@calimero-network/mero-js 19.20.0 → 19.22.0

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export type { SseEventData, WsEventData, AppVersionChangedEvent, GroupMembership
 export { EphemeralClient, jsonCodec } from "./ephemeral/index.js";
 export type { Codec, EphemeralEntry } from "./ephemeral/index.js";
 export * from "./cloud/index.js";
+export * from "./sealed/index.js";
 export * from "./relay/index.js";
 export { signWarrant, intentHash } from "./warrant/index.js";
 export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, signAccountLink, signAccountLogin, } from "./account/index.js";

package/dist/index.js

@@ -20,6 +20,8 @@ export { SseClient, WsClient } from "./events/index.js";
 export { EphemeralClient, jsonCodec } from "./ephemeral/index.js";
 // Cloud client — namespaces, relays, HA, and the cloud sign-in path
 export * from "./cloud/index.js";
+// Sealed transport — requests encrypted to a TEE node's attested key
+export * from "./sealed/index.js";
 // Relay client — write through delegated execution, holding only a signing key
 export * from "./relay/index.js";
 // Warrant signing — mint the author's consent for a relay to run one intent

package/dist/index.mjs

@@ -6489,6 +6489,216 @@ async function defaultNonceSource(deviceSecret) {
   }
 }
 
+// src/sealed/sealed.ts
+var SEALED_PATH = "/sealed/v1";
+var SEALED_CONTENT_TYPE = "application/vnd.calimero.sealed";
+var VERSION = 1;
+var NONCE_LEN = 12;
+var REQUEST_DOMAIN = "calimero/sealed-http/v1/request";
+var RESPONSE_DOMAIN = "calimero/sealed-http/v1/response";
+var TRANSPORT_BINDING_DOMAIN = "calimero.tee-attest.transport-key.v1";
+var PKCS8_X25519_PREFIX = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  110,
+  4,
+  34,
+  4,
+  32
+]);
+var utf8 = new TextEncoder();
+var StaleTransportKeyError = class extends Error {
+  constructor() {
+    super(
+      "The node no longer holds the transport key this request was sealed to; attest again for the current one"
+    );
+    this.name = "StaleTransportKeyError";
+  }
+};
+var SealedTransportError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "SealedTransportError";
+  }
+};
+async function transportKeyBinding(inner, transportKey) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    concat(utf8.encode(TRANSPORT_BINDING_DOMAIN), inner, transportKey)
+  );
+  return new Uint8Array(digest);
+}
+async function fetchAttestedTransportKey(admin, verify, options = {}) {
+  if (options.applicationId === void 0 !== (options.applicationHash === void 0)) {
+    throw new Error("applicationId and applicationHash are given together or not at all");
+  }
+  const nonce = hex(crypto.getRandomValues(new Uint8Array(32)));
+  const attested = await admin.teeAttest({
+    nonce,
+    applicationId: options.applicationId,
+    bindTransportKey: true
+  });
+  if (!attested.transportPublicKey) {
+    throw new Error("The node did not report a transport key; it predates sealed transport");
+  }
+  const transportKey = fromHex(attested.transportPublicKey, "transportPublicKey", 32);
+  const inner = options.applicationHash ? fromHex(options.applicationHash, "applicationHash", 32) : new Uint8Array(32);
+  const reportDataSuffix = hex(await transportKeyBinding(inner, transportKey));
+  if (!await verify({ quoteB64: attested.quoteB64, nonce, reportDataSuffix })) {
+    throw new Error("The attestation did not verify, so its transport key is not trusted");
+  }
+  return transportKey;
+}
+function createSealedFetch(options) {
+  const base = new URL(options.baseUrl);
+  const basePath = base.pathname.replace(/\/+$/, "");
+  const sealedUrl = `${base.origin}${basePath}${SEALED_PATH}`;
+  const transportKey = options.transportPublicKey;
+  if (transportKey.length !== 32) {
+    throw new Error("transportPublicKey must be 32 bytes");
+  }
+  const baseFetch = options.fetch ?? ((input, init) => fetch(input, init));
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const url = new URL(request.url);
+    if (url.origin !== base.origin || !url.pathname.startsWith(`${basePath}/`)) {
+      throw new Error(`Refusing to send ${url.href} outside the sealed node at ${options.baseUrl}`);
+    }
+    const headers = [];
+    request.headers.forEach((value, name) => headers.push([name, value]));
+    const head = {
+      method: request.method,
+      path: url.pathname.slice(basePath.length) + url.search,
+      headers,
+      ts: Math.floor(Date.now() / 1e3)
+    };
+    const body = new Uint8Array(await request.arrayBuffer());
+    const exchange = await sealRequest(transportKey, head, body);
+    const response = await baseFetch(sealedUrl, {
+      method: "POST",
+      headers: { "content-type": SEALED_CONTENT_TYPE },
+      body: exchange.envelope,
+      signal: request.signal
+    });
+    if (response.headers.get("content-type") !== SEALED_CONTENT_TYPE) {
+      throw await envelopeRefusal(response);
+    }
+    const opened = await exchange.open(new Uint8Array(await response.arrayBuffer()));
