@calimero-network/mero-js 19.3.0 → 19.5.0

package/dist/index.d.ts

@@ -24,6 +24,8 @@ export type { SignMemberJoinInput } from './namespace-op/index.js';
 export type { WarrantInput } from './warrant/index.js';
 export { signLoginStatement } from './login/index.js';
 export type { Audience, LoginStatementInput } from './login/index.js';
+export { login, generateSessionKey } from './login/index.js';
+export type { LoginConfig, DelegatedSession, SessionKeyPair, } from './login/index.js';
 export * from './capabilities.js';
 export { DEFAULT_LOCAL_NODE_PORTS, localNodeUrl, nodeEndpoint, probeNodeHealth, discoverLocalNodes, } from './nodeDiscovery.js';
 export type { DiscoverLocalNodesOptions } from './nodeDiscovery.js';

package/dist/index.js

@@ -28,6 +28,7 @@ export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, } from
 export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from './namespace-op/index.js';
 // Login-statement signing — the device's half of a password-free session
 export { signLoginStatement } from './login/index.js';
+export { login, generateSessionKey } from './login/index.js';
 // Member capability bitmask constants & helpers
 export * from './capabilities.js';
 // Utilities

package/dist/index.mjs

@@ -1057,6 +1057,33 @@ var AdminApiClient = class {
   async listApplicationAliases() {
     return unwrap(await this.httpClient.get("/admin-api/alias/list/application"));
   }
+  async createDeviceAlias(request) {
+    return unwrap(
+      await this.httpClient.post(
+        "/admin-api/alias/create/device",
+        { alias: request.alias, deviceId: request.deviceId }
+      )
+    );
+  }
+  async lookupDeviceAlias(name) {
+    return unwrap(
+      await this.httpClient.post(
+        `/admin-api/alias/lookup/device/${encodeURIComponent(name)}`,
+        {}
+      )
+    );
+  }
+  async deleteDeviceAlias(name) {
+    return unwrap(
+      await this.httpClient.post(
+        `/admin-api/alias/delete/device/${encodeURIComponent(name)}`,
+        {}
+      )
+    );
+  }
+  async listDeviceAliases() {
+    return unwrap(await this.httpClient.get("/admin-api/alias/list/device"));
+  }
   // ---- Namespace Management ----
   async listNamespaces() {
     return unwrap(await this.httpClient.get("/admin-api/namespaces"));
@@ -3674,6 +3701,105 @@ async function signLoginStatement(input) {
   );
 }
 
+// src/login/session.ts
+var DEFAULT_TTL_SECONDS2 = 300;
+async function generateSessionKey() {
+  const secret = hex(crypto.getRandomValues(new Uint8Array(32)));
+  return { publicKey: hex(await derivePublicKey(secret)), secret };
+}
+function audienceLabel(audience) {
+  switch (audience.kind) {
+    case "webOrigin":
+      return audience.origin;
+    case "codeSigningId":
+      return audience.id;
+    case "cli":
+      return "cli";
+  }
+}
+async function login(config) {
+  const baseUrl = config.nodeUrl.replace(/\/+$/, "");
+  const doFetch = config.fetch ?? globalThis.fetch;
+  const timeoutMs = config.timeoutMs ?? 1e4;
+  const request = async (path, init) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      response = await doFetch(`${baseUrl}${path}`, {
+        ...init,
+        signal: controller.signal
+      });
+    } catch (err) {
+      throw new HTTPError(
+        0,
+        err instanceof Error ? err.name : "NetworkError",
+        `${baseUrl}${path}`,
+        new Headers(),
+        err instanceof Error ? err.message : String(err)
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    const text = await response.text().catch(() => "");
+    if (!response.ok) {
+      throw new HTTPError(
+        response.status,
+        response.statusText,
+        `${baseUrl}${path}`,
+        response.headers,
+        text
+      );
+    }
+    return text ? JSON.parse(text) : {};
+  };
+  const challengeBody = await request("/auth/challenge", {
+    method: "GET",
+    headers: { Accept: "application/json" }
+  });
+  const challenge = challengeBody.challenge ?? challengeBody.data?.challenge;
+  if (!challenge) {
+    throw new Error("the node issued no challenge");
+  }
+  const session = await generateSessionKey();
+  const issuedAt = Math.floor(Date.now() / 1e3);
+  const statement = await signLoginStatement({
+    node: config.node,
+    audience: config.audience,
+    challenge,
+    sessionKey: session.publicKey,
+    issuedAt,
+    expiresAt: issuedAt + (config.ttlSeconds ?? DEFAULT_TTL_SECONDS2),
+    deviceSecret: config.deviceSecret
+  });
+  const tokenBody = await request("/auth/token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      auth_method: "account_proof",
+      public_key: session.publicKey,
+      client_name: config.clientName ?? audienceLabel(config.audience),
+      timestamp: issuedAt,
+      provider_data: {
+        challenge,
+        login_statement: statement,
+        account_proof: config.accountProof
+      }
+    })
+  });
+  const accessToken = tokenBody.access_token ?? tokenBody.data?.access_token;
+  const refreshToken = tokenBody.refresh_token ?? tokenBody.data?.refresh_token;
+  if (!accessToken) {
+    throw new Error("the node minted no session");
+  }
+  return {
+    accessToken,
+    refreshToken: refreshToken ?? "",
+    sessionKey: session.publicKey,
+    sessionSecret: session.secret
+  };
+}
+
 // src/capabilities.ts
 var CAPABILITIES = {
   CAN_CREATE_CONTEXT: 1 << 0,
@@ -3806,10 +3932,12 @@ export {
   deviceCertPayload,
   discoverLocalNodes,
   encodeSignedInvitation,
+  generateSessionKey,
   hasCap,
   intentHash,
   jsonCodec,
   localNodeUrl,
+  login,
   mintDeviceId,
   nodeEndpoint,
   parseAuthCallback,