@calimero-network/mero-js 24.5.0 → 24.7.0

package/dist/index.d.ts

@@ -28,7 +28,7 @@ export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 export type { Signer } from "./signer/index.js";
 export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, resolveRoot, resolveRootPair, } from "./account/index.js";
 export type { AccountRoot, RecoverableAccountRoot, AccountRootSigner, NewAccountRootSigner, AccountLinkInput, AccountLoginInput, RootSource, ResolvedRoot, } from "./account/index.js";
-export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
+export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
 export type { DelegatedCredential, DelegatedAccountSession, RelayMap, RelayNodeKeyAttempt, RelayResolutionStep, RelayResolutionFailure, ResolvedInvitationRelay, ResolveRelayResult, ResolveRelayFromInvitationInput, JoinWithNodeInput, JoinWithNodeResult, JoinWithNodeSuccess, JoinWithNodeFailure, JoinWithNodeStep, BootstrapStep, BootstrapResult, BootstrapSuccess, BootstrapFailure, BootstrapFromInvitationInput, CreateDelegatedContextRequest, FoundedDelegatedNamespace, RegistryBundle, ResolvedApplication, AccountAdminDeps, NodeAdminDeps, } from "./account/index.js";
 export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
 export type { DeviceCertInput, DeviceCredential } from "./device-cert/index.js";

package/dist/index.js

@@ -52,7 +52,7 @@ resolveRoot, resolveRootPair, } from "./account/index.js";
 // Framework-free; mero-react re-exports every one of these under the same name
 // (its `DelegatedSession` is `DelegatedAccountSession` here: the login module
 // already owns the bare name for the session `login()` mints).
-export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
+export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
 export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
 // A device's scope — signed by the root beside its certificate, and what a relay
 // needs with it to bind the device of an account that has no node.

