.",
-                evidence: [...base.evidence, {
-                        source: "authorization",
-                        fact: `Missing ${missingContracts.map(({ id, version }) => `${id}@${version}`).join(", ")}.`
-                    }],
-                details: { missingContracts }
-            };
-        }
+    if (connection.scope.access !== "full_collection") {
+        return {
+            ...base,
+            state: "requires_authorization",
+            reason: "The current grant uses legacy contract scope and must be reauthorized for the entire collection.",
+            evidence: [...base.evidence, {
+                    source: "authorization",
+                    fact: "Legacy contract scope is compatibility evidence, not active data authority."
+                }]
+        };
     }
-    if (id.startsWith("files.")) {
+    // Compatibility readiness is deliberately limited to v1 aliases. V2 needs
+    // structured file/notification/runtime evidence, not these legacy shortcuts.
+    if (version === 1 && id.startsWith("files.")) {
         const action = id.slice("files.".length);
         if (!connection.fileCapability?.actions.includes(action)) {
             return {
                 ...base,
                 state: connection.fileCapability ? "requires_authorization" : "unsupported",
-                reason: connection.fileCapability
-                    ? `The current file grant does not include ${action}.`
-                    : "This connection has no file capability.",
-                evidence: [...base.evidence, {
-                        source: "authorization",
-                        fact: connection.fileCapability
-                            ? `Granted file actions: ${connection.fileCapability.actions.join(", ")}.`
-                            : "No file capability was granted."
-                    }]
+                reason: connection.fileCapability ? `The current file grant does not include ${action}.` : "This connection has no file capability."
             };
         }
     }
-    if (id === "notifications.background-delivery"
-        && (manifest.notifications?.criteria.length ?? 0) === 0) {
-        return {
-            ...base,
-            state: "requires_setup",
-            reason: "The application manifest declares no notification criteria.",
-            evidence: [...base.evidence, {
-                    source: "application",
-                    fact: "No authority notification criteria are declared."
-                }]
-        };
+    if (version === 1 && id === "notifications.background-delivery" && (manifest.notifications?.criteria.length ?? 0) === 0) {
+        return { ...base, state: "requires_setup", reason: "The application manifest declares no notification criteria." };
     }
     return {
         ...base,
@@ -97,7 +76,7 @@ function effectiveCapability(id, required, manifest, connection) {
                     ? "Backed by a durable hosted mdbase authority."
                     : "Backed by a user-operated mdbase connector."
             }],
-        ...(id === "sync.offline-replica"
+        ...(id === "offline.replica" || (version === 1 && id === "sync.offline-replica")
             ? {
                 details: {
                     durability: "device",
@@ -106,8 +85,7 @@ function effectiveCapability(id, required, manifest, connection) {
                 }
             }
             : {}),
-        ...(id === "notifications.background-delivery"
-            ? { details: { delivery: "authority", payload: "opaque" } }
-            : {})
+        ...(version === 1 && id === "notifications.background-delivery"
+            ? { details: { delivery: "authority", payload: "opaque" } } : {})
     };
 }

package/dist/connect-options.d.ts

@@ -1,4 +1,5 @@
-import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
+import type { JsonObject } from "@mdbase-dev/connect-protocol";
 import type { GrantKeyStore } from "./crypto.js";
 import type { ApplicationIdentityStore } from "./application-identity.js";
 export interface MdbaseConnectTimeouts {

package/dist/connect.d.ts

@@ -1,4 +1,5 @@
-import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import { type ApplicationIdentityStore } from "./application-identity.js";
 import { MdbaseConnection, type MdbaseAuthorizationOutcome, type MdbaseAuthorizationResult, type MdbaseAuthorizeOptions, type MdbaseConnectEnvironment } from "./connection.js";
 import type { MdbaseConnectOptions } from "./connect-options.js";

