@calimero-network/mero-js 25.2.0 → 25.3.1

package/dist/admin-api/admin-client.d.ts

@@ -1,5 +1,5 @@
 import { HttpClient, HTTPError } from '../http-client/index.js';
-import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData, WarrantNonceState } from './admin-types.js';
+import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, NamespaceRevokedDevices, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData, WarrantNonceState } from './admin-types.js';
 import { type RedeemOutcome } from './redeem-invitation.js';
 /**
  * Thrown when a node answers the warrant-nonce route with a 404.
@@ -720,6 +720,8 @@ export declare class AdminApiClient {
      * envelope to unwrap here (unlike most admin reads).
      */
     getMigrationStatus(namespaceId: string): Promise<MigrationStatus>;
+    /** Revoked devices and withdrawn slots of a namespace; 403 unless this node is a bound member. */
+    listNamespaceRevokedDevices(namespaceId: string): Promise<NamespaceRevokedDevices>;
     /** Per-group cascade-migration snapshots for a namespace. */
     getCascadeStatus(namespaceId: string): Promise<CascadeStatusEntry[]>;
     retryGroupUpgrade(groupId: string): Promise<RetryGroupUpgradeResponseData>;

package/dist/admin-api/admin-client.js

@@ -1285,6 +1285,10 @@ export class AdminApiClient {
     async getMigrationStatus(namespaceId) {
         return this.httpClient.get(`/admin-api/groups/${pathSegment(namespaceId)}/migration-status`);
     }
+    /** Revoked devices and withdrawn slots of a namespace; 403 unless this node is a bound member. */
+    async listNamespaceRevokedDevices(namespaceId) {
+        return this.httpClient.get(`/admin-api/namespaces/${pathSegment(namespaceId)}/revoked-devices`);
+    }
     /** Per-group cascade-migration snapshots for a namespace. */
     async getCascadeStatus(namespaceId) {
         return unwrap(await this.httpClient.get(`/admin-api/groups/${pathSegment(namespaceId)}/cascade-status`));

package/dist/admin-api/admin-types.d.ts

@@ -1353,6 +1353,12 @@ export interface MigrationStatus {
     rollup: MigrationStatusRollup;
     members: MemberMigrationStatusEntry[];
 }
+export interface NamespaceRevokedDevices {
+    /** Device ids (64 hex) revoked in the namespace. */
+    revokedDevices: string[];
+    /** Hex `sha256(account || device)` of each device its own account withdrew in the namespace. */
+    withdrawnSlots: string[];
+}
 export interface CascadeStatusEntry {
     groupId: string;
     upgrade: GroupUpgradeStatus;

package/dist/events/sse.js

@@ -1,5 +1,7 @@
 import { isGroupMigrationEvent } from './group.js';
 import { AuthRevokedError, HTTPError } from '../http-client/index.js';
+import { carriesProof, refuseProofRedirect } from '../http-client/web-client.js';
+import { signedPath } from '../request-proof/authorizer.js';
 /**
  * `x-auth-error` reasons that mean the whole token family is gone, mirroring
  * the request path in `web-client.ts`. Anything else — `token_expired` above
@@ -143,13 +145,18 @@ export class SseClient {
         this.abortController = new AbortController();
         try {
             const url = `${this.baseUrl}/sse`;
+            const headers = {
+                ...(await this.authorize({ method: 'GET', path: signedPath(url) })),
+                'Accept': 'text/event-stream',
+            };
+            const proofAttached = carriesProof(headers);
             const response = await this.fetchImpl(url, {
-                headers: {
-                    ...(await this.authorize({ method: 'GET', path: new URL(url).pathname })),
-                    'Accept': 'text/event-stream',
-                },
+                headers,
                 signal: this.abortController.signal,
+                ...(proofAttached && { redirect: 'manual' }),
             });
+            if (proofAttached)
+                refuseProofRedirect(response, url);
             if (!response.ok) {
                 // Throw the same typed errors the request path throws. A bare
                 // `Error("SSE connection failed: 401")` forced callers to string-match
@@ -379,15 +386,20 @@ export class SseClient {
             // differ in key order, which fails as a refused credential rather than as
             // anything that names the real cause.
             const body = JSON.stringify({ id: this.sessionId, method, params });
+            const headers = {
+                ...(await this.authorize({ method: 'POST', path: signedPath(url), body })),
+                'Content-Type': 'application/json',
+            };
+            const proofAttached = carriesProof(headers);
             const response = await this.fetchImpl(url, {
                 method: 'POST',
-                headers: {
-                    ...(await this.authorize({ method: 'POST', path: new URL(url).pathname, body })),
-                    'Content-Type': 'application/json',
-                },
+                headers,
                 body,
                 signal: timeout.signal,
+                ...(proofAttached && { redirect: 'manual' }),
             });
+            if (proofAttached)
+                refuseProofRedirect(response, url);
             if (!response.ok) {
                 // The subscribe path used to report only the status. On the one failure
                 // that matters it is the whole of what the caller got: a revoked family

package/dist/http-client/http-types.d.ts

@@ -18,7 +18,7 @@ export interface Transport {
      */
     authorizeRequest?: (request: {
         method: string;
-        /** The path the node will see, query excluded. */
+        /** The path and query the node will see, as `signedPath` reads them. */
         path: string;
         body?: string | Uint8Array;
     }) => Promise<Record<string, string>>;

