@calimero-network/mero-js 13.3.0 → 14.0.0

package/dist/index.d.ts

@@ -16,6 +16,8 @@ export type { SseEventData, WsEventData, AppVersionChangedEvent, GroupMembership
 export { EphemeralClient, jsonCodec } from './ephemeral/index.js';
 export type { Codec, EphemeralEntry } from './ephemeral/index.js';
 export * from './cloud/index.js';
+export { signWarrant, intentHash } from './warrant/index.js';
+export type { WarrantInput } from './warrant/index.js';
 export * from './capabilities.js';
 export { DEFAULT_LOCAL_NODE_PORTS, localNodeUrl, nodeEndpoint, probeNodeHealth, discoverLocalNodes, } from './nodeDiscovery.js';
 export type { DiscoverLocalNodesOptions } from './nodeDiscovery.js';

package/dist/index.js

@@ -10,7 +10,7 @@ export * from './auth-api/index.js';
 export * from './admin-api/index.js';
 // Auth utilities
 export { parseAuthCallback, buildAuthLoginUrl } from './auth/index.js';
-// Account id encoding (hex on the admin API, base58 in contract data)
+// Account id encoding (hex everywhere core spells one; an app may re-encode)
 export { toAccountHex, toAccountBase58, sameAccount, } from './account/index.js';
 // Token store
 export { MemoryTokenStore, LocalStorageTokenStore } from './token-store/index.js';
@@ -22,6 +22,8 @@ export { SseClient, WsClient } from './events/index.js';
 export { EphemeralClient, jsonCodec } from './ephemeral/index.js';
 // Cloud client (enable-HA, disable-HA)
 export * from './cloud/index.js';
+// Warrant signing — mint the author's consent for a relay to run one intent
+export { signWarrant, intentHash } from './warrant/index.js';
 // Member capability bitmask constants & helpers
 export * from './capabilities.js';
 // Utilities

package/dist/index.mjs

@@ -1119,7 +1119,8 @@ var AdminApiClient = class {
    * CAN_AUTHOR_ON_BEHALF to …", or that the nonce is already spent — so a caller
    * can tell which precondition failed rather than only that one did.
    *
-   * This SDK does not mint warrants; see {@link PerformIntentRequest.warrant}.
+   * Mint the warrant with {@link signWarrant}; see
+   * {@link PerformIntentRequest.warrant}.
    */
   async performIntent(contextId, request) {
     return unwrap(
@@ -1225,14 +1226,16 @@ var AdminApiClient = class {
   }
   /**
    * `identity` is the member's ACCOUNT (64 hex), as returned by
-   * {@link listGroupMembers} — not the bs58 signing key that added them.
+   * {@link listGroupMembers} — not the signing key that added them. Both are
+   * 64 hex, so nothing but the source tells them apart.
    */
   async updateMemberRole(groupId, identity, request) {
     await this.httpClient.put(`/admin-api/groups/${groupId}/members/${identity}/role`, request);
   }
   /**
    * `identity` is the member's ACCOUNT (64 hex), as returned by
-   * {@link listGroupMembers} — not the bs58 signing key that added them.
+   * {@link listGroupMembers} — not the signing key that added them. Both are
+   * 64 hex, so nothing but the source tells them apart.
    */
   async getMemberCapabilities(groupId, identity) {
     return unwrap(
@@ -1243,7 +1246,8 @@ var AdminApiClient = class {
   }
   /**
    * `identity` is the member's ACCOUNT (64 hex), as returned by
-   * {@link listGroupMembers} — not the bs58 signing key that added them.
+   * {@link listGroupMembers} — not the signing key that added them. Both are
+   * 64 hex, so nothing but the source tells them apart.
    */
   async setMemberCapabilities(groupId, identity, request) {
     await this.httpClient.put(`/admin-api/groups/${groupId}/members/${identity}/capabilities`, request);
@@ -1276,7 +1280,8 @@ var AdminApiClient = class {
   }
   /**
    * `identity` is the member's ACCOUNT (64 hex), as returned by
-   * {@link listGroupMembers} — not the bs58 signing key that added them.
+   * {@link listGroupMembers} — not the signing key that added them. Both are
+   * 64 hex, so nothing but the source tells them apart.
    */
   async getMemberMetadata(groupId, identity) {
     const response = await this.httpClient.get(
@@ -1430,7 +1435,8 @@ var AdminApiClient = class {
    * /admin-api/groups/:group_id/members/:identity/auto-follow).
    *
    * `identity` is the member's ACCOUNT (64 hex), as returned by
-   * {@link listGroupMembers} — not the bs58 signing key that added them.
+   * {@link listGroupMembers} — not the signing key that added them. Both are
+   * 64 hex, so nothing but the source tells them apart.
    */
   async setMemberAutoFollow(groupId, identity, request) {
     await this.httpClient.put(`/admin-api/groups/${groupId}/members/${identity}/auto-follow`, request);
@@ -2495,10 +2501,10 @@ function toHex(bytes) {
   for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
   return out;
 }
-function fromHex(hex) {
-  const bytes = new Uint8Array(hex.length / 2);
+function fromHex(hex2) {
+  const bytes = new Uint8Array(hex2.length / 2);
   for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    bytes[i] = parseInt(hex2.slice(i * 2, i * 2 + 2), 16);
   }
   return bytes;
 }
@@ -2603,6 +2609,140 @@ var CloudClient = class {
   }
 };
 
