@calimero-network/mero-js 19.13.1 → 19.14.1

package/dist/index.cjs

@@ -68,6 +68,7 @@ __export(index_exports, {
   generateAccountRoot: () => generateAccountRoot,
   generateSessionKey: () => generateSessionKey,
   hasCap: () => hasCap,
+  hexEncodeUtf8: () => hexEncodeUtf8,
   intentHash: () => intentHash,
   jsonCodec: () => jsonCodec,
   localNodeUrl: () => localNodeUrl,
@@ -1470,6 +1471,43 @@ var AdminApiClient = class {
       )
     );
   }
+  /**
+   * Sign a payload an outside verifier specified, with this account's root.
+   *
+   * The counterpart to a verifier that issued a challenge and will check the
+   * signature against the account id it derives — the cloud's account link and
+   * login exchanges being the ones this exists for. The root never leaves the
+   * node, so this is the only way a client can produce that signature.
+   *
+   * `domain` is a NAME from a closed set the node knows, never the domain bytes.
+   * That is the security property rather than an encoding preference: signing
+   * caller-supplied bytes under a caller-supplied prefix would be an oracle over
+   * the one key that can certify a device. A node refuses a name it does not
+   * know, and refuses one whose bytes could be extended into a credential of its
+   * own.
+   *
+   * What comes back proves possession of the root and nothing else. Whether the
+   * payload is a challenge anyone issued, whether it is fresh, and whether the
+   * holder may link this account are the verifier's to decide — it issued the
+   * challenge and knows who to.
+   *
+   * ```ts
+   * const { nonce } = await cloud.getAccountLoginChallenge();
+   * const { rootPublicKey, signature } = await admin.signWithAccountRoot({
+   *   domain: 'mdma.account-login',
+   *   payload: hexEncodeUtf8(nonce),
+   * });
+   * await cloud.submitAccountLogin({ rootPublicKey, nonce, signature });
+   * ```
+   */
+  async signWithAccountRoot(request) {
+    return unwrap(
+      await this.httpClient.post(
+        "/admin-api/account/sign-with-root",
+        request
+      )
+    );
+  }
   /**
    * Name a device of this account, for a listing to render.
    *
@@ -1885,6 +1923,14 @@ var AdminApiClient = class {
   }
 };
 
+// src/admin-api/admin-types.ts
+function hexEncodeUtf8(text) {
+  return Array.from(
+    new TextEncoder().encode(text),
+    (b) => b.toString(16).padStart(2, "0")
+  ).join("");
+}
+
 // src/admin-api/admin-factory.ts
 function createBrowserAdminApiClient(config) {
   return new AdminApiClient(createBrowserHttpClient(config));
@@ -2006,6 +2052,13 @@ function isGroupMigrationEvent(event) {
 
 // src/events/sse.ts
 var TERMINAL_AUTH_ERRORS2 = /* @__PURE__ */ new Set(["token_reuse", "token_revoked"]);
+var TERMINAL_AUTH_STATUSES = /* @__PURE__ */ new Set([401, 403]);
+function isTerminalAuthFailure(response) {
+  const authError = response.headers.get("x-auth-error");
+  if (!authError) return null;
+  if (!TERMINAL_AUTH_STATUSES.has(response.status)) return null;
+  return TERMINAL_AUTH_ERRORS2.has(authError) ? authError : null;
+}
 var SseClient = class {
   constructor(opts) {
     this.sessionId = null;
@@ -2092,11 +2145,11 @@ var SseClient = class {
         signal: this.abortController.signal
       });
       if (!response.ok) {
-        const authError = response.headers.get("x-auth-error");
+        const terminal = isTerminalAuthFailure(response);
         const bodyText = await response.text().catch(() => void 0);
-        if (response.status === 401 && authError && TERMINAL_AUTH_ERRORS2.has(authError)) {
+        if (terminal) {
           throw new AuthRevokedError(
-            authError,
+            terminal,
             response.status,
             response.statusText,
             url,
@@ -2125,6 +2178,7 @@ var SseClient = class {
       if (this.closed) return;
       const error = err instanceof Error ? err : new Error(String(err));
       this.emit("error", error);
+      if (error instanceof AuthRevokedError) return;
       this.scheduleReconnect();
     }
   }
@@ -2255,7 +2309,25 @@ var SseClient = class {
         })
       });
       if (!response.ok) {
-        this.emit("error", new Error(`SSE ${method} failed: ${response.status}`));
+        const terminal = isTerminalAuthFailure(response);
+        const bodyText = await response.text().catch(() => void 0);
+        this.emit(
+          "error",
+          terminal ? new AuthRevokedError(
+            terminal,
+            response.status,
+            response.statusText,
+            `${this.baseUrl}/sse/subscription`,
+            response.headers,
+            bodyText
+          ) : new HTTPError(
+            response.status,
+            response.statusText,
+            `${this.baseUrl}/sse/subscription`,
+            response.headers,
+            bodyText
+          )
+        );
       }
     } catch (err) {
       this.emit("error", err instanceof Error ? err : new Error(`SSE ${method} failed`));