@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.153

package/dist/application/asset-loader.js

@@ -0,0 +1,130 @@
+import { isAppOrigin, urlOrigin } from "../app-host/app-origin.js";
+import { isMdbaseError, mdbaseError } from "../errors.js";
+import { applicationEnvironmentAllowed, applicationLoopbackAllowed, localApplicationEnvironment, localApplicationOrigin } from "./local-build.js";
+const error = (reason) => mdbaseError("unavailable", "application asset unavailable", reason);
+const fenced = () => mdbaseError("cancelled", "application asset read fenced", "application_asset_fenced");
+function check(signal) { if (signal.aborted)
+    throw fenced(); }
+/** Private same-artifact transport. The SDK release generator supplies immutable
+ * URLs/digests/byte counts from authenticated packaging, never the app or CP.
+ * Persists verified public artifact bytes for offline reopen (HTTP caching alone
+ * is not reliable on WebKit). Every read still passes the packaged size/digest
+ * checks; a different release is never a fallback. Owns IO until work drains. */
+export function applicationAssetLoader(input, source) {
+    const asset = Object.freeze({ ...input }), host = Object.freeze({ ...source });
+    let url, origin;
+    try {
+        url = new URL(asset.url);
+        origin = new URL(host.origin);
+    }
+    catch {
+        throw error("application_asset_binding");
+    }
+    if (!isAppOrigin(host.origin, applicationLoopbackAllowed(host.environment), host.platform) || origin.protocol !== url.protocol
+        || !applicationEnvironmentAllowed(host.environment) || (localApplicationEnvironment(host.environment) && !localApplicationOrigin(host.origin)) || urlOrigin(url) !== host.origin || url.username || url.password || url.search || url.hash
+        || !/^[0-9a-f]{64}$/.test(asset.sha256) || !Number.isSafeInteger(asset.bytes) || asset.bytes < 1
+        || !Number.isSafeInteger(asset.maxBytes) || asset.maxBytes < asset.bytes || asset.maxBytes > 4 * 1024 * 1024)
+        throw error("application_asset_binding");
+    const fetcher = host.fetch ?? globalThis.fetch;
+    if (typeof fetcher !== "function")
+        throw error("application_asset_unavailable");
+    // Public executable bytes only, never collection data or custody. Partition
+    // by exact URL AND digest so a changed release cannot reuse another artifact.
+    const key = new URL(url.href);
+    key.searchParams.set("mdbase-sdk-asset", asset.sha256);
+    return async ({ signal }) => {
+        check(signal);
+        let cache = null, response;
+        try {
+            if (globalThis.caches) {
+                cache = await globalThis.caches.open("mdbase.sdk.application-assets.v1");
+                response = await cache.match(key.href);
+            }
+        }
+        catch { /* Storage can be unavailable; an online load remains usable. */ }
+        const stored = response !== undefined;
+        if (!response) {
+            check(signal);
+            try {
+                response = await fetcher(url.href, { signal, credentials: "omit", cache: "force-cache", redirect: "error" });
+            }
+            catch {
+                check(signal);
+                throw error("application_asset_fetch");
+            }
+        }
+        // Acquire response cleanup before checking cancellation after ignored-abort IO.
+        const reader = response.body?.getReader();
+        if (!reader) {
+            check(signal);
+            throw error("application_asset_response");
+        }
+        let finished = false, closing = null;
+        const close = () => closing ??= Promise.resolve().then(async () => {
+            try {
+                await reader.cancel();
+            }
+            catch {
+                throw error("application_asset_stop_failed");
+            }
+        });
+        const onAbort = () => { void close().catch(() => { }); };
+        signal.addEventListener("abort", onAbort, { once: true });
+        try {
+            check(signal);
+            if (!response.ok || response.redirected || (response.url && response.url !== url.href))
+                throw error("application_asset_response");
+            const length = response.headers.get("content-length");
+            if (length !== null && (!/^(?:0|[1-9][0-9]*)$/.test(length) || Number(length) !== asset.bytes))
+                throw error("application_asset_binding");
+            const bytes = new Uint8Array(asset.bytes);
+            let offset = 0;
+            while (true) {
+                const part = await reader.read();
+                check(signal);
+                if (part.done) {
+                    finished = true;
+                    break;
+                }
+                if (!(part.value instanceof Uint8Array) || part.value.byteLength > asset.bytes - offset)
+                    throw error("application_asset_binding");
+                bytes.set(part.value, offset);
+                offset += part.value.byteLength;
+            }
+            if (offset !== asset.bytes)
+                throw error("application_asset_binding");
+            const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+            check(signal);
+            if (Array.from(digest, byte => byte.toString(16).padStart(2, "0")).join("") !== asset.sha256)
+                throw error("application_asset_binding");
+            check(signal);
+            if (cache && !stored) {
+                // Store only bytes that passed all intake checks; never store a failed
+                // response. Drain the original write before resolving or fencing.
+                try {
+                    await cache.put(key.href, new Response(bytes));
+                }
+                catch { /* Quota/storage refusal must not block an online open. */ }
+            }
+            check(signal);
+            return bytes;
+        }
+        catch (cause) {
+            check(signal);
+            if (isMdbaseError(cause))
+                throw cause;
+            throw error("application_asset_response");
+        }
+        finally {
+            signal.removeEventListener("abort", onAbort);
+            try {
+                if (!finished || signal.aborted)
+                    await close();
+            }
+            finally {
+                reader.releaseLock();
+            }
+        }
+    };
+}
+//# sourceMappingURL=asset-loader.js.map

