@calimero-network/mero-js 19.14.0 → 19.15.0

package/dist/index.cjs

@@ -77,12 +77,14 @@ __export(index_exports, {
   nodeEndpoint: () => nodeEndpoint,
   parseAuthCallback: () => parseAuthCallback,
   probeNodeHealth: () => probeNodeHealth,
+  requestBodyHash: () => requestBodyHash,
   routingProofHeaders: () => routingProofHeaders,
   signAccountLink: () => signAccountLink,
   signAccountLogin: () => signAccountLogin,
   signDeviceCert: () => signDeviceCert,
   signLoginStatement: () => signLoginStatement,
   signMemberJoinOp: () => signMemberJoinOp,
+  signRequest: () => signRequest,
   signRoutingChallenge: () => signRoutingChallenge,
   signWarrant: () => signWarrant,
   withCap: () => withCap,
@@ -2052,6 +2054,13 @@ function isGroupMigrationEvent(event) {
 
 // src/events/sse.ts
 var TERMINAL_AUTH_ERRORS2 = /* @__PURE__ */ new Set(["token_reuse", "token_revoked"]);
+var TERMINAL_AUTH_STATUSES = /* @__PURE__ */ new Set([401, 403]);
+function isTerminalAuthFailure(response) {
+  const authError = response.headers.get("x-auth-error");
+  if (!authError) return null;
+  if (!TERMINAL_AUTH_STATUSES.has(response.status)) return null;
+  return TERMINAL_AUTH_ERRORS2.has(authError) ? authError : null;
+}
 var SseClient = class {
   constructor(opts) {
     this.sessionId = null;
@@ -2138,11 +2147,11 @@ var SseClient = class {
         signal: this.abortController.signal
       });
       if (!response.ok) {
-        const authError = response.headers.get("x-auth-error");
+        const terminal = isTerminalAuthFailure(response);
         const bodyText = await response.text().catch(() => void 0);
-        if (response.status === 401 && authError && TERMINAL_AUTH_ERRORS2.has(authError)) {
+        if (terminal) {
           throw new AuthRevokedError(
-            authError,
+            terminal,
             response.status,
             response.statusText,
             url,
@@ -2171,6 +2180,7 @@ var SseClient = class {
       if (this.closed) return;
       const error = err instanceof Error ? err : new Error(String(err));
       this.emit("error", error);
+      if (error instanceof AuthRevokedError) return;
       this.scheduleReconnect();
     }
   }
@@ -2301,7 +2311,25 @@ var SseClient = class {
         })
       });
       if (!response.ok) {
-        this.emit("error", new Error(`SSE ${method} failed: ${response.status}`));
+        const terminal = isTerminalAuthFailure(response);
+        const bodyText = await response.text().catch(() => void 0);
+        this.emit(
+          "error",
+          terminal ? new AuthRevokedError(
+            terminal,
+            response.status,
+            response.statusText,
+            `${this.baseUrl}/sse/subscription`,
+            response.headers,
+            bodyText
+          ) : new HTTPError(
+            response.status,
+            response.statusText,
+            `${this.baseUrl}/sse/subscription`,
+            response.headers,
+            bodyText
+          )
+        );
       }
     } catch (err) {
       this.emit("error", err instanceof Error ? err : new Error(`SSE ${method} failed`));
@@ -6509,8 +6537,47 @@ async function signMemberJoinOp(input) {
   return hex(concat(signable, signature, unendorsed));
 }
 
+// src/request/request-sig.ts
+var SIGN_DOMAIN2 = new TextEncoder().encode("calimero.auth.request.v1");
+var BODY_DOMAIN = new TextEncoder().encode("calimero.auth.request.body.v1");
+function borshString2(value) {
+  const bytes = new TextEncoder().encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+async function requestBodyHash(body = new Uint8Array(0)) {
+  const bytes = typeof body === "string" ? new TextEncoder().encode(body) : body;
+  return domainHash(BODY_DOMAIN, [bytes]);
+}
+async function signRequest(input) {
+  const key = await importSigningKey(input.signerSecret);
+  const bodyHash = await requestBodyHash(input.body);
+  const issuedAt = u64le(input.issuedAt);
+  const expiresAt = u64le(input.expiresAt);
+  const encoder = new TextEncoder();
+  const preimage = await domainHash(SIGN_DOMAIN2, [
+    encoder.encode(input.method),
+    encoder.encode(input.path),
+    bodyHash,
+    issuedAt,
+    expiresAt
+  ]);
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
+  );
+  return hex(
+    concat(
+      borshString2(input.method),
+      borshString2(input.path),
+      bodyHash,
+      issuedAt,
+      expiresAt,
+      signature
+    )
+  );
+}
+
 // src/login/login.ts
-var SIGN_DOMAIN2 = new TextEncoder().encode("calimero.auth.login.v1");
+var SIGN_DOMAIN3 = new TextEncoder().encode("calimero.auth.login.v1");
 var AUDIENCE_TAG = {
   webOrigin: 0,
   codeSigningId: 1,
@@ -6549,7 +6616,7 @@ async function signLoginStatement(input) {
   const deviceKey = await derivePublicKey(input.deviceSecret);
   const issuedAt = u64le(input.issuedAt);
   const expiresAt = u64le(input.expiresAt);
-  const preimage = await domainHash(SIGN_DOMAIN2, [
+  const preimage = await domainHash(SIGN_DOMAIN3, [
     node,
     audienceSigningBytes(input.audience),
     challenge,