@calimero-network/mero-js 19.22.0 → 19.24.0

package/dist/index.cjs

@@ -26,6 +26,7 @@ __export(index_exports, {
   CloudClient: () => CloudClient,
   DEFAULT_LOCAL_NODE_PORTS: () => DEFAULT_LOCAL_NODE_PORTS,
   EphemeralClient: () => EphemeralClient,
+  HANDSHAKE_PATH: () => HANDSHAKE_PATH,
   HTTPError: () => HTTPError,
   IntentRefusedError: () => IntentRefusedError,
   LocalStorageTokenStore: () => LocalStorageTokenStore,
@@ -1782,6 +1783,15 @@ var AdminApiClient = class {
   async setTeeAuthoringPolicy(groupId, request) {
     await this.httpClient.put(`/admin-api/groups/${groupId}/settings/tee-authoring-policy`, request);
   }
+  /**
+   * Turns TEE authorship off in the namespace: every TEE loses its authority,
+   * and admitted TEEs stay members. The node applies the same op as
+   * `setTeeAuthoringPolicy(groupId, { allowedMrtd: [] })`. `groupId` must be a
+   * namespace root.
+   */
+  async disableTeeAuthoringPolicy(groupId) {
+    await this.httpClient.delete(`/admin-api/groups/${groupId}/settings/tee-authoring-policy`);
+  }
   // ---- Group / member / context metadata ----
   async setGroupMetadata(groupId, request) {
     await this.httpClient.put(`/admin-api/groups/${groupId}/metadata`, request);
@@ -2862,12 +2872,12 @@ var CERT_DOMAIN = new TextEncoder().encode("calimero.device.cert.v1");
 var ACCOUNT_ID_DOMAIN = new TextEncoder().encode("calimero.account.genesis.v1");
 var DEVICE_ID_DOMAIN = new TextEncoder().encode("calimero.device.id.v1");
 var ACCOUNT_GENESIS_VERSION = 2;
-async function mintDeviceId(account, nonce) {
-  if (nonce.length !== 16) {
-    throw new Error(`nonce must be 16 bytes, got ${nonce.length}`);
+async function mintDeviceId(account, nonce2) {
+  if (nonce2.length !== 16) {
+    throw new Error(`nonce must be 16 bytes, got ${nonce2.length}`);
   }
   const accountBytes = fromHex(account, "account", 32);
-  return hex(await domainHash(DEVICE_ID_DOMAIN, [accountBytes, nonce]));
+  return hex(await domainHash(DEVICE_ID_DOMAIN, [accountBytes, nonce2]));
 }
 async function deviceCertPayload(input) {
   return domainHash(CERT_DOMAIN, [
@@ -5097,12 +5107,12 @@ function base64(bytes) {
 var ROUTING_PROOF_DOMAIN = new TextEncoder().encode(
   "calimero.mdma.routing-read.v1\0"
 );
-async function signRoutingChallenge(nonce, deviceSecret) {
+async function signRoutingChallenge(nonce2, deviceSecret) {
   fromHex(deviceSecret, "deviceSecret", 32);
   const key = await importSigningKey(deviceSecret);
   const message = concat(
     ROUTING_PROOF_DOMAIN,
-    new TextEncoder().encode(nonce)
+    new TextEncoder().encode(nonce2)
   );
   const signature = new Uint8Array(
     await crypto.subtle.sign({ name: "Ed25519" }, key, message)
@@ -5192,11 +5202,11 @@ var CloudClient = class {
    */
   async signInWithAccount(rootSecret) {
     const root = await accountRootFromSecret(rootSecret);
-    const { nonce } = await this.getAccountLoginChallenge();
+    const { nonce: nonce2 } = await this.getAccountLoginChallenge();
     return this.submitAccountLogin({
       rootPublicKey: root.publicKey,
-      nonce,
-      signature: await signAccountLogin({ rootSecret, nonce })
+      nonce: nonce2,
+      signature: await signAccountLogin({ rootSecret, nonce: nonce2 })
     });
   }
   /**
@@ -5615,12 +5625,12 @@ var CloudClient = class {
    */
   async linkAccount(rootSecret) {
     const root = await accountRootFromSecret(rootSecret);
-    const { nonce } = await this.getAccountLinkChallenge();
+    const { nonce: nonce2 } = await this.getAccountLinkChallenge();
     return this.submitAccountLink({
       accountId: root.accountId,
       rootPublicKey: root.publicKey,
-      nonce,
