@calimero-network/mero-js 25.0.1 → 25.0.3

package/dist/index.cjs

@@ -10360,17 +10360,6 @@ function normaliseAccount(account) {
   const bare = trimmed.startsWith("0x") ? trimmed.slice(2) : trimmed;
   return bare.length > 0 ? bare : null;
 }
-function httpAdmitterOrigins(addrs) {
-  const out = [];
-  for (const addr of addrs ?? []) {
-    try {
-      const url = new URL(addr);
-      if (url.protocol === "http:" || url.protocol === "https:") out.push(addr.replace(/\/+$/, ""));
-    } catch {
-    }
-  }
-  return out;
-}
 function isInvited(node, invited) {
   if (invited.size === 0) return true;
   const account = normaliseAccount(node.account);
@@ -10395,23 +10384,6 @@ async function resolveRelayFromInvitation(input) {
     };
   }
   if (nodes.length === 0) {
-    const [relayUrl] = httpAdmitterOrigins(input.admitterAddrs);
-    if (relayUrl) {
-      const admitters = (input.admitters ?? []).map(normaliseAccount).filter((a) => a !== null);
-      return {
-        ok: true,
-        relayUrl,
-        admitUrl: `${relayUrl}/admin-api/namespaces/${input.namespaceId}/admit`,
-        admitterAccount: admitters.length === 1 ? admitters[0] : null,
-        peerId: null,
-        // The relay a founder's session runs through executes that founder's
-        // warrants, so it authors on behalf; the node's answer to the first
-        // write is the authoritative one, as for a cloud-routed node.
-        writable: true,
-        stale: false,
-        via: "invitation"
-      };
-    }
     return {
       ok: false,
       step: "no-nodes",
@@ -10455,8 +10427,7 @@ async function resolveRelayFromInvitation(input) {
     // Stale when the node's own heartbeat lapsed OR when the cloud's summary
     // disagrees with trying it at all. Both mean the same thing to a caller:
     // this was attempted on advisory data, so if the admit fails that is why.
-    stale: !chosen.fresh || advisory,
-    via: "cloud"
+    stale: !chosen.fresh || advisory
   };
 }
 
@@ -10742,7 +10713,6 @@ async function bootstrapFromInvitation(input) {
       // separately: two sources for one fact is how an intersection ends up
       // being performed against the wrong list.
       admitters: input.invitation.invitation.admitters,
-      admitterAddrs: input.invitation.admitter_addrs,
       credential: input.credential.credential,
       deviceSecret: input.credential.deviceSecret,
       cloudBaseUrl: input.cloudBaseUrl
@@ -10961,7 +10931,7 @@ async function attestedNodeKey(relay) {
     key.kind === "unavailable" ? "the relay's signing key could not be learned: its attestation did not answer, try again" : "the relay's attestation was refused, so founding through it is not possible: it is not a signed locked-read-only release"
   );
 }
-var HA_ACCOUNT_NOT_LINKED_MESSAGE = "link this account to your cloud user in the wallet so invitees can find this namespace";
+var HA_ACCOUNT_NOT_LINKED_MESSAGE = "link this account to your cloud user in the wallet so the cloud can host this namespace on its fleet";
 var HA_REFUSAL_MESSAGES = {
   account_not_linked: HA_ACCOUNT_NOT_LINKED_MESSAGE,
   account_linked_to_several_users: "this account is linked to more than one cloud user, so the cloud cannot tell whose plan hosts the namespace: unlink it from all but one in the wallet",
@@ -11066,7 +11036,7 @@ var NoRelayError = class extends Error {
 var InvitationNotClaimableError = class extends Error {
   constructor(namespaceId, reason) {
     super(
-      reason === "not-hosted" ? `nobody could claim an invitation to ${namespaceId} yet: the namespace is not hosted in the cloud and has no relay in it, so an invitee with no node has no relay to be admitted through. Link this account to your cloud user in the wallet and enable HA for the namespace, then invite.` : `nobody could claim an invitation to ${namespaceId}: the cloud routes to none of the relays or admins it would name as admitters`
+      reason === "not-hosted" ? `nobody could claim an invitation to ${namespaceId} yet: the cloud lists no node holding the namespace, so an invitee with no node of their own has no relay to be admitted through.` : `nobody could claim an invitation to ${namespaceId}: the cloud routes to none of the relays or admins it would name as admitters`
     );
     this.namespaceId = namespaceId;
     this.reason = reason;
@@ -11254,7 +11224,6 @@ function createAccountAdmin(input, deps = {}) {