package/dist/index.mjs

@@ -8836,7 +8836,7 @@ function missingNodeKey(surface) {
     `this relay-transport client cannot open ${surface}: it was given no relay node key. A relay is an ordinary node and does serve /sse and /ws \u2014 but the login statement must be signed against the node's device signing key, learned out of band (never read from the node, and never derived from its peerId). Pass it as \`observe: { nodeKey }\`. For a cloud-hosted relay the cloud does not publish it yet \u2014 see mdma #312.`
   );
 }
-function buildObserver(relay, observe) {
+function buildObserver(relay, observe, fetchImpl) {
   const nodeKey = observe?.nodeKey;
   if (!nodeKey) return null;
   return new RelayObserver({
@@ -8847,7 +8847,7 @@ function buildObserver(relay, observe) {
     signer: observe?.signer ? async () => observe.signer : () => relay.authorSigner(),
     clientName: observe?.clientName,
     ttlSeconds: observe?.ttlSeconds,
-    fetch: observe?.fetch,
+    fetch: observe?.fetch ?? fetchImpl,
     timeoutMs: observe?.timeoutMs
   });
 }
@@ -8868,12 +8868,16 @@ var MeroClient = class {
     this.proofAuthorizer = null;
     this.relayUrl = null;
     this.proofEvents = null;
+    /** The relay transport's `fetch`, if one was given. */
+    this.relayFetch = void 0;
     this.relayPresence = null;
     if (config.transport === "relay") {
       this.transport = "relay";
       this.nodeClient = null;
-      const relay = config.relay instanceof RelayClient ? config.relay : new RelayClient(config.relay);
-      this.relayObserver = buildObserver(relay, config.observe);
+      const fetchImpl = config.fetch;
+      this.relayFetch = fetchImpl;
+      const relay = config.relay instanceof RelayClient ? config.relay : new RelayClient({ ...config.relay, fetch: config.relay.fetch ?? fetchImpl });
+      this.relayObserver = buildObserver(relay, config.observe, fetchImpl);
       this.rpcTransport = new RelayTransport(relay, this.relayObserver);
       this.relayUrl = relay.relayUrl;
       if (config.proof) {
@@ -8883,13 +8887,14 @@ var MeroClient = class {
         const token = config.session;
         this.relayAdmin = createAdminApiClient({
           baseUrl: relay.relayUrl,
-          getAuthToken: typeof token === "string" ? async () => token : token
+          getAuthToken: typeof token === "string" ? async () => token : token,
+          fetch: fetchImpl
         });
       } else if (this.proofAuthorizer) {
         const authorizeRequest = this.proofAuthorizer;
         this.relayAdmin = createAdminApiClientFromHttpClient(
           createHttpClient({
-            fetch: (url, init) => globalThis.fetch(url, init),
+            fetch: (url, init) => fetchImpl ? fetchImpl(url, init) : globalThis.fetch(url, init),
             baseUrl: relay.relayUrl,
             authorizeRequest
           }),
@@ -9003,7 +9008,8 @@ var MeroClient = class {
     if (this.proofAuthorizer && this.relayUrl) {
       this.proofEvents ?? (this.proofEvents = new SseClient({
         baseUrl: this.relayUrl,
-        authorize: this.proofAuthorizer
+        authorize: this.proofAuthorizer,
+        fetch: this.relayFetch
       }));
       return this.proofEvents;
     }
@@ -9253,8 +9259,8 @@ function relayQuoteVerifier(relayUrl, fetchRelay) {
   };
   return Object.assign(verify, { includeCollateral: true });
 }
-async function attemptRelayNodeKey(relayUrl) {
-  const pinned = readPinnedRelayNodeKey(relayUrl);
+async function attemptRelayNodeKey(relayUrl, options = {}) {
+  const pinned = options.fresh ? null : readPinnedRelayNodeKey(relayUrl);
   if (pinned) return { kind: "learned", nodeKey: pinned };
   const marked = { failure: null };
   const fetchRelay = relayFetch(marked);
@@ -9318,6 +9324,54 @@ function jwtExpiryMs2(token) {
     return null;
   }
 }
+var sealedFetches = /* @__PURE__ */ new Map();
+function forgetRelaySealing() {
+  sealedFetches.clear();
+}
+async function isUnguardedRefusal(response) {
+  if (response.status !== 403) return false;
+  try {
+    const body = await response.clone().json();
+    return body.error?.code === "sealed_route_unguarded";
+  } catch {
+    return false;
+  }
+}
+function needsSession(request) {
+  return request.headers.has("authorization") || new URL(request.url).pathname.startsWith("/auth/");
+}
+function sealedRelayFetch(relayUrl) {
+  const plain = (input, init) => globalThis.fetch(input, init);
+  const sealed = createAttestedSealedFetch({
+    baseUrl: relayUrl,
+    verify: relayQuoteVerifier(relayUrl, plain),
+    fetch: plain
+  });
+  let unguarded = false;
+  return async (input, init) => {
+    const request = new Request(input, init);
+    if (unguarded && needsSession(request)) return plain(request);
+    const response = await sealed(request.clone());
+    if (!await isUnguardedRefusal(response)) return response;
+    if (!unguarded) {
+      unguarded = true;
+      console.warn(
+        `[mero-js] ${relayOrigin(relayUrl)} cannot guard logged-in calls sealed (no forward_auth); they go over its TLS until it does`
+      );
+    }
+    return plain(request);
+  };
+}
+function relayTransportFetch(relayUrl) {
+  if (isLoopback(relayUrl)) return void 0;
+  const origin2 = relayOrigin(relayUrl);
+  let found = sealedFetches.get(origin2);
+  if (!found) {
+    found = sealedRelayFetch(relayUrl);
+    sealedFetches.set(origin2, found);
+  }
+  return found;
+}
 function relaySession(s, nodeKey) {
   let token = null;
   let inflight = null;
@@ -9327,6 +9381,8 @@ function relaySession(s, nodeKey) {
     if (!inflight) {
       inflight = login({
         nodeUrl: s.relayUrl,
+        // Sealed: the token is the session, and the TLS ends outside the TD.
+        fetch: relayTransportFetch(s.relayUrl),
         node: nodeKey,
         deviceSecret: s.deviceSecret,
         accountProof: s.credential,
@@ -9422,6 +9478,9 @@ function buildDelegatedClient(s, _contextId) {
   const nodeKey = readPinnedRelayNodeKey(s.relayUrl);
   const client2 = createMeroClient({
     transport: "relay",
+    // Every request sealed to the relay's attested TD: intents, admin reads,
+    // queries, the login and events (see `relayTransportFetch`).
+    fetch: relayTransportFetch(s.relayUrl),
     relay: {
       relayUrl: s.relayUrl,
       authorAccount: s.account,
@@ -10511,7 +10570,7 @@ function client(s, relayUrl, nonces, fetch2) {
     authorProof: s.credential,
     deviceSecret: s.deviceSecret,
     nonces,
-    fetch: fetch2
+    fetch: fetch2 ?? relayTransportFetch(relayUrl)
   });
 }
 async function createDelegatedContext(s, req, deps = {}) {
@@ -10598,10 +10657,10 @@ async function foundingExecutor(s, relay, fetch2) {
   return { executorAccount: described.executorAccount, executorKey };
 }
 async function attestedNodeKey(relay) {
-  const key = await attemptRelayNodeKey(relay);
+  const key = await attemptRelayNodeKey(relay, { fresh: true });
   if (key.kind === "learned") return key.nodeKey;
   throw new Error(
-    key.kind === "unavailable" ? "the relay's signing key could not be learned: its attestation did not answer, try again" : "the relay's attestation was refused, so founding through it is not possible (only a key from its operator, pinned with pinRelayNodeKey, can stand in)"
+    key.kind === "unavailable" ? "the relay's signing key could not be learned: its attestation did not answer, try again" : "the relay's attestation was refused, so founding through it is not possible: it is not a signed locked-read-only release"
   );
 }
 var HA_ACCOUNT_NOT_LINKED_MESSAGE = "link this account to your cloud user in the wallet so invitees can find this namespace";
@@ -12202,8 +12261,12 @@ var MeroJs = class {
       }
     }
   }
-  /** Run `fn` under the cross-tab refresh lock, or directly if Web Locks are unavailable. */
+  /**
+   * Run `fn` under the refresh lock: the token store's own (shared across
+   * processes), else the cross-tab Web Lock, else directly.
+   */
   withRefreshLock(fn) {
+    if (this.tokenStore?.withLock) return this.tokenStore.withLock(fn);
     const locks = getLockManager();
     return locks ? locks.request(REFRESH_LOCK_NAME, fn) : fn();
   }
@@ -12717,6 +12780,7 @@ export {
   fetchNodeReleaseVersion,
   fetchRegistryBundles,
   forgetMethodKinds,
+  forgetRelaySealing,
   foundDelegatedNamespace,
   foundedNamespaceId,
   generateAccountRoot,
@@ -12777,6 +12841,7 @@ export {
   readRelayMap,
   redeemInvitation,
   relayForContext,
+  relayTransportFetch,
   rememberGroupNamespace,
   rememberRelay,
   reportDataOf,