@calimero-network/mero-js 25.2.0 → 25.3.1

package/dist/index.mjs

@@ -31,6 +31,244 @@ function createTimeoutSignal(timeoutMs) {
   return controller.signal;
 }
 
+// src/crypto/internal.ts
+var PKCS8_ED25519_PREFIX = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  112,
+  4,
+  34,
+  4,
+  32
+]);
+function u32le(value) {
+  const out = new Uint8Array(4);
+  new DataView(out.buffer).setUint32(0, value, true);
+  return out;
+}
+function hex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(value, label2, expectedBytes) {
+  const clean = value.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length !== expectedBytes * 2) {
+    throw new Error(
+      `${label2} must be ${expectedBytes * 2} hex characters, got ${clean.length}`
+    );
+  }
+  const bytes = new Uint8Array(expectedBytes);
+  for (let i = 0; i < expectedBytes; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function fromHexUnsized(value, label2) {
+  const clean = value.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+    throw new Error(`${label2} must be an even number of hex characters`);
+  }
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function u64le(value) {
+  const out = new Uint8Array(8);
+  new DataView(out.buffer).setBigUint64(0, BigInt(value), true);
+  return out;
+}
+function concat(...parts) {
+  const out = new Uint8Array(parts.reduce((total, p) => total + p.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+async function domainHash(domain, parts) {
+  const chunks = [u64le(domain.length), domain];
+  for (const part of parts) {
+    chunks.push(u64le(part.length), part);
+  }
+  return new Uint8Array(
+    await crypto.subtle.digest("SHA-256", concat(...chunks))
+  );
+}
+async function importSigningKey(secretHex) {
+  const seed = fromHex(secretHex, "deviceSecret", 32);
+  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
+  try {
+    return await crypto.subtle.importKey(
+      "pkcs8",
+      pkcs8,
+      { name: "Ed25519" },
+      false,
+      ["sign"]
+    );
+  } catch (cause) {
+    const detail = cause instanceof Error ? `: ${cause.message}` : "";
+    throw new Error(
+      "this runtime has no WebCrypto Ed25519, so a warrant cannot be signed here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it; otherwise mint the warrant with `merod account warrant`" + detail
+    );
+  }
+}
+async function verifySignature(publicKey, signature, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    fromHex(publicKey, "publicKey", 32),
+    { name: "Ed25519" },
+    false,
+    ["verify"]
+  );
+  return crypto.subtle.verify({ name: "Ed25519" }, key, signature, payload);
+}
+async function derivePublicKey(secretHex) {
+  const seed = fromHex(secretHex, "deviceSecret", 32);
+  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
+  const key = await crypto.subtle.importKey(
+    "pkcs8",
+    pkcs8,
+    { name: "Ed25519" },
+    true,
+    ["sign"]
+  );
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  const raw = jwk.x;
+  return Uint8Array.from(
+    atob(raw.replace(/-/g, "+").replace(/_/g, "/")),
+    (c) => c.charCodeAt(0)
+  );
+}
+
+// src/request/request-sig.ts
+var SIGN_DOMAIN = new TextEncoder().encode("calimero.auth.request.v2");
+var BODY_DOMAIN = new TextEncoder().encode("calimero.auth.request.body.v1");
+function borshString(value) {
+  const bytes = new TextEncoder().encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+async function requestBodyHash(body = new Uint8Array(0)) {
+  const bytes = typeof body === "string" ? new TextEncoder().encode(body) : body;
+  return domainHash(BODY_DOMAIN, [bytes]);
+}
+async function signRequest(input) {
+  const key = await importSigningKey(input.signerSecret);
+  const bodyHash = await requestBodyHash(input.body);
+  const issuedAt = u64le(input.issuedAt);
+  const expiresAt = u64le(input.expiresAt);