package/dist/connect.js

@@ -1,4 +1,5 @@
 import { APPLICATION_AUTHORIZATION_PROTOCOL_VERSION, authorizationContractRequirements, DEFAULT_LOOPBACK_PORT, GRANT_ENCRYPTION_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
+import { authorizationOperations, authorizationFiles, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
 import { abortableDelay } from "./async.js";
 import { authorizationCallbackState } from "./authorization-url.js";
 import { randomBase64Url } from "./base64.js";
@@ -7,14 +8,12 @@ import { MdbaseConnection } from "./connection.js";
 import { addConnectionId, connectionIds, removeConnectionId } from "./connection-index.js";
 import { authorizationAbort, declarationIdFromFamilyIdentity } from "./connect-authorization-helpers.js";
 import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
-import { connectError, serverConnectError } from "./errors.js";
-import { DEFAULT_OPERATIONS } from "./internal-types.js";
+import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
 import { prepareAuthorizationWindow, publishPopupAuthorizationCompletion, waitForPopupAuthorization } from "./popup-authorization.js";
-import { uniqueOperations } from "./operation-helpers.js";
 import { pendingRecoveryTransports, removePendingMutations } from "./pending-recovery-transports.js";
 import { GrantKeyLeaseRegistry } from "./grant-key-leases.js";
 import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
-import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
+import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, resolveManifestSource, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
 import { storedTokenFromResponse } from "./token-response.js";
 import { deleteUnusedGrantKey, planRetiredGrantKeys, storedTokenKeyHandles } from "./retired-grant-keys.js";
 import { SharedOperationMap } from "./shared-operation.js";
@@ -41,18 +40,11 @@ export class MdbaseConnectInternals {
     invalidatedConnections = new Map();
     constructor(options) {
         this.serverUrl = stripTrailingSlash(String(options.serverUrl));
-        this.manifest = options.manifest instanceof URL
-            ? options.manifest.href
-            : options.manifest ?? defaultManifestSource();
-        this.manifestSource = typeof this.manifest === "string"
-            ? this.manifest
-            : this.manifest.distribution === "portable"
-                ? `bundle:${this.manifest.id}:${manifestStorageFingerprint(this.manifest)}`
-                : `bundle:${this.manifest.id}`;
+        const declaration = resolveManifestSource(options.manifest, options.redirectUri);
+        this.manifest = declaration.manifest;
+        this.manifestSource = declaration.manifestSource;
         const opaquePortable = isOpaquePortableManifest(this.manifest);
-        this.redirectUri = options.redirectUri === undefined ? (typeof this.manifest !== "string" && this.manifest.distribution === "portable"
-            ? ""
-            : defaultRedirectUri()) : String(options.redirectUri);
+        this.redirectUri = declaration.redirectUri;
         this.storage = options.storage ?? defaultStorage(opaquePortable);
         this.relayEncryption = options.relayEncryption ?? "required";
         this.keyStore = options.keyStore ?? (opaquePortable ? new MemoryGrantKeyStore() : new IndexedDbGrantKeyStore());
@@ -168,6 +160,13 @@ export class MdbaseConnectInternals {
             navigate: this.navigate,
             register: (signal) => this.registerWithinBudget(signal)
         });
+        try {
+            validateAuthorizationSelection(application.requirements, options);
+        }
+        catch (error) {
+            popup?.close();
+            throw error;
+        }
         if (application.distribution === "portable") {
             if (options.openVerification)
