@mdbase-dev/connect 0.1.0-beta.94 → 0.1.0-beta.96

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-kDjazWo3W17cBn4WByvZ0jGGc1aqQxNTWglefSAMrEoEzGRgo8YNzRYSI3sQb8tx
+sha384-qa5e6QDDjQFkjqKf4HstaDjyvJmQnvu4PkubKmMs2QIDou3qqMn+uYWQG2Z0ImA2

package/dist/capabilities.d.ts

@@ -1,4 +1,5 @@
-import { type ApplicationCapabilityId, type ApplicationCapabilityRequirements, type MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import { type ApplicationCapabilityRequirements, type LegacyApplicationCapabilityRequirements } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationCapabilityId as ApplicationCapabilityId, MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import type { MdbaseConnectionInfo } from "./connection-types.js";
 export type MdbaseCapabilityState = "available" | "requires_authorization" | "requires_setup" | "temporarily_unavailable" | "unsupported";
 export interface MdbaseCapabilityEvidence {
@@ -16,8 +17,8 @@ export interface MdbaseEffectiveCapability {
     details?: Record<string, unknown>;
 }
 export interface MdbaseEffectiveCapabilities {
-    contractVersion: 1;
+    contractVersion: 1 | 2;
     values: Partial<Record<ApplicationCapabilityId, MdbaseEffectiveCapability>>;
     requiredAvailable: boolean;
 }
-export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;
+export declare function effectiveCapabilities(requirements: ApplicationCapabilityRequirements | LegacyApplicationCapabilityRequirements, manifest: MdbaseAppManifest, connection: MdbaseConnectionInfo): MdbaseEffectiveCapabilities;

package/dist/capabilities.js

@@ -1,19 +1,19 @@
-import { capabilityOperations } from "@mdbase-dev/connect-protocol";
+import { capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
 export function effectiveCapabilities(requirements, manifest, connection) {
     const required = new Set(requirements.required);
     const declared = [...new Set([...requirements.required, ...(requirements.optional ?? [])])];
     const values = {};
     for (const id of declared) {
-        values[id] = effectiveCapability(id, required.has(id), manifest, connection);
+        values[id] = effectiveCapability(id, required.has(id), connection, requirements.contract_version, manifest);
     }
     return {
-        contractVersion: 1,
+        contractVersion: requirements.contract_version,
         values,
         requiredAvailable: requirements.required.every((id) => values[id]?.state === "available")
     };
 }
-function effectiveCapability(id, required, manifest, connection) {
-    const operations = capabilityOperations(id);
+function effectiveCapability(id, required, connection, version, manifest) {
+    const operations = capabilityOperationsForContractVersion(version, id) ?? [];
     const missingOperations = operations.filter((operation) => !connection.operations.includes(operation));
     const base = {
         id,
@@ -22,7 +22,7 @@ function effectiveCapability(id, required, manifest, connection) {
         missingOperations,
         evidence: [{
                 source: "application",
-                fact: `${required ? "Required" : "Optional"} in capability contract v1.`
+                fact: `${required ? "Required" : "Optional"} in capability contract v${version}.`
             }]
     };
     if (missingOperations.length > 0) {
@@ -47,35 +47,20 @@ function effectiveCapability(id, required, manifest, connection) {
                 }]
         };
     }
-    if (id.startsWith("files.")) {
+    // Compatibility readiness is deliberately limited to v1 aliases. V2 needs
+    // structured file/notification/runtime evidence, not these legacy shortcuts.
+    if (version === 1 && id.startsWith("files.")) {
         const action = id.slice("files.".length);
         if (!connection.fileCapability?.actions.includes(action)) {
             return {
                 ...base,
                 state: connection.fileCapability ? "requires_authorization" : "unsupported",
-                reason: connection.fileCapability
-                    ? `The current file grant does not include ${action}.`
-                    : "This connection has no file capability.",
-                evidence: [...base.evidence, {
-                        source: "authorization",
-                        fact: connection.fileCapability
-                            ? `Granted file actions: ${connection.fileCapability.actions.join(", ")}.`
-                            : "No file capability was granted."
-                    }]
+                reason: connection.fileCapability ? `The current file grant does not include ${action}.` : "This connection has no file capability."
             };
         }
     }
-    if (id === "notifications.background-delivery"
-        && (manifest.notifications?.criteria.length ?? 0) === 0) {
-        return {
-            ...base,
-            state: "requires_setup",
-            reason: "The application manifest declares no notification criteria.",
-            evidence: [...base.evidence, {
-                    source: "application",
-                    fact: "No authority notification criteria are declared."
-                }]
-        };
+    if (version === 1 && id === "notifications.background-delivery" && (manifest.notifications?.criteria.length ?? 0) === 0) {
+        return { ...base, state: "requires_setup", reason: "The application manifest declares no notification criteria." };
     }
     return {
         ...base,
@@ -91,7 +76,7 @@ function effectiveCapability(id, required, manifest, connection) {
                     ? "Backed by a durable hosted mdbase authority."
                     : "Backed by a user-operated mdbase connector."
             }],
-        ...(id === "sync.offline-replica"
+        ...(id === "offline.replica" || (version === 1 && id === "sync.offline-replica")
             ? {
                 details: {
                     durability: "device",
@@ -100,8 +85,7 @@ function effectiveCapability(id, required, manifest, connection) {
                 }
             }
             : {}),
-        ...(id === "notifications.background-delivery"
-            ? { details: { delivery: "authority", payload: "opaque" } }
-            : {})
+        ...(version === 1 && id === "notifications.background-delivery"
+            ? { details: { delivery: "authority", payload: "opaque" } } : {})
     };
 }

