@calimero-network/mero-js 19.13.0 → 19.14.0

package/dist/admin-api/admin-client.d.ts

@@ -1,5 +1,5 @@
 import { HttpClient } from '../http-client/index.js';
-import type { HealthStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, RevokeAccountDeviceResponseData, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, AdmitJoinRequest, AdmitJoinResponseData } from './admin-types.js';
+import type { HealthStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, RevokeAccountDeviceResponseData, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, AdmitJoinRequest, AdmitJoinResponseData } from './admin-types.js';
 /**
  * Compare two version strings by SemVer 2.0 precedence, ascending: negative if
  * `a < b`, positive if `a > b`, `0` if equal. Build metadata (`+...`) is stripped
@@ -280,6 +280,36 @@ export declare class AdminApiClient {
      * device need not be online.
      */
     rescopeAccountDevice(deviceId: string, request: RescopeDeviceRequest): Promise<RescopeDeviceResponseData>;
+    /**
+     * Sign a payload an outside verifier specified, with this account's root.
+     *
+     * The counterpart to a verifier that issued a challenge and will check the
+     * signature against the account id it derives — the cloud's account link and
+     * login exchanges being the ones this exists for. The root never leaves the
+     * node, so this is the only way a client can produce that signature.
+     *
+     * `domain` is a NAME from a closed set the node knows, never the domain bytes.
+     * That is the security property rather than an encoding preference: signing
+     * caller-supplied bytes under a caller-supplied prefix would be an oracle over
+     * the one key that can certify a device. A node refuses a name it does not
+     * know, and refuses one whose bytes could be extended into a credential of its
+     * own.
+     *
+     * What comes back proves possession of the root and nothing else. Whether the
+     * payload is a challenge anyone issued, whether it is fresh, and whether the
+     * holder may link this account are the verifier's to decide — it issued the
+     * challenge and knows who to.
+     *
+     * ```ts
+     * const { nonce } = await cloud.getAccountLoginChallenge();
+     * const { rootPublicKey, signature } = await admin.signWithAccountRoot({
+     *   domain: 'mdma.account-login',
+     *   payload: hexEncodeUtf8(nonce),
+     * });
+     * await cloud.submitAccountLogin({ rootPublicKey, nonce, signature });
+     * ```
+     */
+    signWithAccountRoot(request: AccountSignWithRootRequest): Promise<AccountSignWithRootResponseData>;
     /**
      * Name a device of this account, for a listing to render.
      *

package/dist/admin-api/admin-client.js

@@ -597,6 +597,38 @@ export class AdminApiClient {
     async rescopeAccountDevice(deviceId, request) {
         return unwrap(await this.httpClient.put(`/admin-api/account/devices/${encodeURIComponent(deviceId)}/scope`, request));
     }
+    /**
+     * Sign a payload an outside verifier specified, with this account's root.
+     *
+     * The counterpart to a verifier that issued a challenge and will check the
+     * signature against the account id it derives — the cloud's account link and
+     * login exchanges being the ones this exists for. The root never leaves the
+     * node, so this is the only way a client can produce that signature.
+     *
+     * `domain` is a NAME from a closed set the node knows, never the domain bytes.
+     * That is the security property rather than an encoding preference: signing
+     * caller-supplied bytes under a caller-supplied prefix would be an oracle over
+     * the one key that can certify a device. A node refuses a name it does not
+     * know, and refuses one whose bytes could be extended into a credential of its
+     * own.
+     *
+     * What comes back proves possession of the root and nothing else. Whether the
+     * payload is a challenge anyone issued, whether it is fresh, and whether the
+     * holder may link this account are the verifier's to decide — it issued the
+     * challenge and knows who to.
+     *
+     * ```ts
+     * const { nonce } = await cloud.getAccountLoginChallenge();
+     * const { rootPublicKey, signature } = await admin.signWithAccountRoot({
+     *   domain: 'mdma.account-login',
+     *   payload: hexEncodeUtf8(nonce),
+     * });
+     * await cloud.submitAccountLogin({ rootPublicKey, nonce, signature });
+     * ```
+     */
+    async signWithAccountRoot(request) {
+        return unwrap(await this.httpClient.post('/admin-api/account/sign-with-root', request));
+    }
     /**
      * Name a device of this account, for a listing to render.
      *

