@calimero-network/mero-js 24.1.2 → 24.2.0

package/dist/index.mjs

@@ -1485,12 +1485,12 @@ var AdminApiClient = class {
    * anything.
    *
    * The two facts {@link performIntent} needs and a client cannot derive: whose
-   * account goes in the warrant's `executor`, and whether this node holds
-   * `CAN_AUTHOR_ON_BEHALF` on the owning group. `canAuthorOnBehalf: false` comes
-   * back as an answer rather than an error — it is the default state of every
-   * context — so a caller can say "an admin of `groupId` must grant it to
-   * `executorAccount`" instead of presenting a warrant that will be refused
-   * after the author has spent a nonce on it.
+   * account and key go in the warrant's `executor` and `executor_key`, and
+   * whether this node holds `CAN_AUTHOR_ON_BEHALF` on the owning group.
+   * `canAuthorOnBehalf: false` comes back as an answer rather than an error, as
+   * it is the default state of every context, so a caller can say "an admin of
+   * `groupId` must grant it to `executorAccount`" instead of presenting a
+   * warrant that will be refused after the author has spent a nonce on it.
    *
    * `404` means the context belongs to no group, or this node holds no account
    * yet; either way it can be named as no warrant's executor.
@@ -7199,6 +7199,7 @@ async function signWarrant(input) {
   const context = fromHex(input.context, "context", 32);
   const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
   const executor = fromHex(input.executor, "executor", 32);
+  const executorKey = fromHex(input.executorKey, "executorKey", 32);
   const appVersion = fromHex(
     input.appVersion ?? UNPINNED_APP,
     "appVersion",
@@ -7217,6 +7218,7 @@ async function signWarrant(input) {
     authorAccount,
     publicKey,
     executor,
+    executorKey,
     appVersion,
     method,
     commitment,
@@ -7234,6 +7236,7 @@ async function signWarrant(input) {
       authorAccount,
       publicKey,
       executor,
+      executorKey,
       appVersion,
       u32le(method.length),
       method,
@@ -7280,6 +7283,7 @@ async function creationWarrantPreimage(p) {
     p.authorAccount,
     p.deviceKey,
     p.executor,
+    p.executorKey,
     p.applicationId,
     new Uint8Array([p.serviceName === null ? 0 : 1]),
     p.serviceName ?? new Uint8Array(0),
@@ -7299,6 +7303,7 @@ async function signCreationWarrant(input) {
   const seed = input.seed === void 0 ? crypto.getRandomValues(new Uint8Array(32)) : fromHex(input.seed, "seed", 32);
   const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
   const executor = fromHex(input.executor, "executor", 32);
+  const executorKey = fromHex(input.executorKey, "executorKey", 32);
   const applicationId = fromHex(input.applicationId, "applicationId", 32);
   const serviceName = label(input.serviceName, "serviceName");
   const name = label(input.name, "name");
@@ -7313,6 +7318,7 @@ async function signCreationWarrant(input) {
     authorAccount,
     deviceKey,
     executor,
+    executorKey,
     applicationId,
     serviceName,
     name,
@@ -7330,6 +7336,7 @@ async function signCreationWarrant(input) {
       authorAccount,
       deviceKey,
       executor,
+      executorKey,
       applicationId,
       borshOption(serviceName),
       borshOption(name),
@@ -7389,6 +7396,7 @@ function parseCreationWarrant(warrant) {
     authorAccount: hex(take(32, "authorAccount")),
     deviceKey: hex(take(32, "deviceKey")),
     executor: hex(take(32, "executor")),
+    executorKey: hex(take(32, "executorKey")),
     applicationId: hex(take(32, "applicationId")),
     serviceName: option("serviceName"),
     name: option("name"),
@@ -7435,6 +7443,7 @@ async function governanceWarrantPreimage(p) {
     p.authorAccount,
     p.deviceKey,
     p.executor,
+    p.executorKey,
     p.opHash,
     u64le(p.accountHeads.length),
     ...p.accountHeads,
@@ -7448,6 +7457,7 @@ async function signGovernanceWarrant(input) {
   const scope = fromHex(input.scope, "scope", 32);
   const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
   const executor = fromHex(input.executor, "executor", 32);
