@mdbase-dev/connect 0.1.0-beta.94 → 0.1.0-beta.95

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-kDjazWo3W17cBn4WByvZ0jGGc1aqQxNTWglefSAMrEoEzGRgo8YNzRYSI3sQb8tx
+sha384-pt5qe5l2IuGgDjsId1oPNVT/zCR+0TLeEJNt6xKdZQSxAACXxaCqoxbZd37EriJh

package/dist/capabilities.d.ts

@@ -1,4 +1,5 @@
-import { type ApplicationCapabilityId, type ApplicationCapabilityRequirements, type MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import { type ApplicationCapabilityRequirements, type LegacyApplicationCapabilityRequirements } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationCapabilityId as ApplicationCapabilityId, MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import type { MdbaseConnectionInfo } from "./connection-types.js";
 export type MdbaseCapabilityState = "available" | "requires_authorization" | "requires_setup" | "temporarily_unavailable" | "unsupported";
 export interface MdbaseCapabilityEvidence {
@@ -16,8 +17,8 @@ export interface MdbaseEffectiveCapability {
     details?: Record<string, unknown>;
 }
 export interface MdbaseEffectiveCapabilities {
-    contractVersion: 1;
+    contractVersion: 1 | 2;
     values: Partial<Record<ApplicationCapabilityId, MdbaseEffectiveCapability>>;
     requiredAvailable: boolean;
 }
-export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;
+export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements | LegacyApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;

package/dist/capabilities.js

@@ -1,19 +1,19 @@
-import { capabilityOperations } from "@mdbase-dev/connect-protocol";
+import { capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
 export function effectiveCapabilities(requirements, manifest, connection) {
     const required = new Set(requirements.required);
     const declared = [...new Set([...requirements.required, ...(requirements.optional ?? [])])];
     const values = {};
     for (const id of declared) {
-        values[id] = effectiveCapability(id, required.has(id), manifest, connection);
+        values[id] = effectiveCapability(id, required.has(id), connection, requirements.contract_version, manifest);
     }
     return {
-        contractVersion: 1,
+        contractVersion: requirements.contract_version,
         values,
         requiredAvailable: requirements.required.every((id) => values[id]?.state === "available")
     };
 }
-function effectiveCapability(id, required, manifest, connection) {
-    const operations = capabilityOperations(id);
+function effectiveCapability(id, required, connection, version, manifest) {
+    const operations = capabilityOperationsForContractVersion(version, id) ?? [];
     const missingOperations = operations.filter((operation) => !connection.operations.includes(operation));
     const base = {
         id,
@@ -22,7 +22,7 @@ function effectiveCapability(id, required, manifest, connection) {
         missingOperations,
         evidence: [{
                 source: "application",
-                fact: `${required ? "Required" : "Optional"} in capability contract v1.`
+                fact: `${required ? "Required" : "Optional"} in capability contract v${version}.`
             }]
     };
     if (missingOperations.length > 0) {
@@ -47,35 +47,20 @@ function effectiveCapability(id, required, manifest, connection) {
                 }]
         };
     }
-    if (id.startsWith("files.")) {
+    // Compatibility readiness is deliberately limited to v1 aliases. V2 needs
+    // structured file/notification/runtime evidence, not these legacy shortcuts.
+    if (version === 1 && id.startsWith("files.")) {
         const action = id.slice("files.".length);
         if (!connection.fileCapability?.actions.includes(action)) {
             return {
                 ...base,
                 state: connection.fileCapability ? "requires_authorization" : "unsupported",
-                reason: connection.fileCapability
-                    ? `The current file grant does not include ${action}.`
-                    : "This connection has no file capability.",
-                evidence: [...base.evidence, {
-                        source: "authorization",
-                        fact: connection.fileCapability
-                            ? `Granted file actions: ${connection.fileCapability.actions.join(", ")}.`
-                            : "No file capability was granted."
-                    }]
+                reason: connection.fileCapability ? `The current file grant does not include ${action}.` : "This connection has no file capability."
             };
         }
     }
-    if (id === "notifications.background-delivery"
-        && (manifest.notifications?.criteria.length ?? 0) === 0) {
-        return {
-            ...base,
-            state: "requires_setup",
-            reason: "The application manifest declares no notification criteria.",
-            evidence: [...base.evidence, {
-                    source: "application",
-                    fact: "No authority notification criteria are declared."
-                }]
-        };
+    if (version === 1 && id === "notifications.background-delivery" && (manifest.notifications?.criteria.length ?? 0) === 0) {
+        return { ...base, state: "requires_setup", reason: "The application manifest declares no notification criteria." };
     }
     return {
         ...base,
@@ -91,7 +76,7 @@ function effectiveCapability(id, required, manifest, connection) {
                     ? "Backed by a durable hosted mdbase authority."
                     : "Backed by a user-operated mdbase connector."
             }],
-        ...(id === "sync.offline-replica"
+        ...(id === "offline.replica" || (version === 1 && id === "sync.offline-replica")
             ? {
                 details: {
                     durability: "device",
@@ -100,8 +85,7 @@ function effectiveCapability(id, required, manifest, connection) {
                 }
             }
             : {}),
-        ...(id === "notifications.background-delivery"
-            ? { details: { delivery: "authority", payload: "opaque" } }
-            : {})
+        ...(version === 1 && id === "notifications.background-delivery"
+            ? { details: { delivery: "authority", payload: "opaque" } } : {})
     };
 }