+  const encoder = new TextEncoder();
+  const preimage = await domainHash(SIGN_DOMAIN, [
+    encoder.encode(input.method),
+    encoder.encode(input.path),
+    bodyHash,
+    issuedAt,
+    expiresAt
+  ]);
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
+  );
+  return hex(
+    concat(
+      borshString(input.method),
+      borshString(input.path),
+      bodyHash,
+      issuedAt,
+      expiresAt,
+      signature
+    )
+  );
+}
+
+// src/request-proof/request-proof.ts
+var utf8 = (text) => new TextEncoder().encode(text);
+var REQUEST_PROOF_HEADER = "X-Calimero-Proof";
+var DEFAULT_VALID_FOR = 300;
+async function signRequestProof(input) {
+  const { method, path, credential } = input;
+  if (!method) throw new Error("signRequestProof needs the method the request will use");
+  if (!path.startsWith("/")) {
+    throw new Error(`signRequestProof needs a path, got ${JSON.stringify(path)}`);
+  }
+  const bodyHash = await requestBodyHash(input.body);
+  const issuedAt = Math.floor(input.now ?? Date.now() / 1e3);
+  const expiresAt = issuedAt + (input.validForSeconds ?? DEFAULT_VALID_FOR);
+  const payload = await domainHash(SIGN_DOMAIN, [
+    utf8(method),
+    utf8(path),
+    bodyHash,
+    u64le(issuedAt),
+    u64le(expiresAt)
+  ]);
+  const signature = await signPayload(payload, input);
+  if (signature.length !== 64) {
+    throw new Error(`the signer returned ${signature.length} bytes, not a 64-byte signature`);
+  }
+  const requestSig = concat(
+    u32le(utf8(method).length),
+    utf8(method),
+    u32le(utf8(path).length),
+    utf8(path),
+    bodyHash,
+    u64le(issuedAt),
+    u64le(expiresAt),
+    signature
+  );
+  const accountProof = hexToBytes(credential, "credential");
+  return hex(concat(accountProof, new Uint8Array([0]), requestSig));
+}
+async function signPayload(payload, input) {
+  if (input.signer) return input.signer.sign(payload);
+  if (!input.deviceSecret) {
+    throw new Error("signRequestProof needs either `deviceSecret` or `signer`");
+  }
+  const key = await importSigningKey(input.deviceSecret);
+  return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, key, payload));
+}
+function hexToBytes(value, label2) {
+  const clean = value.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+    throw new Error(`${label2} is not an even-length hex string`);
+  }
+  return fromHex(clean, label2, clean.length / 2);
+}
+
+// src/request-proof/authorizer.ts
+function createProofAuthorizer(credential) {
+  if (!credential.credential) {
+    throw new Error("a proof authorizer needs the `credential` from signDeviceCert");
+  }
+  if (!credential.deviceSecret && !credential.signer) {
+    throw new Error("a proof authorizer needs either `deviceSecret` or `signer`");
+  }
+  return async ({ method, path, body }) => {
+    const proof = await signRequestProof({
+      method,
+      path,
+      body,
+      credential: credential.credential,
+      deviceSecret: credential.deviceSecret,
+      signer: credential.signer,
+      validForSeconds: credential.validForSeconds
+    });
+    return { [REQUEST_PROOF_HEADER]: proof };
+  };
+}
+function signedPath(url2) {
+  const parsed = new URL(url2, globalThis.location?.href ?? "http://localhost");
+  return parsed.pathname + parsed.search;
+}
+
 // src/http-client/web-client.ts
 var TERMINAL_AUTH_ERRORS = /* @__PURE__ */ new Set(["token_reuse", "token_revoked"]);
 function extractErrorMessage(bodyText) {
@@ -86,13 +324,31 @@ function headersToRecord(headers) {
   });
   return record;
 }
-function pathForProof(url2) {
+function withoutBareQuery(url2) {
+  let parsed;
   try {
-    return new URL(url2).pathname;
+    parsed = new URL(url2, globalThis.location?.href);
   } catch {
-    const query = url2.indexOf("?");
-    return query === -1 ? url2 : url2.slice(0, query);
+    return url2;
   }
