@calimero-network/mero-js 23.0.0 → 23.2.0

package/dist/index.cjs

@@ -81,6 +81,10 @@ __export(index_exports, {
   completeDeviceEnrolment: () => completeDeviceEnrolment,
   connectCloud: () => connectCloud,
   connectCloudWithAccount: () => connectCloudWithAccount,
+  contextCapabilityGrantedOp: () => contextCapabilityGrantedOp,
+  contextCapabilityRevokedOp: () => contextCapabilityRevokedOp,
+  contextDetachedOp: () => contextDetachedOp,
+  contextMetadataSetOp: () => contextMetadataSetOp,
   createAccountRootSigner: () => createAccountRootSigner,
   createAdminApiClient: () => createAdminApiClient,
   createAdminApiClientFromHttpClient: () => createAdminApiClientFromHttpClient,
@@ -130,6 +134,7 @@ __export(index_exports, {
   groupDeleteOp: () => groupDeleteOp,
   groupDeletedOp: () => groupDeletedOp,
   groupInvitationHash: () => groupInvitationHash,
+  groupMetadataSetOp: () => groupMetadataSetOp,
   groupReparentedOp: () => groupReparentedOp,
   hasCap: () => hasCap,
   hexEncodeUtf8: () => hexEncodeUtf8,
@@ -139,7 +144,10 @@ __export(index_exports, {
   localNodeUrl: () => localNodeUrl,
   login: () => login,
   memberAddedOp: () => memberAddedOp,
+  memberCapabilitySetOp: () => memberCapabilitySetOp,
+  memberJoinedOpenOp: () => memberJoinedOpenOp,
   memberLeftOp: () => memberLeftOp,
+  memberMetadataSetOp: () => memberMetadataSetOp,
   memberRemovedOp: () => memberRemovedOp,
   memberRoleSetOp: () => memberRoleSetOp,
   mintDeviceId: () => mintDeviceId,
@@ -166,6 +174,7 @@ __export(index_exports, {
   shouldRetain: () => shouldRetain,
   signAccountLink: () => signAccountLink,
   signAccountLogin: () => signAccountLogin,
+  signAccountOwnershipClaim: () => signAccountOwnershipClaim,
   signCreationWarrant: () => signCreationWarrant,
   signDeviceCert: () => signDeviceCert,
   signDeviceScope: () => signDeviceScope,
@@ -182,6 +191,7 @@ __export(index_exports, {
   signerFromCryptoKey: () => signerFromCryptoKey,
   signerFromSecret: () => signerFromSecret,
   subgroupCreation: () => subgroupCreation,
+  subgroupVisibilitySetOp: () => subgroupVisibilitySetOp,
   teeAdmissionPolicyOp: () => teeAdmissionPolicyOp,
   teeAuthoringPolicyOp: () => teeAuthoringPolicyOp,
   teeReleaseAdmissionPolicyOp: () => teeReleaseAdmissionPolicyOp,
@@ -6473,6 +6483,19 @@ var CloudClient = class {
       { body }
     );
   }
+  /**
+   * Enable HA for a namespace this ACCOUNT founded through a relay, with the
+   * founder's claim (`signAccountOwnershipClaim`) instead of a node's
+   * ownership proof: a nodeless account holds no node that could issue one.
+   * The login must be linked to that account.
+   */
+  async enableFoundedNamespaceHa(namespaceId, ownershipProof) {
+    return this.request(
+      "POST",
+      `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/enable-ha`,
+      { body: { groups: [], ownership_proof: ownershipProof } }
+    );
+  }
   /**
    * Stop hosting a claimed namespace.
    *
@@ -7589,12 +7612,21 @@ var GROUP_OP = {
   MemberRemoved: 2,
   MemberLeft: 3,
   MemberRoleSet: 4,
-  DefaultCapabilitiesSet: 6
+  MemberCapabilitySet: 5,
+  DefaultCapabilitiesSet: 6,
+  ContextDetached: 9,
+  SubgroupVisibilitySet: 10,
+  GroupMetadataSet: 11,
+  MemberMetadataSet: 12,
+  ContextMetadataSet: 13,
+  ContextCapabilityGranted: 16,
+  ContextCapabilityRevoked: 17
 };
 var ROOT_OP = {
   GroupCreated: 0,
   GroupReparented: 1,
   GroupDeleted: 2,
+  MemberJoinedOpen: 7,
   NamespaceCreatedV2: 9
 };
 var NAMESPACE_ID_DOMAIN = new TextEncoder().encode("calimero.namespace.id.v1");
@@ -7726,6 +7758,87 @@ function namespaceCreatedOp(input) {
     )
   };
 }
+function str(value) {
+  const bytes = new TextEncoder().encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+function optionalStr(value) {
+  return value === void 0 ? tag(0) : concat(tag(1), str(value));
+}
+function stringMap(data = {}) {
+  const enc = new TextEncoder();
+  const entries = Object.entries(data).map(([k, v]) => [enc.encode(k), v, k]).sort(([a], [b]) => {
+    for (let i = 0; i < Math.min(a.length, b.length); i++) if (a[i] !== b[i]) return a[i] - b[i];
+    return a.length - b.length;
+  });
+  return concat(u32le(entries.length), ...entries.flatMap(([, v, k]) => [str(k), str(v)]));
+}
+function relayableMask(capabilities, what) {
+  if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
+    throw new Error(`${what} must be a u32 bit mask, got ${String(capabilities)}`);
+  }
+  if (hasCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
+    throw new Error(`${what} may not include CAN_AUTHOR_ON_BEHALF (512): a relay never carries a change to it`);
+  }
+  return capabilities;
+}
+function memberCapabilitySetOp(member, capabilities) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberCapabilitySet), fromHex(member, "member", 32), u32le(relayableMask(capabilities, "capabilities")))
+  };
+}
+function contextDetachedOp(contextId) {
+  return { kind: "group", bytes: concat(tag(GROUP_OP.ContextDetached), fromHex(contextId, "contextId", 32)) };
+}
+function subgroupVisibilitySetOp(mode) {
+  if (mode !== "open" && mode !== "restricted") throw new Error(`mode must be open or restricted, got ${String(mode)}`);
+  return { kind: "group", bytes: concat(tag(GROUP_OP.SubgroupVisibilitySet), tag(mode === "open" ? 0 : 1)) };
+}
+function groupMetadataSetOp(input = {}) {
+  return { kind: "group", bytes: concat(tag(GROUP_OP.GroupMetadataSet), optionalStr(input.name), stringMap(input.data)) };
+}
+function memberMetadataSetOp(member, input = {}) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberMetadataSet), fromHex(member, "member", 32), optionalStr(input.name), stringMap(input.data))
+  };
+}
+function contextMetadataSetOp(contextId, input = {}) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextMetadataSet), fromHex(contextId, "contextId", 32), optionalStr(input.name), stringMap(input.data))
+  };
+}
+function contextCapability(capability) {
+  if (!Number.isInteger(capability) || capability < 1 || capability > 255) {
+    throw new Error(`capability must be a non-zero u8, got ${String(capability)}`);
+  }
+  return tag(capability);
+}
+function contextCapabilityGrantedOp(contextId, member, capability) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextCapabilityGranted), fromHex(contextId, "contextId", 32), fromHex(member, "member", 32), contextCapability(capability))
+  };
+}
+function contextCapabilityRevokedOp(contextId, member, capability) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextCapabilityRevoked), fromHex(contextId, "contextId", 32), fromHex(member, "member", 32), contextCapability(capability))
+  };
+}
+function memberJoinedOpenOp(input) {
+  return {
+    kind: "root",
+    bytes: concat(
+      tag(ROOT_OP.MemberJoinedOpen),
+      fromHex(input.member, "member", 32),
+      fromHex(input.groupId, "groupId", 32),
+      fromHexUnsized(input.credential, "credential")
+    )
+  };
+}
 
