@calimero-network/mero-js 23.0.0 → 23.2.0

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export * from "./cloud/index.js";
 export * from "./sealed/index.js";
 export * from "./relay/index.js";
 export * from "./request-proof/index.js";
-export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
+export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, memberCapabilitySetOp, contextDetachedOp, subgroupVisibilitySetOp, groupMetadataSetOp, memberMetadataSetOp, contextMetadataSetOp, contextCapabilityGrantedOp, contextCapabilityRevokedOp, memberJoinedOpenOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 export type { Signer } from "./signer/index.js";
 export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, resolveRoot, resolveRootPair, } from "./account/index.js";

package/dist/index.js

@@ -34,7 +34,7 @@ export * from "./relay/index.js";
 // Request proofs — a caller's identity on the request itself, no session needed
 export * from "./request-proof/index.js";
 // Warrant signing — mint the author's consent for a relay to run one intent
-export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
+export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, memberCapabilitySetOp, contextDetachedOp, subgroupVisibilitySetOp, groupMetadataSetOp, memberMetadataSetOp, contextMetadataSetOp, contextCapabilityGrantedOp, contextCapabilityRevokedOp, memberJoinedOpenOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 // Who signs — a key's capability, separated from its material, so a
 // non-extractable key can be used wherever a hex secret could.
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";

package/dist/index.mjs

@@ -6274,6 +6274,19 @@ var CloudClient = class {
       { body }
     );
   }
+  /**
+   * Enable HA for a namespace this ACCOUNT founded through a relay, with the
+   * founder's claim (`signAccountOwnershipClaim`) instead of a node's
+   * ownership proof: a nodeless account holds no node that could issue one.
+   * The login must be linked to that account.
+   */
+  async enableFoundedNamespaceHa(namespaceId, ownershipProof) {
+    return this.request(
+      "POST",
+      `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/enable-ha`,
+      { body: { groups: [], ownership_proof: ownershipProof } }
+    );
+  }
   /**
    * Stop hosting a claimed namespace.
    *
@@ -7390,12 +7403,21 @@ var GROUP_OP = {
   MemberRemoved: 2,
   MemberLeft: 3,
   MemberRoleSet: 4,
-  DefaultCapabilitiesSet: 6
+  MemberCapabilitySet: 5,
+  DefaultCapabilitiesSet: 6,
+  ContextDetached: 9,
+  SubgroupVisibilitySet: 10,
+  GroupMetadataSet: 11,
+  MemberMetadataSet: 12,
+  ContextMetadataSet: 13,
+  ContextCapabilityGranted: 16,
+  ContextCapabilityRevoked: 17
 };
 var ROOT_OP = {
   GroupCreated: 0,
   GroupReparented: 1,
   GroupDeleted: 2,
+  MemberJoinedOpen: 7,
   NamespaceCreatedV2: 9
 };
 var NAMESPACE_ID_DOMAIN = new TextEncoder().encode("calimero.namespace.id.v1");
@@ -7527,6 +7549,87 @@ function namespaceCreatedOp(input) {
     )
   };
 }
+function str(value) {
+  const bytes = new TextEncoder().encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+function optionalStr(value) {
+  return value === void 0 ? tag(0) : concat(tag(1), str(value));
+}
+function stringMap(data = {}) {
+  const enc = new TextEncoder();
+  const entries = Object.entries(data).map(([k, v]) => [enc.encode(k), v, k]).sort(([a], [b]) => {
+    for (let i = 0; i < Math.min(a.length, b.length); i++) if (a[i] !== b[i]) return a[i] - b[i];
+    return a.length - b.length;
+  });
+  return concat(u32le(entries.length), ...entries.flatMap(([, v, k]) => [str(k), str(v)]));
+}
+function relayableMask(capabilities, what) {
+  if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
+    throw new Error(`${what} must be a u32 bit mask, got ${String(capabilities)}`);
+  }
+  if (hasCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
+    throw new Error(`${what} may not include CAN_AUTHOR_ON_BEHALF (512): a relay never carries a change to it`);
+  }
+  return capabilities;
+}
+function memberCapabilitySetOp(member, capabilities) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberCapabilitySet), fromHex(member, "member", 32), u32le(relayableMask(capabilities, "capabilities")))
+  };
+}
+function contextDetachedOp(contextId) {
+  return { kind: "group", bytes: concat(tag(GROUP_OP.ContextDetached), fromHex(contextId, "contextId", 32)) };
+}
+function subgroupVisibilitySetOp(mode) {
+  if (mode !== "open" && mode !== "restricted") throw new Error(`mode must be open or restricted, got ${String(mode)}`);
+  return { kind: "group", bytes: concat(tag(GROUP_OP.SubgroupVisibilitySet), tag(mode === "open" ? 0 : 1)) };
+}
+function groupMetadataSetOp(input = {}) {
+  return { kind: "group", bytes: concat(tag(GROUP_OP.GroupMetadataSet), optionalStr(input.name), stringMap(input.data)) };
+}
+function memberMetadataSetOp(member, input = {}) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberMetadataSet), fromHex(member, "member", 32), optionalStr(input.name), stringMap(input.data))
+  };
+}
+function contextMetadataSetOp(contextId, input = {}) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextMetadataSet), fromHex(contextId, "contextId", 32), optionalStr(input.name), stringMap(input.data))
+  };
+}
+function contextCapability(capability) {
+  if (!Number.isInteger(capability) || capability < 1 || capability > 255) {
+    throw new Error(`capability must be a non-zero u8, got ${String(capability)}`);
+  }
+  return tag(capability);
+}
+function contextCapabilityGrantedOp(contextId, member, capability) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextCapabilityGranted), fromHex(contextId, "contextId", 32), fromHex(member, "member", 32), contextCapability(capability))
+  };
+}
+function contextCapabilityRevokedOp(contextId, member, capability) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextCapabilityRevoked), fromHex(contextId, "contextId", 32), fromHex(member, "member", 32), contextCapability(capability))
+  };
+}
+function memberJoinedOpenOp(input) {
+  return {
+    kind: "root",
+    bytes: concat(
+      tag(ROOT_OP.MemberJoinedOpen),
+      fromHex(input.member, "member", 32),
+      fromHex(input.groupId, "groupId", 32),
+      fromHexUnsized(input.credential, "credential")
+    )
+  };
+}
 