package/dist/connect-authorization-helpers.d.ts

@@ -1,3 +1,4 @@
 import { MdbaseConnectError } from "./errors.js";
+export declare function assertFreshV2AuthorizationSupport(serverUrl: string, signal?: AbortSignal): Promise<void>;
 export declare function declarationIdFromFamilyIdentity(familyIdentity: string): string;
 export declare function authorizationAbort(signal: AbortSignal, message: string, cause?: unknown): MdbaseConnectError;

package/dist/connect-authorization-helpers.js

@@ -1,4 +1,16 @@
+import { APPLICATION_AUTHORIZATION_V2_ISSUANCE_CAPABILITY } from "@mdbase-dev/connect-protocol";
 import { MdbaseConnectError, connectError } from "./errors.js";
+export async function assertFreshV2AuthorizationSupport(serverUrl, signal) {
+    const response = await fetch(`${serverUrl}/health`, { signal, cache: "no-store" });
+    const health = await response.json().catch(() => null);
+    if (!response.ok || !Array.isArray(health?.capabilities)
+        || !health.capabilities.every((value) => typeof value === "string")
+        || !health.capabilities.includes(APPLICATION_AUTHORIZATION_V2_ISSUANCE_CAPABILITY)) {
+        throw connectError("capability_contract_incompatible", "This server does not support new version-2 application authorizations.", {
+            details: { contract: "fresh_application_authorization", required: [2], supported: [], peer: "server" }
+        });
+    }
+}
 export function declarationIdFromFamilyIdentity(familyIdentity) {
     const prefix = "bundle:";
     if (!familyIdentity.startsWith(prefix) || familyIdentity.length === prefix.length) {

package/dist/connect-options.d.ts

@@ -1,4 +1,5 @@
-import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
+import type { JsonObject } from "@mdbase-dev/connect-protocol";
 import type { GrantKeyStore } from "./crypto.js";
 import type { ApplicationIdentityStore } from "./application-identity.js";
 export interface MdbaseConnectTimeouts {

package/dist/connect.d.ts

@@ -1,4 +1,5 @@
-import type { JsonObject, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import { type ApplicationIdentityStore } from "./application-identity.js";
 import { MdbaseConnection, type MdbaseAuthorizationOutcome, type MdbaseAuthorizationResult, type MdbaseAuthorizeOptions, type MdbaseConnectEnvironment } from "./connection.js";
 import type { MdbaseConnectOptions } from "./connect-options.js";

