@calimero-network/mero-js 23.4.3 → 23.6.0

package/dist/index.mjs

@@ -3471,6 +3471,59 @@ async function resolveSigner(secret, signer, label2) {
   throw new Error(`${label2} or signer is required`);
 }
 
+// src/cloud/account-ownership.ts
+var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
+var DEFAULT_TTL_MS = 6e4;
+var MAX_TTL_MS = 5 * 6e4;
+var MAX_RELAY_URL = 1024;
+var ACCOUNT_OWNERSHIP_AUDIENCE = "mdma:enable-ha-namespace";
+var ACCOUNT_HA_AUDIENCE = "mdma:enable-ha-namespace-as-account";
+function base64(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+var hex32 = (value, what) => {
+  if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
+  return value.toLowerCase();
+};
+async function signClaim(input, audience, subject, relayUrl) {
+  if (relayUrl !== void 0 && !(relayUrl.length > 0 && relayUrl.length <= MAX_RELAY_URL)) {
+    throw new Error(`relayUrl must be a non-empty string of at most ${MAX_RELAY_URL} characters`);
+  }
+  const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
+  if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
+  const groupId = hex32(input.namespaceId, "namespaceId");
+  const accountId = hex32(input.accountId, "accountId");
+  const salt = hex32(input.salt, "salt");
+  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
+  const issued = (input.now ?? Date.now)();
+  const nonce2 = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
+  const payload = new TextEncoder().encode(
+    JSON.stringify({
+      v: 1,
+      audience,
+      group_id: groupId,
+      account_id: accountId,
+      salt,
+      ...subject === void 0 ? {} : { subject },
+      nonce: nonce2,
+      issued_at_ms: issued,
+      expires_at_ms: issued + ttl,
+      ...relayUrl === void 0 ? {} : { relay_url: relayUrl }
+    })
+  );
+  const signature = await signer.sign(concat(DOMAIN, payload));
+  return { kind: "account", credential: input.credential, signed_payload: base64(payload), signature: base64(signature) };
+}
+async function signAccountOwnershipClaim(input) {
+  if (!input.subject) throw new Error("subject must be the cloud login email");
+  return signClaim(input, ACCOUNT_OWNERSHIP_AUDIENCE, input.subject);
+}
+async function signAccountHaClaim(input) {
+  return signClaim(input, ACCOUNT_HA_AUDIENCE, void 0, input.relayUrl);
+}
+
 // src/device-cert/device-cert.ts
 var CERT_DOMAIN = new TextEncoder().encode("calimero.device.cert.v1");
 var ACCOUNT_ID_DOMAIN = new TextEncoder().encode("calimero.account.genesis.v1");
@@ -5762,7 +5815,7 @@ async function signAccountLink(input) {
   const signature = await signer.sign(
     concat(ACCOUNT_LINK_DOMAIN, new TextEncoder().encode(input.nonce))
   );
-  return base64(signature);
+  return base642(signature);
 }
 async function signAccountLogin(input) {
   if (!input.nonce) throw new Error("nonce is required to sign an account login");
@@ -5770,7 +5823,7 @@ async function signAccountLogin(input) {
   const signature = await signer.sign(
     concat(ACCOUNT_LOGIN_DOMAIN, new TextEncoder().encode(input.nonce))
   );
-  return base64(signature);
+  return base642(signature);
 }
 async function withPhrase(secret, phrase) {
   return { ...await accountRootFromSecret(secret), phrase };
@@ -5823,7 +5876,7 @@ function bitsOf(bytes) {
   for (const byte of bytes) bits += byte.toString(2).padStart(8, "0");
   return bits;
 }
-function base64(bytes) {
+function base642(bytes) {
   let binary = "";
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa(binary);
