@calimero-network/mero-js 14.0.0 → 15.1.0

package/dist/index.d.ts

@@ -5,7 +5,6 @@ export * from './auth-api/index.js';
 export * from './admin-api/index.js';
 export { parseAuthCallback, buildAuthLoginUrl } from './auth/index.js';
 export type { AuthCallbackResult, AuthLoginOptions } from './auth/index.js';
-export { toAccountHex, toAccountBase58, sameAccount, } from './account/index.js';
 export { MemoryTokenStore, LocalStorageTokenStore } from './token-store/index.js';
 export type { TokenStore } from './token-store/index.js';
 export { RpcClient, RpcError } from './rpc/index.js';
@@ -17,6 +16,8 @@ export { EphemeralClient, jsonCodec } from './ephemeral/index.js';
 export type { Codec, EphemeralEntry } from './ephemeral/index.js';
 export * from './cloud/index.js';
 export { signWarrant, intentHash } from './warrant/index.js';
+export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, } from './device-cert/index.js';
+export type { DeviceCertInput } from './device-cert/index.js';
 export type { WarrantInput } from './warrant/index.js';
 export * from './capabilities.js';
 export { DEFAULT_LOCAL_NODE_PORTS, localNodeUrl, nodeEndpoint, probeNodeHealth, discoverLocalNodes, } from './nodeDiscovery.js';

package/dist/index.js

@@ -10,8 +10,6 @@ export * from './auth-api/index.js';
 export * from './admin-api/index.js';
 // Auth utilities
 export { parseAuthCallback, buildAuthLoginUrl } from './auth/index.js';
-// Account id encoding (hex everywhere core spells one; an app may re-encode)
-export { toAccountHex, toAccountBase58, sameAccount, } from './account/index.js';
 // Token store
 export { MemoryTokenStore, LocalStorageTokenStore } from './token-store/index.js';
 // RPC client
@@ -24,6 +22,7 @@ export { EphemeralClient, jsonCodec } from './ephemeral/index.js';
 export * from './cloud/index.js';
 // Warrant signing — mint the author's consent for a relay to run one intent
 export { signWarrant, intentHash } from './warrant/index.js';
+export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, } from './device-cert/index.js';
 // Member capability bitmask constants & helpers
 export * from './capabilities.js';
 // Utilities

package/dist/index.mjs

@@ -2441,93 +2441,6 @@ function createMeroJs(config) {
   return new MeroJs(config);
 }
 
-// src/account/index.ts
-var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
-var HEX_ACCOUNT = /^[0-9a-f]{64}$/i;
-function encodeBase58(bytes) {
-  if (bytes.length === 0) return "";
-  const digits = [0];
-  for (const byte of bytes) {
-    let carry = byte;
-    for (let i = 0; i < digits.length; i++) {
-      carry += digits[i] << 8;
-      digits[i] = carry % 58;
-      carry = carry / 58 | 0;
-    }
-    while (carry > 0) {
-      digits.push(carry % 58);
-      carry = carry / 58 | 0;
-    }
-  }
-  let out = "";
-  for (const byte of bytes) {
-    if (byte !== 0) break;
-    out += BASE58_ALPHABET[0];
-  }
-  for (let i = digits.length - 1; i >= 0; i--) {
-    out += BASE58_ALPHABET[digits[i]];
-  }
-  return out;
-}
-function decodeBase58(value) {
-  if (value.length === 0) return null;
-  const bytes = [0];
-  for (const char of value) {
-    const index = BASE58_ALPHABET.indexOf(char);
-    if (index < 0) return null;
-    let carry = index;
-    for (let i = 0; i < bytes.length; i++) {
-      carry += bytes[i] * 58;
-      bytes[i] = carry & 255;
-      carry >>= 8;
-    }
-    while (carry > 0) {
-      bytes.push(carry & 255);
-      carry >>= 8;
-    }
-  }
-  let leadingZeros = 0;
-  for (const char of value) {
-    if (char !== BASE58_ALPHABET[0]) break;
-    leadingZeros++;
-  }
-  return Uint8Array.from([
-    ...new Array(leadingZeros).fill(0),
-    ...bytes.reverse()
-  ]);
-}
-function toHex(bytes) {
-  let out = "";
-  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
-  return out;
-}
-function fromHex(hex2) {
-  const bytes = new Uint8Array(hex2.length / 2);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(hex2.slice(i * 2, i * 2 + 2), 16);
-  }
-  return bytes;
-}
-function toAccountHex(id) {
-  const trimmed = (id ?? "").trim();
-  if (!trimmed) return "";
-  if (HEX_ACCOUNT.test(trimmed)) return trimmed.toLowerCase();
-  const decoded = decodeBase58(trimmed);
-  if (!decoded || decoded.length !== 32) return trimmed;
-  return toHex(decoded);
-}
-function toAccountBase58(id) {
-  const trimmed = (id ?? "").trim();
-  if (!trimmed) return "";
-  if (!HEX_ACCOUNT.test(trimmed)) return trimmed;
-  return encodeBase58(fromHex(trimmed));
-}
-function sameAccount(a, b) {
-  const left = toAccountHex(a);
-  const right = toAccountHex(b);
-  return HEX_ACCOUNT.test(left) && left === right;
-}
-
 // src/token-store/index.ts
 var MemoryTokenStore = class {
   constructor() {
@@ -2609,9 +2522,7 @@ var CloudClient = class {
   }
 };
 
