@calimero-network/mero-js 25.0.4 → 25.0.6

package/dist/auth-api/auth-client.js

@@ -1,3 +1,4 @@
+import { pathSegment } from '../http-client/path-segment.js';
 export class AuthApiClient {
     constructor(httpClient) {
         this.httpClient = httpClient;
@@ -89,7 +90,7 @@ export class AuthApiClient {
         return response.data;
     }
     async deleteRootKey(keyId) {
-        return this.httpClient.delete(`/admin/keys/${keyId}`);
+        return this.httpClient.delete(`/admin/keys/${pathSegment(keyId)}`);
     }
     // Client Management Endpoints
     async listClientKeys() {
@@ -103,14 +104,14 @@ export class AuthApiClient {
         return this.httpClient.post('/admin/client-key', request);
     }
     async deleteClientKey(keyId, clientId) {
-        return this.httpClient.delete(`/admin/keys/${keyId}/clients/${clientId}`);
+        return this.httpClient.delete(`/admin/keys/${pathSegment(keyId)}/clients/${pathSegment(clientId)}`);
     }
     // Permission Management Endpoints
     async getKeyPermissions(keyId) {
-        return this.httpClient.get(`/admin/keys/${keyId}/permissions`);
+        return this.httpClient.get(`/admin/keys/${pathSegment(keyId)}/permissions`);
     }
     async updateKeyPermissions(keyId, changes) {
         // Core expects an { add, remove } delta, not a { permissions } replacement.
-        return this.httpClient.put(`/admin/keys/${keyId}/permissions`, { add: changes.add, remove: changes.remove });
+        return this.httpClient.put(`/admin/keys/${pathSegment(keyId)}/permissions`, { add: changes.add, remove: changes.remove });
     }
 }

package/dist/cloud/cloud-client.js

@@ -27,6 +27,7 @@
 import { signAccountHaClaim } from './account-ownership.js';
 import { resolveRoot, resolveRootPair, signAccountLink, signAccountLogin, } from '../account/index.js';
 import { HTTPError } from '../http-client/web-client.js';
+import { pathSegment } from '../http-client/path-segment.js';
 import { ACCOUNT_HEX, beginLinkState, takeLinkState } from './link-state.js';
 import { routingProofHeaders, } from './routing-proof.js';
 /**
@@ -352,7 +353,7 @@ export class CloudClient {
      * monotonic sequence on it.
      */
     async getNamespaceRelays(namespaceId) {
-        const body = await this.request('GET', `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/relays`);
+        const body = await this.request('GET', `/api/cloud/me/namespaces/${pathSegment(namespaceId)}/relays`);
         return (body.relays ?? []).map((row) => {
             const relayUrl = row.relay_url ?? null;
             const executorAccount = row.executor_account ?? null;
@@ -408,7 +409,7 @@ export class CloudClient {
      * a node holding the namespace, so there is no hosted admitter.
      */
     async getNamespaceRouting(namespaceId) {
-        const body = await this.request('GET', `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/admitters`, {
+        const body = await this.request('GET', `/api/cloud/namespaces/${pathSegment(namespaceId)}/admitters`, {
             anonymous: true,
             headers: await this.routingProof(namespaceId),
         });
@@ -449,7 +450,7 @@ export class CloudClient {
      * challenge somewhere this client cannot reach the key.
      */
     async getRoutingChallenge(namespaceId) {
-        const body = await this.request('GET', `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/challenge`, {
+        const body = await this.request('GET', `/api/cloud/namespaces/${pathSegment(namespaceId)}/challenge`, {
             anonymous: true,
         });
         return {
@@ -481,7 +482,7 @@ export class CloudClient {
      * the account from the certificate and refuses a mismatch.
      */
     async getAccountRelaysChallenge(accountId) {
-        const body = await this.request('GET', `/api/cloud/accounts/${encodeURIComponent(accountId)}/challenge`, {
+        const body = await this.request('GET', `/api/cloud/accounts/${pathSegment(accountId)}/challenge`, {
             anonymous: true,
         });
         return {
@@ -516,7 +517,7 @@ export class CloudClient {
                 'certificate and its signing secret, since this read is proven by the device, not by a session.');
         }
         const challenge = await this.getAccountRelaysChallenge(accountId);
-        const body = await this.request('GET', `/api/cloud/accounts/${encodeURIComponent(accountId)}/relays`, {
+        const body = await this.request('GET', `/api/cloud/accounts/${pathSegment(accountId)}/relays`, {
             anonymous: true,
             headers: await routingProofHeaders(challenge, this.routingCredential),
         });
@@ -633,7 +634,7 @@ export class CloudClient {
         const body = options.admitterAddrs === undefined
             ? {}
             : { admitter_addrs: [...options.admitterAddrs] };
-        return this.request('POST', `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/enable-ha`, { body });
+        return this.request('POST', `/api/cloud/namespaces/${pathSegment(namespaceId)}/enable-ha`, { body });
     }
     /**
      * Enable HA for a namespace this ACCOUNT founded through a relay, with the
@@ -642,7 +643,7 @@ export class CloudClient {
      * The login must be linked to that account.
      */
     async enableFoundedNamespaceHa(namespaceId, ownershipProof) {
-        return this.request('POST', `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/enable-ha`, { body: { groups: [], ownership_proof: ownershipProof } });
+        return this.request('POST', `/api/cloud/me/namespaces/${pathSegment(namespaceId)}/enable-ha`, { body: { groups: [], ownership_proof: ownershipProof } });
     }
     /**
      * Enable HA for a namespace this account founded, with **no cloud session**.
@@ -677,7 +678,7 @@ export class CloudClient {
         const account = options.accountId.toLowerCase();
         const namespace = options.namespaceId.toLowerCase();
         try {
-            return await this.request('POST', `/api/cloud/accounts/${encodeURIComponent(account)}/namespaces/${encodeURIComponent(namespace)}/enable-ha`, { body: { ownership_proof: proof }, anonymous: true });
+            return await this.request('POST', `/api/cloud/accounts/${pathSegment(account)}/namespaces/${pathSegment(namespace)}/enable-ha`, { body: { ownership_proof: proof }, anonymous: true });
         }
         catch (err) {
             if (err instanceof HTTPError && ACCOUNT_HA_REFUSALS[err.status]) {
@@ -699,7 +700,7 @@ export class CloudClient {
      * billing flip.
      */
     async disableNamespaceHa(namespaceId) {
-        return this.request('POST', `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/disable-ha`, { body: {} });
+        return this.request('POST', `/api/cloud/namespaces/${pathSegment(namespaceId)}/disable-ha`, { body: {} });
     }
     /**
      * The node assigned to the signed-in user, or `null`.

package/dist/http-client/path-segment.d.ts

@@ -0,0 +1 @@
+export declare function pathSegment(id: string): string;

package/dist/http-client/path-segment.js

@@ -0,0 +1,8 @@
+// encodeURIComponent leaves "." and ".." intact and URL parsers collapse them,
+// so those (and the empty id, which names the collection route) are refused.
+export function pathSegment(id) {
+    if (id === '' || id === '.' || id === '..') {
+        throw new TypeError(`invalid request path segment: ${JSON.stringify(id)}`);
+    }
+    return encodeURIComponent(id);
+}