package/dist/admin-api/admin-types.d.ts

@@ -800,6 +800,61 @@ export interface AccountPairCompleteResponseData {
      */
     credential: string;
 }
+/**
+ * A domain an outside verifier defined, which the account root may sign under.
+ *
+ * A name from a closed set, never the domain bytes. The node prepends the bytes
+ * itself: "sign these bytes with the account root" would be a signing oracle
+ * over the one key that can certify a device, which is account takeover. A node
+ * refuses any name it does not know.
+ *
+ * Typed as a union plus `(string & {})` so a node newer than this SDK can be
+ * reached without a cast, while the known names still autocomplete.
+ */
+export type ExternalSigningDomain = 'mdma.account-link' | 'mdma.account-login' | 'mdma.account-recovery' | (string & {});
+/**
+ * Ask this node's account root to sign a payload an outside verifier specified.
+ *
+ * The verifier owns the format; the node supplies only the domain. For the cloud
+ * this is how a challenge it sealed and issued gets signed by a root that
+ * deliberately never leaves the node holding it.
+ */
+export interface AccountSignWithRootRequest {
+    /** Which verifier's domain to sign under. */
+    domain: ExternalSigningDomain;
+    /**
+     * The bytes to sign after the domain, hex-encoded.
+     *
+     * Hex rather than text because the field is bytes. For the cloud's challenge —
+     * an ASCII string — that is the UTF-8 of it, hex-encoded; {@link hexEncodeUtf8}
+     * does exactly that and exists so each caller does not re-derive it.
+     */
+    payload: string;
+}
+/**
+ * Hex-encode a string's UTF-8 bytes, for {@link AccountSignWithRootRequest.payload}.
+ *
+ * Exists so each caller does not write the same loop. Every verifier this is
+ * used with issues its challenge as text, and the node takes bytes — getting
+ * that conversion subtly wrong (UTF-16 code units, a stray newline from a shell)
+ * produces a signature over the wrong message, which fails at the verifier with
+ * nothing local to point at.
+ */
+export declare function hexEncodeUtf8(text: string): string;
+/** What the node signed, and the key to check it against. */
+export interface AccountSignWithRootResponseData {
+    /** The account root's public key, 64 hex characters. */
+    rootPublicKey: string;
+    /**
+     * The signature over `domain ‖ payload`, **base64**.
+     *
+     * Base64 rather than hex because that is what the consuming verifiers decode;
+     * re-encoding it on the way out is a step that fails silently at the far end.
+     */
+    signature: string;
+    /** The account the signing key belongs to, 64 hex characters. */
+    accountId: string;
+}
 /**
  * Repair or widen the reach of a device this account already certified.
  *

package/dist/admin-api/admin-types.js

@@ -1,3 +1,14 @@
 // Admin API Types — aligned with core server routes
 // All types use camelCase to match core's #[serde(rename_all = "camelCase")]
-export {};
+/**
+ * Hex-encode a string's UTF-8 bytes, for {@link AccountSignWithRootRequest.payload}.
+ *
+ * Exists so each caller does not write the same loop. Every verifier this is
+ * used with issues its challenge as text, and the node takes bytes — getting
+ * that conversion subtly wrong (UTF-16 code units, a stray newline from a shell)
+ * produces a signature over the wrong message, which fails at the verifier with
+ * nothing local to point at.
+ */
+export function hexEncodeUtf8(text) {
+    return Array.from(new TextEncoder().encode(text), (b) => b.toString(16).padStart(2, '0')).join('');
+}