package/dist/connect-options.d.ts

@@ -1,4 +1,5 @@
-import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
+import type { JsonObject } from "@mdbase-dev/connect-protocol";
 import type { GrantKeyStore } from "./crypto.js";
 import type { ApplicationIdentityStore } from "./application-identity.js";
 export interface MdbaseConnectTimeouts {

package/dist/connect.d.ts

@@ -1,4 +1,5 @@
-import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import { type ApplicationIdentityStore } from "./application-identity.js";
 import { MdbaseConnection, type MdbaseAuthorizationOutcome, type MdbaseAuthorizationResult, type MdbaseAuthorizeOptions, type MdbaseConnectEnvironment } from "./connection.js";
 import type { MdbaseConnectOptions } from "./connect-options.js";

package/dist/connect.js

@@ -1,4 +1,5 @@
 import { APPLICATION_AUTHORIZATION_PROTOCOL_VERSION, authorizationContractRequirements, DEFAULT_LOOPBACK_PORT, GRANT_ENCRYPTION_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
+import { authorizationOperations, authorizationFiles, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
 import { abortableDelay } from "./async.js";
 import { authorizationCallbackState } from "./authorization-url.js";
 import { randomBase64Url } from "./base64.js";
@@ -8,13 +9,11 @@ import { addConnectionId, connectionIds, removeConnectionId } from "./connection
 import { authorizationAbort, declarationIdFromFamilyIdentity } from "./connect-authorization-helpers.js";
 import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
 import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
-import { DEFAULT_OPERATIONS } from "./internal-types.js";
 import { prepareAuthorizationWindow, publishPopupAuthorizationCompletion, waitForPopupAuthorization } from "./popup-authorization.js";
-import { uniqueOperations } from "./operation-helpers.js";
 import { pendingRecoveryTransports, removePendingMutations } from "./pending-recovery-transports.js";
 import { GrantKeyLeaseRegistry } from "./grant-key-leases.js";
 import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
-import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
+import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, resolveManifestSource, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
 import { storedTokenFromResponse } from "./token-response.js";
 import { deleteUnusedGrantKey, planRetiredGrantKeys, storedTokenKeyHandles } from "./retired-grant-keys.js";
 import { SharedOperationMap } from "./shared-operation.js";
@@ -41,18 +40,11 @@ export class MdbaseConnectInternals {
     invalidatedConnections = new Map();
     constructor(options) {
         this.serverUrl = stripTrailingSlash(String(options.serverUrl));
-        this.manifest = options.manifest instanceof URL
-            ? options.manifest.href
-            : options.manifest ?? defaultManifestSource();
-        this.manifestSource = typeof this.manifest === "string"
-            ? this.manifest
-            : this.manifest.distribution === "portable"
-                ? `bundle:${this.manifest.id}:${manifestStorageFingerprint(this.manifest)}`
-                : `bundle:${this.manifest.id}`;
+        const declaration = resolveManifestSource(options.manifest, options.redirectUri);
+        this.manifest = declaration.manifest;
+        this.manifestSource = declaration.manifestSource;
         const opaquePortable = isOpaquePortableManifest(this.manifest);
-        this.redirectUri = options.redirectUri === undefined ? (typeof this.manifest !== "string" && this.manifest.distribution === "portable"
-            ? ""
-            : defaultRedirectUri()) : String(options.redirectUri);
+        this.redirectUri = declaration.redirectUri;
         this.storage = options.storage ?? defaultStorage(opaquePortable);
         this.relayEncryption = options.relayEncryption ?? "required";
         this.keyStore = options.keyStore ?? (opaquePortable ? new MemoryGrantKeyStore() : new IndexedDbGrantKeyStore());
@@ -168,6 +160,13 @@ export class MdbaseConnectInternals {
             navigate: this.navigate,
             register: (signal) => this.registerWithinBudget(signal)
         });
+        try {
+            validateAuthorizationSelection(application.requirements, options);
+        }
+        catch (error) {
+            popup?.close();
+            throw error;
+        }
         if (application.distribution === "portable") {
             if (options.openVerification)
                 popup?.close();
@@ -192,7 +191,8 @@ export class MdbaseConnectInternals {
             await this.keyStore.delete(keyHandle);
             throw error;
         }
-        const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
             protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
@@ -211,11 +211,9 @@ export class MdbaseConnectInternals {
             redirect_uri: this.redirectUri,
             state,
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId)),
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId), semanticContractVersion(application.requirements)),
             requested_operations: operations,
-            ...(application.requirements?.files
-                ? { requested_files: application.requirements.files }
-                : {}),
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
             ...(targetCollectionId ? { collection_id: targetCollectionId } : {})
         }, installation);
         const pending = {
@@ -310,7 +308,8 @@ export class MdbaseConnectInternals {
             await this.keyStore.delete(keyHandle);
             throw error;
         }
-        const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
         const authorizationId = crypto.randomUUID();
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
@@ -328,11 +327,9 @@ export class MdbaseConnectInternals {
             issued_at: issuedAt.toISOString(),
             expires_at: new Date(issuedAt.getTime() + 10 * 60 * 1_000).toISOString(),
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined)),
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined), semanticContractVersion(application.requirements)),
             requested_operations: operations,
-            ...(application.requirements?.files
-                ? { requested_files: application.requirements.files }
-                : {}),
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
             ...(options.target?.kind === "collection"
                 ? { collection_id: options.target.collectionId }
                 : {})

