@calimero-network/mero-js 22.9.0 → 23.0.0

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export * from "./cloud/index.js";
 export * from "./sealed/index.js";
 export * from "./relay/index.js";
 export * from "./request-proof/index.js";
-export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
+export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 export type { Signer } from "./signer/index.js";
 export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, resolveRoot, resolveRootPair, } from "./account/index.js";
@@ -34,7 +34,9 @@ export { signGroupInvitation, encodeGroupInvitation, groupInvitationHash, defaul
 export type { GroupInvitationInput } from "./invitation/index.js";
 export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from "./namespace-op/index.js";
 export type { SignMemberJoinInput } from "./namespace-op/index.js";
-export type { WarrantInput, CreationWarrantInput, CreationWarrantFields, SignedCreationWarrant, GovernanceWarrantInput, GovernanceWarrantFields, GovernanceOp, GovernanceOpKind, GovernanceMemberRole, GroupCreatedInput, NamespaceCreatedInput, } from "./warrant/index.js";
+export { OWNER_OP_KIND, transferOwnershipOp, groupDeleteOp, adminChangedOp, teeAuthoringPolicyOp, teeAdmissionPolicyOp, teeReleaseAdmissionPolicyOp, ownerOpDigest, ownerOpSigningPayload, signOwnerOpProof, rootGuardedOpBytes, } from "./owner-op/index.js";
+export type { OwnerOp, OwnerOpKind, OwnerOpPlane, OwnerOpProofInput, TeeAdmissionPolicyOpInput, TeeReleaseAdmissionPolicyOpInput, } from "./owner-op/index.js";
+export type { WarrantInput, CreationWarrantInput, CreationWarrantFields, SignedCreationWarrant, GovernanceWarrantInput, GovernanceWarrantFields, GovernanceOp, GovernanceOpKind, GovernanceMemberRole, GroupCreatedInput, SubgroupCreation, NamespaceCreatedInput, } from "./warrant/index.js";
 export { requestBodyHash, signRequest, callerProof, createProofSigner, } from "./request/index.js";
 export type { CallerProofInput, ProofRequest, ProofSignerOptions, } from "./request/index.js";
 export type { RequestSigInput } from "./request/index.js";

package/dist/index.js

@@ -34,7 +34,7 @@ export * from "./relay/index.js";
 // Request proofs — a caller's identity on the request itself, no session needed
 export * from "./request-proof/index.js";
 // Warrant signing — mint the author's consent for a relay to run one intent
-export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
+export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 // Who signs — a key's capability, separated from its material, so a
 // non-extractable key can be used wherever a hex secret could.
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
@@ -52,6 +52,7 @@ export { signDeviceScope, deviceScopePayload } from "./device-cert/index.js";
 // Invitations minted off-node, signed by a bound device key.
 export { signGroupInvitation, encodeGroupInvitation, groupInvitationHash, defaultAdmitters, MAX_INVITATION_VALIDITY_SECS, INVITED_ROLE, } from "./invitation/index.js";
 export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from "./namespace-op/index.js";
+export { OWNER_OP_KIND, transferOwnershipOp, groupDeleteOp, adminChangedOp, teeAuthoringPolicyOp, teeAdmissionPolicyOp, teeReleaseAdmissionPolicyOp, ownerOpDigest, ownerOpSigningPayload, signOwnerOpProof, rootGuardedOpBytes, } from "./owner-op/index.js";
 // Login-statement signing — the device's half of a password-free session
 export { requestBodyHash, signRequest, callerProof, createProofSigner, } from "./request/index.js";
 export { signLoginStatement } from "./login/index.js";

package/dist/index.mjs

@@ -2167,9 +2167,45 @@ var AdminApiClient = class {
    * and admitted TEEs stay members. The node applies the same op as
    * `setTeeAuthoringPolicy(groupId, { allowedMrtd: [] })`. `groupId` must be a
    * namespace root.
+   *
+   * `rootProof` is the signing admin's own root proof for that empty policy
+   * (`teeAuthoringPolicyOp([])`); omit it on a node that holds that root.
