@calimero-network/mero-js 23.5.0 → 23.7.0

package/dist/index.cjs

@@ -35,6 +35,7 @@ __export(index_exports, {
   EphemeralClient: () => EphemeralClient,
   HANDSHAKE_PATH: () => HANDSHAKE_PATH,
   HTTPError: () => HTTPError,
+  HaRequestPendingError: () => HaRequestPendingError,
   INVITED_ROLE: () => INVITED_ROLE,
   IntentRefusedError: () => IntentRefusedError,
   LocalStorageTokenStore: () => LocalStorageTokenStore,
@@ -47,6 +48,7 @@ __export(index_exports, {
   PRESENCE_DOMAIN: () => PRESENCE_DOMAIN,
   REQUEST_PROOF_HEADER: () => REQUEST_PROOF_HEADER,
   RelayClient: () => RelayClient,
+  RelayNotDialableError: () => RelayNotDialableError,
   RelayObserver: () => RelayObserver,
   RelayPresenceClient: () => RelayPresenceClient,
   RelayTransport: () => RelayTransport,
@@ -58,6 +60,7 @@ __export(index_exports, {
   SealedTransportError: () => SealedTransportError,
   SseClient: () => SseClient,
   StaleTransportKeyError: () => StaleTransportKeyError,
+  UnknownRelayError: () => UnknownRelayError,
   WarrantNonceExhaustedError: () => WarrantNonceExhaustedError,
   WarrantNonceRouteUnavailableError: () => WarrantNonceRouteUnavailableError,
   WebHttpClient: () => WebHttpClient,
@@ -3696,6 +3699,7 @@ async function resolveSigner(secret, signer, label2) {
 var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
 var DEFAULT_TTL_MS = 6e4;
 var MAX_TTL_MS = 5 * 6e4;
+var MAX_RELAY_URL = 1024;
 var ACCOUNT_OWNERSHIP_AUDIENCE = "mdma:enable-ha-namespace";
 var ACCOUNT_HA_AUDIENCE = "mdma:enable-ha-namespace-as-account";
 function base64(bytes) {
@@ -3707,7 +3711,10 @@ var hex32 = (value, what) => {
   if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
   return value.toLowerCase();
 };
-async function signClaim(input, audience, subject) {
+async function signClaim(input, audience, subject, relayUrl) {
+  if (relayUrl !== void 0 && !(relayUrl.length > 0 && relayUrl.length <= MAX_RELAY_URL)) {
+    throw new Error(`relayUrl must be a non-empty string of at most ${MAX_RELAY_URL} characters`);
+  }
   const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
   if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
   const groupId = hex32(input.namespaceId, "namespaceId");
@@ -3726,7 +3733,8 @@ async function signClaim(input, audience, subject) {
       ...subject === void 0 ? {} : { subject },
       nonce: nonce2,
       issued_at_ms: issued,
-      expires_at_ms: issued + ttl
+      expires_at_ms: issued + ttl,
+      ...relayUrl === void 0 ? {} : { relay_url: relayUrl }
     })
   );
   const signature = await signer.sign(concat(DOMAIN, payload));
@@ -3737,7 +3745,7 @@ async function signAccountOwnershipClaim(input) {
   return signClaim(input, ACCOUNT_OWNERSHIP_AUDIENCE, input.subject);
 }
 async function signAccountHaClaim(input) {
-  return signClaim(input, ACCOUNT_HA_AUDIENCE, void 0);
+  return signClaim(input, ACCOUNT_HA_AUDIENCE, void 0, input.relayUrl);
 }
 
 // src/device-cert/device-cert.ts
@@ -6162,6 +6170,31 @@ var AccountLinkedToSeveralUsersError = class extends AccountHaRefusedError {
   }
 };
 AccountLinkedToSeveralUsersError.CODE = "account_linked_to_several_users";
+var HaRequestPendingError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "HaRequestPendingError";
+  }
+};
+HaRequestPendingError.CODE = "ha_request_pending";
+var UnknownRelayError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "UnknownRelayError";
+  }
+};
+UnknownRelayError.CODE = "unknown_relay";
+var RelayNotDialableError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "RelayNotDialableError";
+  }
+};
+RelayNotDialableError.CODE = "relay_not_dialable";
+var ACCOUNT_HA_REFUSALS = {
+  409: [AccountNotLinkedError, AccountLinkedToSeveralUsersError, HaRequestPendingError],
+  422: [UnknownRelayError, RelayNotDialableError]
+};
 function conflictCode(bodyText) {
   if (!bodyText) return void 0;
   try {
@@ -6584,7 +6617,11 @@ var CloudClient = class {
    * Pass merod's response object straight through. The cloud accepts core's
    * `signerPublicKey`/`signedPayload` casing as well as snake_case, so there is
    * no re-keying step — and getting that wrong used to surface as a `422`
-   * naming three missing fields.
+   * naming three missing fields. Passing it whole also carries the `founding`
+   * and `credential` merod attaches: the cloud accepts a namespace proof only
+   * from a node of the account that founded the namespace, checked with those
+   * two, and only when that account is linked to this login. A node that
+   * predates them, or an admin that did not found the namespace, gets a `422`.
    *
    * Idempotent for the same account. A namespace already claimed by someone
    * else is a `409`; a replayed proof nonce is a `403`.
@@ -6659,7 +6696,8 @@ var CloudClient = class {
       credential: options.credential,
       deviceSecret: options.deviceSecret,
       signer: options.signer,
-      ttlMs: options.ttlMs
+      ttlMs: options.ttlMs,
+      relayUrl: options.relayUrl
     });
     const account = options.accountId.toLowerCase();
     const namespace = options.namespaceId.toLowerCase();
@@ -6670,9 +6708,9 @@ var CloudClient = class {
         { body: { ownership_proof: proof }, anonymous: true }
       );
     } catch (err) {
-      if (err instanceof HTTPError && err.status === 409) {
+      if (err instanceof HTTPError && ACCOUNT_HA_REFUSALS[err.status]) {
         const code = conflictCode(err.bodyText);
-        const Typed = code === AccountNotLinkedError.CODE ? AccountNotLinkedError : code === AccountLinkedToSeveralUsersError.CODE ? AccountLinkedToSeveralUsersError : void 0;
+        const Typed = ACCOUNT_HA_REFUSALS[err.status].find((t) => t.CODE === code);
         if (Typed && code) {
           throw new Typed(code, err.status, err.statusText, err.url, err.headers, err.bodyText);
         }