     async createNamespaceInvitation(namespaceId) {
       const [{ members }, info] = await Promise.all([relay().listGroupMembers(namespaceId), relay().getGroupInfo(namespaceId)]);
       const relays = members.filter((m) => m.role === "RelayTee").map((m) => m.identity.toLowerCase());
-      let admitterAddrs;
       if (routing) {
         const named = new Set(
           relays.length > 0 ? relays : members.filter((m) => m.role === "Admin").map((m) => m.identity.toLowerCase())
@@ -11265,10 +11234,8 @@ function createAccountAdmin(input, deps = {}) {
         } catch {
         }
         if (nodes !== null) {
-          if (nodes.length === 0) {
-            if (relays.length === 0 || !s.relayUrl) throw new InvitationNotClaimableError(namespaceId, "not-hosted");
-            admitterAddrs = [s.relayUrl];
-          } else if (!nodes.some((n) => n.account !== null && named.has(n.account.toLowerCase()))) {
+          if (nodes.length === 0) throw new InvitationNotClaimableError(namespaceId, "not-hosted");
+          if (!nodes.some((n) => n.account !== null && named.has(n.account.toLowerCase()))) {
             throw new InvitationNotClaimableError(namespaceId, "no-named-node");
           }
         }
@@ -11278,7 +11245,6 @@ function createAccountAdmin(input, deps = {}) {
         inviterAccount: s.account,
         deviceSecret: s.deviceSecret,
         ...relays.length > 0 ? { admitters: relays } : {},
-        ...admitterAddrs ? { admitterAddrs } : {},
         members,
         applicationId: info.targetApplicationId,
         appKey: info.appKey
@@ -11659,9 +11625,8 @@ var CloudClient = class {
    * are answered together rather than across two endpoints — the per-context
    * read needs a context id a joiner does not yet have.
    *
-   * An empty `nodes` list is a state, not an error: a namespace with no fleet
-   * assignment has no cloud node, and the joiner must use one of the
-   * invitation's other admitters — another admin's node, or a self-hosted peer.
+   * An empty `nodes` list is a state, not an error: the cloud has no record of
+   * a node holding the namespace, so there is no hosted admitter.
    */
   async getNamespaceRouting(namespaceId) {
     const body = await this.request("GET", `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/admitters`, {
@@ -12336,6 +12301,13 @@ var MeroJs = class {
   constructor(config) {
     this.tokenData = null;
     this.refreshPromise = null;
+    // True while the store is known to hold our tokens; a store that cannot persist never sets it.
+    this.storeHoldsTokens = false;
+    // Bumped when local tokens are dropped, so a refresh already in flight cannot restore them.
+    this.tokenGeneration = 0;
+    this.onStorage = () => {
+      if (this.signedOutElsewhere()) this.dropLocalTokens();
+    };
     this.rpcClient = null;
     this.sseClient = null;
     this.wsClient = null;
@@ -12347,6 +12319,8 @@ var MeroJs = class {
     this.tokenStore = config.tokenStore ?? null;
     if (this.tokenStore) {
       this.tokenData = this.tokenStore.getTokens();
+      this.storeHoldsTokens = this.tokenData !== null;
+      if (typeof window !== "undefined") window.addEventListener("storage", this.onStorage);
     }
     const isTauri = typeof window !== "undefined" && "__TAURI_INTERNALS__" in window;
     const getProof = resolveProofSigner(this.config.requestProof);
@@ -12365,7 +12339,7 @@ var MeroJs = class {
       onTokenRefresh: async (newToken) => {
         if (this.tokenData) {
           this.tokenData.access_token = newToken;
-          this.tokenStore?.setTokens(this.tokenData);
+          this.persistTokens(this.tokenData);
         }
       },
       onAuthRevoked: async () => {
@@ -12511,7 +12485,7 @@ var MeroJs = class {
         refresh_token: response.data.refresh_token,
         expires_at: expiresAtFromJwt(accessToken, Date.now() + 36e5)
       };
-      this.tokenStore?.setTokens(this.tokenData);
+      this.persistTokens(this.tokenData);
       return this.tokenData;
     } catch (error) {
       throw new Error(
@@ -12519,6 +12493,21 @@ var MeroJs = class {
       );
     }
   }
+  persistTokens(data) {
+    if (!this.tokenStore) return;
+    this.tokenStore.setTokens(data);
+    this.storeHoldsTokens = this.tokenStore.getTokens() !== null;
+  }
+  // Raw store read: an empty store is a logout, another node's bundle is not.