    */
-  async disableTeeAuthoringPolicy(groupId) {
-    await this.httpClient.delete(`/admin-api/groups/${groupId}/settings/tee-authoring-policy`);
+  async disableTeeAuthoringPolicy(groupId, options = {}) {
+    const path = `/admin-api/groups/${groupId}/settings/tee-authoring-policy`;
+    if (options.rootProof === void 0) {
+      await this.httpClient.delete(path);
+      return;
+    }
+    await this.httpClient.request(path, {
+      method: "DELETE",
+      body: JSON.stringify({ rootProof: options.rootProof }),
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  // ---- Root-guarded owner ops (core schema 18) ----
+  /**
+   * Hand the group to `newOwner`, who must already be one of its admins.
+   * Owner-only, and it needs the owner account's root proof; see
+   * {@link RootGuardedOpRequest}.
+   */
+  async transferOwnership(groupId, request) {
+    await this.httpClient.post(`/admin-api/groups/${groupId}/transfer-ownership`, request);
+  }
+  /**
+   * Repoint the namespace's admin pin at `newAdmin`, a member of its root.
+   * Owner-only, with the owner account's root proof; see {@link RootGuardedOpRequest}.
+   */
+  async changeNamespaceAdmin(namespaceId, request) {
+    await this.httpClient.post(`/admin-api/namespaces/${namespaceId}/admin`, request);
+  }
+  /**
+   * Delete a group through the owner-only path: it must hold no contexts, and
+   * the op needs the owner account's root proof. {@link deleteGroup} is the
+   * admin-level cascading delete.
+   */
+  async ownerDeleteGroup(groupId, request = {}) {
+    await this.httpClient.post(`/admin-api/groups/${groupId}/owner-delete`, request);
   }
   // ---- Group / member / context metadata ----
   async setGroupMetadata(groupId, request) {
@@ -7163,9 +7199,9 @@ function parseCreationWarrant(warrant) {
   const u32 = (what) => view.getUint32(take(4, what).byteOffset, true);
   const u64 = (what) => view.getBigUint64(take(8, what).byteOffset, true);
   const option = (what) => {
-    const tag2 = take(1, what)[0];
-    if (tag2 === 0) return null;
-    if (tag2 !== 1) throw new Error(`${what} has option tag ${tag2}, expected 0 or 1`);
+    const tag3 = take(1, what)[0];
+    if (tag3 === 0) return null;
+    if (tag3 !== 1) throw new Error(`${what} has option tag ${tag3}, expected 0 or 1`);
     const len = u32(what);
     if (len > MAX_LABEL_BYTES) {
       throw new Error(`${what} is ${len} bytes, over the ${MAX_LABEL_BYTES} a node accepts`);
@@ -7409,6 +7445,17 @@ function memberRoleSetOp(member, memberRole) {
     bytes: concat(tag(GROUP_OP.MemberRoleSet), fromHex(member, "member", 32), role(memberRole))
   };
 }
+var SUBGROUP_ID_DOMAIN = new TextEncoder().encode("calimero.subgroup.id.v1");
+async function createdSubgroupId(admin, parentId, restricted, salt) {
+  return hex(
+    await domainHash(SUBGROUP_ID_DOMAIN, [
+      fromHex(admin, "admin", 32),
+      fromHex(parentId, "parentId", 32),
+      new Uint8Array([restricted ? 1 : 0]),
+      fromHex(salt, "salt", 32)
+    ])
+  );
+}
 function defaultCapabilitiesSetOp(capabilities) {
   if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
     throw new Error(`capabilities must be a u32 bit mask, got ${String(capabilities)}`);
@@ -7431,10 +7478,16 @@ function groupCreatedOp(input) {
       fromHex(input.groupId, "groupId", 32),
       fromHex(input.parentId, "parentId", 32),