+  const executorKey = fromHex(input.executorKey, "executorKey", 32);
   const accountHeads = citedHeads(input.accountHeads, "accountHeads");
   const governanceFloor = citedHeads(input.governanceFloor, "governanceFloor");
   const kind = kindByte(input.op.kind);
@@ -7460,6 +7470,7 @@ async function signGovernanceWarrant(input) {
     authorAccount,
     deviceKey,
     executor,
+    executorKey,
     opHash,
     accountHeads,
     governanceFloor,
@@ -7474,6 +7485,7 @@ async function signGovernanceWarrant(input) {
       authorAccount,
       deviceKey,
       executor,
+      executorKey,
       opHash,
       u32le(accountHeads.length),
       ...accountHeads,
@@ -7525,6 +7537,7 @@ function parseGovernanceWarrant(warrant) {
     authorAccount: hex(take(32, "authorAccount")),
     deviceKey: hex(take(32, "deviceKey")),
     executor: hex(take(32, "executor")),
+    executorKey: hex(take(32, "executorKey")),
     opHash: hex(take(32, "opHash")),
     accountHeads: heads("accountHeads"),
     governanceFloor: heads("governanceFloor"),
@@ -7829,7 +7842,6 @@ var RelayClient = class {
   constructor(config) {
     this.config = config;
     this.baseUrl = config.relayUrl.replace(/\/+$/, "");
-    this.executorAccount = config.executorAccount;
     const injected = config.fetch;
     this.fetchImpl = injected ? (input, init) => injected(input, init) : (input, init) => globalThis.fetch(input, init);
     this.timeoutMs = config.timeoutMs ?? 1e4;
@@ -7879,8 +7891,11 @@ var RelayClient = class {
    * as diagnostics after a failure.
    */
   async describe(contextId) {
-    const body = await this.json("GET", `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`);
-    this.executorAccount = body.data.executorAccount;
+    const body = await this.json(
+      "GET",
+      `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`
+    );
+    this.checkedExecutor(body.data);
     return body.data;
   }
   /**
@@ -7891,14 +7906,15 @@ var RelayClient = class {
    * apply. Nothing accumulates and nothing is reusable.
    */
   async execute(contextId, method, argsJson = {}) {
-    const executor = this.executorAccount ?? (await this.describe(contextId)).executorAccount;
+    const executor = this.executor ?? this.checkedExecutor(await this.describe(contextId));
     const signer = await this.authorSigner();
     const nonce2 = await this.config.nonces.next();
     const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
     const warrant = await signWarrant({
       context: contextId,
       authorAccount: this.config.authorAccount,
-      executor,
+      executor: executor.executorAccount,
+      executorKey: executor.executorKey,
       method,
       argsJson,
       nonce: nonce2,
@@ -7909,7 +7925,10 @@ var RelayClient = class {
       "POST",
       `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`,
       { method, argsJson, warrant, authorProof: this.config.authorProof }
-    );
+    ).catch((err) => {
+      if (err instanceof IntentRefusedError) this.executor = void 0;
+      throw err;
+    });
     return { rootHash: body.data.rootHash, returns: body.data.returns ?? null };
   }
   /**
@@ -7978,7 +7997,7 @@ var RelayClient = class {
         403
       );
     }
-    const executor = this.checkedExecutor(described.executorAccount);
+    const executor = this.checkedExecutor(described);
     const initArgs = input.initArgs ?? {};
     const signer = await this.authorSigner();
     const nonce2 = await this.config.nonces.next();
@@ -7987,7 +8006,8 @@ var RelayClient = class {
       group: input.groupId,
       seed: input.seed,
       authorAccount: this.config.authorAccount,
-      executor,
+      executor: executor.executorAccount,
+      executorKey: executor.executorKey,
       applicationId: input.applicationId,
       serviceName: input.serviceName,
       name: input.name,
@@ -8009,7 +8029,7 @@ var RelayClient = class {
   }
   /**
    * Ask the relay whether it may publish governance ops for members of
-   * `groupId`, and which account a warrant must name.
