@calimero-network/mero-js 19.13.1 → 19.14.0

package/dist/index.cjs

@@ -68,6 +68,7 @@ __export(index_exports, {
   generateAccountRoot: () => generateAccountRoot,
   generateSessionKey: () => generateSessionKey,
   hasCap: () => hasCap,
+  hexEncodeUtf8: () => hexEncodeUtf8,
   intentHash: () => intentHash,
   jsonCodec: () => jsonCodec,
   localNodeUrl: () => localNodeUrl,
@@ -1470,6 +1471,43 @@ var AdminApiClient = class {
       )
     );
   }
+  /**
+   * Sign a payload an outside verifier specified, with this account's root.
+   *
+   * The counterpart to a verifier that issued a challenge and will check the
+   * signature against the account id it derives — the cloud's account link and
+   * login exchanges being the ones this exists for. The root never leaves the
+   * node, so this is the only way a client can produce that signature.
+   *
+   * `domain` is a NAME from a closed set the node knows, never the domain bytes.
+   * That is the security property rather than an encoding preference: signing
+   * caller-supplied bytes under a caller-supplied prefix would be an oracle over
+   * the one key that can certify a device. A node refuses a name it does not
+   * know, and refuses one whose bytes could be extended into a credential of its
+   * own.
+   *
+   * What comes back proves possession of the root and nothing else. Whether the
+   * payload is a challenge anyone issued, whether it is fresh, and whether the
+   * holder may link this account are the verifier's to decide — it issued the
+   * challenge and knows who to.
+   *
+   * ```ts
+   * const { nonce } = await cloud.getAccountLoginChallenge();
+   * const { rootPublicKey, signature } = await admin.signWithAccountRoot({
+   *   domain: 'mdma.account-login',
+   *   payload: hexEncodeUtf8(nonce),
+   * });
+   * await cloud.submitAccountLogin({ rootPublicKey, nonce, signature });
+   * ```
+   */
+  async signWithAccountRoot(request) {
+    return unwrap(
+      await this.httpClient.post(
+        "/admin-api/account/sign-with-root",
+        request
+      )
+    );
+  }
   /**
    * Name a device of this account, for a listing to render.
    *
@@ -1885,6 +1923,14 @@ var AdminApiClient = class {
   }
 };
 
+// src/admin-api/admin-types.ts
+function hexEncodeUtf8(text) {
+  return Array.from(
+    new TextEncoder().encode(text),
+    (b) => b.toString(16).padStart(2, "0")
+  ).join("");
+}
+
 // src/admin-api/admin-factory.ts
 function createBrowserAdminApiClient(config) {
   return new AdminApiClient(createBrowserHttpClient(config));