@calimero-network/mero-js 22.9.0 → 23.0.0

package/dist/index.cjs

@@ -38,6 +38,7 @@ __export(index_exports, {
   MeroClient: () => MeroClient,
   MeroJs: () => MeroJs,
   NODE_RELEASE_SIGNER: () => NODE_RELEASE_SIGNER,
+  OWNER_OP_KIND: () => OWNER_OP_KIND,
   REQUEST_PROOF_HEADER: () => REQUEST_PROOF_HEADER,
   RelayClient: () => RelayClient,
   RelayObserver: () => RelayObserver,
@@ -59,6 +60,7 @@ __export(index_exports, {
   accountRootFromPhrase: () => accountRootFromPhrase,
   accountRootFromSecret: () => accountRootFromSecret,
   accountRootSignerFromPhrase: () => accountRootSignerFromPhrase,
+  adminChangedOp: () => adminChangedOp,
   admitterAddrsFromNetworkStatus: () => admitterAddrsFromNetworkStatus,
   attestKeyBinding: () => attestKeyBinding,
   attestRelayNodeKey: () => attestRelayNodeKey,
@@ -106,6 +108,7 @@ __export(index_exports, {
   createSignedReleaseVerifier: () => createSignedReleaseVerifier,
   createTimeoutSignal: () => createTimeoutSignal,
   createUniversalHttpClient: () => createUniversalHttpClient,
+  createdSubgroupId: () => createdSubgroupId,
   creationInitHash: () => creationInitHash,
   defaultAdmitters: () => defaultAdmitters,
   defaultAudience: () => defaultAudience,
@@ -124,6 +127,7 @@ __export(index_exports, {
   generateSessionKey: () => generateSessionKey,
   governanceOpHash: () => governanceOpHash,
   groupCreatedOp: () => groupCreatedOp,
+  groupDeleteOp: () => groupDeleteOp,
   groupDeletedOp: () => groupDeletedOp,
   groupInvitationHash: () => groupInvitationHash,
   groupReparentedOp: () => groupReparentedOp,
@@ -142,6 +146,8 @@ __export(index_exports, {
   namespaceCreatedOp: () => namespaceCreatedOp,
   nodeEndpoint: () => nodeEndpoint,
   nodeReleaseVersionFromImage: () => nodeReleaseVersionFromImage,
+  ownerOpDigest: () => ownerOpDigest,
+  ownerOpSigningPayload: () => ownerOpSigningPayload,
   parseAuthCallback: () => parseAuthCallback,
   parseCreationWarrant: () => parseCreationWarrant,
   parseDeviceCredential: () => parseDeviceCredential,
@@ -155,6 +161,7 @@ __export(index_exports, {
   requestBodyHash: () => requestBodyHash,
   resolveRoot: () => resolveRoot,
   resolveRootPair: () => resolveRootPair,
+  rootGuardedOpBytes: () => rootGuardedOpBytes,
   routingProofHeaders: () => routingProofHeaders,
   shouldRetain: () => shouldRetain,
   signAccountLink: () => signAccountLink,
@@ -166,6 +173,7 @@ __export(index_exports, {
   signGroupInvitation: () => signGroupInvitation,
   signLoginStatement: () => signLoginStatement,
   signMemberJoinOp: () => signMemberJoinOp,
+  signOwnerOpProof: () => signOwnerOpProof,
   signRequest: () => signRequest,
   signRequestProof: () => signRequestProof,
   signRoutingChallenge: () => signRoutingChallenge,
@@ -173,6 +181,11 @@ __export(index_exports, {
   signedPath: () => signedPath,
   signerFromCryptoKey: () => signerFromCryptoKey,
   signerFromSecret: () => signerFromSecret,
+  subgroupCreation: () => subgroupCreation,
+  teeAdmissionPolicyOp: () => teeAdmissionPolicyOp,
+  teeAuthoringPolicyOp: () => teeAuthoringPolicyOp,
+  teeReleaseAdmissionPolicyOp: () => teeReleaseAdmissionPolicyOp,
+  transferOwnershipOp: () => transferOwnershipOp,
   transportKeyBinding: () => transportKeyBinding,
   trustSignedRelease: () => trustSignedRelease,
   trustedMeasurementsFromReleases: () => trustedMeasurementsFromReleases,
@@ -2353,9 +2366,45 @@ var AdminApiClient = class {
    * and admitted TEEs stay members. The node applies the same op as
    * `setTeeAuthoringPolicy(groupId, { allowedMrtd: [] })`. `groupId` must be a
    * namespace root.
+   *
+   * `rootProof` is the signing admin's own root proof for that empty policy
+   * (`teeAuthoringPolicyOp([])`); omit it on a node that holds that root.