-      signature: await signAccountLink({ rootSecret, nonce })
+      nonce: nonce2,
+      signature: await signAccountLink({ rootSecret, nonce: nonce2 })
     });
   }
   /**
@@ -6305,7 +6315,7 @@ async function signWarrant(input) {
   const publicKey = await derivePublicKey(input.deviceSecret);
   const method = new TextEncoder().encode(input.method);
   const commitment = await intentHash(input.method, input.argsJson);
-  const nonce = u64le(input.nonce);
+  const nonce2 = u64le(input.nonce);
   const notAfter = u64le(input.notAfter);
   const preimage = await domainHash(SIGN_DOMAIN2, [
     context,
@@ -6319,7 +6329,7 @@ async function signWarrant(input) {
     ...accountHeads,
     u64le(governanceFloor.length),
     ...governanceFloor,
-    nonce,
+    nonce2,
     notAfter
   ]);
   const signature = new Uint8Array(
@@ -6339,7 +6349,7 @@ async function signWarrant(input) {
       ...accountHeads,
       u32le(governanceFloor.length),
       ...governanceFloor,
-      nonce,
+      nonce2,
       notAfter,
       signature
     )
@@ -6396,7 +6406,7 @@ var RelayClient = class {
    */
   async execute(contextId, method, argsJson = {}) {
     const executor = this.executorAccount ?? (await this.describe(contextId)).executorAccount;
-    const nonce = await this.config.nonces.next();
+    const nonce2 = await this.config.nonces.next();
     const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
     const warrant = await signWarrant({
       context: contextId,
@@ -6404,7 +6414,7 @@ var RelayClient = class {
       executor,
       method,
       argsJson,
-      nonce,
+      nonce: nonce2,
       notAfter: BigInt(Math.floor(Date.now() / 1e3)) + BigInt(ttl),
       deviceSecret: this.config.deviceSecret
     });
@@ -6594,14 +6604,10 @@ async function defaultNonceSource(deviceSecret) {
   }
 }
 
-// src/sealed/sealed.ts
-var SEALED_PATH = "/sealed/v1";
-var SEALED_CONTENT_TYPE = "application/vnd.calimero.sealed";
-var VERSION = 1;
-var NONCE_LEN = 12;
-var REQUEST_DOMAIN = "calimero/sealed-http/v1/request";
-var RESPONSE_DOMAIN = "calimero/sealed-http/v1/response";
-var TRANSPORT_BINDING_DOMAIN = "calimero.tee-attest.transport-key.v1";
+// src/sealed/noise.ts
+var PROTOCOL_NAME = "Noise_NK_25519_AESGCM_SHA256";
+var DH_LEN = 32;
+var TAG_LEN = 16;
 var PKCS8_X25519_PREFIX = new Uint8Array([
   48,
   46,
@@ -6620,12 +6626,147 @@ var PKCS8_X25519_PREFIX = new Uint8Array([
   4,
   32
 ]);
+var SymmetricState = class _SymmetricState {
+  constructor(h) {
+    this.k = null;
+    this.n = 0;
+    this.ck = h;
+    this.h = h;
+  }
+  static async initialize() {
+    const name = new TextEncoder().encode(PROTOCOL_NAME);
+    const h = new Uint8Array(32);
+    h.set(name);
+    return new _SymmetricState(h);
+  }
+  async mixHash(data) {
+    this.h = await sha256(concat(this.h, data));
+  }
+  async mixKey(inputKeyMaterial) {
+    const [ck, key] = await hkdf2(this.ck, inputKeyMaterial);
+    this.ck = ck;
+    this.k = await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["encrypt", "decrypt"]);
+    this.n = 0;
+  }
+  async encryptAndHash(plaintext) {
+    if (!this.k) throw new Error("Noise: no cipher key yet");
+    const ciphertext = new Uint8Array(
+      await crypto.subtle.encrypt(
+        { name: "AES-GCM", iv: noiseNonce(this.n), additionalData: this.h },
+        this.k,
+        plaintext
+      )
+    );
+    this.n += 1;
+    await this.mixHash(ciphertext);
+    return ciphertext;
+  }
+  async decryptAndHash(ciphertext) {
+    if (!this.k) throw new Error("Noise: no cipher key yet");
+    const plaintext = new Uint8Array(
+      await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: noiseNonce(this.n), additionalData: this.h },