package/dist/connect.js

@@ -1,20 +1,19 @@
 import { APPLICATION_AUTHORIZATION_PROTOCOL_VERSION, authorizationContractRequirements, DEFAULT_LOOPBACK_PORT, GRANT_ENCRYPTION_PROTOCOL_VERSION, RELAY_ENCRYPTION_SUITE } from "@mdbase-dev/connect-protocol";
+import { authorizationOperations, authorizationFiles, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
 import { abortableDelay } from "./async.js";
 import { authorizationCallbackState } from "./authorization-url.js";
 import { randomBase64Url } from "./base64.js";
 import { ApplicationIdentityStoreError, IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, applicationIdentity, applicationInstallationId, signApplicationAuthorization } from "./application-identity.js";
 import { MdbaseConnection } from "./connection.js";
 import { addConnectionId, connectionIds, removeConnectionId } from "./connection-index.js";
-import { authorizationAbort, declarationIdFromFamilyIdentity } from "./connect-authorization-helpers.js";
+import { assertFreshV2AuthorizationSupport, authorizationAbort, declarationIdFromFamilyIdentity } from "./connect-authorization-helpers.js";
 import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
 import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
-import { DEFAULT_OPERATIONS } from "./internal-types.js";
 import { prepareAuthorizationWindow, publishPopupAuthorizationCompletion, waitForPopupAuthorization } from "./popup-authorization.js";
-import { uniqueOperations } from "./operation-helpers.js";
 import { pendingRecoveryTransports, removePendingMutations } from "./pending-recovery-transports.js";
 import { GrantKeyLeaseRegistry } from "./grant-key-leases.js";
 import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
-import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
+import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, resolveManifestSource, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
 import { storedTokenFromResponse } from "./token-response.js";
 import { deleteUnusedGrantKey, planRetiredGrantKeys, storedTokenKeyHandles } from "./retired-grant-keys.js";
 import { SharedOperationMap } from "./shared-operation.js";
@@ -41,18 +40,11 @@ export class MdbaseConnectInternals {
     invalidatedConnections = new Map();
     constructor(options) {
         this.serverUrl = stripTrailingSlash(String(options.serverUrl));
-        this.manifest = options.manifest instanceof URL
-            ? options.manifest.href
-            : options.manifest ?? defaultManifestSource();
-        this.manifestSource = typeof this.manifest === "string"
-            ? this.manifest
-            : this.manifest.distribution === "portable"
-                ? `bundle:${this.manifest.id}:${manifestStorageFingerprint(this.manifest)}`
-                : `bundle:${this.manifest.id}`;
+        const declaration = resolveManifestSource(options.manifest, options.redirectUri);
+        this.manifest = declaration.manifest;
+        this.manifestSource = declaration.manifestSource;
         const opaquePortable = isOpaquePortableManifest(this.manifest);
-        this.redirectUri = options.redirectUri === undefined ? (typeof this.manifest !== "string" && this.manifest.distribution === "portable"
-            ? ""
-            : defaultRedirectUri()) : String(options.redirectUri);
+        this.redirectUri = declaration.redirectUri;
         this.storage = options.storage ?? defaultStorage(opaquePortable);
         this.relayEncryption = options.relayEncryption ?? "required";
         this.keyStore = options.keyStore ?? (opaquePortable ? new MemoryGrantKeyStore() : new IndexedDbGrantKeyStore());
@@ -168,6 +160,16 @@ export class MdbaseConnectInternals {
             navigate: this.navigate,
             register: (signal) => this.registerWithinBudget(signal)
         });
+        try {
+            validateAuthorizationSelection(application.requirements, options);
+            if (application.requirements.capabilities?.contract_version === 2) {
+                await assertFreshV2AuthorizationSupport(this.serverUrl, options.signal);
+            }
+        }
+        catch (error) {
+            popup?.close();
+            throw error;
+        }
         if (application.distribution === "portable") {
             if (options.openVerification)
                 popup?.close();
@@ -192,7 +194,8 @@ export class MdbaseConnectInternals {
             await this.keyStore.delete(keyHandle);
             throw error;
         }
-        const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
             protocol_version: APPLICATION_AUTHORIZATION_PROTOCOL_VERSION,
@@ -211,11 +214,9 @@ export class MdbaseConnectInternals {
             redirect_uri: this.redirectUri,
             state,
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId)),
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId), semanticContractVersion(application.requirements)),
             requested_operations: operations,
-            ...(application.requirements?.files
-                ? { requested_files: application.requirements.files }
-                : {}),
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
             ...(targetCollectionId ? { collection_id: targetCollectionId } : {})
         }, installation);
         const pending = {
@@ -310,7 +311,8 @@ export class MdbaseConnectInternals {
             await this.keyStore.delete(keyHandle);
             throw error;
         }
-        const operations = uniqueOperations(options.operations ?? DEFAULT_OPERATIONS);
+        const operations = authorizationOperations(application, options);
+        const requestedFiles = authorizationFiles(application.requirements);
         const authorizationId = crypto.randomUUID();
         const issuedAt = new Date();
         const proof = await signApplicationAuthorization({
@@ -328,11 +330,9 @@ export class MdbaseConnectInternals {
             issued_at: issuedAt.toISOString(),
             expires_at: new Date(issuedAt.getTime() + 10 * 60 * 1_000).toISOString(),
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined)),
+            contracts: authorizationContractRequirements(operations, requestedFiles, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined), semanticContractVersion(application.requirements)),
             requested_operations: operations,
-            ...(application.requirements?.files
-                ? { requested_files: application.requirements.files }
-                : {}),
+            ...(requestedFiles ? { requested_files: requestedFiles } : {}),
             ...(options.target?.kind === "collection"
                 ? { collection_id: options.target.collectionId }
                 : {})