+   * `groupId`, and which account and key a warrant must name.
    */
   async describeGovernance(groupId) {
     const body = await this.json(
@@ -8043,7 +8063,7 @@ var RelayClient = class {
         403
       );
     }
-    const executor = this.checkedExecutor(described.executorAccount);
+    const executor = this.checkedExecutor(described);
     const signer = await this.authorSigner();
     const nonce2 = await this.config.nonces.next();
     const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
@@ -8051,7 +8071,8 @@ var RelayClient = class {
       scope: input.groupId,
       op: input.op,
       authorAccount: this.config.authorAccount,
-      executor,
+      executor: executor.executorAccount,
+      executorKey: executor.executorKey,
       nonce: nonce2,
       notAfter: BigInt(Math.floor(Date.now() / 1e3)) + BigInt(ttl),
       signer
@@ -8077,9 +8098,7 @@ var RelayClient = class {
    *
    * The executor cannot be learned from the relay first: the namespace does not
    * exist, so `describeGovernance` has nothing to answer about. It comes from
-   * `input.executorAccount`, the configured one, or one an earlier call learned
-   * (`describe`, `createContext`, `govern`), and without any of them this
-   * throws before taking a nonce.
+   * `input.executor` only, and without it this throws before taking a nonce.
    * The nonce is spent in the new namespace's ledger.
    *
    * With `defaultCapabilities`, the founder then sets the namespace's default
@@ -8090,13 +8109,13 @@ var RelayClient = class {
    * Refusals (`400`/`403`) come back as {@link IntentRefusedError}; a salt
    * that names an existing namespace is a `409`, an `HTTPError`.
    */
-  async foundNamespace(input = {}) {
-    const executor = input.executorAccount ? this.checkedExecutor(input.executorAccount) : this.executorAccount;
-    if (!executor) {
+  async foundNamespace(input) {
+    if (!input?.executor) {
       throw new Error(
-        "foundNamespace needs the relay's account: pass executorAccount or configure it (checked before signing, no nonce was spent)"
+        "foundNamespace needs the relay's account and signing key: pass executor (checked before signing, no nonce was spent)"
       );
     }
+    const executor = this.checkedExecutor(input.executor);
     const salt = input.salt ? hex(fromHex(input.salt, "salt", 32)) : hex(crypto.getRandomValues(new Uint8Array(32)));
     const namespaceId = await foundedNamespaceId(this.config.authorAccount, salt);
     const op = namespaceCreatedOp({
@@ -8113,7 +8132,8 @@ var RelayClient = class {
       scope: namespaceId,
       op,
       authorAccount: this.config.authorAccount,
-      executor,
+      executor: executor.executorAccount,
+      executorKey: executor.executorKey,
       nonce: nonce2,
       notAfter: BigInt(Math.floor(Date.now() / 1e3)) + BigInt(ttl),
       signer
@@ -8154,18 +8174,22 @@ var RelayClient = class {
     return body.data;
   }
   /**
-   * The executor a warrant must name: the one the relay answered with, which a
-   * configured account must agree with. Remembered for later calls.
+   * The relay's answer, checked against a configured account and remembered.
+   * Decoded here so a relay naming no key is refused before a nonce is taken.
    */
   checkedExecutor(answered) {
+    const executor = {
+      executorAccount: hex(fromHex(answered.executorAccount ?? "", "the relay's executorAccount", 32)),
+      executorKey: hex(fromHex(answered.executorKey ?? "", "the relay's executorKey", 32))
+    };
     const configured = this.config.executorAccount;
-    if (configured && configured.toLowerCase() !== answered.toLowerCase()) {
+    if (configured && configured.toLowerCase() !== executor.executorAccount) {
       throw new Error(
-        `configured executorAccount ${configured} is not the relay's account ${answered}; a warrant naming it would be unspendable`
+        `configured executorAccount ${configured} is not the relay's account ${executor.executorAccount}; a warrant naming it would be unspendable`
       );
     }
-    this.executorAccount = answered;
-    return answered;
+    this.executor = executor;
+    return executor;
   }
   /**
    * One request, waiting out a rate limit rather than failing the caller.
