@calimero-network/mero-js 19.26.0 → 19.27.0

package/dist/sealed/index.d.ts

@@ -1,4 +1,4 @@
-export { HANDSHAKE_PATH, SEALED_CONTENT_TYPE, SEALED_PATH, SealedTransportError, StaleTransportKeyError, createSealedFetch, fetchAttestedTransportKey, transportKeyBinding, } from './sealed.js';
-export type { SealedFetchOptions, VerifyTransportQuote } from './sealed.js';
+export { HANDSHAKE_PATH, SEALED_CONTENT_TYPE, SEALED_PATH, SealedTransportError, StaleTransportKeyError, createAttestedSealedFetch, createSealedFetch, fetchAttestedTransportKey, transportKeyBinding, } from './sealed.js';
+export type { AttestedSealedFetchOptions, SealedFetchOptions, VerifyTransportQuote } from './sealed.js';
 export { createQuoteVerifier } from './verify.js';
 export type { DcapCollateral, DcapVerifiedReport, DcapVerify, QuoteVerifier, QuoteVerifierOptions, } from './verify.js';

package/dist/sealed/index.js

@@ -1,2 +1,2 @@
-export { HANDSHAKE_PATH, SEALED_CONTENT_TYPE, SEALED_PATH, SealedTransportError, StaleTransportKeyError, createSealedFetch, fetchAttestedTransportKey, transportKeyBinding, } from './sealed.js';
+export { HANDSHAKE_PATH, SEALED_CONTENT_TYPE, SEALED_PATH, SealedTransportError, StaleTransportKeyError, createAttestedSealedFetch, createSealedFetch, fetchAttestedTransportKey, transportKeyBinding, } from './sealed.js';
 export { createQuoteVerifier } from './verify.js';

package/dist/sealed/sealed.d.ts

@@ -103,6 +103,38 @@ export declare function fetchAttestedTransportKey(admin: {
     applicationId?: string;
     applicationHash?: string;
 }): Promise<Uint8Array>;
+export interface AttestedSealedFetchOptions {
+    /** The node's base URL. */
+    baseUrl: string;
+    /**
+     * Decides whether the node's quote is one you trust — typically
+     * {@link createQuoteVerifier}. Asked again whenever the node restarts.
+     */
+    verify: VerifyTransportQuote;
+    /** Also require the node to run this application with this bytecode hash. */
+    applicationId?: string;
+    applicationHash?: string;
+    /** Fetch that carries the attestation and the envelopes. Defaults to global `fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * {@link createSealedFetch} for a node you know only by URL: it attests the
+ * node's transport key with `verify`, over `POST /admin-api/tee/attest` (the
+ * one call that needs no credential and is never sealed), and seals everything
+ * else to it. A restarted node is attested again, through the same verifier.
+ *
+ * This is what to hand a {@link RelayClient} for a TEE relay, so the warrant
+ * and the method's arguments reach only the attested TD:
+ *
+ * ```ts
+ * const relay = new RelayClient({
+ *   relayUrl,
+ *   fetch: createAttestedSealedFetch({ baseUrl: relayUrl, verify: createQuoteVerifier(...) }),
+ *   ...
+ * });
+ * ```
+ */
+export declare function createAttestedSealedFetch(options: AttestedSealedFetchOptions): typeof fetch;
 export interface SealedFetchOptions {
     /** The node's base URL, as given to `MeroJsConfig.baseUrl`. */
     baseUrl: string;

package/dist/sealed/sealed.js

@@ -130,6 +130,51 @@ export async function fetchAttestedTransportKey(admin, verify, options = {}) {
     }
     return transportKey;
 }
+/**
+ * {@link createSealedFetch} for a node you know only by URL: it attests the
+ * node's transport key with `verify`, over `POST /admin-api/tee/attest` (the
+ * one call that needs no credential and is never sealed), and seals everything
+ * else to it. A restarted node is attested again, through the same verifier.
+ *
+ * This is what to hand a {@link RelayClient} for a TEE relay, so the warrant
+ * and the method's arguments reach only the attested TD:
+ *
+ * ```ts
+ * const relay = new RelayClient({
+ *   relayUrl,
+ *   fetch: createAttestedSealedFetch({ baseUrl: relayUrl, verify: createQuoteVerifier(...) }),
+ *   ...
+ * });
+ * ```
+ */
+export function createAttestedSealedFetch(options) {
+    const baseFetch = options.fetch ?? ((input, init) => fetch(input, init));
+    const attestUrl = `${options.baseUrl.replace(/\/+$/, '')}/admin-api/tee/attest`;
+    const admin = {
+        async teeAttest(request) {
+            const response = await baseFetch(attestUrl, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(request),
+            });
+            if (!response.ok) {
+                throw new Error(`The node refused to attest: HTTP ${response.status}`);
+            }
+            const body = (await response.json());
+            if (!body.data)
+                throw new Error('The attestation response is malformed');
+            return body.data;
+        },
+    };
+    return createSealedFetch({
+        baseUrl: options.baseUrl,
+        transportPublicKey: () => fetchAttestedTransportKey(admin, options.verify, {
+            applicationId: options.applicationId,
+            applicationHash: options.applicationHash,
+        }),
+        fetch: baseFetch,
+    });
+}
 /**
  * A `fetch` that seals every request to the node's attested transport key.
  * Pass it as `MeroJsConfig.fetch`.
@@ -146,6 +191,10 @@ export function createSealedFetch(options) {
     let transportKey = attest
         ? Promise.resolve().then(attest)
         : Promise.resolve(options.transportPublicKey);
+    // Attesting starts now, before any request awaits it. A node that fails to
+    // attest must surface on the request that needed the key, not earlier as an
+    // unhandled rejection; the failure is still thrown to every awaiter.
+    transportKey.catch(() => undefined);
     let session;
     const openSession = async () => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "19.26.0",
+  "version": "19.27.0",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {