@calimero-network/mero-js 19.26.0 → 19.27.1

package/dist/index.cjs

@@ -54,6 +54,7 @@ __export(index_exports, {
   connectCloud: () => connectCloud,
   createAdminApiClient: () => createAdminApiClient,
   createAdminApiClientFromHttpClient: () => createAdminApiClientFromHttpClient,
+  createAttestedSealedFetch: () => createAttestedSealedFetch,
   createAuthApiClient: () => createAuthApiClient,
   createAuthApiClientFromHttpClient: () => createAuthApiClientFromHttpClient,
   createBrowserAdminApiClient: () => createBrowserAdminApiClient,
@@ -6574,92 +6575,6 @@ function createLocalStorageNonceSource(key, storage) {
   };
 }
 
-// src/cloud/connect.ts
-async function connectCloud(options) {
-  if (!options.sessionToken && !options.googleIdToken) {
-    throw new Error("connectCloud needs either a sessionToken or a googleIdToken");
-  }
-  const cloud = new CloudClient({
-    cloudBaseUrl: options.cloudBaseUrl,
-    sessionToken: options.sessionToken,
-    onSession: options.onSession,
-    fetch: options.fetch,
-    timeoutMs: options.timeoutMs
-  });
-  if (!options.sessionToken && options.googleIdToken) {
-    await cloud.signInWithGoogle(options.googleIdToken);
-  }
-  const namespaces = await cloud.getMyNamespaces();
-  const namespace = pickNamespace(namespaces, options.namespaceId);
-  const relays = await cloud.getNamespaceRelays(namespace.namespaceId);
-  const relayInfo = relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ?? null;
-  if (!relayInfo) {
-    throw new Error(explainNoRelay(namespace, relays));
-  }
-  const relay = new RelayClient({
-    // Checked by `findExecutingRelay`, which is the only thing that returns a
-    // relay — narrowed here rather than re-validated, so the invariant lives in
-    // one place.
-    relayUrl: relayInfo.relayUrl,
-    executorAccount: relayInfo.executorAccount,
-    authorAccount: options.authorAccount,
-    authorProof: options.authorProof,
-    deviceSecret: options.deviceSecret,
-    nonces: options.nonces ?? await defaultNonceSource(options.deviceSecret),
-    ttlSeconds: options.ttlSeconds,
-    fetch: options.fetch,
-    timeoutMs: options.timeoutMs
-  });
-  return {
-    cloud,
-    relay,
-    namespaceId: namespace.namespaceId,
-    namespace,
-    relayInfo,
-    execute: (contextId, method, argsJson) => relay.execute(contextId, method, argsJson)
-  };
-}
-function pickNamespace(namespaces, requested) {
-  if (requested) {
-    const found = namespaces.find((n) => n.namespaceId === requested);
-    if (!found) {
-      throw new Error(
-        `this account owns no namespace ${requested}; it owns: ${namespaces.map((n) => n.namespaceId).join(", ") || "(none)"}`
-      );
-    }
-    return found;
-  }
-  if (namespaces.length === 0) {
-    throw new Error(
-      "this account owns no namespaces in the cloud: claim one first, then enable HA on it so a relay is assigned"
-    );
-  }
-  if (namespaces.length > 1) {
-    throw new Error(
-      `this account owns ${namespaces.length} namespaces \u2014 pass namespaceId to say which: ${namespaces.map((n) => n.namespaceId).join(", ")}`
-    );
-  }
-  return namespaces[0];
-}
-function explainNoRelay(namespace, relays) {
-  if (relays.length === 0) {
-    return namespace.haStatus === "enabled" ? `namespace ${namespace.namespaceId} has HA enabled but no relay has been assigned to it yet \u2014 retry shortly` : `namespace ${namespace.namespaceId} has no relays: enable HA on it in the cloud to have an attested node assigned`;
-  }
-  const waitingOnGrant = relays.filter((r) => !r.authorshipReady);
-  if (waitingOnGrant.length === relays.length) {
-    return `every relay on namespace ${namespace.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${waitingOnGrant.map((r) => r.executorAccount ?? r.peerId).join(", ") || "the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`;
-  }
-  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none reported both a URL and an executor account yet \u2014 retry shortly`;
-}
-async function defaultNonceSource(deviceSecret) {
-  const key = `mero-js:warrant-nonce:${hex(await derivePublicKey(deviceSecret))}`;
-  try {
-    return createLocalStorageNonceSource(key);
-  } catch {
-    return createMemoryNonceSource(1);
-  }
-}
-
 // src/sealed/noise.ts
 var PROTOCOL_NAME = "Noise_NK_25519_AESGCM_SHA256";
 var DH_LEN = 32;
@@ -6879,6 +6794,33 @@ async function fetchAttestedTransportKey(admin, verify, options = {}) {
   }
   return transportKey;
 }
+function createAttestedSealedFetch(options) {
+  const baseFetch = options.fetch ?? ((input, init) => fetch(input, init));
+  const attestUrl = `${options.baseUrl.replace(/\/+$/, "")}/admin-api/tee/attest`;
+  const admin = {
+    async teeAttest(request) {
+      const response = await baseFetch(attestUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(request)
+      });
+      if (!response.ok) {
+        throw new Error(`The node refused to attest: HTTP ${response.status}`);
+      }
+      const body = await response.json();
+      if (!body.data) throw new Error("The attestation response is malformed");
+      return body.data;
+    }
+  };
+  return createSealedFetch({
+    baseUrl: options.baseUrl,
+    transportPublicKey: () => fetchAttestedTransportKey(admin, options.verify, {
+      applicationId: options.applicationId,
+      applicationHash: options.applicationHash
+    }),
+    fetch: baseFetch
+  });
+}
 function createSealedFetch(options) {
   const base = new URL(options.baseUrl);
   const basePath = base.pathname.replace(/\/+$/, "");
@@ -6886,6 +6828,7 @@ function createSealedFetch(options) {
   const baseFetch = options.fetch ?? ((input, init) => fetch(input, init));
   const attest = typeof options.transportPublicKey === "function" ? options.transportPublicKey : void 0;
   let transportKey = attest ? Promise.resolve().then(attest) : Promise.resolve(options.transportPublicKey);
+  transportKey.catch(() => void 0);
   let session;
   const openSession = async () => {
     try {
@@ -7136,6 +7079,98 @@ async function envelopeRefusal(response) {
   return new SealedTransportError(response.status, code, message, retryAfterMs);
 }
 
+// src/cloud/connect.ts
+async function connectCloud(options) {
+  if (!options.sessionToken && !options.googleIdToken) {
+    throw new Error("connectCloud needs either a sessionToken or a googleIdToken");
+  }
+  const cloud = new CloudClient({
+    cloudBaseUrl: options.cloudBaseUrl,
+    sessionToken: options.sessionToken,
+    onSession: options.onSession,
+    fetch: options.fetch,
+    timeoutMs: options.timeoutMs
+  });
+  if (!options.sessionToken && options.googleIdToken) {
+    await cloud.signInWithGoogle(options.googleIdToken);
+  }
+  const namespaces = await cloud.getMyNamespaces();
+  const namespace = pickNamespace(namespaces, options.namespaceId);
+  const relays = await cloud.getNamespaceRelays(namespace.namespaceId);
+  const relayInfo = relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ?? null;
+  if (!relayInfo) {
+    throw new Error(explainNoRelay(namespace, relays));
+  }
+  const relay = new RelayClient({
+    // Checked by `findExecutingRelay`, which is the only thing that returns a
+    // relay — narrowed here rather than re-validated, so the invariant lives in
+    // one place.
+    relayUrl: relayInfo.relayUrl,
+    executorAccount: relayInfo.executorAccount,
+    authorAccount: options.authorAccount,
+    authorProof: options.authorProof,
+    deviceSecret: options.deviceSecret,
+    nonces: options.nonces ?? await defaultNonceSource(options.deviceSecret),
+    ttlSeconds: options.ttlSeconds,
+    // Only the relay is sealed: a sealed fetch is bound to one node and refuses
+    // any other URL, and the cloud calls above carry no intent.
+    fetch: options.seal ? createAttestedSealedFetch({
+      baseUrl: relayInfo.relayUrl,
+      verify: options.seal,
+      fetch: options.fetch
+    }) : options.fetch,
+    timeoutMs: options.timeoutMs
+  });
+  return {
+    cloud,
+    relay,
+    namespaceId: namespace.namespaceId,
+    namespace,
+    relayInfo,
+    execute: (contextId, method, argsJson) => relay.execute(contextId, method, argsJson)
+  };
+}
+function pickNamespace(namespaces, requested) {
+  if (requested) {
+    const found = namespaces.find((n) => n.namespaceId === requested);
+    if (!found) {
+      throw new Error(
+        `this account owns no namespace ${requested}; it owns: ${namespaces.map((n) => n.namespaceId).join(", ") || "(none)"}`
+      );
+    }
+    return found;
+  }
+  if (namespaces.length === 0) {
+    throw new Error(
+      "this account owns no namespaces in the cloud: claim one first, then enable HA on it so a relay is assigned"
+    );
+  }
+  if (namespaces.length > 1) {
+    throw new Error(
+      `this account owns ${namespaces.length} namespaces \u2014 pass namespaceId to say which: ${namespaces.map((n) => n.namespaceId).join(", ")}`
+    );
+  }
+  return namespaces[0];
+}
+function explainNoRelay(namespace, relays) {
+  if (relays.length === 0) {
+    return namespace.haStatus === "enabled" ? `namespace ${namespace.namespaceId} has HA enabled but no relay has been assigned to it yet \u2014 retry shortly` : `namespace ${namespace.namespaceId} has no relays: enable HA on it in the cloud to have an attested node assigned`;
+  }
+  const waitingOnGrant = relays.filter((r) => !r.authorshipReady);
+  if (waitingOnGrant.length === relays.length) {
+    return `every relay on namespace ${namespace.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${waitingOnGrant.map((r) => r.executorAccount ?? r.peerId).join(", ") || "the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`;
+  }
+  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none reported both a URL and an executor account yet \u2014 retry shortly`;
+}
+async function defaultNonceSource(deviceSecret) {
+  const key = `mero-js:warrant-nonce:${hex(await derivePublicKey(deviceSecret))}`;
+  try {
+    return createLocalStorageNonceSource(key);
+  } catch {
+    return createMemoryNonceSource(1);
+  }
+}
+
 // src/sealed/verify.ts
 var MEASUREMENT_HEX = /^[0-9a-f]{96}$/;
 function createQuoteVerifier(options) {
@@ -7406,17 +7441,14 @@ function audienceLabel(audience) {
 }
 async function login(config) {
   const baseUrl = config.nodeUrl.replace(/\/+$/, "");
-  const doFetch = config.fetch ?? globalThis.fetch;
   const timeoutMs = config.timeoutMs ?? 1e4;
   const request = async (path, init) => {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     let response;
     try {
-      response = await doFetch(`${baseUrl}${path}`, {
-        ...init,
-        signal: controller.signal
-      });
+      const requestInit = { ...init, signal: controller.signal };
+      response = config.fetch ? await config.fetch(`${baseUrl}${path}`, requestInit) : await globalThis.fetch(`${baseUrl}${path}`, requestInit);
     } catch (err) {
       throw new HTTPError(
         0,