                 popup?.close();
@@ -192,7 +191,8 @@ export class MdbaseConnectInternals {
             await this.keyStore.delete(keyHandle);
             throw error;
         }
-        const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
             protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
@@ -211,11 +211,9 @@ export class MdbaseConnectInternals {
             redirect_uri: this.redirectUri,
             state,
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId)),
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId), semanticContractVersion(application.requirements)),
             requested_operations: operations,
-            ...(application.requirements?.files
-                ? { requested_files: application.requirements.files }
-                : {}),
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
             ...(targetCollectionId ? { collection_id: targetCollectionId } : {})
         }, installation);
         const pending = {
@@ -310,7 +308,8 @@ export class MdbaseConnectInternals {
             await this.keyStore.delete(keyHandle);
             throw error;
         }
-        const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
         const authorizationId = crypto.randomUUID();
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
@@ -328,11 +327,9 @@ export class MdbaseConnectInternals {
             issued_at: issuedAt.toISOString(),
             expires_at: new Date(issuedAt.getTime() + 10 * 60 * 1_000).toISOString(),
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined)),
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined), semanticContractVersion(application.requirements)),
             requested_operations: operations,
-            ...(application.requirements?.files
-                ? { requested_files: application.requirements.files }
-                : {}),
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
             ...(options.target?.kind === "collection"
                 ? { collection_id: options.target.collectionId }
                 : {})
@@ -607,15 +604,25 @@ export class MdbaseConnectInternals {
         }
         const previous = parseStored(this.storage.getItem(this.tokenKey(collectionId)));
         const retirement = planRetiredGrantKeys(this.storage, this.pendingMutationKey(collectionId), previous, keyHandle, this.grantKeyLeases.handles(collectionId), this.grantKeyLeases.retainAutomaticallyRetiredKeys);
-        const token = storedTokenFromResponse({
-            body,
-            clientId,
-            keyHandle,
-            previous,
-            retiredKeyHandles: retirement.retained,
-            defaultApplicationOrigin: this.defaultApplicationOrigin(),
-            pinConnectorIdentity: (connectorId, publicKey) => this.pinConnectorIdentity(connectorId, publicKey)
-        });
+        let token;
+        try {
+            token = storedTokenFromResponse({
+                body,
+                clientId,
+                keyHandle,
+                previous,
+                retiredKeyHandles: retirement.retained,
+                defaultApplicationOrigin: this.defaultApplicationOrigin(),
+                pinConnectorIdentity: (connectorId, publicKey) => this.pinConnectorIdentity(connectorId, publicKey)
+            });
+        }
+        catch (error) {
+            if (error instanceof MdbaseConnectError
+                && error.code === "legacy_scope_reauthorization_required") {
+                this.removeToken(collectionId, keyHandle, error.code);
+            }
+            throw error;
+        }
         this.storage.setItem(this.tokenKey(collectionId), JSON.stringify(token));
         for (const handle of retirement.disposable)
             this.deleteGrantKeyWhenUnused(collectionId, handle);