       tag(input.restricted ? 1 : 0),
-      fromHex(input.admin, "admin", 32)
+      fromHex(input.admin, "admin", 32),
+      fromHex(input.salt, "salt", 32)
     )
   };
 }
+async function subgroupCreation(input) {
+  const salt = input.salt ?? hex(crypto.getRandomValues(new Uint8Array(32)));
+  const groupId = await createdSubgroupId(input.admin, input.parentId, input.restricted, salt);
+  return { groupId, salt, op: groupCreatedOp({ ...input, groupId, salt }) };
+}
 function groupReparentedOp(childGroupId, newParentId) {
   return {
     kind: "root",
@@ -7992,12 +8045,12 @@ function audienceSigningBytes(audience) {
   );
 }
 function audienceWire(audience) {
-  const tag2 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
+  const tag3 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
   if (audience.kind === "cli") {
-    return tag2;
+    return tag3;
   }
   const body = audienceBody(audience);
-  return concat(tag2, u32le(body.length), body);
+  return concat(tag3, u32le(body.length), body);
 }
 async function signLoginStatement(input) {
   const node = fromHex(input.node, "node", 32);
@@ -9682,8 +9735,8 @@ var SIGNATURE_HASHES = {
 };
 function read(bytes, offset, limit) {
   if (offset + 2 > limit) throw new Error("it is truncated");
-  const tag2 = bytes[offset];
-  if ((tag2 & 31) === 31) throw new Error("it uses a tag this parser does not read");
+  const tag3 = bytes[offset];
+  if ((tag3 & 31) === 31) throw new Error("it uses a tag this parser does not read");
   let length = bytes[offset + 1];
   let start = offset + 2;
   if (length & 128) {
@@ -9695,7 +9748,7 @@ function read(bytes, offset, limit) {
   }
   const end = start + length;
   if (end > limit) throw new Error("it is truncated");
-  return { tag: tag2, bytes, offset, start, end };
+  return { tag: tag3, bytes, offset, start, end };
 }
 function parseDer(bytes) {
   const element = read(bytes, 0, bytes.length);
@@ -9711,8 +9764,8 @@ function children(element) {
   }
   return out;
 }
-function expectTag(element, tag2, what) {
-  if (!element || element.tag !== tag2) throw new Error(`${what} is not where it should be`);
+function expectTag(element, tag3, what) {
+  if (!element || element.tag !== tag3) throw new Error(`${what} is not where it should be`);
   return element;
 }
 function contents(element) {
@@ -10270,7 +10323,7 @@ function bytes32(value, label2) {
 }
 
 // src/namespace-op/namespace-op.ts
-var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 16;
+var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 20;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
 var NAMESPACE_OP_ROOT = 0;
 var ROOT_OP2 = {
@@ -10360,6 +10413,183 @@ async function signMemberJoinOp(input) {
   return hex(concat(signable, signature, unendorsed));
 }
 
+// src/owner-op/owner-op.ts
+var OWNER_OP_SIGN_DOMAIN = new TextEncoder().encode("calimero.account.owner-op.v1");
+var OWNER_OP_BODY_DOMAIN = new TextEncoder().encode("calimero.account.owner-op.body.v1");
+var ACCOUNT_ID_DOMAIN2 = new TextEncoder().encode("calimero.account.genesis.v1");
+var ACCOUNT_GENESIS_VERSION2 = 2;
+var OWNER_OP_KIND = {
+  transferOwnership: 0,
+  adminChanged: 1,
+  groupDelete: 2,
+  teeAdmissionPolicy: 3,
+  teeAuthoringPolicy: 4,
+  teeReleaseAdmissionPolicy: 5
+};
+var GROUP_OP2 = {
+  GroupDelete: 14,
+  TransferOwnership: 21,
