@calimero-network/mero-js 19.13.0 → 19.14.0

package/dist/index.mjs

@@ -1378,6 +1378,43 @@ var AdminApiClient = class {
       )
     );
   }
+  /**
+   * Sign a payload an outside verifier specified, with this account's root.
+   *
+   * The counterpart to a verifier that issued a challenge and will check the
+   * signature against the account id it derives — the cloud's account link and
+   * login exchanges being the ones this exists for. The root never leaves the
+   * node, so this is the only way a client can produce that signature.
+   *
+   * `domain` is a NAME from a closed set the node knows, never the domain bytes.
+   * That is the security property rather than an encoding preference: signing
+   * caller-supplied bytes under a caller-supplied prefix would be an oracle over
+   * the one key that can certify a device. A node refuses a name it does not
+   * know, and refuses one whose bytes could be extended into a credential of its
+   * own.
+   *
+   * What comes back proves possession of the root and nothing else. Whether the
+   * payload is a challenge anyone issued, whether it is fresh, and whether the
+   * holder may link this account are the verifier's to decide — it issued the
+   * challenge and knows who to.
+   *
+   * ```ts
+   * const { nonce } = await cloud.getAccountLoginChallenge();
+   * const { rootPublicKey, signature } = await admin.signWithAccountRoot({
+   *   domain: 'mdma.account-login',
+   *   payload: hexEncodeUtf8(nonce),
+   * });
+   * await cloud.submitAccountLogin({ rootPublicKey, nonce, signature });
+   * ```
+   */
+  async signWithAccountRoot(request) {
+    return unwrap(
+      await this.httpClient.post(
+        "/admin-api/account/sign-with-root",
+        request
+      )
+    );
+  }
   /**
    * Name a device of this account, for a listing to render.
    *
@@ -1793,6 +1830,14 @@ var AdminApiClient = class {
   }
 };
 
+// src/admin-api/admin-types.ts
+function hexEncodeUtf8(text) {
+  return Array.from(
+    new TextEncoder().encode(text),
+    (b) => b.toString(16).padStart(2, "0")
+  ).join("");
+}
+
 // src/admin-api/admin-factory.ts
 function createBrowserAdminApiClient(config) {
   return new AdminApiClient(createBrowserHttpClient(config));
@@ -6638,6 +6683,7 @@ export {
   generateAccountRoot,
   generateSessionKey,
   hasCap,
+  hexEncodeUtf8,
   intentHash,
   jsonCodec,
   localNodeUrl,