 // src/relay/relay-client.ts
 var DEFAULT_TTL_SECONDS = 300;
@@ -9084,8 +9197,8 @@ async function hkdf2(chainingKey, inputKeyMaterial) {
   return [first, second];
 }
 function base64UrlDecode(value) {
-  const base643 = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = atob(base643 + "=".repeat((4 - base643.length % 4) % 4));
+  const base644 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base644 + "=".repeat((4 - base644.length % 4) % 4));
   return Uint8Array.from(binary, (char) => char.charCodeAt(0));
 }
 
@@ -9741,6 +9854,43 @@ function assertSafeReturnTo(returnTo) {
   );
 }
 
+// src/cloud/account-ownership.ts
+var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
+var DEFAULT_TTL_MS = 6e4;
+var MAX_TTL_MS = 5 * 6e4;
+function base643(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+var hex32 = (value, what) => {
+  if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
+  return value.toLowerCase();
+};
+async function signAccountOwnershipClaim(input) {
+  const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
+  if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
+  if (!input.subject) throw new Error("subject must be the cloud login email");
+  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
+  const issued = (input.now ?? Date.now)();
+  const nonce2 = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
+  const payload = new TextEncoder().encode(
+    JSON.stringify({
+      v: 1,
+      audience: "mdma:enable-ha-namespace",
+      group_id: hex32(input.namespaceId, "namespaceId"),
+      account_id: hex32(input.accountId, "accountId"),
+      salt: hex32(input.salt, "salt"),
+      subject: input.subject,
+      nonce: nonce2,
+      issued_at_ms: issued,
+      expires_at_ms: issued + ttl
+    })
+  );
+  const signature = await signer.sign(concat(DOMAIN, payload));
+  return { kind: "account", credential: input.credential, signed_payload: base643(payload), signature: base643(signature) };
+}
+
 // src/sealed/verify.ts
 var MEASUREMENT_HEX = /^[0-9a-f]{96}$/;
 var REGISTERS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];