+  if (parsed.search === "") parsed.search = "";
+  return parsed.href;
+}
+function carriesProof(headers) {
+  return Object.keys(headers).some(
+    (name) => name.toLowerCase() === REQUEST_PROOF_HEADER.toLowerCase()
+  );
+}
+function refuseProofRedirect(response, url2) {
+  const redirected = response.type === "opaqueredirect" || response.status >= 300 && response.status < 400;
+  if (!redirected) return;
+  throw new HTTPError(
+    0,
+    "Redirect Not Followed",
+    url2,
+    response.headers,
+    `the node answered with a redirect; a request carrying ${REQUEST_PROOF_HEADER} is not followed to another location`
+  );
 }
 var WebHttpClient = class {
   constructor(transport2) {
@@ -157,7 +413,7 @@ var WebHttpClient = class {
   }
   async makeRequest(path, init, retryCount = 0, requestStartTime) {
     const MAX_RETRY_ATTEMPTS = 1;
-    const url2 = this.buildUrl(path);
+    const url2 = withoutBareQuery(this.buildUrl(path));
     const startTime = requestStartTime ?? Date.now();
     const signal = this.createAbortSignal(init);
     const headers = await this.buildHeaders(init?.headers);
@@ -182,7 +438,7 @@ var WebHttpClient = class {
         headersObj,
         await this.transport.authorizeRequest({
           method,
-          path: new URL(url2).pathname,
+          path: signedPath(url2),
           // Narrowed by the guard above; `BodyInit` is wider than what can be
           // signed.
           body
@@ -242,15 +498,20 @@ var WebHttpClient = class {
     if (this.transport.getProof) {
       const proof = await this.transport.getProof({
         method: requestInit.method ?? "GET",
-        path: pathForProof(url2),
+        path: signedPath(url2),
         body: requestInit.body
       });
       if (proof) {
         headersObj["X-Calimero-Proof"] = proof;
       }
     }
+    const proofAttached = carriesProof(headersObj);
+    if (proofAttached && requestInit.redirect !== "error") {
+      requestInit.redirect = "manual";
+    }
     try {
       const response = await this.transport.fetch(url2, requestInit);
+      if (proofAttached) refuseProofRedirect(response, url2);
       if (!response.ok) {
         const bodyText = await this.getBodyText(response);
         const httpError = new HTTPError(
@@ -2269,6 +2530,10 @@ var AdminApiClient = class {
   async getMigrationStatus(namespaceId) {
     return this.httpClient.get(`/admin-api/groups/${pathSegment(namespaceId)}/migration-status`);
   }
+  /** Revoked devices and withdrawn slots of a namespace; 403 unless this node is a bound member. */
+  async listNamespaceRevokedDevices(namespaceId) {
+    return this.httpClient.get(`/admin-api/namespaces/${pathSegment(namespaceId)}/revoked-devices`);
+  }
   /** Per-group cascade-migration snapshots for a namespace. */
   async getCascadeStatus(namespaceId) {
     return unwrap(
@@ -2460,165 +2725,6 @@ function buildAuthLoginUrl(nodeUrl, opts) {
   return `${base}/auth/login?${params.toString()}`;
 }
 
-// src/crypto/internal.ts
-var PKCS8_ED25519_PREFIX = new Uint8Array([
-  48,
-  46,
-  2,
-  1,
-  0,
-  48,
-  5,
-  6,
-  3,
-  43,
-  101,
-  112,
-  4,
-  34,
-  4,
-  32
-]);
-function u32le(value) {
-  const out = new Uint8Array(4);
-  new DataView(out.buffer).setUint32(0, value, true);
-  return out;
-}
-function hex(bytes) {
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-function fromHex(value, label2, expectedBytes) {
-  const clean = value.trim();
-  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length !== expectedBytes * 2) {
-    throw new Error(
-      `${label2} must be ${expectedBytes * 2} hex characters, got ${clean.length}`
-    );
-  }
-  const bytes = new Uint8Array(expectedBytes);
-  for (let i = 0; i < expectedBytes; i += 1) {
-    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-  }
-  return bytes;
-}
-function fromHexUnsized(value, label2) {
