@calimero-network/mero-js 23.5.0 → 23.7.0

package/dist/index.mjs

@@ -3475,6 +3475,7 @@ async function resolveSigner(secret, signer, label2) {
 var DOMAIN = new TextEncoder().encode("calimero.mdma.account-ownership-claim.v1\0");
 var DEFAULT_TTL_MS = 6e4;
 var MAX_TTL_MS = 5 * 6e4;
+var MAX_RELAY_URL = 1024;
 var ACCOUNT_OWNERSHIP_AUDIENCE = "mdma:enable-ha-namespace";
 var ACCOUNT_HA_AUDIENCE = "mdma:enable-ha-namespace-as-account";
 function base64(bytes) {
@@ -3486,7 +3487,10 @@ var hex32 = (value, what) => {
   if (!/^[0-9a-fA-F]{64}$/.test(value)) throw new Error(`${what} must be 64 hex characters`);
   return value.toLowerCase();
 };
-async function signClaim(input, audience, subject) {
+async function signClaim(input, audience, subject, relayUrl) {
+  if (relayUrl !== void 0 && !(relayUrl.length > 0 && relayUrl.length <= MAX_RELAY_URL)) {
+    throw new Error(`relayUrl must be a non-empty string of at most ${MAX_RELAY_URL} characters`);
+  }
   const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
   if (!(ttl > 0 && ttl <= MAX_TTL_MS)) throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
   const groupId = hex32(input.namespaceId, "namespaceId");
@@ -3505,7 +3509,8 @@ async function signClaim(input, audience, subject) {
       ...subject === void 0 ? {} : { subject },
       nonce: nonce2,
       issued_at_ms: issued,
-      expires_at_ms: issued + ttl
+      expires_at_ms: issued + ttl,
+      ...relayUrl === void 0 ? {} : { relay_url: relayUrl }
     })
   );
   const signature = await signer.sign(concat(DOMAIN, payload));
@@ -3516,7 +3521,7 @@ async function signAccountOwnershipClaim(input) {
   return signClaim(input, ACCOUNT_OWNERSHIP_AUDIENCE, input.subject);
 }
 async function signAccountHaClaim(input) {
-  return signClaim(input, ACCOUNT_HA_AUDIENCE, void 0);
+  return signClaim(input, ACCOUNT_HA_AUDIENCE, void 0, input.relayUrl);
 }
 
 // src/device-cert/device-cert.ts
@@ -5941,6 +5946,31 @@ var AccountLinkedToSeveralUsersError = class extends AccountHaRefusedError {
   }
 };
 AccountLinkedToSeveralUsersError.CODE = "account_linked_to_several_users";
+var HaRequestPendingError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "HaRequestPendingError";
+  }
+};
+HaRequestPendingError.CODE = "ha_request_pending";
+var UnknownRelayError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "UnknownRelayError";
+  }
+};
+UnknownRelayError.CODE = "unknown_relay";
+var RelayNotDialableError = class extends AccountHaRefusedError {
+  constructor() {
+    super(...arguments);
+    this.name = "RelayNotDialableError";
+  }
+};
+RelayNotDialableError.CODE = "relay_not_dialable";
+var ACCOUNT_HA_REFUSALS = {
+  409: [AccountNotLinkedError, AccountLinkedToSeveralUsersError, HaRequestPendingError],
+  422: [UnknownRelayError, RelayNotDialableError]
+};
 function conflictCode(bodyText) {
   if (!bodyText) return void 0;
   try {
@@ -6363,7 +6393,11 @@ var CloudClient = class {
    * Pass merod's response object straight through. The cloud accepts core's
    * `signerPublicKey`/`signedPayload` casing as well as snake_case, so there is
    * no re-keying step — and getting that wrong used to surface as a `422`
-   * naming three missing fields.
+   * naming three missing fields. Passing it whole also carries the `founding`
+   * and `credential` merod attaches: the cloud accepts a namespace proof only
+   * from a node of the account that founded the namespace, checked with those
+   * two, and only when that account is linked to this login. A node that
+   * predates them, or an admin that did not found the namespace, gets a `422`.
    *
    * Idempotent for the same account. A namespace already claimed by someone
    * else is a `409`; a replayed proof nonce is a `403`.
@@ -6438,7 +6472,8 @@ var CloudClient = class {
       credential: options.credential,
       deviceSecret: options.deviceSecret,
       signer: options.signer,
-      ttlMs: options.ttlMs
+      ttlMs: options.ttlMs,
+      relayUrl: options.relayUrl
     });
     const account = options.accountId.toLowerCase();
     const namespace = options.namespaceId.toLowerCase();
@@ -6449,9 +6484,9 @@ var CloudClient = class {
         { body: { ownership_proof: proof }, anonymous: true }
       );
     } catch (err) {
-      if (err instanceof HTTPError && err.status === 409) {
+      if (err instanceof HTTPError && ACCOUNT_HA_REFUSALS[err.status]) {
         const code = conflictCode(err.bodyText);
-        const Typed = code === AccountNotLinkedError.CODE ? AccountNotLinkedError : code === AccountLinkedToSeveralUsersError.CODE ? AccountLinkedToSeveralUsersError : void 0;
+        const Typed = ACCOUNT_HA_REFUSALS[err.status].find((t) => t.CODE === code);
         if (Typed && code) {
           throw new Typed(code, err.status, err.statusText, err.url, err.headers, err.bodyText);
         }
@@ -11180,6 +11215,7 @@ export {
   EphemeralClient,
   HANDSHAKE_PATH,
   HTTPError,
+  HaRequestPendingError,
   INVITED_ROLE,
   IntentRefusedError,
   LocalStorageTokenStore,
@@ -11192,6 +11228,7 @@ export {
   PRESENCE_DOMAIN,
   REQUEST_PROOF_HEADER,
   RelayClient,
+  RelayNotDialableError,
   RelayObserver,
   RelayPresenceClient,
   RelayTransport,
@@ -11203,6 +11240,7 @@ export {
   SealedTransportError,
   SseClient,
   StaleTransportKeyError,
+  UnknownRelayError,
   WarrantNonceExhaustedError,
   WarrantNonceRouteUnavailableError,
   WebHttpClient,