package/dist/connection-transport-internals.d.ts

@@ -3,7 +3,7 @@ import type { StoredToken } from "./internal-types.js";
 import type { ResolvedConnectTimeouts } from "./request-budget.js";
 export interface ConnectionTransportInternals {
     readonly relayEncryption: "required" | "disabled";
-    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant", discardPending?: boolean): void;
+    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant" | "legacy_scope_reauthorization_required", discardPending?: boolean): void;
     storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
     acquireGrantKeyLease(collectionId: string, keyHandle: string, signal?: AbortSignal): Promise<() => void>;
     deleteGrantKeyWhenUnused(collectionId: string, keyHandle: string): void;

package/dist/connection-transport.js

@@ -650,7 +650,7 @@ export class ConnectionTransport {
             stored: this.storage.getItem(this.internals.tokenKey(this.collectionId)),
             collectionId: this.collectionId,
             relayEncryption: this.internals.relayEncryption,
-            invalidate: (keyHandle) => this.internals.removeToken(this.collectionId, keyHandle, "invalid_stored_grant"),
+            invalidate: (keyHandle, reason = "invalid_stored_grant") => this.internals.removeToken(this.collectionId, keyHandle, reason),
             directCapable: (token) => this.directCapable(token)
         });
     }

package/dist/connection.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionOperation, CollectionTypeDocument, FileCapability, GrantScope, JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationCapabilityId as ApplicationCapabilityId } from "./application-contract.js";
 import { type ConnectionTransportInternals } from "./connection-transport.js";
 import type { DirectAccessStatus, MdbaseAuthorizationCapabilities, MdbaseConnectionInfo, MdbaseConnectionRoute, MdbaseSyncConnection } from "./connection-types.js";
 import type { GrantKeyStore } from "./crypto.js";
@@ -16,7 +17,10 @@ export type MdbaseAuthorizationTarget = {
     collectionId: string;
 };
 export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
+    /** Exact independent operations, for legacy v1 declarations only. Cannot be mixed with capabilities. */
     operations?: CollectionOperation[];
+    /** Capability groups to request. Required groups are always included; optional groups default to all. */
+    capabilities?: ApplicationCapabilityId[];
     /** Keep a web application loaded while Connect owns the approval ceremony. */
     presentation?: "redirect" | "popup";
     /** Choose any compatible collection, or require one exact collection. */
@@ -29,7 +33,10 @@ export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
 }
 export interface MdbaseConnectionAuthorizeOptions extends ConnectRequestOptions {
+    /** Exact independent operations, for legacy v1 declarations only. */
     operations?: CollectionOperation[];
+    /** Capability groups to request. Required groups are always included; optional groups default to all. */
+    capabilities?: ApplicationCapabilityId[];
     presentation?: "redirect" | "popup";
     returnTo?: string;
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
@@ -80,6 +87,10 @@ export declare class MdbaseConnection<Frontmatter extends JsonObject = JsonObjec
     authorizationCapabilities(requiredOperations?: CollectionOperation[]): MdbaseAuthorizationCapabilities;
     hasOperations(requiredOperations: CollectionOperation[]): boolean;
     authorize(options?: MdbaseConnectionAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
+    requestCapabilities(capabilities: ApplicationCapabilityId[], options?: MdbaseConnectionAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
+        kind: "unchanged";
+        connection: MdbaseConnection<Frontmatter>;
+    }, AuthorizationProblemCode>>;
     requestOperations(requiredOperations: CollectionOperation[], options?: Omit<MdbaseConnectionAuthorizeOptions, "operations">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
         kind: "unchanged";
         connection: MdbaseConnection<Frontmatter>;

package/dist/connection.js

@@ -1,3 +1,5 @@
+import { capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
+import { retainedCapabilities, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
 import { MdbaseCollectionClient } from "./collection-client.js";
 import { ConnectionNotifications } from "./connection-notifications.js";
 import { ConnectionTransport } from "./connection-transport.js";
@@ -106,18 +108,43 @@ export class MdbaseConnection {
             target: { kind: "collection", collectionId: this.collectionId }
         }), AUTHORIZATION_PROBLEM_CODES);
     }
+    async requestCapabilities(capabilities, options = {}) {
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, capabilities });
+            const sufficient = this.info() !== null && capabilities.every((capability) => (capabilityOperationsForContractVersion(semanticContractVersion(application.requirements), capability) ?? [])
+                .every((operation) => this.operations.includes(operation)));
+            if (sufficient)
+                return { kind: "unchanged", connection: this };
+            if (semanticContractVersion(application.requirements) === 1) {
+                const { capabilities: _selection, ...legacyOptions } = options;
+                return this.internals.authorize({
+                    ...legacyOptions,
+                    target: { kind: "collection", collectionId: this.collectionId },
+                    operations: [...new Set([...this.operations, ...capabilities.flatMap((id) => capabilityOperationsForContractVersion(1, id) ?? [])])]
+                });
+            }
+            const retained = retainedCapabilities(application.requirements, this.operations);
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                capabilities: [...new Set([...retained, ...capabilities])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
+    }
     async requestOperations(requiredOperations, options = {}) {
-        const capabilities = this.authorizationCapabilities(requiredOperations);
-        if (capabilities.sufficient) {
-            return connectSuccess({ kind: "unchanged", connection: this });
-        }
-        return this.authorize({
-            ...options,
-            operations: uniqueOperations([
-                ...capabilities.grantedOperations,
-                ...capabilities.missingOperations
-            ])
-        });
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, operations: requiredOperations });
+            const authorization = this.authorizationCapabilities(requiredOperations);
+            if (authorization.sufficient)
+                return { kind: "unchanged", connection: this };
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                operations: [...new Set([...authorization.grantedOperations, ...requiredOperations])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
     }
     onConnectionChange(listener) {
         this.connectionListeners.add(listener);