-  const clean = value.trim();
-  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
-    throw new Error(`${label2} must be an even number of hex characters`);
-  }
-  const bytes = new Uint8Array(clean.length / 2);
-  for (let i = 0; i < bytes.length; i += 1) {
-    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-  }
-  return bytes;
-}
-function u64le(value) {
-  const out = new Uint8Array(8);
-  new DataView(out.buffer).setBigUint64(0, BigInt(value), true);
-  return out;
-}
-function concat(...parts) {
-  const out = new Uint8Array(parts.reduce((total, p) => total + p.length, 0));
-  let offset = 0;
-  for (const part of parts) {
-    out.set(part, offset);
-    offset += part.length;
-  }
-  return out;
-}
-async function domainHash(domain, parts) {
-  const chunks = [u64le(domain.length), domain];
-  for (const part of parts) {
-    chunks.push(u64le(part.length), part);
-  }
-  return new Uint8Array(
-    await crypto.subtle.digest("SHA-256", concat(...chunks))
-  );
-}
-async function importSigningKey(secretHex) {
-  const seed = fromHex(secretHex, "deviceSecret", 32);
-  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
-  try {
-    return await crypto.subtle.importKey(
-      "pkcs8",
-      pkcs8,
-      { name: "Ed25519" },
-      false,
-      ["sign"]
-    );
-  } catch (cause) {
-    const detail = cause instanceof Error ? `: ${cause.message}` : "";
-    throw new Error(
-      "this runtime has no WebCrypto Ed25519, so a warrant cannot be signed here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it; otherwise mint the warrant with `merod account warrant`" + detail
-    );
-  }
-}
-async function verifySignature(publicKey, signature, payload) {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    fromHex(publicKey, "publicKey", 32),
-    { name: "Ed25519" },
-    false,
-    ["verify"]
-  );
-  return crypto.subtle.verify({ name: "Ed25519" }, key, signature, payload);
-}
-async function derivePublicKey(secretHex) {
-  const seed = fromHex(secretHex, "deviceSecret", 32);
-  const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
-  const key = await crypto.subtle.importKey(
-    "pkcs8",
-    pkcs8,
-    { name: "Ed25519" },
-    true,
-    ["sign"]
-  );
-  const jwk = await crypto.subtle.exportKey("jwk", key);
-  const raw = jwk.x;
-  return Uint8Array.from(
-    atob(raw.replace(/-/g, "+").replace(/_/g, "/")),
-    (c) => c.charCodeAt(0)
-  );
-}
-
-// src/request/request-sig.ts
-var SIGN_DOMAIN = new TextEncoder().encode("calimero.auth.request.v1");
-var BODY_DOMAIN = new TextEncoder().encode("calimero.auth.request.body.v1");
-function borshString(value) {
-  const bytes = new TextEncoder().encode(value);
-  return concat(u32le(bytes.length), bytes);
-}
-async function requestBodyHash(body = new Uint8Array(0)) {
-  const bytes = typeof body === "string" ? new TextEncoder().encode(body) : body;
-  return domainHash(BODY_DOMAIN, [bytes]);
-}
-async function signRequest(input) {
-  const key = await importSigningKey(input.signerSecret);
-  const bodyHash = await requestBodyHash(input.body);
-  const issuedAt = u64le(input.issuedAt);
-  const expiresAt = u64le(input.expiresAt);
-  const encoder = new TextEncoder();
-  const preimage = await domainHash(SIGN_DOMAIN, [
-    encoder.encode(input.method),
-    encoder.encode(input.path),
-    bodyHash,
-    issuedAt,
-    expiresAt
-  ]);
-  const signature = new Uint8Array(
-    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
-  );
-  return hex(
-    concat(
-      borshString(input.method),
-      borshString(input.path),
-      bodyHash,
-      issuedAt,
-      expiresAt,
-      signature
-    )
-  );
-}
-
 // src/request/caller-proof.ts
 function callerProof(input) {
   const credential = fromHexUnsized(input.credential, "credential");
@@ -2847,13 +2953,17 @@ var SseClient = class {
     this.abortController = new AbortController();
