@calimero-network/mero-js 22.0.0 → 22.2.0

package/dist/index.mjs

@@ -5256,6 +5256,15 @@ function base642(bytes) {
 
 // src/cloud/cloud-client.ts
 var DEFAULT_CLOUD_BASE_URL = "https://cloud.calimero.network";
+function canExecuteOf(row, legacy) {
+  return typeof row.can_execute === "boolean" ? row.can_execute : legacy;
+}
+function teeRoleOf(row) {
+  return typeof row.tee_role === "string" && row.tee_role !== "" ? row.tee_role : null;
+}
+function pickExecutingRelay(relays) {
+  return relays.find((r) => r.canExecute && r.relayUrl !== null && r.executorAccount !== null) ?? null;
+}
 var REFRESH_HEADER = "x-mdma-session-refresh";
 var REFRESH_EXPIRES_HEADER = "x-mdma-session-expires";
 var CloudClient = class {
@@ -5404,37 +5413,48 @@ var CloudClient = class {
    * The relays serving one namespace: where to present an intent, and as whom.
    *
    * Everything a client needs in order to mint a warrant it can actually
-   * spend. Filter on `authorshipReady` before signing — a warrant presented to
-   * a relay with no grant is refused *after* the author has burned a nonce from
-   * its monotonic sequence on it.
+   * spend. Filter on `canExecute` before signing — a warrant presented to a
+   * relay that does not relay (a `ReadOnlyTee` replica, or a node with no role
+   * and no grant) is refused *after* the author has burned a nonce from its
+   * monotonic sequence on it.
    */
   async getNamespaceRelays(namespaceId) {
     const body = await this.request(
       "GET",
       `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/relays`
     );
-    return (body.relays ?? []).map((row) => ({
-      peerId: String(row.peer_id ?? ""),
-      relayUrl: row.relay_url ?? null,
-      executorAccount: row.executor_account ?? null,
-      status: String(row.status ?? ""),
-      authorshipReady: row.authorship_ready === true,
-      lastSeenAt: row.last_seen_at ?? null,
-      confirmedAt: row.confirmed_at ?? null
-    }));
+    return (body.relays ?? []).map((row) => {
+      const relayUrl = row.relay_url ?? null;
+      const executorAccount = row.executor_account ?? null;
+      const authorshipReady = row.authorship_ready === true;
+      return {
+        peerId: String(row.peer_id ?? ""),
+        relayUrl,
+        executorAccount,
+        status: String(row.status ?? ""),
+        authorshipReady,
+        teeRole: teeRoleOf(row),
+        canExecute: canExecuteOf(
+          row,
+          authorshipReady && relayUrl !== null && executorAccount !== null
+        ),
+        lastSeenAt: row.last_seen_at ?? null,
+        confirmedAt: row.confirmed_at ?? null
+      };
+    });
   }
   /**
    * The first relay for `namespaceId` that can actually run an intent, or
    * `null`.
    *
-   * "Can actually run one" is three conditions, and a client that checks fewer
-   * gets a refusal it cannot explain: the cloud must know a URL, the relay must
-   * have reported the executor account a warrant has to name, and the grant
-   * must be in place.
+   * "Can actually run one" is several conditions, and a client that checks
+   * fewer gets a refusal it cannot explain: the cloud must know a URL, the
+   * relay must have reported the executor account a warrant has to name, and
+   * the node must relay — which the cloud folds into `canExecute`.
    */
   async findExecutingRelay(namespaceId) {
     const relays = await this.getNamespaceRelays(namespaceId);
-    return relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ?? null;
+    return pickExecutingRelay(relays);
   }
   /**
    * Where to reach a namespace without owning it: one read, both verbs.
@@ -5462,17 +5482,27 @@ var CloudClient = class {
     });
     return {
       namespaceId: String(body.namespace_id ?? namespaceId),
-      nodes: (body.admitters ?? []).map((row) => ({
-        peerId: String(row.peer_id ?? ""),
-        account: row.account ?? null,
-        relayUrl: row.relay_url ?? null,
-        admitUrl: row.admit_url ?? null,
-        status: String(row.status ?? ""),
-        fresh: row.fresh === true,
-        canAdmit: row.can_admit === true,
-        authorshipReady: row.authorship_ready === true,
-        canExecute: row.can_execute === true
-      })),
+      nodes: (body.admitters ?? []).map((row) => {
+        const account = row.account ?? null;
+        const relayUrl = row.relay_url ?? null;
+        const fresh = row.fresh === true;
+        const authorshipReady = row.authorship_ready === true;
+        return {
+          peerId: String(row.peer_id ?? ""),
+          account,
+          relayUrl,
+          admitUrl: row.admit_url ?? null,
+          status: String(row.status ?? ""),
+          fresh,
+          canAdmit: row.can_admit === true,