+        this.k,
+        ciphertext
+      )
+    );
+    this.n += 1;
+    await this.mixHash(ciphertext);
+    return plaintext;
+  }
+  /** The initiator-to-responder key, then the responder-to-initiator key. */
+  split() {
+    return hkdf2(this.ck, new Uint8Array());
+  }
+};
+async function initiate(remoteStatic, prologue, fixedEphemeral) {
+  const state = await SymmetricState.initialize();
+  await state.mixHash(prologue);
+  await state.mixHash(remoteStatic);
+  const ephemeral = await x25519KeyPair(fixedEphemeral);
+  await state.mixHash(ephemeral.publicKey);
+  await state.mixKey(await dh(ephemeral.privateKey, remoteStatic));
+  const message1 = concat(ephemeral.publicKey, await state.encryptAndHash(new Uint8Array()));
+  return {
+    message1,
+    async finish(message2) {
+      if (message2.length < DH_LEN + TAG_LEN) throw new Error("Noise: message 2 is too short");
+      const remoteEphemeral = message2.slice(0, DH_LEN);
+      await state.mixHash(remoteEphemeral);
+      await state.mixKey(await dh(ephemeral.privateKey, remoteEphemeral));
+      const payload = await state.decryptAndHash(message2.slice(DH_LEN));
+      return { payload, split: await state.split() };
+    }
+  };
+}
+async function x25519KeyPair(secret) {
+  if (!secret) {
+    const pair = await crypto.subtle.generateKey({ name: "X25519" }, true, [
+      "deriveBits"
+    ]);
+    const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+    return { privateKey: pair.privateKey, publicKey };
+  }
+  const privateKey = await crypto.subtle.importKey(
+    "pkcs8",
+    concat(PKCS8_X25519_PREFIX, secret),
+    { name: "X25519" },
+    true,
+    ["deriveBits"]
+  );
+  const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+  return { privateKey, publicKey: base64UrlDecode(jwk.x) };
+}
+async function dh(privateKey, publicKey) {
+  const peer = await crypto.subtle.importKey("raw", publicKey, { name: "X25519" }, false, []);
+  return new Uint8Array(
+    await crypto.subtle.deriveBits({ name: "X25519", public: peer }, privateKey, 256)
+  );
+}
+function noiseNonce(n) {
+  const nonce2 = new Uint8Array(12);
+  new DataView(nonce2.buffer).setBigUint64(4, BigInt(n), false);
+  return nonce2;
+}
+async function sha256(data) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+}
+async function hmacSha256(key, data) {
+  const hmacKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", hmacKey, data));
+}
+async function hkdf2(chainingKey, inputKeyMaterial) {
+  const temp = await hmacSha256(chainingKey, inputKeyMaterial);
+  const first = await hmacSha256(temp, new Uint8Array([1]));
+  const second = await hmacSha256(temp, concat(first, new Uint8Array([2])));
+  return [first, second];
+}
+function base64UrlDecode(value) {
+  const base643 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base643 + "=".repeat((4 - base643.length % 4) % 4));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+
+// src/sealed/sealed.ts
+var HANDSHAKE_PATH = "/sealed/v2/handshake";
+var SEALED_PATH = "/sealed/v2";
+var SEALED_CONTENT_TYPE = "application/vnd.calimero.sealed";
+var VERSION = 2;
+var PROLOGUE = new TextEncoder().encode("calimero/sealed-http/v2");
+var SESSION_ID_LEN = 16;
+var HEADER_LEN = 1 + SESSION_ID_LEN + 8;
+var FRAME_HEAD = 0;
+var FRAME_DATA = 1;
+var FRAME_END = 2;
+var RENEW_BEFORE_MS = 6e4;
+var TRANSPORT_BINDING_DOMAIN = "calimero.tee-attest.transport-key.v1";
+var NULL_BODY_STATUSES = [101, 204, 205, 304];
 var utf8 = new TextEncoder();
 var StaleTransportKeyError = class extends Error {
   constructor() {
-    super(
-      "The node no longer holds the transport key this request was sealed to; attest again for the current one"