package/dist/connection.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionOperation, CollectionTypeDocument, FileCapability, GrantScope, JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationCapabilityId as ApplicationCapabilityId } from "./application-contract.js";
 import { type ConnectionTransportInternals } from "./connection-transport.js";
 import type { DirectAccessStatus, MdbaseAuthorizationCapabilities, MdbaseConnectionInfo, MdbaseConnectionRoute, MdbaseSyncConnection } from "./connection-types.js";
 import type { GrantKeyStore } from "./crypto.js";
@@ -16,7 +17,10 @@ export type MdbaseAuthorizationTarget = {
     collectionId: string;
 };
 export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
+    /** Exact independent operations, for legacy v1 declarations only. Cannot be mixed with capabilities. */
     operations?: CollectionOperation[];
+    /** Capability groups to request. Required groups are always included; optional groups default to all. */
+    capabilities?: ApplicationCapabilityId[];
     /** Keep a web application loaded while Connect owns the approval ceremony. */
     presentation?: "redirect" | "popup";
     /** Choose any compatible collection, or require one exact collection. */
@@ -29,7 +33,10 @@ export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;
 }
 export interface MdbaseConnectionAuthorizeOptions extends ConnectRequestOptions {
+    /** Exact independent operations, for legacy v1 declarations only. */
     operations?: CollectionOperation[];
+    /** Capability groups to request. Required groups are always included; optional groups default to all. */
+    capabilities?: ApplicationCapabilityId[];
     presentation?: "redirect" | "popup";
     returnTo?: string;
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
@@ -80,6 +87,10 @@ export declare class MdbaseConnection<Frontmatter extends JsonObject = JsonObjec
     authorizationCapabilities(requiredOperations?: CollectionOperation[]): MdbaseAuthorizationCapabilities;
     hasOperations(requiredOperations: CollectionOperation[]): boolean;
     authorize(options?: MdbaseConnectionAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
+    requestCapabilities(capabilities: ApplicationCapabilityId[], options?: MdbaseConnectionAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
+        kind: "unchanged";
+        connection: MdbaseConnection<Frontmatter>;
+    }, AuthorizationProblemCode>>;
     requestOperations(requiredOperations: CollectionOperation[], options?: Omit<MdbaseConnectionAuthorizeOptions, "operations">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
         kind: "unchanged";
         connection: MdbaseConnection<Frontmatter>;