package/dist/connection.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionOperation, CollectionTypeDocument, FileCapability, GrantScope, JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationCapabilityId as ApplicationCapabilityId } from "./application-contract.js";
 import { type ConnectionTransportInternals } from "./connection-transport.js";
 import type { DirectAccessStatus, MdbaseAuthorizationCapabilities, MdbaseConnectionInfo, MdbaseConnectionRoute, MdbaseSyncConnection } from "./connection-types.js";
 import type { GrantKeyStore } from "./crypto.js";
@@ -16,7 +17,10 @@ export type MdbaseAuthorizationTarget = {
     collectionId: string;
 };
 export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
+    /** Exact independent operations, for legacy v1 declarations only. Cannot be mixed with capabilities. */
     operations?: CollectionOperation[];
+    /** Capability groups to request. Required groups are always included; optional groups default to all. */
+    capabilities?: ApplicationCapabilityId[];
     /** Keep a web application loaded while Connect owns the approval ceremony. */
     presentation?: "redirect" | "popup";
     /** Choose any compatible collection, or require one exact collection. */
@@ -29,7 +33,10 @@ export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
 }
 export interface MdbaseConnectionAuthorizeOptions extends ConnectRequestOptions {
+    /** Exact independent operations, for legacy v1 declarations only. */
     operations?: CollectionOperation[];
+    /** Capability groups to request. Required groups are always included; optional groups default to all. */
+    capabilities?: ApplicationCapabilityId[];
     presentation?: "redirect" | "popup";
     returnTo?: string;
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
@@ -80,6 +87,10 @@ export declare class MdbaseConnection<Frontmatter extends JsonObject = JsonObjec
     authorizationCapabilities(requiredOperations?: CollectionOperation[]): MdbaseAuthorizationCapabilities;
     hasOperations(requiredOperations: CollectionOperation[]): boolean;
     authorize(options?: MdbaseConnectionAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
+    requestCapabilities(capabilities: ApplicationCapabilityId[], options?: MdbaseConnectionAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
+        kind: "unchanged";
+        connection: MdbaseConnection<Frontmatter>;
+    }, AuthorizationProblemCode>>;
     requestOperations(requiredOperations: CollectionOperation[], options?: Omit<MdbaseConnectionAuthorizeOptions, "operations">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
         kind: "unchanged";
         connection: MdbaseConnection<Frontmatter>;