+    const nullBody = [101, 204, 205, 304].includes(opened.head.status);
+    return new Response(nullBody ? null : opened.body, {
+      status: opened.head.status,
+      headers: opened.head.headers
+    });
+  };
+}
+async function envelopeRefusal(response) {
+  let code;
+  let message = `Sealed request refused: HTTP ${response.status}`;
+  try {
+    const body = await response.json();
+    code = body?.error?.code;
+    if (body?.error?.message) message = `Sealed request refused: ${body.error.message}`;
+  } catch {
+  }
+  if (code === "stale_transport_key") return new StaleTransportKeyError();
+  return new SealedTransportError(response.status, code, message);
+}
+async function sealRequest(transportKey, head, body, fixed) {
+  const { privateKey, publicKey } = await clientKeyPair(fixed?.clientSecret);
+  const transport = await crypto.subtle.importKey("raw", transportKey, { name: "X25519" }, false, []);
+  const shared = new Uint8Array(
+    await crypto.subtle.deriveBits({ name: "X25519", public: transport }, privateKey, 256)
+  );
+  if (shared.every((byte) => byte === 0)) {
+    throw new Error("The transport key is a low-order point");
+  }
+  const salt = concat(transportKey, publicKey);
+  const requestKey = await exchangeKey(shared, salt, REQUEST_DOMAIN, "encrypt");
+  const responseKey = await exchangeKey(shared, salt, RESPONSE_DOMAIN, "decrypt");
+  const nonce = fixed?.nonce ?? crypto.getRandomValues(new Uint8Array(NONCE_LEN));
+  const header = concat(new Uint8Array([VERSION]), transportKey, publicKey, nonce);
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: nonce, additionalData: header },
+    requestKey,
+    joinInner(head, body)
+  );
+  const responseAad = concat(new Uint8Array([VERSION]), salt);
+  return {
+    envelope: concat(header, new Uint8Array(ciphertext)),
+    async open(sealed) {
+      if (sealed.length < 1 + NONCE_LEN + 16 || sealed[0] !== VERSION) {
+        throw new Error("The sealed response is malformed");
+      }
+      let plaintext;
+      try {
+        plaintext = new Uint8Array(
+          await crypto.subtle.decrypt(
+            { name: "AES-GCM", iv: sealed.slice(1, 1 + NONCE_LEN), additionalData: responseAad },
+            responseKey,
+            sealed.slice(1 + NONCE_LEN)
+          )
+        );
+      } catch {
+        throw new Error("The sealed response did not open: it was not sealed by the attested node");
+      }
+      const view = new DataView(plaintext.buffer, plaintext.byteOffset, plaintext.byteLength);
+      const len = view.getUint32(0, false);
+      const head2 = JSON.parse(new TextDecoder().decode(plaintext.slice(4, 4 + len)));
+      return { head: head2, body: plaintext.slice(4 + len) };
+    }
+  };
+}
+function joinInner(head, body) {
+  const encoded = utf8.encode(JSON.stringify(head));
+  const len = new Uint8Array(4);
+  new DataView(len.buffer).setUint32(0, encoded.length, false);
+  return concat(len, encoded, body);
+}
+async function exchangeKey(shared, salt, domain, usage) {
+  const ikm = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt, info: utf8.encode(domain) },
+    ikm,
+    { name: "AES-GCM", length: 256 },
+    false,
+    [usage]
+  );
+}
+async function clientKeyPair(secret) {
+  if (!secret) {
+    const pair = await crypto.subtle.generateKey({ name: "X25519" }, true, [
+      "deriveBits"
+    ]);
+    const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+    return { privateKey: pair.privateKey, publicKey };
+  }
+  const privateKey = await crypto.subtle.importKey(
+    "pkcs8",
+    concat(PKCS8_X25519_PREFIX, secret),
+    { name: "X25519" },
+    true,
+    ["deriveBits"]
+  );
+  const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+  return { privateKey, publicKey: base64UrlDecode(jwk.x) };
+}
+function base64UrlDecode(value) {
+  const base643 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base643 + "=".repeat((4 - base643.length % 4) % 4));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+
 // src/namespace-op/namespace-op.ts
 var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 8;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
@@ -6831,8 +7041,12 @@ export {
   RelayClient,
   RpcClient,
   RpcError,
+  SEALED_CONTENT_TYPE,
+  SEALED_PATH,
   SIGNED_NAMESPACE_OP_SCHEMA_VERSION,
+  SealedTransportError,
   SseClient,
+  StaleTransportKeyError,
   WebHttpClient,
   WsClient,
   accountForRoot,
@@ -6860,11 +7074,13 @@ export {
   createNodeHttpClient,
   createProofSigner,
   createRetryableMethod,
+  createSealedFetch,
   createTimeoutSignal,
   createUniversalHttpClient,
   deviceCertPayload,
   discoverLocalNodes,
   encodeSignedInvitation,
+  fetchAttestedTransportKey,
   generateAccountRoot,
   generateSessionKey,
   hasCap,
@@ -6887,6 +7103,7 @@ export {
   signRequest,
   signRoutingChallenge,
   signWarrant,
+  transportKeyBinding,
   withCap,
   withRetry,
   withoutCap