    */
-  async disableTeeAuthoringPolicy(groupId) {
-    await this.httpClient.delete(`/admin-api/groups/${groupId}/settings/tee-authoring-policy`);
+  async disableTeeAuthoringPolicy(groupId, options = {}) {
+    const path = `/admin-api/groups/${groupId}/settings/tee-authoring-policy`;
+    if (options.rootProof === void 0) {
+      await this.httpClient.delete(path);
+      return;
+    }
+    await this.httpClient.request(path, {
+      method: "DELETE",
+      body: JSON.stringify({ rootProof: options.rootProof }),
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  // ---- Root-guarded owner ops (core schema 18) ----
+  /**
+   * Hand the group to `newOwner`, who must already be one of its admins.
+   * Owner-only, and it needs the owner account's root proof; see
+   * {@link RootGuardedOpRequest}.
+   */
+  async transferOwnership(groupId, request) {
+    await this.httpClient.post(`/admin-api/groups/${groupId}/transfer-ownership`, request);
+  }
+  /**
+   * Repoint the namespace's admin pin at `newAdmin`, a member of its root.
+   * Owner-only, with the owner account's root proof; see {@link RootGuardedOpRequest}.
+   */
+  async changeNamespaceAdmin(namespaceId, request) {
+    await this.httpClient.post(`/admin-api/namespaces/${namespaceId}/admin`, request);
+  }
+  /**
+   * Delete a group through the owner-only path: it must hold no contexts, and
+   * the op needs the owner account's root proof. {@link deleteGroup} is the
+   * admin-level cascading delete.
+   */
+  async ownerDeleteGroup(groupId, request = {}) {
+    await this.httpClient.post(`/admin-api/groups/${groupId}/owner-delete`, request);
   }
   // ---- Group / member / context metadata ----
   async setGroupMetadata(groupId, request) {
@@ -7349,9 +7398,9 @@ function parseCreationWarrant(warrant) {
   const u32 = (what) => view.getUint32(take(4, what).byteOffset, true);
   const u64 = (what) => view.getBigUint64(take(8, what).byteOffset, true);
   const option = (what) => {
-    const tag2 = take(1, what)[0];
-    if (tag2 === 0) return null;
-    if (tag2 !== 1) throw new Error(`${what} has option tag ${tag2}, expected 0 or 1`);
+    const tag3 = take(1, what)[0];
+    if (tag3 === 0) return null;
+    if (tag3 !== 1) throw new Error(`${what} has option tag ${tag3}, expected 0 or 1`);
     const len = u32(what);
     if (len > MAX_LABEL_BYTES) {
       throw new Error(`${what} is ${len} bytes, over the ${MAX_LABEL_BYTES} a node accepts`);
@@ -7595,6 +7644,17 @@ function memberRoleSetOp(member, memberRole) {
     bytes: concat(tag(GROUP_OP.MemberRoleSet), fromHex(member, "member", 32), role(memberRole))
   };
 }
+var SUBGROUP_ID_DOMAIN = new TextEncoder().encode("calimero.subgroup.id.v1");
+async function createdSubgroupId(admin, parentId, restricted, salt) {
+  return hex(
+    await domainHash(SUBGROUP_ID_DOMAIN, [
+      fromHex(admin, "admin", 32),
+      fromHex(parentId, "parentId", 32),
+      new Uint8Array([restricted ? 1 : 0]),
+      fromHex(salt, "salt", 32)
+    ])
+  );
+}
 function defaultCapabilitiesSetOp(capabilities) {
   if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
     throw new Error(`capabilities must be a u32 bit mask, got ${String(capabilities)}`);
@@ -7617,10 +7677,16 @@ function groupCreatedOp(input) {
       fromHex(input.groupId, "groupId", 32),
       fromHex(input.parentId, "parentId", 32),
       tag(input.restricted ? 1 : 0),
-      fromHex(input.admin, "admin", 32)
+      fromHex(input.admin, "admin", 32),
+      fromHex(input.salt, "salt", 32)
     )
   };
 }
+async function subgroupCreation(input) {
+  const salt = input.salt ?? hex(crypto.getRandomValues(new Uint8Array(32)));
+  const groupId = await createdSubgroupId(input.admin, input.parentId, input.restricted, salt);
+  return { groupId, salt, op: groupCreatedOp({ ...input, groupId, salt }) };
+}
 function groupReparentedOp(childGroupId, newParentId) {
   return {
     kind: "root",
