@calimero-network/mero-js 18.3.0 → 19.1.0

package/dist/index.cjs

@@ -1031,13 +1031,30 @@ var AdminApiClient = class {
     );
     return { blobs: res.blobs.map((b) => ({ blobId: b.blob_id, size: b.size })) };
   }
+  /**
+   * Blob-read query params. `context_id` is the same snake_case param
+   * {@link uploadBlob} announces with; building it in one place keeps the read
+   * side from drifting from the write side.
+   */
+  blobPath(blobId, options) {
+    if (!options?.contextId) return `/admin-api/blobs/${blobId}`;
+    const params = new URLSearchParams({ context_id: options.contextId });
+    return `/admin-api/blobs/${blobId}?${params.toString()}`;
+  }
   /**
    * Download a blob's raw bytes. `GET /admin-api/blobs/:id` streams the blob
    * content (e.g. `application/gzip`), NOT JSON — so fetch it as an ArrayBuffer.
    * Use {@link listBlobs} for `{ blobId, size }` metadata.
+   *
+   * Without `contextId` the read is local-only: the node answers from its own
+   * blob store and returns immediately, or 404s. Passing `contextId` opts into
+   * network discovery — the node probes that context's peers (availability
+   * nodes first) for a holder, then transfers the bytes. Budget for it: core
+   * bounds discovery by a ~30s deadline, and the transfer is on top of that, so
+   * the worst case is well past what a UI should block on unhinted.
    */
-  async getBlob(blobId) {
-    return this.httpClient.get(`/admin-api/blobs/${blobId}`, {
+  async getBlob(blobId, options) {
+    return this.httpClient.get(this.blobPath(blobId, options), {
       parse: "arrayBuffer"
     });
   }
@@ -1045,15 +1062,26 @@ var AdminApiClient = class {
    * Fetch a blob's metadata without downloading it. `HEAD /admin-api/blobs/:id`
    * returns the info in response headers (size via `content-length`, plus
    * `x-blob-id`/`x-blob-hash`/`x-blob-mime-type`).
+   *
+   * Without `contextId` this is a local-only presence check that returns
+   * immediately. Passing `contextId` opts into the same network discovery
+   * {@link getBlob} uses — presence and size answered by probing the context's
+   * peers, with no transfer — so it inherits core's ~30s discovery deadline as
+   * its worst case. A probe only carries `found` and `size`, so a peer-sourced
+   * answer has no `hash`/`mimeType`; read `source` to tell the two apart.
    */
-  async getBlobInfo(blobId) {
-    const { headers } = await this.httpClient.head(`/admin-api/blobs/${blobId}`);
+  async getBlobInfo(blobId, options) {
+    const { headers } = await this.httpClient.head(this.blobPath(blobId, options));
     const size = Number(headers["content-length"]);
     return {
       blobId: headers["x-blob-id"] ?? blobId,
       size: Number.isFinite(size) ? size : 0,
       hash: headers["x-blob-hash"],
-      mimeType: headers["x-blob-mime-type"]
+      mimeType: headers["x-blob-mime-type"],
+      // Nodes that predate the context-aware HEAD omit this header entirely, so
+      // it stays undefined rather than being defaulted to 'local' — absent means
+      // "the node didn't say", which is not the same claim as "served locally".
+      source: headers["x-blob-source"]
     };
   }
   // ---- Alias Management ----
@@ -3164,8 +3192,10 @@ async function derivePublicKey(secretHex) {
 }
 
 // src/warrant/warrant.ts
-var SIGN_DOMAIN = new TextEncoder().encode("calimero.warrant.v1");
+var SIGN_DOMAIN = new TextEncoder().encode("calimero.warrant.v2");
 var INTENT_DOMAIN = new TextEncoder().encode("calimero.warrant.intent.v1");
+var MAX_CITED_HEADS = 64;
+var UNPINNED_APP = "00".repeat(32);
 async function intentHash(method, argsJson) {
   const args = new TextEncoder().encode(JSON.stringify(argsJson));
   return domainHash(INTENT_DOMAIN, [new TextEncoder().encode(method), args]);
@@ -3174,8 +3204,16 @@ async function signWarrant(input) {
   const context = fromHex(input.context, "context", 32);
   const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
   const executor = fromHex(input.executor, "executor", 32);
+  const appVersion = fromHex(
+    input.appVersion ?? UNPINNED_APP,
+    "appVersion",
+    32
+  );
+  const accountHeads = citedHeads(input.accountHeads, "accountHeads");
+  const governanceFloor = citedHeads(input.governanceFloor, "governanceFloor");
   const key = await importSigningKey(input.deviceSecret);
   const publicKey = await derivePublicKey(input.deviceSecret);
+  const method = new TextEncoder().encode(input.method);
   const commitment = await intentHash(input.method, input.argsJson);
   const nonce = u64le(input.nonce);
   const notAfter = u64le(input.notAfter);
@@ -3184,7 +3222,13 @@ async function signWarrant(input) {
     authorAccount,
     publicKey,
     executor,
+    appVersion,
+    method,
     commitment,
+    u64le(accountHeads.length),
+    ...accountHeads,
+    u64le(governanceFloor.length),
+    ...governanceFloor,
     nonce,
     notAfter
   ]);
@@ -3197,13 +3241,29 @@ async function signWarrant(input) {
       authorAccount,
       publicKey,
       executor,
+      appVersion,
+      u32le(method.length),
+      method,
       commitment,
+      u32le(accountHeads.length),
+      ...accountHeads,
+      u32le(governanceFloor.length),
+      ...governanceFloor,
       nonce,
       notAfter,
       signature
     )
   );
 }
+function citedHeads(heads, label) {
+  const list = heads ?? [];
+  if (list.length > MAX_CITED_HEADS) {
+    throw new Error(
+      `${label} cites ${list.length} heads, over the ${MAX_CITED_HEADS} a node accepts`
+    );
+  }
+  return list.map((head, i) => fromHex(head, `${label}[${i}]`, 32));
+}
 
 // src/relay/relay-client.ts
 var DEFAULT_TTL_SECONDS = 300;