package/dist/connection.js

@@ -1,3 +1,5 @@
+import { capabilityOperationsForContractVersion } from "@mdbase-dev/connect-protocol";
+import { retainedCapabilities, semanticContractVersion, validateAuthorizationSelection } from "./application-contract.js";
 import { MdbaseCollectionClient } from "./collection-client.js";
 import { ConnectionNotifications } from "./connection-notifications.js";
 import { ConnectionTransport } from "./connection-transport.js";
@@ -106,18 +108,43 @@ export class MdbaseConnection {
             target: { kind: "collection", collectionId: this.collectionId }
         }), AUTHORIZATION_PROBLEM_CODES);
     }
+    async requestCapabilities(capabilities, options = {}) {
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, capabilities });
+            const sufficient = this.info() !== null && capabilities.every((capability) => (capabilityOperationsForContractVersion(semanticContractVersion(application.requirements), capability) ?? [])
+                .every((operation) => this.operations.includes(operation)));
+            if (sufficient)
+                return { kind: "unchanged", connection: this };
+            if (semanticContractVersion(application.requirements) === 1) {
+                const { capabilities: _selection, ...legacyOptions } = options;
+                return this.internals.authorize({
+                    ...legacyOptions,
+                    target: { kind: "collection", collectionId: this.collectionId },
+                    operations: [...new Set([...this.operations, ...capabilities.flatMap((id) => capabilityOperationsForContractVersion(1, id) ?? [])])]
+                });
+            }
+            const retained = retainedCapabilities(application.requirements, this.operations);
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                capabilities: [...new Set([...retained, ...capabilities])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
+    }
     async requestOperations(requiredOperations, options = {}) {
-        const capabilities = this.authorizationCapabilities(requiredOperations);
-        if (capabilities.sufficient) {
-            return connectSuccess({ kind: "unchanged", connection: this });
-        }
-        return this.authorize({
-            ...options,
-            operations: uniqueOperations([
-                ...capabilities.grantedOperations,
-                ...capabilities.missingOperations
-            ])
-        });
+        return captureConnectOutcome(async () => {
+            const application = await this.internals.register(options);
+            validateAuthorizationSelection(application.requirements, { ...options, operations: requiredOperations });
+            const authorization = this.authorizationCapabilities(requiredOperations);
+            if (authorization.sufficient)
+                return { kind: "unchanged", connection: this };
+            return this.internals.authorize({
+                ...options,
+                target: { kind: "collection", collectionId: this.collectionId },
+                operations: [...new Set([...authorization.grantedOperations, ...requiredOperations])]
+            });
+        }, AUTHORIZATION_PROBLEM_CODES);
     }
     onConnectionChange(listener) {
         this.connectionListeners.add(listener);

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { MdbaseConnection } from "./connection.js";
 export type { MdbaseAuthorizationTarget, MdbaseAuthorizeOptions, MdbaseConnectionAuthorizeOptions, MdbaseConnectEnvironment, MdbaseAuthorizationResult, MdbaseAuthorizationOutcome } from "./connection.js";
 export type { MdbaseConnectionRoute, DirectAccessStatus, MdbaseConnectionInfo, MdbaseAuthorizationCapabilities, MdbaseSyncTransport, MdbaseSyncConnection } from "./connection-types.js";
 export { effectiveCapabilities } from "./capabilities.js";
+export type { MdbaseStructuredReadiness } from "./structured-readiness.js";
 export type { MdbaseCapabilityState, MdbaseCapabilityEvidence, MdbaseEffectiveCapability, MdbaseEffectiveCapabilities } from "./capabilities.js";
 export { MdbaseConnectError, isRetryableConnectError } from "./errors.js";
 export type { ConnectErrorContext } from "./errors.js";
@@ -22,4 +23,5 @@ export { MdbaseBrowserSelection, MdbaseMemorySelection } from "./selection.js";
 export type { MdbaseSelectionHistory, MdbaseApplicationSelection, MdbaseBrowserSelectionOptions } from "./selection.js";
 export type { MdbaseUnavailableReason } from "./session.js";
 export { MDBASE_RECORD_CREATED_CONTRACT, MDBASE_TIMER_FIRED_CONTRACT, operationsForApplicationCapabilities } from "@mdbase-dev/connect-protocol";
-export type { ApplicationProvisions, ApplicationCapabilityId, ApplicationCapabilityRequirements, ApplicationRequirements, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, FileAction, FileCapability, CollectionOperation as MdbaseOperation, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, GrantScope, JsonObject, MdbaseAppManifest, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, TypePackManifest, TypePackManifestResource, TypePackProvision, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";
+export type { MdbaseApplicationManifest, MdbaseApplicationManifest as MdbaseAppManifest, MdbaseApplicationRequirements, MdbaseApplicationCapabilityId as ApplicationCapabilityId, MdbaseApplicationCapabilityRequirements as ApplicationCapabilityRequirements } from "./application-contract.js";
+export type { ApplicationProvisions, ApplicationRequirements, LegacyApplicationRequirements, LegacyApplicationCapabilityId, LegacyApplicationCapabilityRequirements, LegacyMdbaseAppManifest, ApplicationNotifications, ApplicationAuthorizationBinding, ApplicationAuthorizationProof, FileAction, FileCapability, CollectionOperation as MdbaseOperation, CollectionTypeDocument, ConnectOperationOutcome, ConnectProblem, ConnectProblemCategory, ConnectProblemCode, ConnectProblemDetailsByCode, ConnectRecoveryAction, ContractRequirement, GrantScope, JsonObject, NotificationCriterion, MdbaseDiagnostic, MdbaseOperationEnvelope, KnownConnectProblem, TypePackManifest, TypePackManifestResource, TypePackProvision, TypePackSourceResource, UnknownConnectProblem } from "@mdbase-dev/connect-protocol";