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { MdbaseConnection } from "./connection.js";
 export type { MdbaseAuthorizationTarget, MdbaseAuthorizeOptions, MdbaseConnectionAuthorizeOptions, MdbaseConnectEnvironment, MdbaseAuthorizationResult, MdbaseAuthorizationOutcome } from "./connection.js";
 export type { MdbaseConnectionRoute, DirectAccessStatus, MdbaseConnectionInfo, MdbaseAuthorizationCapabilities, MdbaseSyncTransport, MdbaseSyncConnection } from "./connection-types.js";
 export { effectiveCapabilities } from "./capabilities.js";
+export type { MdbaseStructuredReadiness } from "./structured-readiness.js";
 export type { MdbaseCapabilityState, MdbaseCapabilityEvidence, MdbaseEffectiveCapability, MdbaseEffectiveCapabilities } from "./capabilities.js";
 export { MdbaseConnectError, isRetryableConnectError } from "./errors.js";
 export type { ConnectErrorContext } from "./errors.js";
@@ -22,4 +23,5 @@ export { MdbaseBrowserSelection, MdbaseMemorySelection } from "./selection.js";
 export type { MdbaseSelectionHistory, MdbaseApplicationSelection, MdbaseBrowserSelectionOptions } from "./selection.js";
 export type { MdbaseUnavailableReason } from "./session.js";
 export { MDBASE_RECORD_CREATED_CONTRACT, MDBASE_TIMER_FIRED_CONTRACT, operationsForApplicationCapabilities } from "@mdbase-dev/connect-protocol";
-export type { ApplicationProvisions, ApplicationCapabilityId, ApplicationCapabilityRequirements, ApplicationRequirements, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, FileAction, FileCapability, CollectionOperation as MdbaseOperation, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, GrantScope, JsonObject, MdbaseAppManifest, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, TypePackManifest, TypePackManifestResource, TypePackProvision, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";
+export type { MdbaseApplicationManifest, MdbaseApplicationManifest as MdbaseAppManifest, MdbaseApplicationRequirements, MdbaseApplicationCapabilityId as ApplicationCapabilityId, MdbaseApplicationCapabilityRequirements as ApplicationCapabilityRequirements } from "./application-contract.js";
+export type { ApplicationProvisions, ApplicationRequirements, LegacyApplicationRequirements, LegacyApplicationCapabilityId, LegacyApplicationCapabilityRequirements, LegacyMdbaseAppManifest, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, FileAction, FileCapability, CollectionOperation as MdbaseOperation, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, GrantScope, JsonObject, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, TypePackManifest, TypePackManifestResource, TypePackProvision, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";

package/dist/internal-types.d.ts

@@ -1,4 +1,5 @@
-import type { ApplicationNotifications, ApplicationRequirements, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, FileCapability, GrantScope, MdbaseOperationRequest, MutationOperationIdentifier } from "@mdbase-dev/connect-protocol";
+import type { ApplicationNotifications, ApplicationProvisions, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, FileCapability, GrantScope, MdbaseOperationRequest, MutationOperationIdentifier } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationRequirements as ApplicationRequirements } from "./application-contract.js";
 import { encryptRelayRequest } from "./crypto.js";
 export interface Application {
     id: string;
@@ -10,6 +11,7 @@ export interface Application {
     project_url?: string;
     notifications?: ApplicationNotifications;
     requirements: ApplicationRequirements;
+    provisions?: ApplicationProvisions;
 }
 export interface StoredAuthorization {
     version: 1;
@@ -95,4 +97,4 @@ export interface OperationAttempt {
     pendingMutationRecord?: PendingMutation;
     resumingMutation?: boolean;
 }
-export declare const DEFAULT_OPERATIONS: CollectionOperation[];
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/internal-types.js

@@ -1 +1 @@
-export const DEFAULT_OPERATIONS = ["describe", "changes", "read", "query"];
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/mdbase-connect.d.ts

@@ -14,7 +14,7 @@ export declare class MdbaseConnect<Frontmatter extends JsonObject = JsonObject>
     authorize(options?: MdbaseAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
     /** The ordinary application lifecycle entry point. */
     application(options: MdbaseApplicationSessionOptions): MdbaseApplicationSession<Frontmatter>;
-    manifest(options?: ConnectRequestOptions): Promise<ConnectOutcome<import("@mdbase-dev/connect-protocol").MdbaseAppManifest, RegistrationProblemCode>>;
+    manifest(options?: ConnectRequestOptions): Promise<ConnectOutcome<import("./application-contract.js").MdbaseApplicationManifest, RegistrationProblemCode>>;
     environment(): MdbaseConnectEnvironment;
     completeAuthorization(callbackUrl?: string | URL, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationResult<Frontmatter>, AuthorizationProblemCode>>;
     connections(): MdbaseConnectionInfo[];