package/dist/application/asset-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-loader.js","sourceRoot":"","sources":["../../src/application/asset-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAC,SAAS,EAAC,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAC,aAAa,EAAC,WAAW,EAAC,MAAM,cAAc,CAAC;AACvD,OAAO,EAAC,6BAA6B,EAAC,0BAA0B,EAAC,2BAA2B,EAAC,sBAAsB,EAAC,MAAM,kBAAkB,CAAC;AAgB7I,MAAM,KAAK,GAAC,CAAC,MAAa,EAAC,EAAE,CAAA,WAAW,CAAC,aAAa,EAAC,+BAA+B,EAAC,MAAM,CAAC,CAAC;AAC/F,MAAM,MAAM,GAAC,GAAE,EAAE,CAAA,WAAW,CAAC,WAAW,EAAC,+BAA+B,EAAC,0BAA0B,CAAC,CAAC;AACrG,SAAS,KAAK,CAAC,MAAkB,IAAO,IAAG,MAAM,CAAC,OAAO;IAAC,MAAM,MAAM,EAAE,CAAC,CAAA,CAAC;AAE1E;;;;iFAIiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,KAAsB,EAAC,MAA2B;IAEvF,MAAM,KAAK,GAAC,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,KAAK,EAAC,CAAC,EAAC,IAAI,GAAC,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,MAAM,EAAC,CAAC,CAAC;IACtE,IAAI,GAAO,EAAC,MAAU,CAAC;IACvB,IAAG,CAAC;QAAA,GAAG,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAA,MAAM,GAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAAA,CAAC;IACxG,IAAG,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAE,MAAM,CAAC,QAAQ,KAAG,GAAG,CAAC,QAAQ;WACnH,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAE,SAAS,CAAC,GAAG,CAAC,KAAG,IAAI,CAAC,MAAM,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,MAAM,IAAE,GAAG,CAAC,IAAI;WACvN,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAE,KAAK,CAAC,KAAK,GAAC,CAAC;WACvF,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAE,KAAK,CAAC,QAAQ,GAAC,KAAK,CAAC,KAAK,IAAE,KAAK,CAAC,QAAQ,GAAC,CAAC,GAAC,IAAI,GAAC,IAAI;QAAC,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAC,IAAI,CAAC,KAAK,IAAE,UAAU,CAAC,KAAK,CAAC;IAC3C,IAAG,OAAO,OAAO,KAAG,UAAU;QAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAAA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO,KAAK,EAAC,EAAC,MAAM,EAAC,EAAC,EAAE;QACtB,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,KAAK,GAAY,IAAI,EAAC,QAA2B,CAAC;QACtD,IAAG,CAAC;YACF,IAAG,UAAU,CAAC,MAAM,EAAC,CAAC;gBAAA,KAAK,GAAC,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBAAA,QAAQ,GAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAA,CAAC;QACrI,CAAC;QAAA,MAAK,CAAC,CAAA,gEAAgE,CAAA,CAAC;QACxE,MAAM,MAAM,GAAC,QAAQ,KAAG,SAAS,CAAC;QAClC,IAAG,CAAC,QAAQ,EAAC,CAAC;YACZ,KAAK,CAAC,MAAM,CAAC,CAAC;YACd,IAAG,CAAC;gBAAA,QAAQ,GAAC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAC,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,EAAC,KAAK,EAAC,aAAa,EAAC,QAAQ,EAAC,OAAO,EAAC,CAAC,CAAC;YAAA,CAAC;YACvG,MAAK,CAAC;gBAAA,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAAA,CAAC;QAC9D,CAAC;QACD,gFAAgF;QAChF,MAAM,MAAM,GAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACxC,IAAG,CAAC,MAAM,EAAC,CAAC;YAAA,KAAK,CAAC,MAAM,CAAC,CAAC;YAAA,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAAA,CAAC;QACrE,IAAI,QAAQ,GAAC,KAAK,EAAC,OAAO,GAAoB,IAAI,CAAC;QACnD,MAAM,KAAK,GAAC,GAAE,EAAE,CAAA,OAAO,KAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAE,EAAE;YACxD,IAAG,CAAC;gBAAA,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAAA,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAC,GAAE,EAAE,GAAC,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;QAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,OAAO,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;QACrD,IAAG,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,CAAC;YACd,IAAG,CAAC,QAAQ,CAAC,EAAE,IAAE,QAAQ,CAAC,UAAU,IAAE,CAAC,QAAQ,CAAC,GAAG,IAAE,QAAQ,CAAC,GAAG,KAAG,GAAG,CAAC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACxH,MAAM,MAAM,GAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAG,MAAM,KAAG,IAAI,IAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAE,MAAM,CAAC,MAAM,CAAC,KAAG,KAAK,CAAC,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/H,MAAM,KAAK,GAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAA,IAAI,MAAM,GAAC,CAAC,CAAC;YACrD,OAAM,IAAI,EAAC,CAAC;gBACV,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAA,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAG,IAAI,CAAC,IAAI,EAAC,CAAC;oBAAA,QAAQ,GAAC,IAAI,CAAC;oBAAA,MAAM;gBAAA,CAAC;gBACnC,IAAG,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY,UAAU,CAAC,IAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAC,KAAK,CAAC,KAAK,GAAC,MAAM;oBAAC,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAC1H,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,IAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC7D,CAAC;YACD,IAAG,MAAM,KAAG,KAAK,CAAC,KAAK;gBAAC,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACjE,MAAM,MAAM,GAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAC,KAAK,CAAC,CAAC,CAAC;YAAA,KAAK,CAAC,MAAM,CAAC,CAAC;YACvF,IAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAG,KAAK,CAAC,MAAM;gBAAC,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/H,KAAK,CAAC,MAAM,CAAC,CAAC;YACd,IAAG,KAAK,IAAE,CAAC,MAAM,EAAC,CAAC;gBACjB,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAG,CAAC;oBAAA,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAA,CAAC;gBAAA,MAAK,CAAC,CAAA,0DAA0D,CAAA,CAAC;YACtH,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,CAAC;YAAA,OAAO,KAAK,CAAC;QAC7B,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YACZ,KAAK,CAAC,MAAM,CAAC,CAAC;YACd,IAAG,aAAa,CAAC,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC;YACpC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;gBAAO,CAAC;YACP,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,OAAO,CAAC,CAAC;YAC5C,IAAG,CAAC;gBAAA,IAAG,CAAC,QAAQ,IAAE,MAAM,CAAC,OAAO;oBAAC,MAAM,KAAK,EAAE,CAAC;YAAA,CAAC;oBAAO,CAAC;gBAAA,MAAM,CAAC,WAAW,EAAE,CAAC;YAAA,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/application/asset-pins.json