+          authorshipReady,
+          teeRole: teeRoleOf(row),
+          canExecute: canExecuteOf(
+            row,
+            authorshipReady && relayUrl !== null && account !== null && fresh
+          )
+        };
+      }),
       servable: body.servable === true,
       writable: body.writable === true
     };
@@ -5603,23 +5633,32 @@ var CloudClient = class {
       "GET",
       "/api/cloud/me/machines"
     );
-    return (body.machines ?? []).map((row) => ({
-      peerId: String(row.peer_id ?? ""),
-      relayUrl: row.relay_url ?? null,
-      executorAccount: row.executor_account ?? null,
-      canExecute: row.can_execute === true,
-      namespaces: (Array.isArray(row.namespaces) ? row.namespaces : []).map((n) => {
+    return (body.machines ?? []).map((row) => {
+      const relayUrl = row.relay_url ?? null;
+      const executorAccount = row.executor_account ?? null;
+      const namespaces = (Array.isArray(row.namespaces) ? row.namespaces : []).map((n) => {
         const ns = n;
         return {
           namespaceId: String(ns.namespace_id ?? ""),
           status: String(ns.status ?? ""),
           authorshipReady: ns.authorship_ready === true,
+          teeRole: teeRoleOf(ns),
           fresh: ns.fresh === true,
           confirmedAt: ns.confirmed_at ?? null,
           lastSeenAt: ns.last_seen_at ?? null
         };
-      })
-    }));
+      });
+      return {
+        peerId: String(row.peer_id ?? ""),
+        relayUrl,
+        executorAccount,
+        canExecute: canExecuteOf(
+          row,
+          relayUrl !== null && executorAccount !== null && namespaces.some((n) => n.authorshipReady)
+        ),
+        namespaces
+      };
+    });
   }
   /**
    * Claim a namespace under this account, proving ownership.
@@ -7159,12 +7198,12 @@ async function connectCloud(options) {
   const namespaces = await cloud.getMyNamespaces();
   const namespace = pickNamespace(namespaces, options.namespaceId);
   const relays = await cloud.getNamespaceRelays(namespace.namespaceId);
-  const relayInfo = relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ?? null;
+  const relayInfo = pickExecutingRelay(relays);
   if (!relayInfo) {
     throw new Error(explainNoRelay(namespace, relays));
   }
   const relay = new RelayClient({
-    // Checked by `findExecutingRelay`, which is the only thing that returns a
+    // Checked by `pickExecutingRelay`, which is the only thing that returns a
     // relay — narrowed here rather than re-validated, so the invariant lives in
     // one place.
     relayUrl: relayInfo.relayUrl,
@@ -7218,11 +7257,15 @@ function explainNoRelay(namespace, relays) {
   if (relays.length === 0) {
     return namespace.haStatus === "enabled" ? `namespace ${namespace.namespaceId} has HA enabled but no relay has been assigned to it yet \u2014 retry shortly` : `namespace ${namespace.namespaceId} has no relays: enable HA on it in the cloud to have an attested node assigned`;
   }
-  const waitingOnGrant = relays.filter((r) => !r.authorshipReady);
-  if (waitingOnGrant.length === relays.length) {
+  const replicas = relays.filter((r) => r.teeRole !== null && r.teeRole !== "RelayTee");
+  if (replicas.length === relays.length) {
+    return `every node on namespace ${namespace.namespaceId} is a read-only TEE replica (ReadOnlyTee), which never relays delegated writes: an admin of the namespace must set its TEE admission policy with mode: 'relay' \u2014 AdminClient.setTeeAdmissionPolicy(namespaceId, { ..., mode: 'relay' }) \u2014 so fleet nodes are admitted as RelayTee`;
+  }
+  const waitingOnGrant = relays.filter((r) => r.teeRole === null && !r.authorshipReady);
+  if (waitingOnGrant.length > 0 && waitingOnGrant.length + replicas.length === relays.length) {
     return `every relay on namespace ${namespace.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${waitingOnGrant.map((r) => r.executorAccount ?? r.peerId).join(", ") || "the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`;
   }
-  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none reported both a URL and an executor account yet \u2014 retry shortly`;
+  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none is ready to relay yet (a URL, an executor account and a recent heartbeat) \u2014 retry shortly`;
 }
 async function defaultNonceSource(deviceSecret) {
   const key = `mero-js:warrant-nonce:${hex(await derivePublicKey(deviceSecret))}`;
@@ -7894,7 +7937,7 @@ function splitVersion2(version) {
 }
 
 // src/namespace-op/namespace-op.ts
-var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 11;
+var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 12;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
 var NAMESPACE_OP_ROOT = 0;
 var ROOT_OP = {