package/dist/operation-types.d.ts

@@ -138,8 +138,9 @@ export interface QuerySummary {
 /** Application-facing form of the canonical mdbase v0.3 query schema. */
 export interface QueryInput {
     /**
-     * Contract-scoped queries accept only `types`, `timezone`, pagination,
-     * `frontmatterMode`, and `contract`; filter normalized fields in the app.
+     * Queries using a semantic contract view accept only `types`, `timezone`,
+     * pagination, `frontmatterMode`, and `contract`; filter normalized fields in
+     * the app.
      */
     types?: string[];
     /** IANA timezone used for calendar semantics in this invocation. */
@@ -166,7 +167,7 @@ export interface QueryInput {
     snapshot?: string;
     includeBody?: boolean;
     frontmatterMode?: "effective" | "persisted" | "both";
-    /** Narrow a contract-scoped query to one exact contract/provider view. */
+    /** Select one exact semantic contract/provider view for this query. */
     contract?: DataContractSelector;
 }
 export interface QueryResult<Record extends JsonObject = JsonObject> {

package/dist/outcomes.d.ts

@@ -18,14 +18,14 @@ export declare const COMMON_OPERATION_PROBLEM_CODES: readonly ["access_denied",
 export declare const ALL_CONNECT_PROBLEM_CODES: ConnectProblemCode[];
 export type RegistrationProblemCode = "discovery_failed" | "invalid_operation_response" | "invalid_application_manifest" | "invalid_request" | "manifest_load_failed" | "rate_limited" | "temporarily_unavailable" | "timeout";
 export declare const REGISTRATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout"];
-export type AuthorizationProblemCode = RegistrationProblemCode | "access_denied" | "application_declaration_mismatch" | "application_identity_unavailable" | "approval_window_blocked" | "authorization_binding_incompatible" | "authorization_cancelled" | "authorization_replayed" | "browser_required" | "capability_contract_incompatible" | "collection_access_denied" | "collection_configuration_invalid" | "collection_contracts_missing" | "collection_incompatible" | "collection_invalid" | "collection_kind_unsupported" | "collection_mismatch" | "collection_not_found" | "collection_type_registry_invalid" | "collection_version_unsupported" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "device_authorization_failed" | "durable_mutation_unsupported" | "encryption_required" | "expired_token" | "invalid_application_authorization" | "invalid_callback" | "invalid_device_authorization_response" | "invalid_token_response" | "scope_denied" | "reconnect_required" | "token_exchange_failed" | "transport_protocol_incompatible";
-export declare const AUTHORIZATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible"];
+export type AuthorizationProblemCode = RegistrationProblemCode | "access_denied" | "application_declaration_mismatch" | "application_identity_unavailable" | "approval_window_blocked" | "authorization_binding_incompatible" | "authorization_cancelled" | "authorization_replayed" | "browser_required" | "capability_contract_incompatible" | "collection_access_denied" | "collection_configuration_invalid" | "collection_contracts_missing" | "collection_incompatible" | "collection_invalid" | "collection_kind_unsupported" | "collection_mismatch" | "collection_not_found" | "collection_type_registry_invalid" | "collection_version_unsupported" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "device_authorization_failed" | "durable_mutation_unsupported" | "encryption_required" | "expired_token" | "invalid_application_authorization" | "invalid_callback" | "invalid_device_authorization_response" | "invalid_token_response" | "legacy_scope_reauthorization_required" | "scope_denied" | "reconnect_required" | "token_exchange_failed" | "transport_protocol_incompatible";
+export declare const AUTHORIZATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "legacy_scope_reauthorization_required", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible"];
 export type NotificationProblemCode = RegistrationProblemCode | "authorization_expired" | "invalid_operation_response" | "invalid_push_subscription" | "managed_fcm_not_declared" | "not_authorized" | "notification_criterion_not_declared" | "notification_reauthorization_required" | "notification_registration_failed" | "notification_unregistration_failed" | "notifications_not_declared" | "notifications_unavailable";
 export declare const NOTIFICATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "authorization_expired", "invalid_operation_response", "invalid_push_subscription", "managed_fcm_not_declared", "not_authorized", "notification_criterion_not_declared", "notification_reauthorization_required", "notification_registration_failed", "notification_unregistration_failed", "notifications_not_declared", "notifications_unavailable"];
 export type DirectAccessProblemCode = "connector_offline" | "connector_upgrade_required" | "invalid_operation_response" | "not_authorized" | "operation_failed" | "temporarily_unavailable" | "timeout";
 export declare const DIRECT_ACCESS_PROBLEM_CODES: readonly ["connector_offline", "connector_upgrade_required", "invalid_operation_response", "not_authorized", "operation_failed", "temporarily_unavailable", "timeout"];
 export type SessionProblemCode = AuthorizationProblemCode | "collection_not_ready" | "collection_not_selected" | "operation_cancelled" | "session_destroyed" | "session_not_started" | "session_starting" | "unknown_collection";
-export declare const SESSION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible", "collection_not_ready", "collection_not_selected", "operation_cancelled", "session_destroyed", "session_not_started", "session_starting", "unknown_collection"];
+export declare const SESSION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "legacy_scope_reauthorization_required", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible", "collection_not_ready", "collection_not_selected", "operation_cancelled", "session_destroyed", "session_not_started", "session_starting", "unknown_collection"];
 export type CollectionSetupProblemCode = "collection_configuration_invalid" | "collection_invalid" | "collection_type_registry_invalid" | "collection_version_unsupported";
 export type CollectionDescriptionProblemCode = CommonOperationProblemCode | CollectionSetupProblemCode;
 export type CollectionReadProblemCode = CollectionDescriptionProblemCode | "invalid_path" | "operation_invalid";