@@ -0,0 +1,24 @@
+{
+    "runtime": {
+        "sha256": "b4e5b26f101072655d8c880c2355a044cb7afb6e4ffbbdef403db2dda9358010",
+        "bytes": 3782199,
+        "maxBytes": 3782199,
+        "source": {
+            "repository": "mdbase-dev/mdbase-connect",
+            "commit": "1e6b83c6b338b8ce708de7e2cbddb05992d8dc11"
+        }
+    },
+    "sqlite": {
+        "sha256": "2ee8f3dab694532afc8840e07703127287662d08b74e6ff50491ce63f00d5752",
+        "bytes": 868907,
+        "maxBytes": 1100000,
+        "initializer": {
+            "sha256": "a6d3fe46aa3f924e7686329f97b0564549ef1f787e0c19924179aef7f72bcc01",
+            "bytes": 642742
+        },
+        "asyncProxy": {
+            "sha256": "9f1970e05ee07a79332498858740b705eeb1dcee03bc150f6f690bc0fb5f0a06",
+            "bytes": 32505
+        }
+    }
+}

package/dist/application/browser-capabilities.d.ts

@@ -0,0 +1,48 @@
+/** Upfront browser capability probe for the application entry.
+ *
+ * The SDK needs a small set of modern browser features before it can register,
+ * spawn its Worker or keep keys and replicas on the device. Below that floor
+ * (old Safari/Firefox, private browsing), failing later and piecemeal gives
+ * raw TypeErrors; this probe runs once, before any registration, Worker, key
+ * or storage allocation, and the entry reports a single typed problem on the
+ * existing `unavailable` phase instead.
+ *
+ * Feature detection only — no version or user-agent sniffing, so future
+ * browsers pass by construction. The probe itself uses none of the features
+ * it gates, never throws, and writes nothing: the X25519 check generates a
+ * throwaway key that is never stored, and the storage check only asks for the
+ * (lazily created) OPFS root directory, which private browsing rejects. */
+export type BrowserCapabilityProblem = "browser_unsupported" | "application_storage_unavailable";
+export type BrowserCapabilityResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly problem: BrowserCapabilityProblem;
+    readonly missing: readonly string[];
+};
+/** The narrow slice of the browser the probe reads. Tests fake it. */
+export interface BrowserCapabilityEnvironment {
+    /** `crypto.subtle` (secure contexts only), or undefined where absent. */
+    readonly subtle?: {
+        generateKey(algorithm: {
+            name: string;
+        }, extractable: boolean, usages: string[]): Promise<unknown>;
+    } | undefined;
+    readonly abortSignalAny: boolean;
+    readonly randomUUID: boolean;
+    readonly worker: boolean;
+    readonly messageChannel: boolean;
+    readonly locks: boolean;
+    readonly broadcastChannel: boolean;
+    readonly indexedDB: boolean;
+    /** `navigator.storage.getDirectory`, present as a function where OPFS exists. */
+    readonly getDirectory?: (() => Promise<unknown>) | undefined;
+}
+/** The real page environment. Every read is guarded: hostile or partial
+ * globals read as absent, never as a thrown error. */
+export declare function defaultBrowserCapabilityEnvironment(): BrowserCapabilityEnvironment;
+/** Probe the browser once. `missing` carries stable developer tokens (never
+ * shown to people): feature absences under `browser_unsupported`, or the
+ * OPFS rejection under `application_storage_unavailable` (the shape private
+ * browsing takes on an otherwise current browser). */
+export declare function probeBrowserCapabilities(env?: BrowserCapabilityEnvironment): Promise<BrowserCapabilityResult>;