package/dist/internal-types.d.ts

@@ -1,4 +1,5 @@
-import type { ApplicationNotifications, ApplicationRequirements, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, FileCapability, GrantScope, MdbaseOperationRequest, MutationOperationIdentifier } from "@mdbase-dev/connect-protocol";
+import type { ApplicationNotifications, ApplicationProvisions, CollectionOperation, EncryptedRelayOperationRequest, GrantEncryption, FileCapability, GrantScope, MdbaseOperationRequest, MutationOperationIdentifier } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationRequirements as ApplicationRequirements } from "./application-contract.js";
 import { encryptRelayRequest } from "./crypto.js";
 export interface Application {
     id: string;
@@ -10,6 +11,7 @@ export interface Application {
     project_url?: string;
     notifications?: ApplicationNotifications;
     requirements: ApplicationRequirements;
+    provisions?: ApplicationProvisions;
 }
 export interface StoredAuthorization {
     version: 1;
@@ -95,4 +97,4 @@ export interface OperationAttempt {
     pendingMutationRecord?: PendingMutation;
     resumingMutation?: boolean;
 }
-export declare const DEFAULT_OPERATIONS: CollectionOperation[];
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/internal-types.js

@@ -1 +1 @@
-export const DEFAULT_OPERATIONS = ["describe", "changes", "read", "query"];
+export { DEFAULT_OPERATIONS } from "./application-contract.js";

package/dist/mdbase-connect.d.ts

@@ -14,7 +14,7 @@ export declare class MdbaseConnect<Frontmatter extends JsonObject = JsonObject>
     authorize(options?: MdbaseAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
     /** The ordinary application lifecycle entry point. */
     application(options: MdbaseApplicationSessionOptions): MdbaseApplicationSession<Frontmatter>;
-    manifest(options?: ConnectRequestOptions): Promise<ConnectOutcome<import("@mdbase-dev/connect-protocol").MdbaseAppManifest, RegistrationProblemCode>>;
+    manifest(options?: ConnectRequestOptions): Promise<ConnectOutcome<import("./application-contract.js").MdbaseApplicationManifest, RegistrationProblemCode>>;
     environment(): MdbaseConnectEnvironment;
     completeAuthorization(callbackUrl?: string | URL, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationResult<Frontmatter>, AuthorizationProblemCode>>;
     connections(): MdbaseConnectionInfo[];

