@calimero-network/mero-js 22.1.0 → 22.3.0

package/dist/index.cjs

@@ -5379,6 +5379,15 @@ function base642(bytes) {
 
 // src/cloud/cloud-client.ts
 var DEFAULT_CLOUD_BASE_URL = "https://cloud.calimero.network";
+function canExecuteOf(row, legacy) {
+  return typeof row.can_execute === "boolean" ? row.can_execute : legacy;
+}
+function teeRoleOf(row) {
+  return typeof row.tee_role === "string" && row.tee_role !== "" ? row.tee_role : null;
+}
+function pickExecutingRelay(relays) {
+  return relays.find((r) => r.canExecute && r.relayUrl !== null && r.executorAccount !== null) ?? null;
+}
 var REFRESH_HEADER = "x-mdma-session-refresh";
 var REFRESH_EXPIRES_HEADER = "x-mdma-session-expires";
 var CloudClient = class {
@@ -5527,37 +5536,48 @@ var CloudClient = class {
    * The relays serving one namespace: where to present an intent, and as whom.
    *
    * Everything a client needs in order to mint a warrant it can actually
-   * spend. Filter on `authorshipReady` before signing — a warrant presented to
-   * a relay with no grant is refused *after* the author has burned a nonce from
-   * its monotonic sequence on it.
+   * spend. Filter on `canExecute` before signing — a warrant presented to a
+   * relay that does not relay (a `ReadOnlyTee` replica, or a node with no role
+   * and no grant) is refused *after* the author has burned a nonce from its
+   * monotonic sequence on it.
    */
   async getNamespaceRelays(namespaceId) {
     const body = await this.request(
       "GET",
       `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/relays`
     );
-    return (body.relays ?? []).map((row) => ({
-      peerId: String(row.peer_id ?? ""),
-      relayUrl: row.relay_url ?? null,
-      executorAccount: row.executor_account ?? null,
-      status: String(row.status ?? ""),
-      authorshipReady: row.authorship_ready === true,
-      lastSeenAt: row.last_seen_at ?? null,
-      confirmedAt: row.confirmed_at ?? null
-    }));
+    return (body.relays ?? []).map((row) => {
+      const relayUrl = row.relay_url ?? null;
+      const executorAccount = row.executor_account ?? null;
+      const authorshipReady = row.authorship_ready === true;
+      return {
+        peerId: String(row.peer_id ?? ""),
+        relayUrl,
+        executorAccount,
+        status: String(row.status ?? ""),
+        authorshipReady,
+        teeRole: teeRoleOf(row),
+        canExecute: canExecuteOf(
+          row,
+          authorshipReady && relayUrl !== null && executorAccount !== null
+        ),
+        lastSeenAt: row.last_seen_at ?? null,
+        confirmedAt: row.confirmed_at ?? null
+      };
+    });
   }
   /**
    * The first relay for `namespaceId` that can actually run an intent, or
    * `null`.
    *
-   * "Can actually run one" is three conditions, and a client that checks fewer
-   * gets a refusal it cannot explain: the cloud must know a URL, the relay must
-   * have reported the executor account a warrant has to name, and the grant
-   * must be in place.
+   * "Can actually run one" is several conditions, and a client that checks
+   * fewer gets a refusal it cannot explain: the cloud must know a URL, the
+   * relay must have reported the executor account a warrant has to name, and
+   * the node must relay — which the cloud folds into `canExecute`.
    */
   async findExecutingRelay(namespaceId) {
     const relays = await this.getNamespaceRelays(namespaceId);
-    return relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ?? null;
+    return pickExecutingRelay(relays);
   }
   /**
    * Where to reach a namespace without owning it: one read, both verbs.