package/dist/application/browser-capabilities.js

@@ -0,0 +1,87 @@
+/** Upfront browser capability probe for the application entry.
+ *
+ * The SDK needs a small set of modern browser features before it can register,
+ * spawn its Worker or keep keys and replicas on the device. Below that floor
+ * (old Safari/Firefox, private browsing), failing later and piecemeal gives
+ * raw TypeErrors; this probe runs once, before any registration, Worker, key
+ * or storage allocation, and the entry reports a single typed problem on the
+ * existing `unavailable` phase instead.
+ *
+ * Feature detection only — no version or user-agent sniffing, so future
+ * browsers pass by construction. The probe itself uses none of the features
+ * it gates, never throws, and writes nothing: the X25519 check generates a
+ * throwaway key that is never stored, and the storage check only asks for the
+ * (lazily created) OPFS root directory, which private browsing rejects. */
+function read(get) {
+    try {
+        return get();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The real page environment. Every read is guarded: hostile or partial
+ * globals read as absent, never as a thrown error. */
+export function defaultBrowserCapabilityEnvironment() {
+    const subtle = read(() => globalThis.crypto?.subtle);
+    const storage = read(() => globalThis.navigator?.storage);
+    const getDirectory = read(() => (typeof storage?.getDirectory === "function"
+        ? () => storage.getDirectory.call(storage)
+        : undefined));
+    return {
+        subtle,
+        abortSignalAny: read(() => typeof AbortSignal === "function" && typeof AbortSignal.any === "function") === true,
+        randomUUID: read(() => typeof globalThis.crypto?.randomUUID === "function") === true,
+        worker: read(() => typeof Worker === "function") === true,
+        messageChannel: read(() => typeof MessageChannel === "function") === true,
+        locks: read(() => typeof globalThis.navigator?.locks?.request === "function") === true,
+        broadcastChannel: read(() => typeof BroadcastChannel === "function") === true,
+        indexedDB: read(() => typeof globalThis.indexedDB !== "undefined") === true,
+        getDirectory,
+    };
+}
+/** Probe the browser once. `missing` carries stable developer tokens (never
+ * shown to people): feature absences under `browser_unsupported`, or the
+ * OPFS rejection under `application_storage_unavailable` (the shape private
+ * browsing takes on an otherwise current browser). */
+export async function probeBrowserCapabilities(env = defaultBrowserCapabilityEnvironment()) {
+    const missing = [];
+    if (!env.subtle)
+        missing.push("web_crypto");
+    if (!env.abortSignalAny)
+        missing.push("abort_signal_any");
+    if (!env.randomUUID)
+        missing.push("random_uuid");
+    if (!env.worker)
+        missing.push("worker");
+    if (!env.messageChannel)
+        missing.push("message_channel");
+    if (!env.locks)
+        missing.push("web_locks");
+    if (!env.broadcastChannel)
+        missing.push("broadcast_channel");
+    if (!env.indexedDB)
+        missing.push("indexed_db");
+    if (env.subtle) {
+        // The exact operation grant/Noise key custody needs later; a throwaway key.
+        try {
+            await env.subtle.generateKey({ name: "X25519" }, false, ["deriveBits"]);
+        }
+        catch {
+            missing.push("x25519");
+        }
+    }
+    if (missing.length)
+        return { ok: false, problem: "browser_unsupported", missing: Object.freeze(missing) };
+    if (typeof env.getDirectory !== "function") {
+        return { ok: false, problem: "application_storage_unavailable", missing: Object.freeze(["opfs"]) };
+    }
+    try {
+        await env.getDirectory();
+    }
+    catch {
+        return { ok: false, problem: "application_storage_unavailable", missing: Object.freeze(["opfs"]) };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=browser-capabilities.js.map

package/dist/application/browser-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-capabilities.js","sourceRoot":"","sources":["../../src/application/browser-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;2EAa2E;AAuB3E,SAAS,IAAI,CAAI,GAAY;IAC3B,IAAI,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACnD,CAAC;AAED;sDACsD;AACtD,MAAM,UAAU,mCAAmC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAE,UAAgD,CAAC,MAAM,EAAE,MAAM,CAClD,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAE,UAAuE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACxH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,OAAO,EAAE,YAAY,KAAK,UAAU;QAC1E,CAAC,CAAC,GAAG,EAAE,CAAE,OAAO,CAAC,YAAuC,CAAC,IAAI,CAAC,OAAO,CAAC;QACtE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAChB,OAAO;QACL,MAAM;QACN,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,WAAW,KAAK,UAAU,IAAI,OAAQ,WAAiC,CAAC,GAAG,KAAK,UAAU,CAAC,KAAK,IAAI;QACtI,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAQ,UAAoD,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,CAAC,KAAK,IAAI;QAC/H,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,MAAM,KAAK,UAAU,CAAC,KAAK,IAAI;QACzD,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,cAAc,KAAK,UAAU,CAAC,KAAK,IAAI;QACzE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAQ,UAAgE,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,KAAK,UAAU,CAAC,KAAK,IAAI;QAC7I,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,gBAAgB,KAAK,UAAU,CAAC,KAAK,IAAI;QAC7E,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAQ,UAAsC,CAAC,SAAS,KAAK,WAAW,CAAC,KAAK,IAAI;QACxG,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;sDAGsD;AACtD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAoC,mCAAmC,EAAE;IAEzE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,4EAA4E;QAC5E,IAAI,CAAC;YAAC,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAAC,CAAC;QAChF,MAAM,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1G,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;IAAC,CAAC;IACjC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC7G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/application/browser-selection.d.ts

@@ -0,0 +1,58 @@
+/** SDK-private browser selection policy. URL/stored IDs are REQUESTED hints,
+ * never approval, identity, native access or current semantic readiness. */
+export interface ApplicationBrowserSelectionOptions {
+    readonly parameter?: string;
+    readonly fallbackPath?: string;
+}
+export interface ApplicationSelectionSnapshot {
+    readonly requestedCollectionId: string | null;
+    readonly source: "none" | "url" | "user" | "stored" | "preferred" | "sole";
+    readonly problem: ApplicationSelectionError["code"] | null;
+}
+export interface ApplicationSelectionBrowserPort {
+    href(): string;
+    write(href: string, history: "push" | "replace"): void;
+    listen(listener: () => void): () => void;
+}
+export declare class ApplicationSelectionError extends Error {
+    readonly code: "application_selection_binding" | "application_selection_invalid" | "application_selection_empty" | "application_selection_duplicate" | "application_selection_metadata" | "application_selection_fenced" | "application_selection_not_approved" | "application_selection_busy";
+    constructor(code: "application_selection_binding" | "application_selection_invalid" | "application_selection_empty" | "application_selection_duplicate" | "application_selection_metadata" | "application_selection_fenced" | "application_selection_not_approved" | "application_selection_busy");
+}
+/** Clear precedence: any URL request/error blocks silent fallback; stored hint
+ * next (even if not admitted yet), then genuinely admitted preferred/sole.
+ * Unknown hints stay requested for the SDK's targeted approval path. */
+export declare function applicationStartTarget(url: ApplicationSelectionSnapshot, options: {
+    readonly storedId?: string | null;
+    readonly preferredId?: string | null;
+    readonly collections: readonly {
+        readonly collectionId: string;
+    }[];
+}): ApplicationSelectionSnapshot;
+export declare class ApplicationBrowserSelection {
+    private readonly port;
+    private readonly origin;
+    private readonly parameter;
+    private readonly fallback;
+    private readonly listeners;
+    private snapshot;
+    private stopListening;
+    private started;
+    private closed;
+    constructor(origin: string, options?: ApplicationBrowserSelectionOptions, port?: ApplicationSelectionBrowserPort | null);
+    getSnapshot(): ApplicationSelectionSnapshot;
+    subscribe(listener: () => void): () => void;
+    start(): ApplicationSelectionSnapshot;
+    private check;
+    private url;
+    private read;
+    private publish;
+    select(collectionId: string | null, options?: {
+        readonly history?: "push" | "replace";
+    }): ApplicationSelectionSnapshot;
+    /** Same-origin return-path policy; never navigate to a caller-supplied origin. */
+    returnUrl(value: string): string;
+    close(): void;
+}
+/** SDK browser adapter, not an app option. Native/testing policy has no location
+ * and uses the same requested-ID semantics without fabricating a browser URL. */
+export declare function browserApplicationSelectionPort(): ApplicationSelectionBrowserPort | null;