@@ -5843,7 +5896,7 @@ async function signRoutingChallenge(nonce2, deviceSecret) {
   const signature = new Uint8Array(
     await crypto.subtle.sign({ name: "Ed25519" }, key, message)
   );
-  return base642(signature);
+  return base643(signature);
 }
 async function routingProofHeaders(challenge, credential) {
   return {
@@ -5855,7 +5908,7 @@ async function routingProofHeaders(challenge, credential) {
     )
   };
 }
-function base642(bytes) {
+function base643(bytes) {
   let binary = "";
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa(binary);
@@ -5872,6 +5925,64 @@ function teeRoleOf(row) {
 function pickExecutingRelay(relays) {
   return relays.find((r) => r.canExecute && r.relayUrl !== null && r.executorAccount !== null) ?? null;
 }
+var AccountHaRefusedError = class extends HTTPError {
+  constructor(code, status, statusText, url, headers, bodyText) {
+    super(status, statusText, url, headers, bodyText);
+    this.code = code;
+    this.name = "AccountHaRefusedError";
+  }
+};
+var AccountNotLinkedError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "AccountNotLinkedError";
+  }
+};
+AccountNotLinkedError.CODE = "account_not_linked";
+var AccountLinkedToSeveralUsersError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "AccountLinkedToSeveralUsersError";
+  }
+};
+AccountLinkedToSeveralUsersError.CODE = "account_linked_to_several_users";
+var HaRequestPendingError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "HaRequestPendingError";
+  }
+};
+HaRequestPendingError.CODE = "ha_request_pending";
+var UnknownRelayError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "UnknownRelayError";
+  }
+};
+UnknownRelayError.CODE = "unknown_relay";
+var RelayNotDialableError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "RelayNotDialableError";
+  }
+};
+RelayNotDialableError.CODE = "relay_not_dialable";
+var ACCOUNT_HA_REFUSALS = {
+  409: [AccountNotLinkedError, AccountLinkedToSeveralUsersError, HaRequestPendingError],
+  422: [UnknownRelayError, RelayNotDialableError]
+};
+function conflictCode(bodyText) {
+  if (!bodyText) return void 0;
+  try {
+    const body = JSON.parse(bodyText);
+    if (typeof body?.error === "string") return body.error;
+    if (typeof body?.detail === "string") return body.detail;
+    const nested = body?.detail?.error;
+    if (typeof nested === "string") return nested;
+  } catch {
+  }
+  return void 0;
+}
 var REFRESH_HEADER = "x-mdma-session-refresh";
 var REFRESH_EXPIRES_HEADER = "x-mdma-session-expires";
 var CloudClient = class {
@@ -6332,6 +6443,53 @@ var CloudClient = class {
       { body: { groups: [], ownership_proof: ownershipProof } }
     );
   }
+  /**
+   * Enable HA for a namespace this account founded, with **no cloud session**.
+   *
+   * The anonymous sibling of {@link enableFoundedNamespaceHa}: it signs the
+   * founder's claim itself ({@link signAccountHaClaim} — no `subject`, its own
+   * audience) and posts it to
+   * `/api/cloud/accounts/{accountId}/namespaces/{namespaceId}/enable-ha`. The
+   * cloud bills the user the account is linked to through the wallet, so the
+   * account must be linked to exactly one:
+   *
+   * - not linked at all → {@link AccountNotLinkedError};
+   * - linked to several → {@link AccountLinkedToSeveralUsersError}.
+   *
+   * A claim that does not verify is a `403` `HTTPError`; quota and the rest
+   * answer as the session route does. Returns the cloud's response body, the
+   * same shape the session route's enable-ha returns.