package/dist/operation-types.d.ts

@@ -187,7 +187,9 @@ export interface QueryResult<Record extends JsonObject = JsonObject> {
     };
 }
 export interface QueryPagesOptions<Record extends JsonObject = JsonObject> {
+    /** Initial page size. Cursor authorities pin this size for the query lifetime. */
     firstPageSize?: number;
+    /** Also sets the initial size unless firstPageSize is explicit; authorities may cap it. */
     pageSize?: number;
     signal?: AbortSignal;
     /** Independent budget for each page requested by this caller-driven iterator. */
@@ -196,7 +198,9 @@ export interface QueryPagesOptions<Record extends JsonObject = JsonObject> {
     onProgress?: (page: QueryPage<Record>) => void;
 }
 export interface QueryAllOptions<Record extends JsonObject = JsonObject> extends ConnectRequestOptions {
+    /** Initial page size. Cursor authorities pin this size for the query lifetime. */
     firstPageSize?: number;
+    /** Also sets the initial size unless firstPageSize is explicit; authorities may cap it. */
     pageSize?: number;
     onProgress?: (page: QueryPage<Record>) => void;
 }

package/dist/query-pagination.js

@@ -3,7 +3,7 @@ import { connectFailure, connectSuccess } from "./outcomes.js";
 export async function* coordinatedQueryPages(query, releaseQueryCursor, input = {}, options = {}) {
     const { offset: requestedOffset, limit: requestedLimit, cursor: requestedCursor, pagination: requestedPagination, snapshot: requestedSnapshot, ...criteria } = input;
     let offset = nonNegativeInteger(requestedOffset, 0);
-    const firstPageSize = positiveInteger(options.firstPageSize ?? requestedLimit, 200);
+    const firstPageSize = positiveInteger(options.firstPageSize ?? options.pageSize ?? requestedLimit, 200);
     const pageSize = positiveInteger(options.pageSize ?? requestedLimit, 1_000);
     let cursor = requestedCursor;
     let cursorMode = requestedCursor !== undefined;
@@ -25,7 +25,8 @@ export async function* coordinatedQueryPages(query, releaseQueryCursor, input =
                 && requestedSnapshot === undefined;
             let queried = await query({
                 ...criteria,
-                limit: pageNumber === 0 ? firstPageSize : pageSize,
+                // Continuations use the page size pinned when the cursor was opened.
+                ...(!cursorMode ? { limit: pageNumber === 0 ? firstPageSize : pageSize } : {}),
                 ...(cursorMode
                     ? (pageCursor ? { cursor: pageCursor } : { pagination: "cursor" })
                     : {
@@ -100,7 +101,9 @@ export async function* coordinatedQueryPages(query, releaseQueryCursor, input =
     }
     finally {
         if (cursorMode && cursorToRelease) {
-            await releaseQueryCursor(cursorToRelease);
+            // Cleanup has its own bounded request. It must not delay delivery of
+            // completed pages or consume the caller's data deadline.
+            void releaseQueryCursor(cursorToRelease).catch(() => undefined);
         }
     }
 }

package/dist/request-coordinator.js

@@ -79,6 +79,7 @@ export class CollectionRequestCoordinator {
                 if (queued.started || queued.settled)
                     return;
                 queued.settled = true;
+                queue.splice(queue.indexOf(queued), 1);
                 queued.reject(requestAbortReason(combined.signal));
                 combined.dispose();
                 this.releaseLatest(coordination.family, replacement);

package/dist/runtime-utils.d.ts

@@ -1,7 +1,14 @@
-import type { FileCapability, GrantEncryption, GrantScope, MdbaseAppManifest } from "@mdbase-dev/connect-protocol";
+import type { FileCapability, GrantEncryption, GrantScope } from "@mdbase-dev/connect-protocol";
+import type { MdbaseApplicationManifest as MdbaseAppManifest } from "./application-contract.js";
 import { MdbaseConnectError } from "./errors.js";
 import type { StoredToken } from "./internal-types.js";
 import type { MdbaseDeviceAuthorization } from "./authorization-types.js";
+/** Resolve bundled declarations and their stable storage identity without loading URLs. */
+export declare function resolveManifestSource(input?: MdbaseAppManifest | string | URL, redirect?: string | URL): {
+    manifest: MdbaseAppManifest | string;
+    manifestSource: string;
+    redirectUri: string;
+};
 type NetworkProblemCode = "notification_registration_failed" | "notification_unregistration_failed" | "notifications_unavailable" | "temporarily_unavailable";
 /** Normalize fetch rejection at the exact I/O boundary. */
 export declare function connectFetch(input: RequestInfo | URL, init: RequestInit | undefined, code: NetworkProblemCode, message: string): Promise<Response>;