+  signedOutElsewhere() {
+    return this.storeHoldsTokens && !this.tokenStore?.getTokens();
+  }
+  dropLocalTokens() {
+    this.tokenGeneration++;
+    this.refreshPromise = null;
+    this.tokenData = null;
+    this.storeHoldsTokens = false;
+  }
   /**
    * Get a valid token. Returns the current token as-is.
    * The server rejects refresh attempts while the access token is still valid,
@@ -12572,8 +12561,13 @@ var MeroJs = class {
    * Perform the actual token refresh. Runs with the refresh lock held.
    */
   async performTokenRefreshLocked(triggeringAccessToken) {
+    if (this.signedOutElsewhere()) {
+      this.dropLocalTokens();
+      throw new Error("Signed out in another tab");
+    }
     const stored = this.tokenStore?.getTokens() ?? null;
     if (stored?.refresh_token) {
+      this.storeHoldsTokens = true;
       this.tokenData = stored;
       if (triggeringAccessToken && stored.access_token !== triggeringAccessToken) {
         return stored;
@@ -12582,11 +12576,20 @@ var MeroJs = class {
     if (!this.tokenData?.refresh_token) {
       throw new Error("No refresh token available");
     }
+    const generation = this.tokenGeneration;
+    const presented = this.tokenData.access_token;
+    const storeHeldPresented = this.tokenStore?.getTokens()?.access_token === presented;
     try {
       const response = await this.authClient.refreshToken({
         access_token: this.tokenData.access_token,
         refresh_token: this.tokenData.refresh_token
       });
+      if (generation !== this.tokenGeneration) throw new Error("Signed out during token refresh");
+      if (storeHeldPresented && this.tokenStore?.getTokens()?.access_token !== presented) {
+        this.tokenData = this.tokenStore?.getTokens() ?? null;
+        this.storeHoldsTokens = this.tokenData !== null;
+        throw new Error("Signed out during token refresh");
+      }
       const accessToken = response.data.access_token;
       this.tokenData = {
         access_token: accessToken,
@@ -12595,7 +12598,7 @@ var MeroJs = class {
         refresh_token: response.data.refresh_token,
         expires_at: expiresAtFromJwt(accessToken, Date.now() + 36e5)
       };
-      this.tokenStore?.setTokens(this.tokenData);
+      this.persistTokens(this.tokenData);
       return this.tokenData;
     } catch (error) {
       throw new Error(
@@ -12607,8 +12610,7 @@ var MeroJs = class {
    * Clear the current token
    */
   clearToken() {
-    this.refreshPromise = null;
-    this.tokenData = null;
+    this.dropLocalTokens();
     this.tokenStore?.clear();
   }
   /**
@@ -12625,7 +12627,7 @@ var MeroJs = class {
   setTokenData(data) {
     const expiresAt = data.expires_at || expiresAtFromJwt(data.access_token, Date.now() + 36e5);
     this.tokenData = { ...data, expires_at: expiresAt };
-    this.tokenStore?.setTokens(this.tokenData);
+    this.persistTokens(this.tokenData);
   }
   /**
    * Get the current token data (for debugging)
@@ -12637,6 +12639,7 @@ var MeroJs = class {
    * Close all event connections and clean up resources
    */
   close() {
+    if (typeof window !== "undefined") window.removeEventListener("storage", this.onStorage);
     this.sseClient?.close();
     this.wsClient?.close();
   }