@calimero-network/mero-js 19.15.0 → 19.16.0

package/dist/crypto/internal.d.ts

@@ -11,6 +11,17 @@
 export declare function u32le(value: number): Uint8Array;
 export declare function hex(bytes: Uint8Array): string;
 export declare function fromHex(value: string, label: string, expectedBytes: number): Uint8Array;
+/**
+ * Decode hex of an unknown length.
+ *
+ * The sized {@link fromHex} is the right default — every key and digest here
+ * has a fixed width, and checking it catches a truncated paste at the edge
+ * rather than deep inside a signature check. This one exists for the already-
+ * encoded structures whose length is genuinely variable: a device certificate,
+ * a login statement, a request signature. It still rejects odd-length and
+ * non-hex input, so the only check it gives up is the one that cannot apply.
+ */
+export declare function fromHexUnsized(value: string, label: string): Uint8Array;
 export declare function u64le(value: number | bigint): Uint8Array;
 export declare function concat(...parts: Uint8Array[]): Uint8Array;
 /**

package/dist/crypto/internal.js

@@ -34,6 +34,27 @@ export function fromHex(value, label, expectedBytes) {
     }
     return bytes;
 }
+/**
+ * Decode hex of an unknown length.
+ *
+ * The sized {@link fromHex} is the right default — every key and digest here
+ * has a fixed width, and checking it catches a truncated paste at the edge
+ * rather than deep inside a signature check. This one exists for the already-
+ * encoded structures whose length is genuinely variable: a device certificate,
+ * a login statement, a request signature. It still rejects odd-length and
+ * non-hex input, so the only check it gives up is the one that cannot apply.
+ */
+export function fromHexUnsized(value, label) {
+    const clean = value.trim();
+    if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+        throw new Error(`${label} must be an even number of hex characters`);
+    }
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < bytes.length; i += 1) {
+        bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
 export function u64le(value) {
     const out = new Uint8Array(8);
     new DataView(out.buffer).setBigUint64(0, BigInt(value), true);

package/dist/http-client/http-factory.d.ts

@@ -3,6 +3,7 @@ export declare function createHttpClient(transport: Transport): HttpClient;
 export declare function createBrowserHttpClient(options: {
     baseUrl: string;
     getAuthToken?: () => Promise<string | undefined>;
+    getProof?: Transport['getProof'];
     onTokenRefresh?: (newToken: string) => Promise<void>;
     /**
      * Callback to refresh the access token when a 401 error with 'token_expired' is detected.
@@ -25,6 +26,7 @@ export declare function createNodeHttpClient(options: {
     baseUrl: string;
     fetch?: typeof fetch;
     getAuthToken?: () => Promise<string | undefined>;
+    getProof?: Transport['getProof'];
     onTokenRefresh?: (newToken: string) => Promise<void>;
     /**
      * Callback to refresh the access token when a 401 error with 'token_expired' is detected.
@@ -47,6 +49,7 @@ export declare function createUniversalHttpClient(options: {
     baseUrl: string;
     fetch?: typeof fetch;
     getAuthToken?: () => Promise<string | undefined>;
+    getProof?: Transport['getProof'];
     onTokenRefresh?: (newToken: string) => Promise<void>;
     /**
      * Callback to refresh the access token when a 401 error with 'token_expired' is detected.

package/dist/http-client/http-factory.js

@@ -11,6 +11,7 @@ export function createBrowserHttpClient(options) {
         fetch: (url, init) => globalThis.fetch(url, init),
         baseUrl: options.baseUrl,
         getAuthToken: options.getAuthToken,
+        getProof: options.getProof,
         onTokenRefresh: options.onTokenRefresh,
         refreshToken: options.refreshToken,
         onAuthRevoked: options.onAuthRevoked,
@@ -42,6 +43,7 @@ export function createNodeHttpClient(options) {
             : (url, init) => fetchImpl(url, init),
         baseUrl: options.baseUrl,
         getAuthToken: options.getAuthToken,
+        getProof: options.getProof,
         onTokenRefresh: options.onTokenRefresh,
         refreshToken: options.refreshToken,
         onAuthRevoked: options.onAuthRevoked,

package/dist/http-client/http-types.d.ts

@@ -4,6 +4,21 @@ export interface Transport {
     baseUrl: string;
     defaultHeaders?: Record<string, string>;
     getAuthToken?: () => Promise<string | undefined>;
+    /**
+     * Sign each request instead of, or alongside, presenting a session.
+     *
+     * Called per call with the method, the path the node will see, and the exact
+     * body — a proof commits to all three, so unlike `getAuthToken` it cannot be
+     * resolved once and reused. Returning `undefined` sends no proof header,
+     * which is how a client that only sometimes has a key stays usable.
+     *
+     * `createProofSigner` builds one of these from a credential and a key.
+     */
+    getProof?: (request: {
+        method: string;
+        path: string;
+        body?: unknown;
+    }) => Promise<string | undefined>;
     onTokenRefresh?: (newToken: string) => Promise<void>;
     /**
      * Callback to refresh the access token when a 401 error with 'token_expired' is detected.

package/dist/http-client/web-client.js

@@ -88,6 +88,23 @@ function headersToRecord(headers) {
     return record;
 }
 // Web Standards HTTP client implementation
+/**
+ * The path a node will verify a request signature against.
+ *
+ * `new URL` drops the query and keeps any prefix the base URL contributed,
+ * which is exactly what reaches the server. The fallback covers a `url` that is
+ * already relative — it cannot be parsed, and signing the whole string with its
+ * query attached would be worse than signing the part before the `?`.
+ */
+function pathForProof(url) {
+    try {
+        return new URL(url).pathname;
+    }
+    catch {
+        const query = url.indexOf('?');
+        return query === -1 ? url : url.slice(0, query);
+    }
+}
 export class WebHttpClient {
     constructor(transport) {
         this.transport = transport;
@@ -234,6 +251,26 @@ export class WebHttpClient {
         if (init?.keepalive !== undefined) {
             requestInit.keepalive = init.keepalive;
         }
+        // Signed here rather than in `buildHeaders`, which sees neither the method
+        // nor the body — and a proof commits to both. Signed AFTER the body is
+        // settled above, so what is hashed is what is sent.
+        //
+        // The path comes from the built URL's `pathname`, not from the `path`
+        // argument: that argument may carry a query string, and may be relative to
+        // a base URL that contributes its own prefix. The node verifies against the
+        // path it received, so the only safe source is the URL actually being
+        // fetched. A query string is deliberately not covered — core's `RequestSig`
+        // signs the path alone, and signing more here would fail every request.
+        if (this.transport.getProof) {
+            const proof = await this.transport.getProof({
+                method: requestInit.method ?? 'GET',
+                path: pathForProof(url),
+                body: requestInit.body,
+            });
+            if (proof) {
+                headersObj['X-Calimero-Proof'] = proof;
+            }
+        }
         try {
             const response = await this.transport.fetch(url, requestInit);
             if (!response.ok) {