-// src/warrant/warrant.ts
-var SIGN_DOMAIN = new TextEncoder().encode("calimero.warrant.v1");
-var INTENT_DOMAIN = new TextEncoder().encode("calimero.warrant.intent.v1");
+// src/crypto/internal.ts
 var PKCS8_ED25519_PREFIX = new Uint8Array([
   48,
   46,
@@ -2630,10 +2541,15 @@ var PKCS8_ED25519_PREFIX = new Uint8Array([
   4,
   32
 ]);
+function u32le(value) {
+  const out = new Uint8Array(4);
+  new DataView(out.buffer).setUint32(0, value, true);
+  return out;
+}
 function hex(bytes) {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-function fromHex2(value, label, expectedBytes) {
+function fromHex(value, label, expectedBytes) {
   const clean = value.trim();
   if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length !== expectedBytes * 2) {
     throw new Error(
@@ -2669,12 +2585,8 @@ async function domainHash(domain, parts) {
     await crypto.subtle.digest("SHA-256", concat(...chunks))
   );
 }
-async function intentHash(method, argsJson) {
-  const args = new TextEncoder().encode(JSON.stringify(argsJson));
-  return domainHash(INTENT_DOMAIN, [new TextEncoder().encode(method), args]);
-}
 async function importSigningKey(secretHex) {
-  const seed = fromHex2(secretHex, "deviceSecret", 32);
+  const seed = fromHex(secretHex, "deviceSecret", 32);
   const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
   try {
     return await crypto.subtle.importKey(
@@ -2691,10 +2603,35 @@ async function importSigningKey(secretHex) {
     );
   }
 }
+async function derivePublicKey(secretHex) {
+  const seed = fromHex(secretHex, "deviceSecret", 32);
+  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
+  const key = await crypto.subtle.importKey(
+    "pkcs8",
+    pkcs8,
+    { name: "Ed25519" },
+    true,
+    ["sign"]
+  );
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  const raw = jwk.x;
+  return Uint8Array.from(
+    atob(raw.replace(/-/g, "+").replace(/_/g, "/")),
+    (c) => c.charCodeAt(0)
+  );
+}
+
+// src/warrant/warrant.ts
+var SIGN_DOMAIN = new TextEncoder().encode("calimero.warrant.v1");
+var INTENT_DOMAIN = new TextEncoder().encode("calimero.warrant.intent.v1");
+async function intentHash(method, argsJson) {
+  const args = new TextEncoder().encode(JSON.stringify(argsJson));
+  return domainHash(INTENT_DOMAIN, [new TextEncoder().encode(method), args]);
+}
 async function signWarrant(input) {
-  const context = fromHex2(input.context, "context", 32);
-  const authorAccount = fromHex2(input.authorAccount, "authorAccount", 32);
-  const executor = fromHex2(input.executor, "executor", 32);
+  const context = fromHex(input.context, "context", 32);
+  const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
+  const executor = fromHex(input.executor, "executor", 32);
   const key = await importSigningKey(input.deviceSecret);
   const publicKey = await derivePublicKey(input.deviceSecret);
   const commitment = await intentHash(input.method, input.argsJson);
@@ -2725,21 +2662,72 @@ async function signWarrant(input) {
     )
   );
 }
-async function derivePublicKey(secretHex) {
-  const seed = fromHex2(secretHex, "deviceSecret", 32);
-  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
-  const key = await crypto.subtle.importKey(