package/dist/application/browser-selection.js

@@ -0,0 +1,160 @@
+import { isAppOrigin, urlOrigin } from "../app-host/app-origin.js";
+export class ApplicationSelectionError extends Error {
+    code;
+    constructor(code) {
+        super("SDK collection selection unavailable");
+        this.code = code;
+        this.name = "ApplicationSelectionError";
+    }
+}
+const validId = (id) => typeof id === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id) && id !== "00000000-0000-0000-0000-000000000000";
+const state = (requestedCollectionId, source, problem = null) => Object.freeze({ requestedCollectionId, source, problem });
+/** Clear precedence: any URL request/error blocks silent fallback; stored hint
+ * next (even if not admitted yet), then genuinely admitted preferred/sole.
+ * Unknown hints stay requested for the SDK's targeted approval path. */
+export function applicationStartTarget(url, options) {
+    if (url.source !== "none")
+        return url;
+    if (options.storedId !== undefined && options.storedId !== null)
+        return validId(options.storedId) ? state(options.storedId, "stored") : state(null, "stored", "application_selection_invalid");
+    if (options.collections.length > 1024 || options.collections.some(value => !validId(value.collectionId)) || new Set(options.collections.map(value => value.collectionId)).size !== options.collections.length)
+        return state(null, "none", "application_selection_metadata");
+    if (options.preferredId !== undefined && options.preferredId !== null)
+        return validId(options.preferredId) && options.collections.some(value => value.collectionId === options.preferredId) ? state(options.preferredId, "preferred") : state(null, "preferred", "application_selection_metadata");
+    return options.collections.length === 1 ? state(options.collections[0].collectionId, "sole") : state(null, "none");
+}
+export class ApplicationBrowserSelection {
+    port;
+    origin;
+    parameter;
+    fallback;
+    listeners = new Set();
+    snapshot = state(null, "none");
+    stopListening = null;
+    started = false;
+    closed = false;
+    constructor(origin, options = {}, port = null) {
+        let base, fallback;
+        try {
+            base = new URL(origin);
+            fallback = new URL(options.fallbackPath ?? "/", base);
+        }
+        catch {
+            throw new ApplicationSelectionError("application_selection_binding");
+        }
+        const parameter = options.parameter ?? "collection";
+        if (!isAppOrigin(origin, true) || urlOrigin(base) !== origin || urlOrigin(fallback) !== origin || fallback.username || fallback.password || fallback.search || fallback.hash ||
+            typeof parameter !== "string" || !/^[a-z][a-zA-Z0-9_.-]{0,63}$/.test(parameter) || ["code", "state", "error", "error_description"].includes(parameter))
+            throw new ApplicationSelectionError("application_selection_binding");
+        this.origin = origin;
+        this.parameter = parameter;
+        this.fallback = fallback.href;
+        this.port = port;
+    }
+    getSnapshot() { return this.snapshot; }
+    subscribe(listener) { this.check(); this.listeners.add(listener); return () => { this.listeners.delete(listener); }; }
+    start() {
+        this.check();
+        if (this.started)
+            return this.snapshot;
+        this.started = true;
+        this.stopListening = this.port?.listen(() => { if (!this.closed)
+            this.publish(this.read()); }) ?? null;
+        this.publish(this.read());
+        return this.snapshot;
+    }
+    check() { if (this.closed)
+        throw new ApplicationSelectionError("application_selection_fenced"); }
+    url() {
+        let url;
+        try {
+            url = new URL(this.port.href());
+        }
+        catch {
+            throw new ApplicationSelectionError("application_selection_binding");
+        }
+        if (urlOrigin(url) !== this.origin || url.username || url.password)
+            throw new ApplicationSelectionError("application_selection_binding");
+        return url;
+    }
+    read() {
+        if (!this.port)
+            return state(null, "none");
+        let values;
+        try {
+            values = this.url().searchParams.getAll(this.parameter);
+        }
+        catch {
+            return state(null, "url", "application_selection_binding");
+        }
+        if (values.length === 0)
+            return state(null, "none");
+        if (values.length !== 1)
+            return state(null, "url", "application_selection_duplicate");
+        if (values[0] === "")
+            return state(null, "url", "application_selection_empty");
+        if (!validId(values[0]))
+            return state(null, "url", "application_selection_invalid");
+        return state(values[0], "url");
+    }
+    publish(snapshot) {
+        if (this.snapshot.requestedCollectionId === snapshot.requestedCollectionId && this.snapshot.source === snapshot.source && this.snapshot.problem === snapshot.problem)
+            return;
+        this.snapshot = snapshot;
+        for (const listener of [...this.listeners]) {
+            try {
+                listener();
+            }
+            catch { /* observer never owns selection */ }
+        }
+    }
+    select(collectionId, options = {}) {
+        this.check();
+        if (collectionId !== null && !validId(collectionId))
+            throw new ApplicationSelectionError("application_selection_invalid");
+        const history = options.history ?? "replace";
+        if (history !== "push" && history !== "replace")
+            throw new ApplicationSelectionError("application_selection_binding");
+        if (this.port) {
+            const url = this.url(), before = url.href;
+            if (collectionId === null)
+                url.searchParams.delete(this.parameter);
+            else
+                url.searchParams.set(this.parameter, collectionId);
+            // Deliberate SDK selection fixes duplicate/invalid hints, preserving all
+            // unrelated query/hash/path. Callback cleanup belongs to its validated
+            // authorization owner, not arbitrary code/state parameter deletion here.
+            if (url.href !== before)
+                this.port.write(url.href, history);
+        }
+        this.publish(state(collectionId, collectionId === null ? "none" : "user"));
+        return this.snapshot;
+    }
+    /** Same-origin return-path policy; never navigate to a caller-supplied origin. */
+    returnUrl(value) {
+        this.check();
+        try {
+            const url = new URL(value, this.origin);
+            if (urlOrigin(url) === this.origin && !url.username && !url.password)
+                return url.href;
+        }
+        catch { /* use declared base-path */ }
+        return this.fallback;
+    }
+    close() { if (this.closed)
+        return; this.closed = true; const stop = this.stopListening; this.stopListening = null; stop?.(); this.listeners.clear(); }
+}
+/** SDK browser adapter, not an app option. Native/testing policy has no location
+ * and uses the same requested-ID semantics without fabricating a browser URL. */
+export function browserApplicationSelectionPort() {
+    if (typeof window === "undefined" || !window.location || !window.history)
+        return null;
+    const owner = window;
+    return Object.freeze({ href: () => owner.location.href, write: (href, history) => {
+            if (history === "push")
+                owner.history.pushState(owner.history.state, "", href);
+            else
+                owner.history.replaceState(owner.history.state, "", href);
+        }, listen: (listener) => { owner.addEventListener("popstate", listener); return () => owner.removeEventListener("popstate", listener); } });
+}
+//# sourceMappingURL=browser-selection.js.map

