@calimero-network/mero-js 23.4.2 → 23.5.0

package/dist/index.mjs

@@ -2752,6 +2752,14 @@ var SseClient = class {
     this.reconnectTimer = null;
     this.subscribedContextIds = /* @__PURE__ */ new Set();
     this.subscribedGroupIds = /* @__PURE__ */ new Set();
+    /**
+     * The current presence of each subscribed context, as the node's replay and
+     * its live deltas left it: author → that author's last `Ephemeral` data and
+     * when it arrived. The node replays a context's presence once, when the
+     * context is first subscribed on this connection, so a presence listener
+     * that comes later would never see it; {@link presenceSeed} gives it this.
+     */
+    this.presence = /* @__PURE__ */ new Map();
     this.closed = false;
     this.listeners = { connect: [], event: [], error: [] };
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
@@ -2917,6 +2925,7 @@ var SseClient = class {
       if (msg.type === "connect" && msg.session_id) {
         this.sessionId = msg.session_id;
         this.emit("connect", msg.session_id);
+        this.presence.clear();
         if (this.subscribedContextIds.size > 0 || this.subscribedGroupIds.size > 0) {
           this.sendSubscription("subscribe", {
             contextIds: [...this.subscribedContextIds],
@@ -2936,6 +2945,7 @@ var SseClient = class {
         }
       }
       if (msg.result.contextId) {
+        if (msg.result.type === "Ephemeral") this.notePresence(msg.result.contextId, eventData);
         this.emit("event", {
           contextId: msg.result.contextId,
           // Forward the event tag (sibling of `data` in core's flattened
@@ -2969,12 +2979,38 @@ var SseClient = class {
       await this.sendSubscription("subscribe", { contextIds: newContextIds, groupIds: newGroupIds });
     }
   }
+  /** Whether this connection holds `contextId`'s events. */
+  isSubscribed(contextId) {
+    return this.subscribedContextIds.has(contextId);
+  }
+  /**
+   * The presence currently known for `contextId`, as `Ephemeral` event data,
+   * each entry's `ageMs` advanced by how long ago it arrived. Empty for a
+   * context this connection does not hold.
+   */
+  presenceSeed(contextId) {
+    const now = Date.now();
+    return [...this.presence.get(contextId)?.values() ?? []].map(({ data, at }) => ({
+      ...data,
+      ageMs: (typeof data.ageMs === "number" ? data.ageMs : 0) + (now - at)
+    }));
+  }
+  notePresence(contextId, data) {
+    if (!this.subscribedContextIds.has(contextId)) return;
+    const d = data;
+    if (!d || typeof d.author !== "string") return;
+    let byAuthor = this.presence.get(contextId);
+    if (!byAuthor) this.presence.set(contextId, byAuthor = /* @__PURE__ */ new Map());
+    if (d.removed) byAuthor.delete(d.author);
+    else byAuthor.set(d.author, { data: d, at: Date.now() });
+  }
   async unsubscribe(idsOrOpts) {
     const opts = Array.isArray(idsOrOpts) ? { contextIds: idsOrOpts } : idsOrOpts;
     const hadContextIds = (opts.contextIds ?? []).filter((id) => this.subscribedContextIds.has(id));
     const hadGroupIds = (opts.groupIds ?? []).filter((id) => this.subscribedGroupIds.has(id));
     for (const id of opts.contextIds ?? []) {
       this.subscribedContextIds.delete(id);
+      this.presence.delete(id);
     }
     for (const id of opts.groupIds ?? []) {
       this.subscribedGroupIds.delete(id);
@@ -3312,6 +3348,11 @@ function subscribePresence(sse, contextId, handler, codec = jsonCodec()) {
     handler(entry);
   };
   sse.on("event", listener);
+  if (sse.isSubscribed?.(contextId)) {
+    for (const data of sse.presenceSeed?.(contextId) ?? []) {
+      listener({ contextId, type: "Ephemeral", data });
+    }
+  }
   void sse.connect().catch(() => void 0);
   void sse.subscribe([contextId]).catch(() => void 0);
   return () => {
@@ -3430,6 +3471,54 @@ async function resolveSigner(secret, signer, label2) {
   throw new Error(`${label2} or signer is required`);
 }
 
+// src/cloud/account-ownership.ts
+var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
+var DEFAULT_TTL_MS = 6e4;
+var MAX_TTL_MS = 5 * 6e4;
+var ACCOUNT_OWNERSHIP_AUDIENCE = "mdma:enable-ha-namespace";
+var ACCOUNT_HA_AUDIENCE = "mdma:enable-ha-namespace-as-account";
+function base64(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+var hex32 = (value, what) => {
+  if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
+  return value.toLowerCase();
+};
+async function signClaim(input, audience, subject) {
+  const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