-    "pkcs8",
-    pkcs8,
-    { name: "Ed25519" },
-    true,
-    ["sign"]
+
+// src/device-cert/device-cert.ts
+var CERT_DOMAIN = new TextEncoder().encode("calimero.device.cert.v1");
+var ACCOUNT_ID_DOMAIN = new TextEncoder().encode("calimero.account.genesis.v1");
+var DEVICE_ID_DOMAIN = new TextEncoder().encode("calimero.device.id.v1");
+var ACCOUNT_GENESIS_VERSION = 1;
+async function mintDeviceId(account, nonce) {
+  if (nonce.length !== 16) {
+    throw new Error(`nonce must be 16 bytes, got ${nonce.length}`);
+  }
+  const accountBytes = fromHex(account, "account", 32);
+  return hex(await domainHash(DEVICE_ID_DOMAIN, [accountBytes, nonce]));
+}
+async function deviceCertPayload(input) {
+  return domainHash(CERT_DOMAIN, [
+    fromHex(input.account, "account", 32),
+    fromHex(input.device, "device", 32),
+    fromHex(input.signPublicKey, "signPublicKey", 32),
+    fromHex(input.kemPublicKey, "kemPublicKey", 32),
+    u32le(input.keyEpoch),
+    u32le(input.deviceEpoch)
+  ]);
+}
+async function signDeviceCert(input) {
+  const rootPublicKey = await derivePublicKey(input.rootSecret);
+  const account = hex(
+    await domainHash(ACCOUNT_ID_DOMAIN, [
+      concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), rootPublicKey)
+    ])
   );
-  const jwk = await crypto.subtle.exportKey("jwk", key);
-  const raw = jwk.x;
-  return Uint8Array.from(
-    atob(raw.replace(/-/g, "+").replace(/_/g, "/")),
-    (c) => c.charCodeAt(0)
+  const keyEpoch = 0;
+  const payload = await deviceCertPayload({
+    account,
+    device: input.device,
+    signPublicKey: input.signPublicKey,
+    kemPublicKey: input.kemPublicKey,
+    keyEpoch,
+    deviceEpoch: input.deviceEpoch
+  });
+  const key = await importSigningKey(input.rootSecret);
+  const signature = new Uint8Array(
+    await crypto.subtle.sign("Ed25519", key, payload)
+  );
+  const credential = concat(
+    // AccountGenesis
+    new Uint8Array([ACCOUNT_GENESIS_VERSION]),
+    rootPublicKey,
+    // chain: Vec<RootKeyHandoff>, empty
+    u32le(0),
+    // DeviceCert
+    fromHex(account, "account", 32),
+    fromHex(input.device, "device", 32),
+    fromHex(input.signPublicKey, "signPublicKey", 32),
+    fromHex(input.kemPublicKey, "kemPublicKey", 32),
+    u32le(keyEpoch),
+    u32le(input.deviceEpoch),
+    signature
+  );
+  return hex(credential);
+}
+async function accountForRoot(rootSecret) {
+  const rootPublicKey = await derivePublicKey(rootSecret);
+  return hex(
+    await domainHash(ACCOUNT_ID_DOMAIN, [
+      concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), rootPublicKey)
+    ])
   );
 }
 
@@ -2835,6 +2823,7 @@ export {
   SseClient,
   WebHttpClient,
   WsClient,
+  accountForRoot,
   buildAuthLoginUrl,
   combineSignals,
   compareSemver,
@@ -2853,18 +2842,18 @@ export {
   createRetryableMethod,
   createTimeoutSignal,
   createUniversalHttpClient,
+  deviceCertPayload,
   discoverLocalNodes,
   hasCap,
   intentHash,
   jsonCodec,
   localNodeUrl,
+  mintDeviceId,
   nodeEndpoint,
   parseAuthCallback,
   probeNodeHealth,
-  sameAccount,
+  signDeviceCert,
   signWarrant,
-  toAccountBase58,
-  toAccountHex,
   withCap,
   withRetry,
   withoutCap