package/dist/connection.js

@@ -1,3 +1,5 @@
+import { capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
+import { retainedCapabilities, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
 import { MdbaseCollectionClient } from "./collection-client.js";
 import { ConnectionNotifications } from "./connection-notifications.js";
 import { ConnectionTransport } from "./connection-transport.js";
@@ -106,18 +108,43 @@ export class MdbaseConnection {
             target: { kind: "collection", collectionId: this.collectionId }
         }), AUTHORIZATION_PROBLEM_CODES);
     }
+    async requestCapabilities(capabilities, options = {}) {
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, capabilities });
+            const sufficient = this.info() !== null && capabilities.every((capability) => (capabilityOperationsForContractVersion(semanticContractVersion(application.requirements), capability) ?? [])
+                .every((operation) => this.operations.includes(operation)));
+            if (sufficient)
+                return { kind: "unchanged", connection: this };
+            if (semanticContractVersion(application.requirements) === 1) {
+                const { capabilities: _selection, ...legacyOptions } = options;
+                return this.internals.authorize({
+                    ...legacyOptions,
+                    target: { kind: "collection", collectionId: this.collectionId },
+                    operations: [...new Set([...this.operations, ...capabilities.flatMap((id) => capabilityOperationsForContractVersion(1, id) ?? [])])]
+                });
+            }
+            const retained = retainedCapabilities(application.requirements, this.operations);
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                capabilities: [...new Set([...retained, ...capabilities])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
+    }
     async requestOperations(requiredOperations, options = {}) {
-        const capabilities = this.authorizationCapabilities(requiredOperations);
-        if (capabilities.sufficient) {
-            return connectSuccess({ kind: "unchanged", connection: this });
-        }
-        return this.authorize({
-            ...options,
-            operations: uniqueOperations([
-                ...capabilities.grantedOperations,
-                ...capabilities.missingOperations
-            ])
-        });
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, operations: requiredOperations });
+            const authorization = this.authorizationCapabilities(requiredOperations);
+            if (authorization.sufficient)
+                return { kind: "unchanged", connection: this };
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                operations: [...new Set([...authorization.grantedOperations, ...requiredOperations])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
     }
     onConnectionChange(listener) {
         this.connectionListeners.add(listener);

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { MdbaseConnection } from "./connection.js";
 export type { MdbaseAuthorizationTarget, MdbaseAuthorizeOptions, MdbaseConnectionAuthorizeOptions, MdbaseConnectEnvironment, MdbaseAuthorizationResult, MdbaseAuthorizationOutcome } from "./connection.js";
 export type { MdbaseConnectionRoute, DirectAccessStatus, MdbaseConnectionInfo, MdbaseAuthorizationCapabilities, MdbaseSyncTransport, MdbaseSyncConnection } from "./connection-types.js";
 export { effectiveCapabilities } from "./capabilities.js";
+export type { MdbaseStructuredReadiness } from "./structured-readiness.js";
 export type { MdbaseCapabilityState, MdbaseCapabilityEvidence, MdbaseEffectiveCapability, MdbaseEffectiveCapabilities } from "./capabilities.js";
 export { MdbaseConnectError, isRetryableConnectError } from "./errors.js";
 export type { ConnectErrorContext } from "./errors.js";
@@ -22,4 +23,5 @@ export { MdbaseBrowserSelection, MdbaseMemorySelection } from "./selection.js";
 export type { MdbaseSelectionHistory, MdbaseApplicationSelection, MdbaseBrowserSelectionOptions } from "./selection.js";
 export type { MdbaseUnavailableReason } from "./session.js";
 export { MDBASE_RECORD_CREATED_CONTRACT, MDBASE_TIMER_FIRED_CONTRACT, operationsForApplicationCapabilities } from "@mdbase-dev/connect-protocol";
-export type { ApplicationProvisions, ApplicationCapabilityId, ApplicationCapabilityRequirements, ApplicationRequirements, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, FileAction, FileCapability, CollectionOperation as MdbaseOperation, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, GrantScope, JsonObject, MdbaseAppManifest, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, TypePackManifest, TypePackManifestResource, TypePackProvision, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";
+export type { MdbaseApplicationManifest, MdbaseApplicationManifest as MdbaseAppManifest, MdbaseApplicationRequirements, MdbaseApplicationCapabilityId as ApplicationCapabilityId, MdbaseApplicationCapabilityRequirements as ApplicationCapabilityRequirements } from "./application-contract.js";
+export type { ApplicationProvisions, ApplicationRequirements, LegacyApplicationRequirements, LegacyApplicationCapabilityId, LegacyApplicationCapabilityRequirements, LegacyMdbaseAppManifest, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, FileAction, FileCapability, CollectionOperation as MdbaseOperation, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, GrantScope, JsonObject, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, TypePackManifest, TypePackManifestResource, TypePackProvision, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";