 // src/relay/relay-client.ts
 var DEFAULT_TTL_SECONDS = 300;
@@ -8885,8 +8988,8 @@ async function hkdf2(chainingKey, inputKeyMaterial) {
   return [first, second];
 }
 function base64UrlDecode(value) {
-  const base643 = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = atob(base643 + "=".repeat((4 - base643.length % 4) % 4));
+  const base644 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base644 + "=".repeat((4 - base644.length % 4) % 4));
   return Uint8Array.from(binary, (char) => char.charCodeAt(0));
 }
 
@@ -9542,6 +9645,43 @@ function assertSafeReturnTo(returnTo) {
   );
 }
 
+// src/cloud/account-ownership.ts
+var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
+var DEFAULT_TTL_MS = 6e4;
+var MAX_TTL_MS = 5 * 6e4;
+function base643(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+var hex32 = (value, what) => {
+  if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
+  return value.toLowerCase();
+};
+async function signAccountOwnershipClaim(input) {
+  const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
+  if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
+  if (!input.subject) throw new Error("subject must be the cloud login email");
+  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
+  const issued = (input.now ?? Date.now)();
+  const nonce2 = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
+  const payload = new TextEncoder().encode(
+    JSON.stringify({
+      v: 1,
+      audience: "mdma:enable-ha-namespace",
+      group_id: hex32(input.namespaceId, "namespaceId"),
+      account_id: hex32(input.accountId, "accountId"),
+      salt: hex32(input.salt, "salt"),
+      subject: input.subject,
+      nonce: nonce2,
+      issued_at_ms: issued,
+      expires_at_ms: issued + ttl
+    })
+  );
+  const signature = await signer.sign(concat(DOMAIN, payload));
+  return { kind: "account", credential: input.credential, signed_payload: base643(payload), signature: base643(signature) };
+}
+
 // src/sealed/verify.ts
 var MEASUREMENT_HEX = /^[0-9a-f]{96}$/;
 var REGISTERS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];
@@ -10801,6 +10941,10 @@ export {
   completeDeviceEnrolment,
   connectCloud,
   connectCloudWithAccount,
+  contextCapabilityGrantedOp,
+  contextCapabilityRevokedOp,
+  contextDetachedOp,
+  contextMetadataSetOp,
   createAccountRootSigner,
   createAdminApiClient,
   createAdminApiClientFromHttpClient,
@@ -10850,6 +10994,7 @@ export {
   groupDeleteOp,
   groupDeletedOp,
   groupInvitationHash,
+  groupMetadataSetOp,
   groupReparentedOp,
   hasCap,
   hexEncodeUtf8,
@@ -10859,7 +11004,10 @@ export {
   localNodeUrl,
   login,
   memberAddedOp,
+  memberCapabilitySetOp,
+  memberJoinedOpenOp,
   memberLeftOp,
+  memberMetadataSetOp,
   memberRemovedOp,
   memberRoleSetOp,
   mintDeviceId,
@@ -10886,6 +11034,7 @@ export {
   shouldRetain,
   signAccountLink,
   signAccountLogin,
+  signAccountOwnershipClaim,
   signCreationWarrant,
   signDeviceCert,
   signDeviceScope,
@@ -10902,6 +11051,7 @@ export {
   signerFromCryptoKey,
   signerFromSecret,
   subgroupCreation,
+  subgroupVisibilitySetOp,
   teeAdmissionPolicyOp,
   teeAuthoringPolicyOp,
   teeReleaseAdmissionPolicyOp,