@calimero-network/mero-js 24.3.0 → 24.4.1

package/dist/admin-api/admin-types.d.ts

@@ -375,6 +375,25 @@ export interface Namespace {
      * this is absent only on nodes that predate it.
      */
     founding?: NamespaceFounding;
+    /**
+     * Group ops this node logged but holds unapplied, because their group's
+     * history is sealed under a key it lacks: their effects are missing here until
+     * that key arrives. What explains a subgroup that looks stale on this node and
+     * current on another. Absent when nothing is held, and on nodes that predate it.
+     */
+    heldOps?: NamespaceHeldOps;
+}
+/** The group ops a namespace holds unapplied on the node that answered. */
+export interface NamespaceHeldOps {
+    ops: NamespaceHeldOp[];
+    /** Holds past the node's listing bound, counted but not listed. */
+    untracked: number;
+}
+export interface NamespaceHeldOp {
+    /** Hex id of the namespace op in the governance DAG. */
+    deltaId: string;
+    /** Hex id of the group whose sealed history it waits on. */
+    groupId: string;
 }
 /**
  * The founder and salt a namespace id was derived from:

package/dist/cloud/enrol-redirect.d.ts

@@ -34,9 +34,9 @@
  * - the credential certifies **the key this app asked about** — otherwise the
  *   app stores a credential it cannot sign for, and every warrant it mints is
  *   refused somewhere far from here;
- * - the credential is **internally consistent** — the root signed it and the
- *   account it names is the one that root derives ({@link
- *   verifyDeviceCredential});
+ * - the credential is **internally consistent** — the root signed it, the
+ *   account it names is the one that root derives, and its device id was
+ *   minted for that account ({@link verifyDeviceCredential});
  * - the account reported beside it is **the account the credential names** —
  *   the app shows that id to a person and keys state by it, so a mismatch is a
  *   credential filed under someone else's name.

package/dist/cloud/enrol-redirect.js

@@ -34,9 +34,9 @@
  * - the credential certifies **the key this app asked about** — otherwise the
  *   app stores a credential it cannot sign for, and every warrant it mints is
  *   refused somewhere far from here;
- * - the credential is **internally consistent** — the root signed it and the
- *   account it names is the one that root derives ({@link
- *   verifyDeviceCredential});
+ * - the credential is **internally consistent** — the root signed it, the
+ *   account it names is the one that root derives, and its device id was
+ *   minted for that account ({@link verifyDeviceCredential});
  * - the account reported beside it is **the account the credential names** —
  *   the app shows that id to a person and keys state by it, so a mismatch is a
  *   credential filed under someone else's name.

package/dist/device-cert/device-cert.d.ts

@@ -155,14 +155,16 @@ export interface DeviceCredential {
  */
 export declare function parseDeviceCredential(credential: string): DeviceCredential;
 /**
- * Check that a credential says what it claims: the root signed it, and the
- * account it names is the one that root derives.
+ * Check that a credential says what it claims: the root signed it, the
+ * account it names is the one that root derives, and the device id was minted
+ * for that account.
  *
- * Both halves matter and neither implies the other. The signature says the
+ * The first two matter and neither implies the other. The signature says the
  * genesis root consented to these exact keys; the account derivation says the
  * certificate cannot have been re-pointed at a different account while keeping a
  * signature that verifies. A caller that checked only the first would accept a
- * certificate naming an account whose root never signed anything.
+ * certificate naming an account whose root never signed anything. The third
+ * stops a root claiming a device id minted for another account.
  *
  * What it does **not** establish is that the account is one the caller wanted.
  * Anyone can mint a root offline and certify any public key with it, so a

package/dist/device-cert/device-cert.js

@@ -182,14 +182,16 @@ export function parseDeviceCredential(credential) {
     };
 }
 /**
- * Check that a credential says what it claims: the root signed it, and the
- * account it names is the one that root derives.
+ * Check that a credential says what it claims: the root signed it, the
+ * account it names is the one that root derives, and the device id was minted
+ * for that account.
  *
- * Both halves matter and neither implies the other. The signature says the
+ * The first two matter and neither implies the other. The signature says the
  * genesis root consented to these exact keys; the account derivation says the
  * certificate cannot have been re-pointed at a different account while keeping a
  * signature that verifies. A caller that checked only the first would accept a
- * certificate naming an account whose root never signed anything.
+ * certificate naming an account whose root never signed anything. The third
+ * stops a root claiming a device id minted for another account.
  *
  * What it does **not** establish is that the account is one the caller wanted.
  * Anyone can mint a root offline and certify any public key with it, so a
@@ -206,6 +208,11 @@ export async function verifyDeviceCredential(credential) {
         throw new Error(`this credential names account ${parsed.account}, but its root key ` +
             `derives ${derived} — the certificate was re-pointed at another account`);
     }
+    const nonce = fromHex(parsed.device, 'device', 32).subarray(0, 16);
+    if ((await mintDeviceId(parsed.account, nonce)) !== parsed.device) {
+        throw new Error(`this credential names device ${parsed.device}, which was not minted for ` +
+            `account ${parsed.account}; core refuses it`);
+    }
     const signed = await verifySignature(parsed.rootPublicKey, fromHex(parsed.signature, 'signature', 64), await deviceCertPayload(parsed));
     if (!signed) {
         throw new Error(`the root key of account ${parsed.account} did not sign this certificate`);