+  if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
+  const groupId = hex32(input.namespaceId, "namespaceId");
+  const accountId = hex32(input.accountId, "accountId");
+  const salt = hex32(input.salt, "salt");
+  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
+  const issued = (input.now ?? Date.now)();
+  const nonce2 = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
+  const payload = new TextEncoder().encode(
+    JSON.stringify({
+      v: 1,
+      audience,
+      group_id: groupId,
+      account_id: accountId,
+      salt,
+      ...subject === void 0 ? {} : { subject },
+      nonce: nonce2,
+      issued_at_ms: issued,
+      expires_at_ms: issued + ttl
+    })
+  );
+  const signature = await signer.sign(concat(DOMAIN, payload));
+  return { kind: "account", credential: input.credential, signed_payload: base64(payload), signature: base64(signature) };
+}
+async function signAccountOwnershipClaim(input) {
+  if (!input.subject) throw new Error("subject must be the cloud login email");
+  return signClaim(input, ACCOUNT_OWNERSHIP_AUDIENCE, input.subject);
+}
+async function signAccountHaClaim(input) {
+  return signClaim(input, ACCOUNT_HA_AUDIENCE, void 0);
+}
+
 // src/device-cert/device-cert.ts
 var CERT_DOMAIN = new TextEncoder().encode("calimero.device.cert.v1");
 var ACCOUNT_ID_DOMAIN = new TextEncoder().encode("calimero.account.genesis.v1");
@@ -5721,7 +5810,7 @@ async function signAccountLink(input) {
   const signature = await signer.sign(
     concat(ACCOUNT_LINK_DOMAIN, new TextEncoder().encode(input.nonce))
   );
-  return base64(signature);
+  return base642(signature);
 }
 async function signAccountLogin(input) {
   if (!input.nonce) throw new Error("nonce is required to sign an account login");
@@ -5729,7 +5818,7 @@ async function signAccountLogin(input) {
   const signature = await signer.sign(
     concat(ACCOUNT_LOGIN_DOMAIN, new TextEncoder().encode(input.nonce))
   );
-  return base64(signature);
+  return base642(signature);
 }
 async function withPhrase(secret, phrase) {
   return { ...await accountRootFromSecret(secret), phrase };
@@ -5782,7 +5871,7 @@ function bitsOf(bytes) {
   for (const byte of bytes) bits += byte.toString(2).padStart(8, "0");
   return bits;
 }
-function base64(bytes) {
+function base642(bytes) {
   let binary = "";
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa(binary);
@@ -5802,7 +5891,7 @@ async function signRoutingChallenge(nonce2, deviceSecret) {
   const signature = new Uint8Array(
     await crypto.subtle.sign({ name: "Ed25519" }, key, message)
   );
-  return base642(signature);
+  return base643(signature);
 }
 async function routingProofHeaders(challenge, credential) {
   return {
@@ -5814,7 +5903,7 @@ async function routingProofHeaders(challenge, credential) {
     )
   };
 }
-function base642(bytes) {
+function base643(bytes) {
   let binary = "";
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa(binary);
@@ -5831,6 +5920,39 @@ function teeRoleOf(row) {
 function pickExecutingRelay(relays) {
   return relays.find((r) => r.canExecute && r.relayUrl !== null && r.executorAccount !== null) ?? null;
 }
+var AccountHaRefusedError = class extends HTTPError {
+  constructor(code, status, statusText, url, headers, bodyText) {
+    super(status, statusText, url, headers, bodyText);
+    this.code = code;
+    this.name = "AccountHaRefusedError";
+  }
+};
+var AccountNotLinkedError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "AccountNotLinkedError";
+  }
+};
+AccountNotLinkedError.CODE = "account_not_linked";
+var AccountLinkedToSeveralUsersError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "AccountLinkedToSeveralUsersError";
+  }
+};
+AccountLinkedToSeveralUsersError.CODE = "account_linked_to_several_users";
+function conflictCode(bodyText) {
+  if (!bodyText) return void 0;
+  try {
+    const body = JSON.parse(bodyText);
+    if (typeof body?.error === "string") return body.error;
+    if (typeof body?.detail === "string") return body.detail;
+    const nested = body?.detail?.error;
+    if (typeof nested === "string") return nested;
+  } catch {
+  }
+  return void 0;
+}
 var REFRESH_HEADER = "x-mdma-session-refresh";
 var REFRESH_EXPIRES_HEADER = "x-mdma-session-expires";
 var CloudClient = class {
@@ -6291,6 +6413,52 @@ var CloudClient = class {
       { body: { groups: [], ownership_proof: ownershipProof } }
     );
   }
+  /**
+   * Enable HA for a namespace this account founded, with **no cloud session**.