package/dist/internal-types.d.ts

@@ -1,4 +1,5 @@
-import type { ApplicationNotifications, ApplicationRequirements, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, FileCapability, GrantScope, MdbaseOperationRequest, MutationOperationIdentifier } from "@mdbase-dev/connect-protocol";
+import type { ApplicationNotifications, ApplicationProvisions, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, FileCapability, GrantScope, MdbaseOperationRequest, MutationOperationIdentifier } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationRequirements as ApplicationRequirements } from "./application-contract.js";
 import { encryptRelayRequest } from "./crypto.js";
 export interface Application {
     id: string;
@@ -10,6 +11,7 @@ export interface Application {
     project_url?: string;
     notifications?: ApplicationNotifications;
     requirements: ApplicationRequirements;
+    provisions?: ApplicationProvisions;
 }
 export interface StoredAuthorization {
     version: 1;
@@ -95,4 +97,4 @@ export interface OperationAttempt {
     pendingMutationRecord?: PendingMutation;
     resumingMutation?: boolean;
 }
-export declare const DEFAULT_OPERATIONS: CollectionOperation[];
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/internal-types.js

@@ -1 +1 @@
-export const DEFAULT_OPERATIONS = ["describe", "changes", "read", "query"];
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/mdbase-connect.d.ts

@@ -14,7 +14,7 @@ export declare class MdbaseConnect<Frontmatter extends JsonObject = JsonObject>
     authorize(options?: MdbaseAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
     /** The ordinary application lifecycle entry point. */
     application(options: MdbaseApplicationSessionOptions): MdbaseApplicationSession<Frontmatter>;
-    manifest(options?: ConnectRequestOptions): Promise<ConnectOutcome<import("@mdbase-dev/connect-protocol").MdbaseAppManifest, RegistrationProblemCode>>;
+    manifest(options?: ConnectRequestOptions): Promise<ConnectOutcome<import("./application-contract.js").MdbaseApplicationManifest, RegistrationProblemCode>>;
     environment(): MdbaseConnectEnvironment;
     completeAuthorization(callbackUrl?: string | URL, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationResult<Frontmatter>, AuthorizationProblemCode>>;
     connections(): MdbaseConnectionInfo[];

package/dist/request-coordinator.js

@@ -79,6 +79,7 @@ export class CollectionRequestCoordinator {
                 if (queued.started || queued.settled)
                     return;
                 queued.settled = true;
+                queue.splice(queue.indexOf(queued), 1);
                 queued.reject(requestAbortReason(combined.signal));
                 combined.dispose();
                 this.releaseLatest(coordination.family, replacement);

package/dist/runtime-utils.d.ts

@@ -1,7 +1,14 @@
-import type { FileCapability, GrantEncryption, GrantScope, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { FileCapability, GrantEncryption, GrantScope } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import { MdbaseConnectError } from "./errors.js";
 import type { StoredToken } from "./internal-types.js";
 import type { MdbaseDeviceAuthorization } from "./authorization-types.js";
+/** Resolve bundled declarations and their stable storage identity without loading URLs. */
+export declare function resolveManifestSource(input?: MdbaseAppManifest | string | URL, redirect?: string | URL): {
+    manifest: MdbaseAppManifest | string;
+    manifestSource: string;
+    redirectUri: string;
+};
 type NetworkProblemCode = "notification_registration_failed" | "notification_unregistration_failed" | "notifications_unavailable" | "temporarily_unavailable";
 /** Normalize fetch rejection at the exact I/O boundary. */
 export declare function connectFetch(input: RequestInfo | URL, init: RequestInit | undefined, code: NetworkProblemCode, message: string): Promise<Response>;

