@calimero-network/mero-js 24.2.0 → 24.3.0

package/dist/index.mjs

@@ -1484,16 +1484,18 @@ var AdminApiClient = class {
    * Ask what this node can do for a member in `contextId`, before they sign
    * anything.
    *
-   * The two facts {@link performIntent} needs and a client cannot derive: whose
-   * account and key go in the warrant's `executor` and `executor_key`, and
-   * whether this node holds `CAN_AUTHOR_ON_BEHALF` on the owning group.
+   * The facts {@link performIntent} needs and a client cannot derive: whose
+   * account and key go in the warrant's `executor` and `executor_key`, which
+   * release it pins, and whether this node holds `CAN_AUTHOR_ON_BEHALF` on the
+   * owning group.
    * `canAuthorOnBehalf: false` comes back as an answer rather than an error, as
    * it is the default state of every context, so a caller can say "an admin of
    * `groupId` must grant it to `executorAccount`" instead of presenting a
    * warrant that will be refused after the author has spent a nonce on it.
    *
-   * `404` means the context belongs to no group, or this node holds no account
-   * yet; either way it can be named as no warrant's executor.
+   * `404` means the context belongs to no group, this node holds no account or
+   * identity in it yet, or its group names no release yet; no warrant can be
+   * spent here until that changes.
    *
    * For a caller with no credential on the node at all — a browser tab holding
    * one signing key — use `RelayClient`, which reads this same route on a node
@@ -7190,7 +7192,7 @@ function splitVersion2(version) {
 var SIGN_DOMAIN2 = new TextEncoder().encode("calimero.warrant.v2");
 var INTENT_DOMAIN = new TextEncoder().encode("calimero.warrant.intent.v1");
 var MAX_CITED_HEADS = 64;
-var UNPINNED_APP = "00".repeat(32);
+var MAX_RELEASE_VERSION_LEN = 256;
 async function intentHash(method, argsJson) {
   const args = new TextEncoder().encode(JSON.stringify(argsJson));
   return domainHash(INTENT_DOMAIN, [new TextEncoder().encode(method), args]);
@@ -7200,11 +7202,8 @@ async function signWarrant(input) {
   const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
   const executor = fromHex(input.executor, "executor", 32);
   const executorKey = fromHex(input.executorKey, "executorKey", 32);
-  const appVersion = fromHex(
-    input.appVersion ?? UNPINNED_APP,
-    "appVersion",
-    32
-  );
+  const releaseBytecodeId = fromHex(input.releaseBytecodeId, "releaseBytecodeId", 32);
+  const releaseVersion2 = releaseVersionBytes(input.releaseVersion ?? "");
   const accountHeads = citedHeads(input.accountHeads, "accountHeads");
   const governanceFloor = citedHeads(input.governanceFloor, "governanceFloor");
   const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
@@ -7219,7 +7218,8 @@ async function signWarrant(input) {
     publicKey,
     executor,
     executorKey,
-    appVersion,
+    releaseBytecodeId,
+    releaseVersion2,
     method,
     commitment,
     u64le(accountHeads.length),
@@ -7237,7 +7237,9 @@ async function signWarrant(input) {
       publicKey,
       executor,
       executorKey,
-      appVersion,
+      releaseBytecodeId,
+      u32le(releaseVersion2.length),
+      releaseVersion2,
       u32le(method.length),
       method,
       commitment,
@@ -7258,6 +7260,18 @@ function checkedSignature(signature) {
   }
   return signature;
 }
+function releaseVersionBytes(version) {
+  const bytes = new TextEncoder().encode(version);
+  checkReleaseVersionLength(bytes.length);
+  return bytes;
+}
+function checkReleaseVersionLength(len) {
+  if (len > MAX_RELEASE_VERSION_LEN) {
+    throw new Error(
+      `releaseVersion is ${len} bytes, over the ${MAX_RELEASE_VERSION_LEN} a node accepts`
+    );
+  }
+}
 function citedHeads(heads, label2) {
   const list = heads ?? [];
   if (list.length > MAX_CITED_HEADS) {
@@ -7895,7 +7909,6 @@ var RelayClient = class {
       "GET",
       `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`
     );
-    this.checkedExecutor(body.data);
     return body.data;
   }
   /**
@@ -7906,7 +7919,13 @@ var RelayClient = class {
    * apply. Nothing accumulates and nothing is reusable.
    */
   async execute(contextId, method, argsJson = {}) {
-    const executor = this.executor ?? this.checkedExecutor(await this.describe(contextId));
+    const described = await this.describe(contextId);
+    const executor = this.checkedExecutor(described);
+    const releaseBytecodeId = hex(
+      fromHex(described.releaseBytecodeId ?? "", "the relay's releaseBytecodeId", 32)
+    );
+    const releaseVersion2 = described.releaseVersion ?? "";
+    releaseVersionBytes(releaseVersion2);
     const signer = await this.authorSigner();
     const nonce2 = await this.config.nonces.next();
     const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
@@ -7915,6 +7934,8 @@ var RelayClient = class {
       authorAccount: this.config.authorAccount,
       executor: executor.executorAccount,
       executorKey: executor.executorKey,
+      releaseBytecodeId,
+      releaseVersion: releaseVersion2,
       method,
       argsJson,
       nonce: nonce2,
@@ -7925,10 +7946,7 @@ var RelayClient = class {
       "POST",
       `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`,
       { method, argsJson, warrant, authorProof: this.config.authorProof }
-    ).catch((err) => {
-      if (err instanceof IntentRefusedError) this.executor = void 0;
-      throw err;
-    });
+    );
     return { rootHash: body.data.rootHash, returns: body.data.returns ?? null };
   }
   /**
@@ -8174,7 +8192,7 @@ var RelayClient = class {
     return body.data;
   }
   /**
-   * The relay's answer, checked against a configured account and remembered.
+   * The relay's answer, checked against a configured account.
    * Decoded here so a relay naming no key is refused before a nonce is taken.
    */
   checkedExecutor(answered) {
@@ -8188,7 +8206,6 @@ var RelayClient = class {
         `configured executorAccount ${configured} is not the relay's account ${executor.executorAccount}; a warrant naming it would be unspendable`
       );
     }
-    this.executor = executor;
     return executor;
   }
   /**