-    );
+    super("The node no longer holds the attested transport key; attest again for the current one");
     this.name = "StaleTransportKeyError";
   }
 };
@@ -6648,9 +6789,9 @@ async function fetchAttestedTransportKey(admin, verify, options = {}) {
   if (options.applicationId === void 0 !== (options.applicationHash === void 0)) {
     throw new Error("applicationId and applicationHash are given together or not at all");
   }
-  const nonce = hex(crypto.getRandomValues(new Uint8Array(32)));
+  const nonce2 = hex(crypto.getRandomValues(new Uint8Array(32)));
   const attested = await admin.teeAttest({
-    nonce,
+    nonce: nonce2,
     applicationId: options.applicationId,
     bindTransportKey: true
   });
@@ -6660,7 +6801,7 @@ async function fetchAttestedTransportKey(admin, verify, options = {}) {
   const transportKey = fromHex(attested.transportPublicKey, "transportPublicKey", 32);
   const inner = options.applicationHash ? fromHex(options.applicationHash, "applicationHash", 32) : new Uint8Array(32);
   const reportDataSuffix = hex(await transportKeyBinding(inner, transportKey));
-  if (!await verify({ quoteB64: attested.quoteB64, nonce, reportDataSuffix })) {
+  if (!await verify({ quoteB64: attested.quoteB64, nonce: nonce2, reportDataSuffix })) {
     throw new Error("The attestation did not verify, so its transport key is not trusted");
   }
   return transportKey;
@@ -6668,12 +6809,37 @@ async function fetchAttestedTransportKey(admin, verify, options = {}) {
 function createSealedFetch(options) {
   const base = new URL(options.baseUrl);
   const basePath = base.pathname.replace(/\/+$/, "");
-  const sealedUrl = `${base.origin}${basePath}${SEALED_PATH}`;
-  const transportKey = options.transportPublicKey;
-  if (transportKey.length !== 32) {
-    throw new Error("transportPublicKey must be 32 bytes");
-  }
+  const nodeUrl = `${base.origin}${basePath}`;
   const baseFetch = options.fetch ?? ((input, init) => fetch(input, init));
+  const attest = typeof options.transportPublicKey === "function" ? options.transportPublicKey : void 0;
+  let transportKey = attest ? Promise.resolve().then(attest) : Promise.resolve(options.transportPublicKey);
+  let session;
+  const openSession = async () => {
+    try {
+      return await handshake(baseFetch, nodeUrl, await checkedKey(transportKey));
+    } catch (error) {
+      if (!(error instanceof StaleTransportKeyError) || !attest) throw error;
+      transportKey = Promise.resolve().then(attest);
+      return handshake(baseFetch, nodeUrl, await checkedKey(transportKey));
+    }
+  };
+  const currentSession = async () => {
+    const pending = session ?? renew(void 0);
+    const open = await pending;
+    if (Date.now() < open.renewAt) return [open, pending];
+    const renewed = renew(pending);
+    return [await renewed, renewed];
+  };
+  const renew = (stale) => {
+    if (session === stale) {
+      const opening = openSession();
+      session = opening;
+      opening.catch(() => {
+        if (session === opening) session = void 0;
+      });
+    }
+    return session;
+  };
   return async (input, init) => {
     const request = new Request(input, init);
     const url = new URL(request.url);
@@ -6682,126 +6848,190 @@ function createSealedFetch(options) {
     }
     const headers = [];
     request.headers.forEach((value, name) => headers.push([name, value]));
-    const head = {
-      method: request.method,
-      path: url.pathname.slice(basePath.length) + url.search,
-      headers,
-      ts: Math.floor(Date.now() / 1e3)
-    };
+    const head = { method: request.method, path: url.pathname.slice(basePath.length) + url.search, headers };