+   */
+  async enableHaAsAccount(options) {
+    const proof = await signAccountHaClaim({
+      namespaceId: options.namespaceId,
+      accountId: options.accountId,
+      salt: options.salt,
+      credential: options.credential,
+      deviceSecret: options.deviceSecret,
+      signer: options.signer,
+      ttlMs: options.ttlMs,
+      relayUrl: options.relayUrl
+    });
+    const account = options.accountId.toLowerCase();
+    const namespace = options.namespaceId.toLowerCase();
+    try {
+      return await this.request(
+        "POST",
+        `/api/cloud/accounts/${encodeURIComponent(account)}/namespaces/${encodeURIComponent(namespace)}/enable-ha`,
+        { body: { ownership_proof: proof }, anonymous: true }
+      );
+    } catch (err) {
+      if (err instanceof HTTPError && ACCOUNT_HA_REFUSALS[err.status]) {
+        const code = conflictCode(err.bodyText);
+        const Typed = ACCOUNT_HA_REFUSALS[err.status].find((t) => t.CODE === code);
+        if (Typed && code) {
+          throw new Typed(code, err.status, err.statusText, err.url, err.headers, err.bodyText);
+        }
+      }
+      throw err;
+    }
+  }
   /**
    * Stop hosting a claimed namespace.
    *
@@ -9840,43 +9998,6 @@ function assertSafeReturnTo(returnTo) {
   );
 }
 
-// src/cloud/account-ownership.ts
-var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
-var DEFAULT_TTL_MS = 6e4;
-var MAX_TTL_MS = 5 * 6e4;
-function base643(bytes) {
-  let binary = "";
-  for (const b of bytes) binary += String.fromCharCode(b);
-  return btoa(binary);
-}
-var hex32 = (value, what) => {
-  if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
-  return value.toLowerCase();
-};
-async function signAccountOwnershipClaim(input) {
-  const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
-  if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
-  if (!input.subject) throw new Error("subject must be the cloud login email");
-  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
-  const issued = (input.now ?? Date.now)();
-  const nonce2 = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, "0")).join("");
-  const payload = new TextEncoder().encode(
-    JSON.stringify({
-      v: 1,
-      audience: "mdma:enable-ha-namespace",
-      group_id: hex32(input.namespaceId, "namespaceId"),
-      account_id: hex32(input.accountId, "accountId"),
-      salt: hex32(input.salt, "salt"),
-      subject: input.subject,
-      nonce: nonce2,
-      issued_at_ms: issued,
-      expires_at_ms: issued + ttl
-    })
-  );
-  const signature = await signer.sign(concat(DOMAIN, payload));
-  return { kind: "account", credential: input.credential, signed_payload: base643(payload), signature: base643(signature) };
-}
-
 // src/sealed/verify.ts
 var MEASUREMENT_HEX = /^[0-9a-f]{96}$/;
 var REGISTERS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];
@@ -11074,6 +11195,11 @@ async function attestRelayNodeKey(opts) {
   return { nodeKey: hex(nodeKey), mock };
 }
 export {
+  ACCOUNT_HA_AUDIENCE,
+  ACCOUNT_OWNERSHIP_AUDIENCE,
+  AccountHaRefusedError,
+  AccountLinkedToSeveralUsersError,
+  AccountNotLinkedError,
   AdminApiClient,
   AuthApiClient,
   AuthRevokedError,
@@ -11085,6 +11211,7 @@ export {
   EphemeralClient,
   HANDSHAKE_PATH,
   HTTPError,
+  HaRequestPendingError,
   INVITED_ROLE,
   IntentRefusedError,
   LocalStorageTokenStore,
@@ -11097,6 +11224,7 @@ export {
   PRESENCE_DOMAIN,
   REQUEST_PROOF_HEADER,
   RelayClient,
+  RelayNotDialableError,
   RelayObserver,
   RelayPresenceClient,
   RelayTransport,
@@ -11108,6 +11236,7 @@ export {
   SealedTransportError,
   SseClient,
   StaleTransportKeyError,
+  UnknownRelayError,
   WarrantNonceExhaustedError,
   WarrantNonceRouteUnavailableError,
   WebHttpClient,
@@ -11230,6 +11359,7 @@ export {
   rootGuardedOpBytes,
   routingProofHeaders,
   shouldRetain,
+  signAccountHaClaim,
   signAccountLink,
   signAccountLogin,
   signAccountOwnershipClaim,