package/dist/application/browser-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-selection.js","sourceRoot":"","sources":["../../src/application/browser-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAC,SAAS,EAAC,MAAM,2BAA2B,CAAC;AAchE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAArB,YAAqB,IAAsQ;QACzR,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAD3B,SAAI,GAAJ,IAAI,CAAkQ;QAC3O,IAAI,CAAC,IAAI,GAAC,2BAA2B,CAAC;IACtF,CAAC;CACF;AACD,MAAM,OAAO,GAAC,CAAC,EAAU,EAAc,EAAE,CAAA,OAAO,EAAE,KAAG,QAAQ,IAAE,gEAAgE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAE,EAAE,KAAG,sCAAsC,CAAC;AACtL,MAAM,KAAK,GAAC,CAAC,qBAAiC,EAAC,MAA6C,EAAC,UAAgD,IAAI,EAA8B,EAAE,CAAA,MAAM,CAAC,MAAM,CAAC,EAAC,qBAAqB,EAAC,MAAM,EAAC,OAAO,EAAC,CAAC,CAAC;AACvO;;wEAEwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,GAAgC,EAAC,OAAwI;IAC9M,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM;QAAC,OAAO,GAAG,CAAC;IAClC,IAAG,OAAO,CAAC,QAAQ,KAAG,SAAS,IAAE,OAAO,CAAC,QAAQ,KAAG,IAAI;QAAC,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,EAAC,QAAQ,EAAC,+BAA+B,CAAC,CAAC;IAChL,IAAG,OAAO,CAAC,WAAW,CAAC,MAAM,GAAC,IAAI,IAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAE,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAG,OAAO,CAAC,WAAW,CAAC,MAAM;QAAC,OAAO,KAAK,CAAC,IAAI,EAAC,MAAM,EAAC,gCAAgC,CAAC,CAAC;IAC5P,IAAG,OAAO,CAAC,WAAW,KAAG,SAAS,IAAE,OAAO,CAAC,WAAW,KAAG,IAAI;QAAC,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,YAAY,KAAG,OAAO,CAAC,WAAW,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,OAAO,CAAC,WAAW,EAAC,WAAW,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,EAAC,WAAW,EAAC,gCAAgC,CAAC,CAAC;IAC9Q,OAAO,OAAO,CAAC,WAAW,CAAC,MAAM,KAAG,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,YAAY,EAAC,MAAM,CAAC,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;AAC9G,CAAC;AACD,MAAM,OAAO,2BAA2B;IACrB,IAAI,CAAsC;IAC1C,MAAM,CAAQ;IACd,SAAS,CAAQ;IACjB,QAAQ,CAAQ;IAChB,SAAS,GAAC,IAAI,GAAG,EAAY,CAAC;IACvC,QAAQ,GAA8B,KAAK,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;IACzD,aAAa,GAAiB,IAAI,CAAC;IACnC,OAAO,GAAC,KAAK,CAAC;IACd,MAAM,GAAC,KAAK,CAAC;IACrB,YAAY,MAAa,EAAC,UAA2C,EAAE,EAAC,OAA0C,IAAI;QACpH,IAAI,IAAQ,EAAC,QAAY,CAAC;QAC1B,IAAG,CAAC;YAAA,IAAI,GAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAAA,QAAQ,GAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAE,GAAG,EAAC,IAAI,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;QAAA,CAAC;QACvJ,MAAM,SAAS,GAAC,OAAO,CAAC,SAAS,IAAE,YAAY,CAAC;QAChD,IAAG,CAAC,WAAW,CAAC,MAAM,EAAC,IAAI,CAAC,IAAE,SAAS,CAAC,IAAI,CAAC,KAAG,MAAM,IAAE,SAAS,CAAC,QAAQ,CAAC,KAAG,MAAM,IAAE,QAAQ,CAAC,QAAQ,IAAE,QAAQ,CAAC,QAAQ,IAAE,QAAQ,CAAC,MAAM,IAAE,QAAQ,CAAC,IAAI;YACxJ,OAAO,SAAS,KAAG,QAAQ,IAAE,CAAE,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC,IAAE,CAAC,MAAM,EAAC,OAAO,EAAC,OAAO,EAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAC,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;QACtN,IAAI,CAAC,MAAM,GAAC,MAAM,CAAC;QAAA,IAAI,CAAC,SAAS,GAAC,SAAS,CAAC;QAAA,IAAI,CAAC,QAAQ,GAAC,QAAQ,CAAC,IAAI,CAAC;QAAA,IAAI,CAAC,IAAI,GAAC,IAAI,CAAC;IACzF,CAAC;IACD,WAAW,KAAgC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA,CAAC;IACjE,SAAS,CAAC,QAAiB,IAAW,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA,OAAM,GAAE,EAAE,GAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC,CAAC,CAAA,CAAC;IAC9H,KAAK;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;QAAA,IAAG,IAAI,CAAC,OAAO;YAAC,OAAO,IAAI,CAAC,QAAQ,CAAC;QAAA,IAAI,CAAC,OAAO,GAAC,IAAI,CAAC;QACpE,IAAI,CAAC,aAAa,GAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAE,EAAE,GAAC,IAAG,CAAC,IAAI,CAAC,MAAM;YAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,CAAC,IAAE,IAAI,CAAC;QAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAAA,OAAO,IAAI,CAAC,QAAQ,CAAC;IACjD,CAAC;IACO,KAAK,KAAQ,IAAG,IAAI,CAAC,MAAM;QAAC,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC,CAAA,CAAC;IACjG,GAAG;QACT,IAAI,GAAO,CAAC;QAAA,IAAG,CAAC;YAAA,GAAG,GAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;QAAA,CAAC;QAC5H,IAAG,SAAS,CAAC,GAAG,CAAC,KAAG,IAAI,CAAC,MAAM,IAAE,GAAG,CAAC,QAAQ,IAAE,GAAG,CAAC,QAAQ;YAAC,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;QAAA,OAAO,GAAG,CAAC;IAC9I,CAAC;IACO,IAAI;QACV,IAAG,CAAC,IAAI,CAAC,IAAI;YAAC,OAAO,KAAK,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAe,CAAC;QAAA,IAAG,CAAC;YAAA,MAAM,GAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,OAAO,KAAK,CAAC,IAAI,EAAC,KAAK,EAAC,+BAA+B,CAAC,CAAC;QAAA,CAAC;QAC/I,IAAG,MAAM,CAAC,MAAM,KAAG,CAAC;YAAC,OAAO,KAAK,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAG,MAAM,CAAC,MAAM,KAAG,CAAC;YAAC,OAAO,KAAK,CAAC,IAAI,EAAC,KAAK,EAAC,iCAAiC,CAAC,CAAC;QAChF,IAAG,MAAM,CAAC,CAAC,CAAC,KAAG,EAAE;YAAC,OAAO,KAAK,CAAC,IAAI,EAAC,KAAK,EAAC,6BAA6B,CAAC,CAAC;QACzE,IAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC,IAAI,EAAC,KAAK,EAAC,+BAA+B,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACO,OAAO,CAAC,QAAqC;QACnD,IAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAG,QAAQ,CAAC,qBAAqB,IAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAG,QAAQ,CAAC,MAAM,IAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAG,QAAQ,CAAC,OAAO;YAAC,OAAO;QACjK,IAAI,CAAC,QAAQ,GAAC,QAAQ,CAAC;QAAA,KAAI,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,CAAC;YAAA,IAAG,CAAC;gBAAA,QAAQ,EAAE,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC,CAAA,mCAAmC,CAAA,CAAC;QAAA,CAAC;IAC/H,CAAC;IACD,MAAM,CAAC,YAAwB,EAAC,UAA6C,EAAE;QAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QAAA,IAAG,YAAY,KAAG,IAAI,IAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAAC,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;QACjI,MAAM,OAAO,GAAC,OAAO,CAAC,OAAO,IAAE,SAAS,CAAC;QAAA,IAAG,OAAO,KAAG,MAAM,IAAE,OAAO,KAAG,SAAS;YAAC,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,CAAC,CAAC;QACvJ,IAAG,IAAI,CAAC,IAAI,EAAC,CAAC;YACZ,MAAM,GAAG,GAAC,IAAI,CAAC,GAAG,EAAE,EAAC,MAAM,GAAC,GAAG,CAAC,IAAI,CAAC;YACrC,IAAG,YAAY,KAAG,IAAI;gBAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;;gBAAK,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAC,YAAY,CAAC,CAAC;YACtH,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,IAAG,GAAG,CAAC,IAAI,KAAG,MAAM;gBAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAC,YAAY,KAAG,IAAI,CAAA,CAAC,CAAA,MAAM,CAAA,CAAC,CAAA,MAAM,CAAC,CAAC,CAAC;QAAA,OAAO,IAAI,CAAC,QAAQ,CAAC;IAC3F,CAAC;IACD,kFAAkF;IAClF,SAAS,CAAC,KAAY;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;QAAA,IAAG,CAAC;YAAA,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,KAAK,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAA,IAAG,SAAS,CAAC,GAAG,CAAC,KAAG,IAAI,CAAC,MAAM,IAAE,CAAC,GAAG,CAAC,QAAQ,IAAE,CAAC,GAAG,CAAC,QAAQ;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC,CAAA,4BAA4B,CAAA,CAAC;QAAA,OAAO,IAAI,CAAC,QAAQ,CAAC;IAC/L,CAAC;IACD,KAAK,KAAS,IAAG,IAAI,CAAC,MAAM;QAAC,OAAO,CAAA,IAAI,CAAC,MAAM,GAAC,IAAI,CAAC,CAAA,MAAM,IAAI,GAAC,IAAI,CAAC,aAAa,CAAC,CAAA,IAAI,CAAC,aAAa,GAAC,IAAI,CAAC,CAAA,IAAI,EAAE,EAAE,CAAC,CAAA,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA,CAAC;CAC7I;AACD;iFACiF;AACjF,MAAM,UAAU,+BAA+B;IAC7C,IAAG,OAAO,MAAM,KAAG,WAAW,IAAE,CAAC,MAAM,CAAC,QAAQ,IAAE,CAAC,MAAM,CAAC,OAAO;QAAC,OAAO,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAC,MAAM,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,GAAE,EAAE,CAAA,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAC,KAAK,EAAC,CAAC,IAAW,EAAC,OAAwB,EAAC,EAAE;YAC/F,IAAG,OAAO,KAAG,MAAM;gBAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAC,EAAE,EAAC,IAAI,CAAC,CAAC;;gBAAK,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAC,EAAE,EAAC,IAAI,CAAC,CAAC;QACxI,CAAC,EAAC,MAAM,EAAC,CAAC,QAAiB,EAAC,EAAE,GAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAC,QAAQ,CAAC,CAAC,CAAA,OAAM,GAAE,EAAE,CAAA,KAAK,CAAC,mBAAmB,CAAC,UAAU,EAAC,QAAQ,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,CAAC;AAC1I,CAAC"}