     try {
       const url2 = `${this.baseUrl}/sse`;
+      const headers = {
+        ...await this.authorize({ method: "GET", path: signedPath(url2) }),
+        "Accept": "text/event-stream"
+      };
+      const proofAttached = carriesProof(headers);
       const response = await this.fetchImpl(url2, {
-        headers: {
-          ...await this.authorize({ method: "GET", path: new URL(url2).pathname }),
-          "Accept": "text/event-stream"
-        },
-        signal: this.abortController.signal
+        headers,
+        signal: this.abortController.signal,
+        ...proofAttached && { redirect: "manual" }
       });
+      if (proofAttached) refuseProofRedirect(response, url2);
       if (!response.ok) {
         const terminal = isTerminalAuthFailure(response);
         const bodyText = await response.text().catch(() => void 0);
@@ -3051,15 +3161,19 @@ var SseClient = class {
       if (ids.groupIds && ids.groupIds.length > 0) params.groupIds = ids.groupIds;
       const url2 = `${this.baseUrl}/sse/subscription`;
       const body = JSON.stringify({ id: this.sessionId, method, params });
+      const headers = {
+        ...await this.authorize({ method: "POST", path: signedPath(url2), body }),
+        "Content-Type": "application/json"
+      };
+      const proofAttached = carriesProof(headers);
       const response = await this.fetchImpl(url2, {
         method: "POST",
-        headers: {
-          ...await this.authorize({ method: "POST", path: new URL(url2).pathname, body }),
-          "Content-Type": "application/json"
-        },
+        headers,
         body,
-        signal: timeout.signal
+        signal: timeout.signal,
+        ...proofAttached && { redirect: "manual" }
       });
+      if (proofAttached) refuseProofRedirect(response, url2);
       if (!response.ok) {
         const terminal = isTerminalAuthFailure(response);
         const bodyText = await response.text().catch(() => void 0);
@@ -6179,7 +6293,7 @@ var MAX_HANDSHAKE_REPLY = 1024;
 var RENEW_BEFORE_MS = 6e4;
 var TRANSPORT_BINDING_DOMAIN = "calimero.tee-attest.transport-key.v1";
 var NULL_BODY_STATUSES = [101, 204, 205, 304];
-var utf8 = new TextEncoder();
+var utf82 = new TextEncoder();
 var StaleTransportKeyError = class extends Error {
   constructor() {
     super("The node no longer holds the attested transport key; attest again for the current one");
@@ -6198,7 +6312,7 @@ var SealedTransportError = class extends Error {
 async function transportKeyBinding(inner, transportKey) {
   const digest = await crypto.subtle.digest(
     "SHA-256",
-    concat(utf8.encode(TRANSPORT_BINDING_DOMAIN), inner, transportKey)
+    concat(utf82.encode(TRANSPORT_BINDING_DOMAIN), inner, transportKey)
   );
   return new Uint8Array(digest);
 }
@@ -6402,7 +6516,7 @@ function nonce(requestId, index) {
   return bytes;
 }
 function joinInner(head, body) {
-  const encoded = utf8.encode(JSON.stringify(head));
+  const encoded = utf82.encode(JSON.stringify(head));
   const len = new Uint8Array(4);
   new DataView(len.buffer).setUint32(0, encoded.length, false);
   return concat(len, encoded, body);
@@ -6892,7 +7006,7 @@ var FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
 var SAN_URI = 134;
 var UTF8_STRING = 12;
 var SEQUENCE2 = 48;
-var utf82 = new TextEncoder();
+var utf83 = new TextEncoder();
 var fromUtf8 = (bytes) => new TextDecoder().decode(bytes);
 async function verifyCosignBundle(body, bundle, signer, signature) {
   const { base64Signature, cert, rekorBundle } = cosignBundle(bundle);
@@ -6905,7 +7019,7 @@ async function verifyCosignBundle(body, bundle, signer, signature) {
   const leaf = parseCertificate(leafDer);
   const log = REKOR_LOGS.find((candidate) => candidate.logId === payload.logID.toLowerCase());
   if (!log) throw new Error(`The bundle names Rekor log ${payload.logID}, which the Sigstore trust root does not know`);