@@ -5585,17 +5605,27 @@ var CloudClient = class {
     });
     return {
       namespaceId: String(body.namespace_id ?? namespaceId),
-      nodes: (body.admitters ?? []).map((row) => ({
-        peerId: String(row.peer_id ?? ""),
-        account: row.account ?? null,
-        relayUrl: row.relay_url ?? null,
-        admitUrl: row.admit_url ?? null,
-        status: String(row.status ?? ""),
-        fresh: row.fresh === true,
-        canAdmit: row.can_admit === true,
-        authorshipReady: row.authorship_ready === true,
-        canExecute: row.can_execute === true
-      })),
+      nodes: (body.admitters ?? []).map((row) => {
+        const account = row.account ?? null;
+        const relayUrl = row.relay_url ?? null;
+        const fresh = row.fresh === true;
+        const authorshipReady = row.authorship_ready === true;
+        return {
+          peerId: String(row.peer_id ?? ""),
+          account,
+          relayUrl,
+          admitUrl: row.admit_url ?? null,
+          status: String(row.status ?? ""),
+          fresh,
+          canAdmit: row.can_admit === true,
+          authorshipReady,
+          teeRole: teeRoleOf(row),
+          canExecute: canExecuteOf(
+            row,
+            authorshipReady && relayUrl !== null && account !== null && fresh
+          )
+        };
+      }),
       servable: body.servable === true,
       writable: body.writable === true
     };
@@ -5726,23 +5756,32 @@ var CloudClient = class {
       "GET",
       "/api/cloud/me/machines"
     );
-    return (body.machines ?? []).map((row) => ({
-      peerId: String(row.peer_id ?? ""),
-      relayUrl: row.relay_url ?? null,
-      executorAccount: row.executor_account ?? null,
-      canExecute: row.can_execute === true,
-      namespaces: (Array.isArray(row.namespaces) ? row.namespaces : []).map((n) => {
+    return (body.machines ?? []).map((row) => {
+      const relayUrl = row.relay_url ?? null;
+      const executorAccount = row.executor_account ?? null;
+      const namespaces = (Array.isArray(row.namespaces) ? row.namespaces : []).map((n) => {
         const ns = n;
         return {
           namespaceId: String(ns.namespace_id ?? ""),
           status: String(ns.status ?? ""),
           authorshipReady: ns.authorship_ready === true,
+          teeRole: teeRoleOf(ns),
           fresh: ns.fresh === true,
           confirmedAt: ns.confirmed_at ?? null,
           lastSeenAt: ns.last_seen_at ?? null
         };
-      })
-    }));
+      });
+      return {
+        peerId: String(row.peer_id ?? ""),
+        relayUrl,
+        executorAccount,
+        canExecute: canExecuteOf(
+          row,
+          relayUrl !== null && executorAccount !== null && namespaces.some((n) => n.authorshipReady)
+        ),
+        namespaces
+      };
+    });
   }
   /**
    * Claim a namespace under this account, proving ownership.
@@ -7282,12 +7321,12 @@ async function connectCloud(options) {
   const namespaces = await cloud.getMyNamespaces();
   const namespace = pickNamespace(namespaces, options.namespaceId);
   const relays = await cloud.getNamespaceRelays(namespace.namespaceId);
-  const relayInfo = relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ?? null;
+  const relayInfo = pickExecutingRelay(relays);
   if (!relayInfo) {
     throw new Error(explainNoRelay(namespace, relays));
   }
   const relay = new RelayClient({
-    // Checked by `findExecutingRelay`, which is the only thing that returns a
+    // Checked by `pickExecutingRelay`, which is the only thing that returns a
     // relay — narrowed here rather than re-validated, so the invariant lives in
     // one place.