package/dist/application/capabilities.d.ts

@@ -0,0 +1,20 @@
+import { type MdbaseApplicationDeclaration } from "./declaration.js";
+import type { MdbaseApplicationConnection } from "./entry.js";
+export interface MdbaseApplicationCapability {
+    readonly id: string;
+    readonly requirement: "required" | "optional";
+    readonly state: "available" | "missing";
+}
+export interface MdbaseApplicationCapabilities {
+    /** Declared groups (required first, then optional), in declaration order. */
+    readonly values: readonly MdbaseApplicationCapability[];
+    readonly requiredAvailable: boolean;
+    /** Declared groups the current grant lacks: show "update access", then reauthorize(). */
+    readonly missing: readonly string[];
+}
+/** Prod `effectiveCapabilities`. Compares the declaration's v2 capability groups
+ * with the current session's negotiated hello grant, for step-up UI only. It
+ * does not refresh permissions or authorize an operation; native operation
+ * checks remain authoritative. Reauthorization still requires user approval and
+ * may return another restricted grant. Null without a v2 capability contract. */
+export declare function effectiveCapabilities(declaration: MdbaseApplicationDeclaration, connection: Pick<MdbaseApplicationConnection, "records" | "isCurrent">): MdbaseApplicationCapabilities | null;

package/dist/application/capabilities.js

@@ -0,0 +1,22 @@
+import { applicationDeclaration } from "./declaration.js";
+import { compileApplicationManifest } from "./manifest.js";
+import { mdbaseError } from "../errors.js";
+/** Prod `effectiveCapabilities`. Compares the declaration's v2 capability groups
+ * with the current session's negotiated hello grant, for step-up UI only. It
+ * does not refresh permissions or authorize an operation; native operation
+ * checks remain authoritative. Reauthorization still requires user approval and
+ * may return another restricted grant. Null without a v2 capability contract. */
+export function effectiveCapabilities(declaration, connection) {
+    const declared = compileApplicationManifest(applicationDeclaration(declaration)).manifest.requirements.capabilities;
+    if (declared?.contract_version !== 2)
+        return null;
+    if (!connection.isCurrent())
+        throw mdbaseError("invalid_request", "the application connection is not current", "application_connection_fenced");
+    const granted = new Set(connection.records.hello.grant.capabilities), required = new Set(declared.required);
+    const values = Object.freeze([...new Set([...declared.required, ...(declared.optional ?? [])])].map(id => Object.freeze({
+        id, requirement: required.has(id) ? "required" : "optional", state: granted.has(id) ? "available" : "missing"
+    })));
+    return Object.freeze({ values, requiredAvailable: values.every(v => v.requirement === "optional" || v.state === "available"),
+        missing: Object.freeze(values.filter(v => v.state === "missing").map(v => v.id)) });
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/application/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/application/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,sBAAsB,EAAmC,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAC,0BAA0B,EAAC,MAAM,eAAe,CAAC;AACzD,OAAO,EAAC,WAAW,EAAC,MAAM,cAAc,CAAC;AAezC;;;;iFAIiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,WAAwC,EAAC,UAAkE;IAC/I,MAAM,QAAQ,GAAC,0BAA0B,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC;IAClH,IAAG,QAAQ,EAAE,gBAAgB,KAAG,CAAC;QAAC,OAAO,IAAI,CAAC;IAC9C,IAAG,CAAC,UAAU,CAAC,SAAS,EAAE;QAAC,MAAM,WAAW,CAAC,iBAAiB,EAAC,2CAA2C,EAAC,+BAA+B,CAAC,CAAC;IAC5I,MAAM,OAAO,GAAC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAC,QAAQ,GAAC,IAAI,GAAG,CAAS,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAA,EAAE,CAAA,MAAM,CAAC,MAAM,CAAC;QACvH,EAAE,EAAC,WAAW,EAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA,CAAC,CAAA,UAAmB,CAAA,CAAC,CAAA,UAAmB,EAAC,KAAK,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA,CAAC,CAAA,WAAoB,CAAA,CAAC,CAAA,SAAkB;KAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,iBAAiB,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,WAAW,KAAG,UAAU,IAAE,CAAC,CAAC,KAAK,KAAG,WAAW,CAAC;QAC/G,OAAO,EAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,KAAK,KAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC,CAAC,CAAC;AAChF,CAAC"}