     const body = new Uint8Array(await request.arrayBuffer());
-    const exchange = await sealRequest(transportKey, head, body);
-    const response = await baseFetch(sealedUrl, {
-      method: "POST",
-      headers: { "content-type": SEALED_CONTENT_TYPE },
-      body: exchange.envelope,
-      signal: request.signal
-    });
-    if (response.headers.get("content-type") !== SEALED_CONTENT_TYPE) {
-      throw await envelopeRefusal(response);
+    const send = async (open2) => {
+      const { requestId, header, envelope } = await sealRequest(open2, head, body);
+      const response = await baseFetch(`${nodeUrl}${SEALED_PATH}`, {
+        method: "POST",
+        headers: { "content-type": SEALED_CONTENT_TYPE },
+        body: envelope,
+        signal: request.signal
+      });
+      if (response.headers.get("content-type") !== SEALED_CONTENT_TYPE) {
+        throw await envelopeRefusal(response);
+      }
+      return openResponse(response, open2.responseKey, header, requestId);
+    };
+    const [open, pending] = await currentSession();
+    try {
+      return await send(open);
+    } catch (error) {
+      if (!(error instanceof SealedTransportError) || error.code !== "unknown_session") throw error;
+      return send(await renew(pending));
     }
-    const opened = await exchange.open(new Uint8Array(await response.arrayBuffer()));
-    const nullBody = [101, 204, 205, 304].includes(opened.head.status);
-    return new Response(nullBody ? null : opened.body, {
-      status: opened.head.status,
-      headers: opened.head.headers
-    });
   };
 }
-async function envelopeRefusal(response) {
-  let code;
-  let message = `Sealed request refused: HTTP ${response.status}`;
-  try {
-    const body = await response.json();
-    code = body?.error?.code;
-    if (body?.error?.message) message = `Sealed request refused: ${body.error.message}`;
-  } catch {
+async function checkedKey(key) {
+  const bytes = await key;
+  if (bytes.length !== 32) throw new Error("transportPublicKey must be 32 bytes");
+  return bytes;
+}
+async function handshake(baseFetch, nodeUrl, transportKey) {
+  const noise = await initiate(transportKey, PROLOGUE);
+  const response = await baseFetch(`${nodeUrl}${HANDSHAKE_PATH}`, {
+    method: "POST",
+    headers: { "content-type": SEALED_CONTENT_TYPE },
+    body: concat(new Uint8Array([VERSION]), transportKey, noise.message1)
+  });
+  if (response.headers.get("content-type") !== SEALED_CONTENT_TYPE) {
+    throw await envelopeRefusal(response);
   }
-  if (code === "stale_transport_key") return new StaleTransportKeyError();
-  return new SealedTransportError(response.status, code, message);
+  const reply = new Uint8Array(await response.arrayBuffer());
+  return sessionFrom(noise, reply);
 }
-async function sealRequest(transportKey, head, body, fixed) {
-  const { privateKey, publicKey } = await clientKeyPair(fixed?.clientSecret);
-  const transport = await crypto.subtle.importKey("raw", transportKey, { name: "X25519" }, false, []);
-  const shared = new Uint8Array(
-    await crypto.subtle.deriveBits({ name: "X25519", public: transport }, privateKey, 256)
-  );
-  if (shared.every((byte) => byte === 0)) {
-    throw new Error("The transport key is a low-order point");
-  }
-  const salt = concat(transportKey, publicKey);
-  const requestKey = await exchangeKey(shared, salt, REQUEST_DOMAIN, "encrypt");
-  const responseKey = await exchangeKey(shared, salt, RESPONSE_DOMAIN, "decrypt");
-  const nonce = fixed?.nonce ?? crypto.getRandomValues(new Uint8Array(NONCE_LEN));
-  const header = concat(new Uint8Array([VERSION]), transportKey, publicKey, nonce);