package/dist/runtime-utils.js

@@ -2,6 +2,19 @@ import { validateGrantEncryption } from "./crypto.js";
 import { connectError, serverConnectError } from "./errors.js";
 import { canonicalJson } from "./operation-helpers.js";
 import { bytesToBase64Url, randomBase64Url } from "./base64.js";
+/** Resolve bundled declarations and their stable storage identity without loading URLs. */
+export function resolveManifestSource(input, redirect) {
+    const manifest = input instanceof URL ? input.href : input ?? defaultManifestSource();
+    const manifestSource = typeof manifest === "string"
+        ? manifest
+        : manifest.distribution === "portable"
+            ? `bundle:${manifest.id}:${manifestStorageFingerprint(manifest)}`
+            : `bundle:${manifest.id}`;
+    const redirectUri = redirect === undefined ? (typeof manifest !== "string" && manifest.distribution === "portable"
+        ? ""
+        : defaultRedirectUri()) : String(redirect);
+    return { manifest, manifestSource, redirectUri };
+}
 /** Normalize fetch rejection at the exact I/O boundary. */
 export async function connectFetch(input, init, code, message) {
     try {

package/dist/session.d.ts

@@ -1,10 +1,12 @@
 import type { CollectionOperation, ConnectProblem, JsonObject } from "@mdbase-dev/connect-protocol";
+import { type MdbaseApplicationManifest, type MdbaseApplicationCapabilityId as ApplicationCapabilityId } from "./application-contract.js";
 import { MdbaseConnection, type MdbaseAuthorizationOutcome, type MdbaseAuthorizationResult, type MdbaseAuthorizeOptions } from "./connection.js";
 import type { MdbaseAuthorizationCapabilities, MdbaseConnectionInfo } from "./connection-types.js";
-import { type AuthorizationProblemCode, type ConnectOutcome, type SessionProblemCode } from "./outcomes.js";
+import { type AuthorizationProblemCode, type RegistrationProblemCode, type ConnectOutcome, type SessionProblemCode } from "./outcomes.js";
 import type { MdbaseSelectionHistory, MdbaseApplicationSelection } from "./selection.js";
 import type { ConnectRequestOptions } from "./operation-types.js";
 export interface MdbaseSessionConnect<Frontmatter extends JsonObject> {
+    manifest?(options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseApplicationManifest, RegistrationProblemCode>>;
     authorize(options?: MdbaseAuthorizeOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, AuthorizationProblemCode>>;
     completeAuthorization(callbackUrl: string, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationResult<Frontmatter>, AuthorizationProblemCode>>;
     connections(): MdbaseConnectionInfo[];
@@ -87,11 +89,16 @@ export declare class MdbaseSession<Frontmatter extends JsonObject = JsonObject>
     forget(collectionId: string): ConnectOutcome<void, SessionProblemCode>;
     authorize(target: "choose" | "selected" | {
         collectionId: string;
-    }, options?: Omit<MdbaseAuthorizeOptions, "operations" | "returnTo" | "target">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
-    ensureOperations(requiredOperations: CollectionOperation[], options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter> | {
+    }, options?: Omit<MdbaseAuthorizeOptions, "returnTo" | "target">): Promise<ConnectOutcome<MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
+    ensureOperations(requiredOperations: CollectionOperation[], options?: ConnectRequestOptions): Promise<ConnectOutcome<{
         kind: "unchanged";
         connection: MdbaseConnection<Frontmatter>;
-    }, SessionProblemCode>>;
+    } | MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
+    ensureCapabilities(requiredCapabilities: ApplicationCapabilityId[], options?: ConnectRequestOptions): Promise<ConnectOutcome<{
+        kind: "unchanged";
+        connection: MdbaseConnection<Frontmatter>;
+    } | MdbaseAuthorizationOutcome<Frontmatter>, SessionProblemCode>>;
+    private ensureAuthorization;
     handleAuthorizationCallback(callbackUrl: string, options?: ConnectRequestOptions): Promise<ConnectOutcome<MdbaseConnection<Frontmatter>, SessionProblemCode>>;
     private completeAuthorizationCallback;
     private beginCallbackCompletion;