package/dist/runtime-utils.js

@@ -2,6 +2,19 @@ import { validateGrantEncryption } from "./crypto.js";
 import { connectError, serverConnectError } from "./errors.js";
 import { canonicalJson } from "./operation-helpers.js";
 import { bytesToBase64Url, randomBase64Url } from "./base64.js";
+/** Resolve bundled declarations and their stable storage identity without loading URLs. */
+export function resolveManifestSource(input, redirect) {
+    const manifest = input instanceof URL ? input.href : input ?? defaultManifestSource();
+    const manifestSource = typeof manifest === "string"
+        ? manifest
+        : manifest.distribution === "portable"
+            ? `bundle:${manifest.id}:${manifestStorageFingerprint(manifest)}`
+            : `bundle:${manifest.id}`;
+    const redirectUri = redirect === undefined ? (typeof manifest !== "string" && manifest.distribution === "portable"
+        ? ""
+        : defaultRedirectUri()) : String(redirect);
+    return { manifest, manifestSource, redirectUri };
+}
 /** Normalize fetch rejection at the exact I/O boundary. */
 export async function connectFetch(input, init, code, message) {
     try {

package/dist/session.d.ts

@@ -1,10 +1,12 @@
 import type { CollectionOperation, ConnectProblem, JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationManifest, type MdbaseApplicationCapabilityId as ApplicationCapabilityId } from "./application-contract.js";
 import { MdbaseConnection, type MdbaseAuthorizationOutcome, type MdbaseAuthorizationResult, type MdbaseAuthorizeOptions } from "./connection.js";
 import type { MdbaseAuthorizationCapabilities, MdbaseConnectionInfo } from "./connection-types.js";
-import { type AuthorizationProblemCode, type ConnectOutcome, type SessionProblemCode } from "./outcomes.js";
+import { type AuthorizationProblemCode, type RegistrationProblemCode, type ConnectOutcome, type SessionProblemCode } from "./outcomes.js";
 import type { MdbaseSelectionHistory, MdbaseApplicationSelection } from "./selection.js";
 import type { ConnectRequestOptions } from "./operation-types.js";
 export interface MdbaseSessionConnect<Frontmatter extends JsonObject> {
+    manifest?(options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseApplicationManifest, RegistrationProblemCode>>;
     authorize(options?: MdbaseAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
     completeAuthorization(callbackUrl: string, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationResult<Frontmatter>, AuthorizationProblemCode>>;
     connections(): MdbaseConnectionInfo[];
@@ -87,11 +89,16 @@ export declare class MdbaseSession<Frontmatter extends JsonObject = JsonObject>
     forget(collectionId: string): ConnectOutcome<void, SessionProblemCode>;
     authorize(target: "choose" | "selected" | {
         collectionId: string;
-    }, options?: Omit<MdbaseAuthorizeOptions, "operations" | "returnTo" | "target">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
-    ensureOperations(requiredOperations: CollectionOperation[], options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
+    }, options?: Omit<MdbaseAuthorizeOptions, "returnTo" | "target">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
+    ensureOperations(requiredOperations: CollectionOperation[], options?: ConnectRequestOptions): Promise<ConnectOutcome<{
         kind: "unchanged";
         connection: MdbaseConnection<Frontmatter>;
-    }, SessionProblemCode>>;
+    } | MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
+    ensureCapabilities(requiredCapabilities: ApplicationCapabilityId[], options?: ConnectRequestOptions): Promise<ConnectOutcome<{
+        kind: "unchanged";
+        connection: MdbaseConnection<Frontmatter>;
+    } | MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
+    private ensureAuthorization;
     handleAuthorizationCallback(callbackUrl: string, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseConnection<Frontmatter>, SessionProblemCode>>;
     private completeAuthorizationCallback;
     private beginCallbackCompletion;