     relayUrl: relayInfo.relayUrl,
@@ -7341,11 +7380,15 @@ function explainNoRelay(namespace, relays) {
   if (relays.length === 0) {
     return namespace.haStatus === "enabled" ? `namespace ${namespace.namespaceId} has HA enabled but no relay has been assigned to it yet \u2014 retry shortly` : `namespace ${namespace.namespaceId} has no relays: enable HA on it in the cloud to have an attested node assigned`;
   }
-  const waitingOnGrant = relays.filter((r) => !r.authorshipReady);
-  if (waitingOnGrant.length === relays.length) {
+  const replicas = relays.filter((r) => r.teeRole !== null && r.teeRole !== "RelayTee");
+  if (replicas.length === relays.length) {
+    return `every node on namespace ${namespace.namespaceId} is a read-only TEE replica (ReadOnlyTee), which never relays delegated writes: an admin of the namespace must set its TEE admission policy with mode: 'relay' \u2014 AdminClient.setTeeAdmissionPolicy(namespaceId, { ..., mode: 'relay' }) \u2014 so fleet nodes are admitted as RelayTee`;
+  }
+  const waitingOnGrant = relays.filter((r) => r.teeRole === null && !r.authorshipReady);
+  if (waitingOnGrant.length > 0 && waitingOnGrant.length + replicas.length === relays.length) {
     return `every relay on namespace ${namespace.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${waitingOnGrant.map((r) => r.executorAccount ?? r.peerId).join(", ") || "the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`;
   }
-  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none reported both a URL and an executor account yet \u2014 retry shortly`;
+  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none is ready to relay yet (a URL, an executor account and a recent heartbeat) \u2014 retry shortly`;
 }
 async function defaultNonceSource(deviceSecret) {
   const key = `mero-js:warrant-nonce:${hex(await derivePublicKey(deviceSecret))}`;
@@ -7922,8 +7965,24 @@ function nodeReleaseVersionFromImage(osImage) {
   return `${Number(match[1])}.${Number(match[2])}.${Number(match[3])}`;
 }
 async function fetchNodeReleaseVersion(baseUrl, options = {}) {
-  const url = `${baseUrl.replace(/\/+$/, "")}/admin-api/tee/info`;
-  const response = await (options.fetch ?? fetch)(url, { headers: { accept: "application/json" } });
+  const version = await readNodeReleaseVersion(baseUrl, options.fetch ?? fetch);
+  if (version === void 0) {
+    throw new Error(
+      `${infoUrl(baseUrl)} was refused unsealed: the node requires sealing and is too old to name its release before a session exists. Name the release it runs yourself (createSignedReleaseSealedFetch's \`releaseVersion\`), or upgrade the node`
+    );
+  }
+  return version;
+}
+function infoUrl(baseUrl) {
+  return `${baseUrl.replace(/\/+$/, "")}/admin-api/tee/info`;
+}
+async function readNodeReleaseVersion(baseUrl, givenFetch) {
+  const url = infoUrl(baseUrl);
+  const response = await givenFetch(url, { headers: { accept: "application/json" } });
+  if (response.status === 403) {
+    const code = await response.json().then((body) => body?.error?.code).catch(() => void 0);
+    if (code === "sealed_required") return void 0;
+  }
   if (!response.ok) throw new Error(`Fetching ${url} failed: HTTP ${response.status}`);
   let osImage;
   try {
@@ -7970,10 +8029,19 @@ function createSignedReleaseVerifier(options) {
   return Object.assign(verifier, { includeCollateral: true });
 }
 function createSignedReleaseSealedFetch(options) {
-  const { baseUrl, releaseSource, applicationId, applicationHash, fetch: givenFetch, ...verifierOptions } = options;
+  const {
+    baseUrl,
+    releaseSource,
+    releaseVersion: fallbackVersion,
+    applicationId,
+    applicationHash,
+    fetch: givenFetch,
+    ...verifierOptions
+  } = options;
+  if (fallbackVersion !== void 0) releaseVersion(fallbackVersion, "releaseVersion");
   const baseFetch = givenFetch ?? ((input, init) => fetch(input, init));
   const release = async () => {
-    const version = await fetchNodeReleaseVersion(baseUrl, { fetch: baseFetch });
+    const version = fallbackVersion === void 0 ? await fetchNodeReleaseVersion(baseUrl, { fetch: baseFetch }) : await readNodeReleaseVersion(baseUrl, baseFetch) ?? fallbackVersion;
     return typeof releaseSource === "function" ? releaseSource({ baseUrl, version, fetch: baseFetch }) : fetchNodeRelease(cloudNodeReleaseUrl(releaseSource ?? DEFAULT_RELEASE_MIRROR, version), { fetch: baseFetch });
   };
   return createAttestedSealedFetch({