+  TeeAuthoringPolicySet: 33,
+  TeeAdmissionPolicySetV2: 37,
+  TeeReleaseAdmissionPolicySetV2: 38,
+  RootGuarded: 42
+};
+var ROOT_OP3 = {
+  AdminChanged: 3,
+  RootGuarded: 12
+};
+var TEE_MODE = { replica: 0, relay: 1 };
+var te = new TextEncoder();
+function tag2(byte) {
+  return new Uint8Array([byte]);
+}
+function borshString3(value) {
+  const bytes = te.encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+function borshStrings(values) {
+  return concat(u32le(values.length), ...values.map(borshString3));
+}
+function borshBool(value) {
+  return tag2(value ? 1 : 0);
+}
+function teeMode(mode) {
+  const byte = TEE_MODE[mode ?? "replica"];
+  if (byte === void 0) {
+    throw new Error(`mode must be replica or relay, got ${String(mode)}`);
+  }
+  return tag2(byte);
+}
+function transferOwnershipOp(newOwner) {
+  return {
+    kind: "transferOwnership",
+    plane: "group",
+    bytes: concat(tag2(GROUP_OP2.TransferOwnership), fromHex(newOwner, "newOwner", 32))
+  };
+}
+function groupDeleteOp() {
+  return { kind: "groupDelete", plane: "group", bytes: tag2(GROUP_OP2.GroupDelete) };
+}
+function adminChangedOp(newAdmin) {
+  return {
+    kind: "adminChanged",
+    plane: "root",
+    bytes: concat(tag2(ROOT_OP3.AdminChanged), fromHex(newAdmin, "newAdmin", 32))
+  };
+}
+function teeAuthoringPolicyOp(allowedMrtd) {
+  return {
+    kind: "teeAuthoringPolicy",
+    plane: "group",
+    bytes: concat(tag2(GROUP_OP2.TeeAuthoringPolicySet), borshStrings(allowedMrtd))
+  };
+}
+function teeAdmissionPolicyOp(input) {
+  return {
+    kind: "teeAdmissionPolicy",
+    plane: "group",
+    bytes: concat(
+      tag2(GROUP_OP2.TeeAdmissionPolicySetV2),
+      borshStrings(input.allowedMrtd),
+      borshStrings(input.allowedRtmr0),
+      borshStrings(input.allowedRtmr1),
+      borshStrings(input.allowedRtmr2),
+      borshStrings(input.allowedRtmr3),
+      borshStrings(input.allowedTcbStatuses),
+      borshBool(input.acceptMock),
+      teeMode(input.mode)
+    )
+  };
+}
+function teeReleaseAdmissionPolicyOp(input) {
+  const minRelease = input.minReleaseVersion === void 0 ? tag2(0) : concat(tag2(1), borshString3(input.minReleaseVersion));
+  return {
+    kind: "teeReleaseAdmissionPolicy",
+    plane: "group",
+    bytes: concat(
+      tag2(GROUP_OP2.TeeReleaseAdmissionPolicySetV2),
+      borshStrings(input.allowedProfiles),
+      minRelease,
+      borshStrings(input.allowedTcbStatuses),
+      borshBool(input.acceptMock),
+      teeMode(input.mode)
+    )
+  };
+}
+async function ownerOpDigest(opBytes) {
+  return domainHash(OWNER_OP_BODY_DOMAIN, [opBytes]);
+}
+async function ownerOpSigningPayload(input) {
+  return domainHash(OWNER_OP_SIGN_DOMAIN, [
+    fromHex(input.account, "account", 32),
+    fromHex(input.namespaceId, "namespaceId", 32),
+    fromHex(input.groupId, "groupId", 32),
+    tag2(kindByte2(input.kind)),
+    input.opDigest,
+    u64le(input.counter),
+    u32le(input.keyEpoch)
+  ]);
+}
+function kindByte2(kind) {
+  const byte = OWNER_OP_KIND[kind];
+  if (byte === void 0) {
+    throw new Error(`unknown owner-op kind ${String(kind)}`);
+  }
+  return byte;
+}
+var HANDOFF_BYTES = 32 + 4 + 32 + 64;
+async function signOwnerOpProof(input) {
+  const rootPublicKey = await derivePublicKey(input.rootSecret);
+  const genesis = concat(tag2(ACCOUNT_GENESIS_VERSION2), rootPublicKey);