-  const ciphertext = await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv: nonce, additionalData: header },
-    requestKey,
-    joinInner(head, body)
-  );
-  const responseAad = concat(new Uint8Array([VERSION]), salt);
+async function sessionFrom(noise, reply) {
+  if (reply[0] !== VERSION) throw new Error("The handshake reply is malformed");
+  let finished;
+  try {
+    finished = await noise.finish(reply.slice(1));
+  } catch {
+    throw new Error("The handshake reply did not open: it did not come from the attested node");
+  }
+  const { payload, split } = finished;
+  if (payload.length !== SESSION_ID_LEN + 4) throw new Error("The handshake reply is malformed");
+  const sessionId = payload.slice(0, SESSION_ID_LEN);
+  const lifetimeSecs = new DataView(payload.buffer, payload.byteOffset).getUint32(SESSION_ID_LEN, false);
+  const [requestKey, responseKey] = await Promise.all([
+    crypto.subtle.importKey("raw", split[0], "AES-GCM", false, ["encrypt"]),
+    crypto.subtle.importKey("raw", split[1], "AES-GCM", false, ["decrypt"])
+  ]);
+  split[0].fill(0);
+  split[1].fill(0);
   return {
-    envelope: concat(header, new Uint8Array(ciphertext)),
-    async open(sealed) {
-      if (sealed.length < 1 + NONCE_LEN + 16 || sealed[0] !== VERSION) {
-        throw new Error("The sealed response is malformed");
-      }
-      let plaintext;
-      try {
-        plaintext = new Uint8Array(
-          await crypto.subtle.decrypt(
-            { name: "AES-GCM", iv: sealed.slice(1, 1 + NONCE_LEN), additionalData: responseAad },
-            responseKey,
-            sealed.slice(1 + NONCE_LEN)
-          )
-        );
-      } catch {
-        throw new Error("The sealed response did not open: it was not sealed by the attested node");
-      }
-      const view = new DataView(plaintext.buffer, plaintext.byteOffset, plaintext.byteLength);
-      const len = view.getUint32(0, false);
-      const head2 = JSON.parse(new TextDecoder().decode(plaintext.slice(4, 4 + len)));
-      return { head: head2, body: plaintext.slice(4 + len) };
+    requestKey,
+    responseKey,
+    nextRequestId: 1,
+    renewAt: Date.now() + lifetimeSecs * 1e3 - RENEW_BEFORE_MS,
+    header(requestId) {
+      const header = new Uint8Array(HEADER_LEN);
+      header[0] = VERSION;
+      header.set(sessionId, 1);
+      new DataView(header.buffer).setBigUint64(1 + SESSION_ID_LEN, BigInt(requestId), false);
+      return header;
     }
   };
 }
+async function sealRequest(session, head, body) {
+  const requestId = session.nextRequestId;
+  session.nextRequestId += 1;
+  const header = session.header(requestId);
+  const sealed = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: nonce(requestId, 0), additionalData: header },
+    session.requestKey,
+    joinInner(head, body)
+  );
+  return { requestId, header, envelope: concat(header, new Uint8Array(sealed)) };
+}
+function nonce(requestId, index) {
+  const bytes = new Uint8Array(12);
+  const view = new DataView(bytes.buffer);
+  view.setBigUint64(0, BigInt(requestId), false);
+  view.setUint32(8, index, false);
+  return bytes;
+}
 function joinInner(head, body) {
   const encoded = utf8.encode(JSON.stringify(head));
   const len = new Uint8Array(4);
   new DataView(len.buffer).setUint32(0, encoded.length, false);
   return concat(len, encoded, body);
 }
-async function exchangeKey(shared, salt, domain, usage) {
-  const ikm = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt, info: utf8.encode(domain) },
-    ikm,
-    { name: "AES-GCM", length: 256 },
-    false,
-    [usage]
-  );
+async function openResponse(response, responseKey, header, requestId) {
+  if (!response.body) throw new Error("The sealed response has no body");
