@calimero-network/mero-js 22.7.0 → 22.9.0

package/dist/index.d.ts

@@ -11,6 +11,8 @@ export type { TokenStore } from "./token-store/index.js";
 export { RpcClient, RpcError } from "./rpc/index.js";
 export type { MigrateMyEntriesSummary } from "./rpc/index.js";
 export type { ExecuteParams } from "./rpc/index.js";
+export { MeroClient, createMeroClient, RelayTransport, RelayObserver, defaultAudience, } from './transport/index.js';
+export type { MeroClientConfig, NodeTransportConfig, RelayTransportConfig, RelayObserveConfig, ExecuteTransport, ExecuteResult, TransportKind, } from './transport/index.js';
 export { SseClient, WsClient } from "./events/index.js";
 export type { SseEventData, WsEventData, AppVersionChangedEvent, GroupMembershipEventData, GroupMigrationEventData, MigrationStartedData, MigrationProgressData, CascadeProgressData, MigrationCompletedData, } from "./events/index.js";
 export { EphemeralClient, jsonCodec } from "./ephemeral/index.js";
@@ -18,13 +20,18 @@ export type { Codec, EphemeralEntry } from "./ephemeral/index.js";
 export * from "./cloud/index.js";
 export * from "./sealed/index.js";
 export * from "./relay/index.js";
+export * from "./request-proof/index.js";
 export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 export type { Signer } from "./signer/index.js";
-export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, signAccountLink, signAccountLogin, } from "./account/index.js";
-export type { AccountRoot, RecoverableAccountRoot, AccountLinkInput, AccountLoginInput, } from "./account/index.js";
-export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, } from "./device-cert/index.js";
-export type { DeviceCertInput } from "./device-cert/index.js";
+export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, resolveRoot, resolveRootPair, } from "./account/index.js";
+export type { AccountRoot, RecoverableAccountRoot, AccountRootSigner, NewAccountRootSigner, AccountLinkInput, AccountLoginInput, RootSource, ResolvedRoot, } from "./account/index.js";
+export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
+export type { DeviceCertInput, DeviceCredential } from "./device-cert/index.js";
+export { signDeviceScope, deviceScopePayload } from "./device-cert/index.js";
+export type { DeviceScopeInput } from "./device-cert/index.js";
+export { signGroupInvitation, encodeGroupInvitation, groupInvitationHash, defaultAdmitters, MAX_INVITATION_VALIDITY_SECS, INVITED_ROLE, } from "./invitation/index.js";
+export type { GroupInvitationInput } from "./invitation/index.js";
 export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from "./namespace-op/index.js";
 export type { SignMemberJoinInput } from "./namespace-op/index.js";
 export type { WarrantInput, CreationWarrantInput, CreationWarrantFields, SignedCreationWarrant, GovernanceWarrantInput, GovernanceWarrantFields, GovernanceOp, GovernanceOpKind, GovernanceMemberRole, GroupCreatedInput, NamespaceCreatedInput, } from "./warrant/index.js";
@@ -38,3 +45,5 @@ export type { LoginConfig, DelegatedSession, SessionKeyPair, } from "./login/ind
 export * from "./capabilities.js";
 export { DEFAULT_LOCAL_NODE_PORTS, localNodeUrl, nodeEndpoint, probeNodeHealth, discoverLocalNodes, } from "./nodeDiscovery.js";
 export type { DiscoverLocalNodesOptions } from "./nodeDiscovery.js";
+export { attestRelayNodeKey, attestKeyBinding, reportDataOf } from "./relay-attestation/index.js";
+export type { AttestedNodeKey, AttestRelayNodeKeyOptions } from "./relay-attestation/index.js";

package/dist/index.js

@@ -16,6 +16,11 @@ export { parseAuthCallback, buildAuthLoginUrl } from "./auth/index.js";
 export { MemoryTokenStore, LocalStorageTokenStore, } from "./token-store/index.js";
 // RPC client
 export { RpcClient, RpcError } from "./rpc/index.js";
+// Transport — one client, two write paths, chosen at construction (node by default)
+export { MeroClient, createMeroClient, RelayTransport, 
+// A relay is a node: given its signing key, a relay-transport client
+// subscribes over the same `/sse` and `/ws` a node client uses.
+RelayObserver, defaultAudience, } from './transport/index.js';
 // Events (SSE / WebSocket)
 export { SseClient, WsClient } from "./events/index.js";
 // Ephemeral presence (cursors / typing / online)
@@ -26,14 +31,26 @@ export * from "./cloud/index.js";
 export * from "./sealed/index.js";
 // Relay client — write through delegated execution, holding only a signing key
 export * from "./relay/index.js";
+// Request proofs — a caller's identity on the request itself, no session needed
+export * from "./request-proof/index.js";
 // Warrant signing — mint the author's consent for a relay to run one intent
 export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 // Who signs — a key's capability, separated from its material, so a
 // non-extractable key can be used wherever a hex secret could.
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 // Account roots — mint one with a recovery phrase, or prove you hold one
-export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, signAccountLink, signAccountLogin, } from "./account/index.js";
-export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, } from "./device-cert/index.js";
+export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, 
+// The two forms a root may be held in, and what resolves either. Exported
+// because `RootSource` is already the parameter type of every cloud entry
+// point that takes a root — a consumer writing a wrapper around one could
+// name it in a signature only by re-declaring it.
+resolveRoot, resolveRootPair, } from "./account/index.js";
+export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
+// A device's scope — signed by the root beside its certificate, and what a relay
+// needs with it to bind the device of an account that has no node.
+export { signDeviceScope, deviceScopePayload } from "./device-cert/index.js";
+// Invitations minted off-node, signed by a bound device key.
+export { signGroupInvitation, encodeGroupInvitation, groupInvitationHash, defaultAdmitters, MAX_INVITATION_VALIDITY_SECS, INVITED_ROLE, } from "./invitation/index.js";
 export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from "./namespace-op/index.js";
 // Login-statement signing — the device's half of a password-free session
 export { requestBodyHash, signRequest, callerProof, createProofSigner, } from "./request/index.js";
@@ -43,3 +60,5 @@ export { login, generateSessionKey } from "./login/index.js";
 export * from "./capabilities.js";
 // Utilities
 export { DEFAULT_LOCAL_NODE_PORTS, localNodeUrl, nodeEndpoint, probeNodeHealth, discoverLocalNodes, } from "./nodeDiscovery.js";
+// A relay's node key, learned from its TEE attestation rather than pasted in.
+export { attestRelayNodeKey, attestKeyBinding, reportDataOf } from "./relay-attestation/index.js";