package/dist/outcomes.js

@@ -78,6 +78,7 @@ export const AUTHORIZATION_PROBLEM_CODES = [
     "invalid_callback",
     "invalid_device_authorization_response",
     "invalid_token_response",
+    "legacy_scope_reauthorization_required",
     "scope_denied",
     "reconnect_required",
     "token_exchange_failed",

package/dist/request-coordinator.js

@@ -79,6 +79,7 @@ export class CollectionRequestCoordinator {
                 if (queued.started || queued.settled)
                     return;
                 queued.settled = true;
+                queue.splice(queue.indexOf(queued), 1);
                 queued.reject(requestAbortReason(combined.signal));
                 combined.dispose();
                 this.releaseLatest(coordination.family, replacement);

package/dist/runtime-utils.d.ts

@@ -1,7 +1,14 @@
-import type { FileCapability, GrantEncryption, GrantScope, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { FileCapability, GrantEncryption, GrantScope } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import { MdbaseConnectError } from "./errors.js";
 import type { StoredToken } from "./internal-types.js";
 import type { MdbaseDeviceAuthorization } from "./authorization-types.js";
+/** Resolve bundled declarations and their stable storage identity without loading URLs. */
+export declare function resolveManifestSource(input?: MdbaseAppManifest | string | URL, redirect?: string | URL): {
+    manifest: MdbaseAppManifest | string;
+    manifestSource: string;
+    redirectUri: string;
+};
 type NetworkProblemCode = "notification_registration_failed" | "notification_unregistration_failed" | "notifications_unavailable" | "temporarily_unavailable";
 /** Normalize fetch rejection at the exact I/O boundary. */
 export declare function connectFetch(input: RequestInfo | URL, init: RequestInit | undefined, code: NetworkProblemCode, message: string): Promise<Response>;
@@ -20,7 +27,10 @@ export declare function validFileCapability(value: unknown): value is FileCapabi
 export declare function validStoredEncryption(encryption: StoredToken["encryption"], collectionId: string): encryption is GrantEncryption;
 export declare function parseDeviceAuthorization(body: any): MdbaseDeviceAuthorization;
 export declare function parseStored<T>(value: string | null): T | null;
+/** Parse both canonical and N-1 grant shapes so callers can diagnose legacy grants. */
 export declare function parseGrantScope(value: unknown): GrantScope | null;
+/** Only this scope authorizes application data access. */
+export declare function isCanonicalGrantScope(scope: GrantScope): boolean;
 export declare function stripTrailingSlash(value: string): string;
 export declare function defaultManifestSource(): string;
 export declare function defaultRedirectUri(): string;