+  const frames = frameReader(response.body.getReader());
+  let index = 0;
+  const next = async () => {
+    const sealed = await frames.next();
+    if (!sealed) return null;
+    let plain;
+    try {
+      plain = new Uint8Array(
+        await crypto.subtle.decrypt(
+          { name: "AES-GCM", iv: nonce(requestId, index), additionalData: header },
+          responseKey,
+          sealed
+        )
+      );
+    } catch {
+      throw new Error("A sealed response frame did not open: it was not sealed by the attested node");
+    }
+    index += 1;
+    return { kind: plain[0], data: plain.slice(1) };
+  };
+  const first = await next();
+  if (!first || first.kind !== FRAME_HEAD) throw new Error("The sealed response is malformed");
+  const head = JSON.parse(new TextDecoder().decode(first.data));
+  if (NULL_BODY_STATUSES.includes(head.status)) {
+    await frames.cancel();
+    return new Response(null, { status: head.status, headers: head.headers });
+  }
+  const body = new ReadableStream({
+    async pull(controller) {
+      try {
+        const frame = await next();
+        if (!frame) {
+          controller.error(new Error("The sealed response was cut short"));
+        } else if (frame.kind === FRAME_DATA) {
+          controller.enqueue(frame.data);
+        } else if (frame.kind === FRAME_END) {
+          controller.close();
+          await frames.cancel();
+        } else {
+          controller.error(new Error("The sealed response is malformed"));
+        }
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    cancel() {
+      return frames.cancel();
+    }
+  });
+  return new Response(body, { status: head.status, headers: head.headers });
 }
-async function clientKeyPair(secret) {
-  if (!secret) {
-    const pair = await crypto.subtle.generateKey({ name: "X25519" }, true, [
-      "deriveBits"
-    ]);
-    const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
-    return { privateKey: pair.privateKey, publicKey };
-  }
-  const privateKey = await crypto.subtle.importKey(
-    "pkcs8",
-    concat(PKCS8_X25519_PREFIX, secret),
-    { name: "X25519" },
-    true,
-    ["deriveBits"]
-  );
-  const jwk = await crypto.subtle.exportKey("jwk", privateKey);
-  return { privateKey, publicKey: base64UrlDecode(jwk.x) };
+function frameReader(reader) {
+  let buffer = new Uint8Array();
+  const fill = async (length) => {
+    while (buffer.length < length) {
+      const { done, value } = await reader.read();
+      if (done) return false;
+      buffer = concat(buffer, value);
+    }
+    return true;
+  };
+  return {
+    async next() {
+      if (!await fill(4)) return null;
+      const length = new DataView(buffer.buffer, buffer.byteOffset).getUint32(0, false);
+      if (!await fill(4 + length)) return null;
+      const frame = buffer.slice(4, 4 + length);
+      buffer = buffer.slice(4 + length);
+      return frame;
+    },
+    cancel: () => reader.cancel()
+  };
 }
-function base64UrlDecode(value) {
-  const base643 = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = atob(base643 + "=".repeat((4 - base643.length % 4) % 4));
-  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+async function envelopeRefusal(response) {
+  let code;
+  let message = `Sealed request refused: HTTP ${response.status}`;
+  try {
+    const body = await response.json();
+    code = body?.error?.code;
+    if (body?.error?.message) message = `Sealed request refused: ${body.error.message}`;
+  } catch {
+  }
+  if (code === "stale_transport_key") return new StaleTransportKeyError();
+  return new SealedTransportError(response.status, code, message);
 }
 
 // src/namespace-op/namespace-op.ts