@@ -8178,12 +8244,12 @@ function audienceSigningBytes(audience) {
   );
 }
 function audienceWire(audience) {
-  const tag2 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
+  const tag3 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
   if (audience.kind === "cli") {
-    return tag2;
+    return tag3;
   }
   const body = audienceBody(audience);
-  return concat(tag2, u32le(body.length), body);
+  return concat(tag3, u32le(body.length), body);
 }
 async function signLoginStatement(input) {
   const node = fromHex(input.node, "node", 32);
@@ -9868,8 +9934,8 @@ var SIGNATURE_HASHES = {
 };
 function read(bytes, offset, limit) {
   if (offset + 2 > limit) throw new Error("it is truncated");
-  const tag2 = bytes[offset];
-  if ((tag2 & 31) === 31) throw new Error("it uses a tag this parser does not read");
+  const tag3 = bytes[offset];
+  if ((tag3 & 31) === 31) throw new Error("it uses a tag this parser does not read");
   let length = bytes[offset + 1];
   let start = offset + 2;
   if (length & 128) {
@@ -9881,7 +9947,7 @@ function read(bytes, offset, limit) {
   }
   const end = start + length;
   if (end > limit) throw new Error("it is truncated");
-  return { tag: tag2, bytes, offset, start, end };
+  return { tag: tag3, bytes, offset, start, end };
 }
 function parseDer(bytes) {
   const element = read(bytes, 0, bytes.length);
@@ -9897,8 +9963,8 @@ function children(element) {
   }
   return out;
 }
-function expectTag(element, tag2, what) {
-  if (!element || element.tag !== tag2) throw new Error(`${what} is not where it should be`);
+function expectTag(element, tag3, what) {
+  if (!element || element.tag !== tag3) throw new Error(`${what} is not where it should be`);
   return element;
 }
 function contents(element) {
@@ -10456,7 +10522,7 @@ function bytes32(value, label2) {
 }
 
 // src/namespace-op/namespace-op.ts
-var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 16;
+var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 20;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
 var NAMESPACE_OP_ROOT = 0;
 var ROOT_OP2 = {
@@ -10546,6 +10612,183 @@ async function signMemberJoinOp(input) {
   return hex(concat(signable, signature, unendorsed));
 }
 
+// src/owner-op/owner-op.ts
+var OWNER_OP_SIGN_DOMAIN = new TextEncoder().encode("calimero.account.owner-op.v1");
+var OWNER_OP_BODY_DOMAIN = new TextEncoder().encode("calimero.account.owner-op.body.v1");
+var ACCOUNT_ID_DOMAIN2 = new TextEncoder().encode("calimero.account.genesis.v1");
+var ACCOUNT_GENESIS_VERSION2 = 2;
+var OWNER_OP_KIND = {
+  transferOwnership: 0,
+  adminChanged: 1,
+  groupDelete: 2,
+  teeAdmissionPolicy: 3,
+  teeAuthoringPolicy: 4,
+  teeReleaseAdmissionPolicy: 5
+};
+var GROUP_OP2 = {
+  GroupDelete: 14,
+  TransferOwnership: 21,
+  TeeAuthoringPolicySet: 33,
+  TeeAdmissionPolicySetV2: 37,
+  TeeReleaseAdmissionPolicySetV2: 38,
+  RootGuarded: 42
+};
+var ROOT_OP3 = {
+  AdminChanged: 3,
+  RootGuarded: 12
+};
+var TEE_MODE = { replica: 0, relay: 1 };
+var te = new TextEncoder();
+function tag2(byte) {
+  return new Uint8Array([byte]);
+}
+function borshString3(value) {
+  const bytes = te.encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+function borshStrings(values) {
+  return concat(u32le(values.length), ...values.map(borshString3));
+}
+function borshBool(value) {
+  return tag2(value ? 1 : 0);
+}
+function teeMode(mode) {
+  const byte = TEE_MODE[mode ?? "replica"];
+  if (byte === void 0) {
+    throw new Error(`mode must be replica or relay, got ${String(mode)}`);
+  }
+  return tag2(byte);
+}
+function transferOwnershipOp(newOwner) {
+  return {
+    kind: "transferOwnership",
+    plane: "group",
+    bytes: concat(tag2(GROUP_OP2.TransferOwnership), fromHex(newOwner, "newOwner", 32))
+  };
+}
+function groupDeleteOp() {
+  return { kind: "groupDelete", plane: "group", bytes: tag2(GROUP_OP2.GroupDelete) };
+}
+function adminChangedOp(newAdmin) {