+  const account = hex(await domainHash(ACCOUNT_ID_DOMAIN2, [genesis]));
+  const keyEpoch = input.keyEpoch ?? 0;
+  const chain = (input.chain ?? []).map((handoff, index) => {
+    const bytes = fromHexUnsized(handoff, `chain[${index}]`);
+    if (bytes.length !== HANDOFF_BYTES) {
+      throw new Error(
+        `chain[${index}] must be a ${HANDOFF_BYTES}-byte RootKeyHandoff, got ${bytes.length}`
+      );
+    }
+    return bytes;
+  });
+  if (keyEpoch > chain.length) {
+    throw new Error(
+      `keyEpoch ${keyEpoch} needs ${keyEpoch} handoffs in chain, got ${chain.length}`
+    );
+  }
+  const opDigest = await ownerOpDigest(input.op.bytes);
+  const payload = await ownerOpSigningPayload({
+    account,
+    namespaceId: input.namespaceId,
+    groupId: input.groupId,
+    kind: input.op.kind,
+    opDigest,
+    counter: input.counter,
+    keyEpoch
+  });
+  const key = await importSigningKey(input.rootSecret);
+  const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", key, payload));
+  return hex(
+    concat(
+      genesis,
+      u32le(chain.length),
+      ...chain,
+      fromHex(account, "account", 32),
+      fromHex(input.namespaceId, "namespaceId", 32),
+      fromHex(input.groupId, "groupId", 32),
+      tag2(kindByte2(input.op.kind)),
+      opDigest,
+      u64le(input.counter),
+      u32le(keyEpoch),
+      signature
+    )
+  );
+}
+function rootGuardedOpBytes(op, rootProof) {
+  const wrapper = op.plane === "group" ? GROUP_OP2.RootGuarded : ROOT_OP3.RootGuarded;
+  return concat(tag2(wrapper), op.bytes, fromHexUnsized(rootProof, "rootProof"));
+}
+
 // src/nodeDiscovery.ts
 var DEFAULT_LOCAL_NODE_PORTS = [2428, 2429, 2528, 2529];
 var LOCAL_HOST = "localhost";
@@ -10528,6 +10758,7 @@ export {
   MeroClient,
   MeroJs,
   NODE_RELEASE_SIGNER,
+  OWNER_OP_KIND,
   REQUEST_PROOF_HEADER,
   RelayClient,
   RelayObserver,
@@ -10549,6 +10780,7 @@ export {
   accountRootFromPhrase,
   accountRootFromSecret,
   accountRootSignerFromPhrase,
+  adminChangedOp,
   admitterAddrsFromNetworkStatus,
   attestKeyBinding,
   attestRelayNodeKey,
@@ -10596,6 +10828,7 @@ export {
   createSignedReleaseVerifier,
   createTimeoutSignal,
   createUniversalHttpClient,
+  createdSubgroupId,
   creationInitHash,
   defaultAdmitters,
   defaultAudience,
@@ -10614,6 +10847,7 @@ export {
   generateSessionKey,
   governanceOpHash,
   groupCreatedOp,
+  groupDeleteOp,
   groupDeletedOp,
   groupInvitationHash,
   groupReparentedOp,
@@ -10632,6 +10866,8 @@ export {
   namespaceCreatedOp,
   nodeEndpoint,
   nodeReleaseVersionFromImage,
+  ownerOpDigest,
+  ownerOpSigningPayload,
   parseAuthCallback,
   parseCreationWarrant,
   parseDeviceCredential,
@@ -10645,6 +10881,7 @@ export {
   requestBodyHash,
   resolveRoot,
   resolveRootPair,
+  rootGuardedOpBytes,
   routingProofHeaders,
   shouldRetain,
   signAccountLink,
@@ -10656,6 +10893,7 @@ export {
   signGroupInvitation,
   signLoginStatement,
   signMemberJoinOp,
+  signOwnerOpProof,
   signRequest,
   signRequestProof,
   signRoutingChallenge,
@@ -10663,6 +10901,11 @@ export {
   signedPath,
   signerFromCryptoKey,
   signerFromSecret,
+  subgroupCreation,
+  teeAdmissionPolicyOp,
+  teeAuthoringPolicyOp,
+  teeReleaseAdmissionPolicyOp,
+  transferOwnershipOp,
   transportKeyBinding,
   trustSignedRelease,
   trustedMeasurementsFromReleases,