package/dist/http-client/web-client.d.ts

@@ -36,6 +36,13 @@ export declare class AuthRevokedError extends HTTPError {
     /** Value of the `x-auth-error` header, e.g. `token_reuse` or `token_revoked`. */
     reason: string, status: number, statusText: string, url: string, headers: Headers, bodyText?: string);
 }
+/** Whether `headers` carry a request proof, which must never follow a redirect. */
+export declare function carriesProof(headers: Record<string, string>): boolean;
+/**
+ * Throws when a proof-carrying request was answered with a redirect, which
+ * fetch reports as an opaque response with status 0 under redirect: 'manual'.
+ */
+export declare function refuseProofRedirect(response: Response, url: string): void;
 export declare class WebHttpClient implements HttpClient {
     private transport;
     private refreshTokenPromise;

package/dist/http-client/web-client.js

@@ -1,4 +1,6 @@
 import { combineSignals, createTimeoutSignal } from './signal-utils.js';
+import { signedPath } from '../request-proof/authorizer.js';
+import { REQUEST_PROOF_HEADER } from '../request-proof/request-proof.js';
 /**
  * `x-auth-error` reasons that mean the whole token family is gone.
  *
@@ -93,24 +95,36 @@ function headersToRecord(headers) {
     });
     return record;
 }
-// Web Standards HTTP client implementation
-/**
- * The path a node will verify a request signature against.
- *
- * `new URL` drops the query and keeps any prefix the base URL contributed,
- * which is exactly what reaches the server. The fallback covers a `url` that is
- * already relative — it cannot be parsed, and signing the whole string with its
- * query attached would be worse than signing the part before the `?`.
- */
-function pathForProof(url) {
+/** Runtimes disagree on sending a bare `?`, so the URL parser drops it once and
+ * the URL signed and the URL fetched are one string. */
+function withoutBareQuery(url) {
+    let parsed;
     try {
-        return new URL(url).pathname;
+        parsed = new URL(url, globalThis.location?.href);
     }
     catch {
-        const query = url.indexOf('?');
-        return query === -1 ? url : url.slice(0, query);
+        return url; // relative, with no page to resolve it against
     }
+    if (parsed.search === '')
+        parsed.search = '';
+    return parsed.href;
+}
+/** Whether `headers` carry a request proof, which must never follow a redirect. */
+export function carriesProof(headers) {
+    return Object.keys(headers).some((name) => name.toLowerCase() === REQUEST_PROOF_HEADER.toLowerCase());
 }
+/**
+ * Throws when a proof-carrying request was answered with a redirect, which
+ * fetch reports as an opaque response with status 0 under redirect: 'manual'.
+ */
+export function refuseProofRedirect(response, url) {
+    const redirected = response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400);
+    if (!redirected)
+        return;
+    // Status 0 marks a withheld response; its explanation is the body text.
+    throw new HTTPError(0, 'Redirect Not Followed', url, response.headers, `the node answered with a redirect; a request carrying ${REQUEST_PROOF_HEADER} is not followed to another location`);
+}
+// Web Standards HTTP client implementation
 export class WebHttpClient {
     constructor(transport) {
         this.transport = transport;
@@ -175,7 +189,7 @@ export class WebHttpClient {
     async makeRequest(path, init, retryCount = 0, requestStartTime) {
         // Maximum retry attempts to prevent infinite loops
         const MAX_RETRY_ATTEMPTS = 1;
-        const url = this.buildUrl(path);
+        const url = withoutBareQuery(this.buildUrl(path));
         // Track request start time for timeout calculation (only on first attempt)
         // Use per-request start time to avoid corruption from concurrent requests
         const startTime = requestStartTime ?? Date.now();
@@ -195,9 +209,7 @@ export class WebHttpClient {
         }
         const method = init?.method || 'GET';
         // A credential that commits to the request can only be produced here, where
-        // the method, the assembled path and the body are all known. The path comes
-        // from the URL rather than from `path`, because a base URL may carry a prefix
-        // (`…/admin-api`) that the node sees and a bare relative path would not sign.
+        // the method, the assembled path and query, and the body are all known.
         if (this.transport.authorizeRequest) {
             const body = init?.body;
             if (body !== undefined && typeof body !== 'string' && !(body instanceof Uint8Array)) {
@@ -207,7 +219,7 @@ export class WebHttpClient {
             }
             Object.assign(headersObj, await this.transport.authorizeRequest({
                 method,
-                path: new URL(url).pathname,
+                path: signedPath(url),
                 // Narrowed by the guard above; `BodyInit` is wider than what can be
                 // signed.
                 body: body,
@@ -281,24 +293,28 @@ export class WebHttpClient {
         // nor the body — and a proof commits to both. Signed AFTER the body is
         // settled above, so what is hashed is what is sent.
         //
-        // The path comes from the built URL's `pathname`, not from the `path`
-        // argument: that argument may carry a query string, and may be relative to
-        // a base URL that contributes its own prefix. The node verifies against the
-        // path it received, so the only safe source is the URL actually being
-        // fetched. A query string is deliberately not covered — core's `RequestSig`
-        // signs the path alone, and signing more here would fail every request.
+        // The path and query come from the built URL, not from the `path` argument,
+        // which may be relative to a base URL that contributes its own prefix.
         if (this.transport.getProof) {
             const proof = await this.transport.getProof({
                 method: requestInit.method ?? 'GET',
-                path: pathForProof(url),
+                path: signedPath(url),
                 body: requestInit.body,
             });
             if (proof) {
                 headersObj['X-Calimero-Proof'] = proof;
             }
         }
+        // fetch forwards custom headers across redirects, so a proof must never be
+        // sent anywhere but where it was signed for.
+        const proofAttached = carriesProof(headersObj);
+        if (proofAttached && requestInit.redirect !== 'error') {
+            requestInit.redirect = 'manual';
+        }
         try {
             const response = await this.transport.fetch(url, requestInit);
+            if (proofAttached)
+                refuseProofRedirect(response, url);
             if (!response.ok) {
                 const bodyText = await this.getBodyText(response);
                 const httpError = new HTTPError(response.status, response.statusText, url, response.headers, bodyText);