@@ -10152,7 +10176,7 @@ function bytes32(value, label2) {
 }
 
 // src/namespace-op/namespace-op.ts
-var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 22;
+var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 23;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
 var NAMESPACE_OP_ROOT = 0;
 var ROOT_OP2 = {
@@ -10507,19 +10531,10 @@ async function foundDelegatedNamespace(s, req = {}, deps = {}) {
   const relays = knownRelays(s).map((u) => u.replace(/\/+$/, ""));
   const relay = relays[0];
   if (!relay) throw new Error("no relay is known for this account, so there is nowhere to found a namespace");
-  const known = Object.entries(readRelayMap(s.account).namespaces).find(
-    ([, url]) => url.replace(/\/+$/, "") === relay
-  )?.[0];
-  const named = s.executorAccount && s.relayUrl && s.relayUrl.replace(/\/+$/, "") === relay ? s.executorAccount : null;
-  if (!named && !known) {
-    throw new Error(
-      "the executor account of this relay is not known: join a namespace on it first, or connect with the relay's executor account (the cloud shows it beside the relay)"
-    );
-  }
-  const executorAccount = named ?? (await client(s, relay, governanceNonce(relay, known), deps.fetch).describeGovernance(known)).executorAccount;
+  const executor = await foundingExecutor(s, relay, deps.fetch);
   let next = BigInt(Date.now());
   const founded = await client(s, relay, { next: async () => next++ }, deps.fetch).foundNamespace({
-    executorAccount,
+    executor,
     ...req.defaultCapabilities !== void 0 ? { defaultCapabilities: req.defaultCapabilities } : {},
     ...req.application ? { application: req.application } : {}
   });
@@ -10539,6 +10554,33 @@ async function foundDelegatedNamespace(s, req = {}, deps = {}) {
   };
   return { namespaceId: founded.namespaceId, teeEnabled: founded.teeEnabled, ...ha };
 }
+async function foundingExecutor(s, relay, fetch2) {
+  const named = s.executorAccount && s.relayUrl?.replace(/\/+$/, "") === relay ? s.executorAccount : null;
+  if (named) return { executorAccount: named, executorKey: await attestedNodeKey(relay) };
+  const known = Object.entries(readRelayMap(s.account).namespaces).find(
+    ([, url]) => url.replace(/\/+$/, "") === relay
+  )?.[0];
+  if (!known) {
+    throw new Error(
+      "the executor account of this relay is not known: join a namespace on it first, or connect with the relay's executor account (the cloud shows it beside the relay)"
+    );
+  }
+  const executorKey = await attestedNodeKey(relay);
+  const described = await client(s, relay, governanceNonce(relay, known), fetch2).describeGovernance(known);
+  if (described.executorKey?.toLowerCase() !== executorKey) {
+    throw new Error(
+      `the relay's discovery names signing key ${described.executorKey}, not the relay's node key ${executorKey}: refusing to found through it`
+    );
+  }
+  return { executorAccount: described.executorAccount, executorKey };
+}
+async function attestedNodeKey(relay) {
+  const key = await attemptRelayNodeKey(relay);
+  if (key.kind === "learned") return key.nodeKey;
+  throw new Error(
+    key.kind === "unavailable" ? "the relay's signing key could not be learned: its attestation did not answer, try again" : "the relay's attestation was refused, so founding through it is not possible (only a key from its operator, pinned with pinRelayNodeKey, can stand in)"
+  );
+}
 var HA_ACCOUNT_NOT_LINKED_MESSAGE = "link this account to your cloud user in the wallet so invitees can find this namespace";
 var HA_REFUSAL_MESSAGES = {
   account_not_linked: HA_ACCOUNT_NOT_LINKED_MESSAGE,