+   *
+   * The anonymous sibling of {@link enableFoundedNamespaceHa}: it signs the
+   * founder's claim itself ({@link signAccountHaClaim} — no `subject`, its own
+   * audience) and posts it to
+   * `/api/cloud/accounts/{accountId}/namespaces/{namespaceId}/enable-ha`. The
+   * cloud bills the user the account is linked to through the wallet, so the
+   * account must be linked to exactly one:
+   *
+   * - not linked at all → {@link AccountNotLinkedError};
+   * - linked to several → {@link AccountLinkedToSeveralUsersError}.
+   *
+   * A claim that does not verify is a `403` `HTTPError`; quota and the rest
+   * answer as the session route does. Returns the cloud's response body, the
+   * same shape the session route's enable-ha returns.
+   */
+  async enableHaAsAccount(options) {
+    const proof = await signAccountHaClaim({
+      namespaceId: options.namespaceId,
+      accountId: options.accountId,
+      salt: options.salt,
+      credential: options.credential,
+      deviceSecret: options.deviceSecret,
+      signer: options.signer,
+      ttlMs: options.ttlMs
+    });
+    const account = options.accountId.toLowerCase();
+    const namespace = options.namespaceId.toLowerCase();
+    try {
+      return await this.request(
+        "POST",
+        `/api/cloud/accounts/${encodeURIComponent(account)}/namespaces/${encodeURIComponent(namespace)}/enable-ha`,
+        { body: { ownership_proof: proof }, anonymous: true }
+      );
+    } catch (err) {
+      if (err instanceof HTTPError && err.status === 409) {
+        const code = conflictCode(err.bodyText);
+        const Typed = code === AccountNotLinkedError.CODE ? AccountNotLinkedError : code === AccountLinkedToSeveralUsersError.CODE ? AccountLinkedToSeveralUsersError : void 0;
+        if (Typed && code) {
+          throw new Typed(code, err.status, err.statusText, err.url, err.headers, err.bodyText);
+        }
+      }
+      throw err;
+    }
+  }
   /**
    * Stop hosting a claimed namespace.
    *
@@ -9799,43 +9967,6 @@ function assertSafeReturnTo(returnTo) {
   );
 }
 
-// src/cloud/account-ownership.ts
-var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
-var DEFAULT_TTL_MS = 6e4;
-var MAX_TTL_MS = 5 * 6e4;
-function base643(bytes) {
-  let binary = "";
-  for (const b of bytes) binary += String.fromCharCode(b);
-  return btoa(binary);
-}
-var hex32 = (value, what) => {
-  if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
-  return value.toLowerCase();
-};
-async function signAccountOwnershipClaim(input) {
-  const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
-  if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
-  if (!input.subject) throw new Error("subject must be the cloud login email");
-  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
-  const issued = (input.now ?? Date.now)();
-  const nonce2 = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
-  const payload = new TextEncoder().encode(
-    JSON.stringify({
-      v: 1,
-      audience: "mdma:enable-ha-namespace",
-      group_id: hex32(input.namespaceId, "namespaceId"),
-      account_id: hex32(input.accountId, "accountId"),
-      salt: hex32(input.salt, "salt"),
-      subject: input.subject,
-      nonce: nonce2,
-      issued_at_ms: issued,
-      expires_at_ms: issued + ttl
-    })
-  );
-  const signature = await signer.sign(concat(DOMAIN, payload));
-  return { kind: "account", credential: input.credential, signed_payload: base643(payload), signature: base643(signature) };
-}
-
 // src/sealed/verify.ts
 var MEASUREMENT_HEX = /^[0-9a-f]{96}$/;
 var REGISTERS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];
@@ -11033,6 +11164,11 @@ async function attestRelayNodeKey(opts) {
   return { nodeKey: hex(nodeKey), mock };
 }
 export {
+  ACCOUNT_HA_AUDIENCE,
+  ACCOUNT_OWNERSHIP_AUDIENCE,
+  AccountHaRefusedError,
+  AccountLinkedToSeveralUsersError,
+  AccountNotLinkedError,
   AdminApiClient,
   AuthApiClient,
   AuthRevokedError,
@@ -11189,6 +11325,7 @@ export {
   rootGuardedOpBytes,
   routingProofHeaders,
   shouldRetain,
+  signAccountHaClaim,
   signAccountLink,
   signAccountLogin,
   signAccountOwnershipClaim,