Connect protocol 1
Connect trust boundaries
Connect keeps authorization enforcement at the local connector or hosted provider. It minimizes control-plane data, encrypts local relay payloads end to end, and names the hosted provider's trust boundary directly.
Data boundaries
| Data | Local collection | Hosted collection |
|---|---|---|
| Markdown records | Remain on the registered computer | Encrypted at rest in the hosted provider |
| Absolute paths | Remain at the local connector | Hosted records use provider identifiers |
| Operation payloads | Encrypted app to connector across relay | Sent directly to the grant-bound provider |
| Grant policy | Cached and rechecked locally | Rechecked by the hosted provider |
| Notification signals | Opaque signal, criterion, grant, and cursor metadata; no record path or content | |
Application responsibilities
Operation scope
Start with contract-scoped access. Collection-wide types and saved views require full collection access. Ask for additional operations when the user opens the relevant feature.
Credential storage
Browser defaults use localStorage plus non-extractable IndexedDB keys. Native shells should provide storage and navigation adapters that match their platform security model.
Notifications
Treat each signal as a prompt to refresh. Open the application, renew authorization if needed, and read the latest authorized collection state.
Revision preconditions
Preserve the revision returned by reads and queries, then pass if_revision to update, rename, and delete operations. Resolve conflicts explicitly.