-  const canonical = utf82.encode(
+  const canonical = utf83.encode(
     `{"body":${JSON.stringify(payload.body)},"integratedTime":${payload.integratedTime},"logID":${JSON.stringify(payload.logID)},"logIndex":${payload.logIndex}}`
   );
   const setVerifies = await verifyEcdsa(
@@ -8643,92 +8757,6 @@ var RelayObserver = class {
   }
 };
 
-// src/request-proof/request-proof.ts
-var utf83 = (text) => new TextEncoder().encode(text);
-var REQUEST_SIGN_DOMAIN = utf83("calimero.auth.request.v1");
-var REQUEST_BODY_DOMAIN = utf83("calimero.auth.request.body.v1");
-var REQUEST_PROOF_HEADER = "X-Calimero-Proof";
-var DEFAULT_VALID_FOR = 300;
-async function signRequestProof(input) {
-  const { method, path, credential } = input;
-  if (!method) throw new Error("signRequestProof needs the method the request will use");
-  if (!path.startsWith("/")) {
-    throw new Error(`signRequestProof needs a path, got ${JSON.stringify(path)}`);
-  }
-  if (path.includes("?")) {
-    throw new Error(
-      `the path must carry no query string, got ${JSON.stringify(path)} \u2014 a query is excluded from the signature on purpose, because a proxy may rewrite one. Anything that must be bound belongs in the body.`
-    );
-  }
-  const bodyBytes2 = input.body === void 0 ? new Uint8Array() : typeof input.body === "string" ? utf83(input.body) : input.body;
-  const bodyHash = await domainHash(REQUEST_BODY_DOMAIN, [bodyBytes2]);
-  const issuedAt = Math.floor(input.now ?? Date.now() / 1e3);
-  const expiresAt = issuedAt + (input.validForSeconds ?? DEFAULT_VALID_FOR);
-  const payload = await domainHash(REQUEST_SIGN_DOMAIN, [
-    utf83(method),
-    utf83(path),
-    bodyHash,
-    u64le(issuedAt),
-    u64le(expiresAt)
-  ]);
-  const signature = await signPayload(payload, input);
-  if (signature.length !== 64) {
-    throw new Error(`the signer returned ${signature.length} bytes, not a 64-byte signature`);
-  }
-  const requestSig = concat(
-    u32le(utf83(method).length),
-    utf83(method),
-    u32le(utf83(path).length),
-    utf83(path),
-    bodyHash,
-    u64le(issuedAt),
-    u64le(expiresAt),
-    signature
-  );
-  const accountProof = hexToBytes(credential, "credential");
-  return hex(concat(accountProof, new Uint8Array([0]), requestSig));
-}
-async function signPayload(payload, input) {
-  if (input.signer) return input.signer.sign(payload);
-  if (!input.deviceSecret) {
-    throw new Error("signRequestProof needs either `deviceSecret` or `signer`");
-  }
-  const key = await importSigningKey(input.deviceSecret);
-  return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, key, payload));
-}
-function hexToBytes(value, label2) {
-  const clean = value.trim();
-  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
-    throw new Error(`${label2} is not an even-length hex string`);
-  }
-  return fromHex(clean, label2, clean.length / 2);
-}
-
-// src/request-proof/authorizer.ts
-function createProofAuthorizer(credential) {
-  if (!credential.credential) {
-    throw new Error("a proof authorizer needs the `credential` from signDeviceCert");
-  }
-  if (!credential.deviceSecret && !credential.signer) {
-    throw new Error("a proof authorizer needs either `deviceSecret` or `signer`");
-  }
-  return async ({ method, path, body }) => {
-    const proof = await signRequestProof({
-      method,
-      path,
-      body,
-      credential: credential.credential,
-      deviceSecret: credential.deviceSecret,
-      signer: credential.signer,
-      validForSeconds: credential.validForSeconds
-    });
-    return { [REQUEST_PROOF_HEADER]: proof };
-  };
-}
-function signedPath(url2) {
-  return new URL(url2).pathname;
-}
-
 // src/presence/statement.ts
 var PRESENCE_DOMAIN = new TextEncoder().encode("calimero/presence/1");
 async function stateHash(state) {