+// src/warrant/warrant.ts
+var SIGN_DOMAIN = new TextEncoder().encode("calimero.warrant.v1");
+var INTENT_DOMAIN = new TextEncoder().encode("calimero.warrant.intent.v1");
+var PKCS8_ED25519_PREFIX = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  112,
+  4,
+  34,
+  4,
+  32
+]);
+function hex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex2(value, label, expectedBytes) {
+  const clean = value.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length !== expectedBytes * 2) {
+    throw new Error(
+      `${label} must be ${expectedBytes * 2} hex characters, got ${clean.length}`
+    );
+  }
+  const bytes = new Uint8Array(expectedBytes);
+  for (let i = 0; i < expectedBytes; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function u64le(value) {
+  const out = new Uint8Array(8);
+  new DataView(out.buffer).setBigUint64(0, BigInt(value), true);
+  return out;
+}
+function concat(...parts) {
+  const out = new Uint8Array(parts.reduce((total, p) => total + p.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+async function domainHash(domain, parts) {
+  const chunks = [u64le(domain.length), domain];
+  for (const part of parts) {
+    chunks.push(u64le(part.length), part);
+  }
+  return new Uint8Array(
+    await crypto.subtle.digest("SHA-256", concat(...chunks))
+  );
+}
+async function intentHash(method, argsJson) {
+  const args = new TextEncoder().encode(JSON.stringify(argsJson));
+  return domainHash(INTENT_DOMAIN, [new TextEncoder().encode(method), args]);
+}
+async function importSigningKey(secretHex) {
+  const seed = fromHex2(secretHex, "deviceSecret", 32);
+  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
+  try {
+    return await crypto.subtle.importKey(
+      "pkcs8",
+      pkcs8,
+      { name: "Ed25519" },
+      false,
+      ["sign"]
+    );
+  } catch (cause) {
+    const detail = cause instanceof Error ? `: ${cause.message}` : "";
+    throw new Error(
+      "this runtime has no WebCrypto Ed25519, so a warrant cannot be signed here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it; otherwise mint the warrant with `merod account warrant`" + detail
+    );
+  }
+}
+async function signWarrant(input) {
+  const context = fromHex2(input.context, "context", 32);
+  const authorAccount = fromHex2(input.authorAccount, "authorAccount", 32);
+  const executor = fromHex2(input.executor, "executor", 32);
+  const key = await importSigningKey(input.deviceSecret);
+  const publicKey = await derivePublicKey(input.deviceSecret);
+  const commitment = await intentHash(input.method, input.argsJson);
+  const nonce = u64le(input.nonce);
+  const notAfter = u64le(input.notAfter);
+  const preimage = await domainHash(SIGN_DOMAIN, [
+    context,
+    authorAccount,
+    publicKey,
+    executor,
+    commitment,
+    nonce,
+    notAfter
+  ]);
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
+  );
+  return hex(
+    concat(
+      context,
+      authorAccount,
+      publicKey,
+      executor,
+      commitment,
+      nonce,
+      notAfter,
+      signature
+    )
+  );
+}
+async function derivePublicKey(secretHex) {
+  const seed = fromHex2(secretHex, "deviceSecret", 32);
+  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
+  const key = await crypto.subtle.importKey(
+    "pkcs8",
+    pkcs8,
+    { name: "Ed25519" },
+    true,
+    ["sign"]
+  );
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  const raw = jwk.x;
+  return Uint8Array.from(
+    atob(raw.replace(/-/g, "+").replace(/_/g, "/")),
+    (c) => c.charCodeAt(0)
+  );
+}
+
 // src/capabilities.ts
 var CAPABILITIES = {
   CAN_CREATE_CONTEXT: 1 << 0,
@@ -2715,12 +2855,14 @@ export {
   createUniversalHttpClient,
   discoverLocalNodes,
   hasCap,
+  intentHash,
   jsonCodec,
   localNodeUrl,
   nodeEndpoint,
   parseAuthCallback,
   probeNodeHealth,
   sameAccount,
+  signWarrant,
   toAccountBase58,
   toAccountHex,
   withCap,