package/dist/session.js

@@ -1,3 +1,5 @@
+import { APPLICATION_CAPABILITY_DEFINITIONS, capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
+import { retainedCapabilities, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
 import { authorizationCallbackState, authorizationReturnToFromProblem, isAuthorizationCallbackUrl } from "./authorization-url.js";
 import { MdbaseConnectError, connectProblem } from "./errors.js";
 import { DEFAULT_OPERATIONS } from "./internal-types.js";
@@ -221,9 +223,16 @@ export class MdbaseSession {
         const operation = this.beginLifecycleOperation(options);
         this.transactionDepth += 1;
         try {
+            const declaration = await this.connect.manifest?.(operation.options);
+            if (declaration && !declaration.ok)
+                return declaration;
+            if (!this.lifecycleCurrent(operation.generation))
+                return this.destroyedOutcome(connectSuccess(undefined));
+            const version = declaration ? semanticContractVersion(declaration.value.requirements) : 1;
             const outcome = await this.connect.authorize({
                 ...operation.options,
-                operations: this.operations,
+                ...(version === 1 && options.operations === undefined && options.capabilities === undefined
+                    ? { operations: this.operations } : {}),
                 target: targetCollectionId === null
                     ? { kind: "choose" }
                     : { kind: "collection", collectionId: targetCollectionId },
@@ -242,7 +251,13 @@ export class MdbaseSession {
             this.refresh();
         }
     }
-    async ensureOperations(requiredOperations, options) {
+    ensureOperations(requiredOperations, options) {
+        return this.ensureAuthorization({ operations: requiredOperations }, options);
+    }
+    ensureCapabilities(requiredCapabilities, options) {
+        return this.ensureAuthorization({ capabilities: requiredCapabilities }, options);
+    }
+    async ensureAuthorization(selection, options) {
         const lifecycle = this.lifecycleProblem();
         if (lifecycle)
             return connectFailure(lifecycle);
@@ -250,17 +265,30 @@ export class MdbaseSession {
         if (current.status !== "ready") {
             return connectFailure(connectProblem("collection_not_ready", "Choose an authorized collection first."));
         }
-        const required = uniqueOperations(requiredOperations);
-        const capabilities = current.connection.authorizationCapabilities(required);
-        if (capabilities.sufficient) {
-            return connectSuccess({ kind: "unchanged", connection: current.connection });
-        }
         const operation = this.beginLifecycleOperation(options);
         this.transactionDepth += 1;
         try {
+            const declaration = await this.connect.manifest?.(operation.options);
+            if (declaration && !declaration.ok)
+                return declaration;
+            if (!this.lifecycleCurrent(operation.generation))
+                return this.destroyedOutcome(connectSuccess(undefined));
+            // Custom advanced session adapters predating manifest() retain exact v1
+            // operations. The concrete SDK always supplies its declared manifest.
+            const requirements = declaration?.value.requirements ?? ("operations" in selection
+                ? { access: "full_collection", contracts: [] }
+                : { access: "full_collection", contracts: [], capabilities: { contract_version: 2, required: [], optional: Object.keys(APPLICATION_CAPABILITY_DEFINITIONS) } });
+            validateAuthorizationSelection(requirements, { ...options, ...selection });
+            const requiredOperations = "operations" in selection ? selection.operations : selection.capabilities.flatMap((id) => capabilityOperationsForContractVersion(semanticContractVersion(requirements), id) ?? []);
+            const authorization = current.connection.authorizationCapabilities(requiredOperations);
+            if (authorization.sufficient)
+                return connectSuccess({ kind: "unchanged", connection: current.connection });
+            const incremental = "operations" in selection || semanticContractVersion(requirements) === 1
+                ? { operations: uniqueOperations([...authorization.grantedOperations, ...requiredOperations]) }
+                : { capabilities: [...new Set([...retainedCapabilities(requirements, authorization.grantedOperations), ...selection.capabilities])] };
             const outcome = await this.connect.authorize({
                 ...operation.options,
-                operations: uniqueOperations([...capabilities.grantedOperations, ...capabilities.missingOperations]),
+                ...incremental,
                 target: { kind: "collection", collectionId: current.collectionId },
                 returnTo: this.selection.authorizationReturnTo()
             });
@@ -271,6 +299,11 @@ export class MdbaseSession {
             }
             return outcome;
         }
+        catch (error) {
+            if (error instanceof MdbaseConnectError)
+                return connectFailure(error.problem);
+            throw error;
+        }
         finally {
             operation.dispose();
             this.transactionDepth -= 1;