@calimero-network/mero-js 23.1.0 → 23.2.0

package/dist/index.cjs

@@ -174,6 +174,7 @@ __export(index_exports, {
   shouldRetain: () => shouldRetain,
   signAccountLink: () => signAccountLink,
   signAccountLogin: () => signAccountLogin,
+  signAccountOwnershipClaim: () => signAccountOwnershipClaim,
   signCreationWarrant: () => signCreationWarrant,
   signDeviceCert: () => signDeviceCert,
   signDeviceScope: () => signDeviceScope,
@@ -6482,6 +6483,19 @@ var CloudClient = class {
       { body }
     );
   }
+  /**
+   * Enable HA for a namespace this ACCOUNT founded through a relay, with the
+   * founder's claim (`signAccountOwnershipClaim`) instead of a node's
+   * ownership proof: a nodeless account holds no node that could issue one.
+   * The login must be linked to that account.
+   */
+  async enableFoundedNamespaceHa(namespaceId, ownershipProof) {
+    return this.request(
+      "POST",
+      `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/enable-ha`,
+      { body: { groups: [], ownership_proof: ownershipProof } }
+    );
+  }
   /**
    * Stop hosting a claimed namespace.
    *
@@ -9183,8 +9197,8 @@ async function hkdf2(chainingKey, inputKeyMaterial) {
   return [first, second];
 }
 function base64UrlDecode(value) {
-  const base643 = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = atob(base643 + "=".repeat((4 - base643.length % 4) % 4));
+  const base644 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base644 + "=".repeat((4 - base644.length % 4) % 4));
   return Uint8Array.from(binary, (char) => char.charCodeAt(0));
 }
 
@@ -9840,6 +9854,43 @@ function assertSafeReturnTo(returnTo) {
   );
 }
 
+// src/cloud/account-ownership.ts
+var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
+var DEFAULT_TTL_MS = 6e4;
+var MAX_TTL_MS = 5 * 6e4;
+function base643(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+var hex32 = (value, what) => {
+  if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
+  return value.toLowerCase();
+};
+async function signAccountOwnershipClaim(input) {
+  const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
+  if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
+  if (!input.subject) throw new Error("subject must be the cloud login email");
+  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
+  const issued = (input.now ?? Date.now)();
+  const nonce2 = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
+  const payload = new TextEncoder().encode(
+    JSON.stringify({
+      v: 1,
+      audience: "mdma:enable-ha-namespace",
+      group_id: hex32(input.namespaceId, "namespaceId"),
+      account_id: hex32(input.accountId, "accountId"),
+      salt: hex32(input.salt, "salt"),
+      subject: input.subject,
+      nonce: nonce2,
+      issued_at_ms: issued,
+      expires_at_ms: issued + ttl
+    })
+  );
+  const signature = await signer.sign(concat(DOMAIN, payload));
+  return { kind: "account", credential: input.credential, signed_payload: base643(payload), signature: base643(signature) };
+}
+
 // src/sealed/verify.ts
 var MEASUREMENT_HEX = /^[0-9a-f]{96}$/;
 var REGISTERS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];