+  return {
+    kind: "adminChanged",
+    plane: "root",
+    bytes: concat(tag2(ROOT_OP3.AdminChanged), fromHex(newAdmin, "newAdmin", 32))
+  };
+}
+function teeAuthoringPolicyOp(allowedMrtd) {
+  return {
+    kind: "teeAuthoringPolicy",
+    plane: "group",
+    bytes: concat(tag2(GROUP_OP2.TeeAuthoringPolicySet), borshStrings(allowedMrtd))
+  };
+}
+function teeAdmissionPolicyOp(input) {
+  return {
+    kind: "teeAdmissionPolicy",
+    plane: "group",
+    bytes: concat(
+      tag2(GROUP_OP2.TeeAdmissionPolicySetV2),
+      borshStrings(input.allowedMrtd),
+      borshStrings(input.allowedRtmr0),
+      borshStrings(input.allowedRtmr1),
+      borshStrings(input.allowedRtmr2),
+      borshStrings(input.allowedRtmr3),
+      borshStrings(input.allowedTcbStatuses),
+      borshBool(input.acceptMock),
+      teeMode(input.mode)
+    )
+  };
+}
+function teeReleaseAdmissionPolicyOp(input) {
+  const minRelease = input.minReleaseVersion === void 0 ? tag2(0) : concat(tag2(1), borshString3(input.minReleaseVersion));
+  return {
+    kind: "teeReleaseAdmissionPolicy",
+    plane: "group",
+    bytes: concat(
+      tag2(GROUP_OP2.TeeReleaseAdmissionPolicySetV2),
+      borshStrings(input.allowedProfiles),
+      minRelease,
+      borshStrings(input.allowedTcbStatuses),
+      borshBool(input.acceptMock),
+      teeMode(input.mode)
+    )
+  };
+}
+async function ownerOpDigest(opBytes) {
+  return domainHash(OWNER_OP_BODY_DOMAIN, [opBytes]);
+}
+async function ownerOpSigningPayload(input) {
+  return domainHash(OWNER_OP_SIGN_DOMAIN, [
+    fromHex(input.account, "account", 32),
+    fromHex(input.namespaceId, "namespaceId", 32),
+    fromHex(input.groupId, "groupId", 32),
+    tag2(kindByte2(input.kind)),
+    input.opDigest,
+    u64le(input.counter),
+    u32le(input.keyEpoch)
+  ]);
+}
+function kindByte2(kind) {
+  const byte = OWNER_OP_KIND[kind];
+  if (byte === void 0) {
+    throw new Error(`unknown owner-op kind ${String(kind)}`);
+  }
+  return byte;
+}
+var HANDOFF_BYTES = 32 + 4 + 32 + 64;
+async function signOwnerOpProof(input) {
+  const rootPublicKey = await derivePublicKey(input.rootSecret);
+  const genesis = concat(tag2(ACCOUNT_GENESIS_VERSION2), rootPublicKey);
+  const account = hex(await domainHash(ACCOUNT_ID_DOMAIN2, [genesis]));
+  const keyEpoch = input.keyEpoch ?? 0;
+  const chain = (input.chain ?? []).map((handoff, index) => {
+    const bytes = fromHexUnsized(handoff, `chain[${index}]`);
+    if (bytes.length !== HANDOFF_BYTES) {
+      throw new Error(
+        `chain[${index}] must be a ${HANDOFF_BYTES}-byte RootKeyHandoff, got ${bytes.length}`
+      );
+    }
+    return bytes;
+  });
+  if (keyEpoch > chain.length) {
+    throw new Error(
+      `keyEpoch ${keyEpoch} needs ${keyEpoch} handoffs in chain, got ${chain.length}`
+    );
+  }
+  const opDigest = await ownerOpDigest(input.op.bytes);
+  const payload = await ownerOpSigningPayload({
+    account,
+    namespaceId: input.namespaceId,
+    groupId: input.groupId,
+    kind: input.op.kind,
+    opDigest,
+    counter: input.counter,
+    keyEpoch
+  });
+  const key = await importSigningKey(input.rootSecret);
+  const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", key, payload));
+  return hex(
+    concat(
+      genesis,
+      u32le(chain.length),
+      ...chain,
+      fromHex(account, "account", 32),
+      fromHex(input.namespaceId, "namespaceId", 32),
+      fromHex(input.groupId, "groupId", 32),
+      tag2(kindByte2(input.op.kind)),
+      opDigest,
+      u64le(input.counter),
+      u32le(keyEpoch),
+      signature
+    )
+  );
+}
+function rootGuardedOpBytes(op, rootProof) {
+  const wrapper = op.plane === "group" ? GROUP_OP2.RootGuarded : ROOT_OP3.RootGuarded;
+  return concat(tag2(wrapper), op.bytes, fromHexUnsized(rootProof, "rootProof"));
+}
+
 // src/nodeDiscovery.ts
 var DEFAULT_LOCAL_NODE_PORTS = [2428, 2429, 2528, 2529];
 var LOCAL_HOST = "localhost";