@calimero-network/mero-js 25.3.2 → 26.0.0

package/dist/index.mjs

@@ -1219,50 +1219,6 @@ async function redeemInvitation(parsed, redeemer) {
 }
 
 // src/admin-api/admin-client.ts
-var WarrantNonceRouteUnavailableError = class extends Error {
-  constructor(path, cause) {
-    super(
-      `this node does not serve warrant-nonce discovery (404 on ${path}); it predates the route, so a client must fall back to its own nonce counter`
-    );
-    this.path = path;
-    this.cause = cause;
-    this.name = "WarrantNonceRouteUnavailableError";
-  }
-};
-function u64FromBody(body, parsed, field) {
-  const value = parsed[field];
-  if (value === void 0 || value === null) return void 0;
-  const digits = new RegExp(`"${field}"\\s*:\\s*(\\d+)`).exec(body);
-  if (digits) return BigInt(digits[1]);
-  if (typeof value === "string" && /^\d+$/.test(value)) return BigInt(value);
-  throw new Error(`warrant-nonce response field \`${field}\` is not a u64: ${JSON.stringify(value)}`);
-}
-function parseWarrantNonce(body) {
-  const parsed = JSON.parse(body);
-  const data = parsed?.data;
-  if (!data || typeof data !== "object") {
-    throw new Error(`warrant-nonce response had no \`data\`: ${body.slice(0, 200)}`);
-  }
-  const common = {
-    contextId: String(data.contextId ?? ""),
-    authorDeviceKey: String(data.authorDeviceKey ?? ""),
-    seen: data.seen === true,
-    highWaterNonce: u64FromBody(body, data, "highWaterNonce"),
-    // Not defaulted: a node that stopped sending it is a node whose window this
-    // client would be guessing at, and the window is not a nonce input anyway.
-    windowWidth: u64FromBody(body, data, "windowWidth") ?? 0n
-  };
-  const nextNonce = u64FromBody(body, data, "nextNonce");
-  if (nextNonce === void 0) {
-    return {
-      ...common,
-      kind: "exhausted",
-      seen: true,
-      highWaterNonce: common.highWaterNonce ?? 0xffffffffffffffffn
-    };
-  }
-  return { ...common, kind: "open", nextNonce };
-}
 function unwrap(response) {
   return response?.data;
 }
@@ -1476,14 +1432,6 @@ var AdminApiClient = class {
     );
     return r ?? { contextId, resyncStarted: true };
   }
-  async inviteSpecializedNode(request) {
-    return unwrap(
-      await this.httpClient.post(
-        "/admin-api/contexts/invite-specialized-node",
-        request
-      )
-    );
-  }
   async updateContextApplication(contextId, request) {
     await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/application`, request);
   }
@@ -1675,29 +1623,6 @@ var AdminApiClient = class {
   async getNodeIdentity() {
     return unwrap(await this.httpClient.get("/admin-api/identity"));
   }
-  /**
-   * @deprecated Use {@link getNodeIdentity} instead. Every field this returns is
-   * node-level, so the namespace was only ever decoration — it now delegates to
-   * the node-level route and reshapes the answer.
-   *
-   * Three consequences of that delegation, all visible to a caller who relied on
-   * the old route's behaviour:
-   *
-   * - **No participation gate.** The namespace route answered 404 when this node
-   *   had never joined the namespace; this answers whatever the node's identity
-   *   is, regardless. If you were using it to ask "am I in this namespace?", ask
-   *   {@link listNamespaces} instead — that is the question you were really
-   *   asking.
-   * - **`namespaceId` is echoed verbatim.** The old route resolved a subgroup id
-   *   to its root namespace and returned that; passing a subgroup id here gives
-   *   the subgroup id back.
-   * - **404 means something else.** Previously "not my namespace", now "this node
-   *   holds no account root yet".
-   */
-  async getNamespaceIdentity(namespaceId) {
-    const node = await this.getNodeIdentity();
-    return { namespaceId, publicKey: node.publicKey, account: node.accountId };
-  }
   /**
    * Ask this node to run one method on a member's behalf, under a warrant that
    * member signed.
@@ -2171,104 +2096,6 @@ var AdminApiClient = class {
     );
     return response.members;
   }
-  /**
-   * Where `authorDeviceKey` stands in its warrant-nonce sequence in `contextId`.
-   *
-   * # What this is for
-   *
-   * The nonce is the one input to a warrant that is stateful on the *client*.
-   * Everything else an author needs it either holds (its keys, the method, the
-   * args) or can read from the relay ({@link RelayClient.describe} gives the
-   * executor account and the grant). So an author that has lost its counter —
-   * a browser keyholder in partitioned or periodically cleared storage, which
-   * is its normal lifecycle rather than a fault — otherwise has exactly one
-   * strategy: guess upward and burn a refused round trip per wrong guess, with
-   * each refusal indistinguishable at the API from a genuinely spent nonce.
-   *
-   * Read {@link WarrantNonceOpen.nextNonce} and mint there. If you still hold
-   * your own counter, mint at `max(ownNext, nextNonce)`: nonce state folds per
-   * peer, so a node can only be BEHIND a client whose warrants it has not
-   * applied — never ahead of the truth. An author spread across several relays
-   * asks each and takes the highest answer. {@link createRecoveringNonceSource}
-   * does all of that.
-   *
-   * Purely a read. It spends nothing and advances nothing, so it may be called
-   * as often as you like.
-   *
-   * # Forward compatibility — this route is NEW
-   *
-   * It is not on core `master` yet, so a current node answers **404**, which
-   * this method surfaces as {@link WarrantNonceRouteUnavailableError} rather
-   * than as an opaque {@link HTTPError}. That distinction matters because the
-   * handler itself never 404s: a device with no row is a `200` with
-   * `seen: false`, and a malformed id is a `400`. So a 404 here means the node
-   * does not serve the route at all — an older build, or a deployment that has
-   * not re-mounted it — and the answer is to fall back to a local counter, not
-   * to retry.
-   *
-   * # Authentication
-   *
-   * On the PROTECTED admin router, unlike the two delegated-execution routes it
-   * sits beside: it takes another principal's device key as input and reports
-   * that principal's activity. A `--public-intents` deployment does not serve
-   * this anonymously, so an admin credential is required.
-   *
-   * @param authorDeviceKey the device's signing key, base58 (43-44 chars) or
-   *        hex (exactly 64). The node accepts either; the two never collide.
-   */
-  async getWarrantNonce(contextId, authorDeviceKey) {
-    const path = `/admin-api/contexts/${pathSegment(contextId)}/warrant-nonce/${pathSegment(authorDeviceKey)}`;
-    let raw;
-    try {
-      raw = await this.httpClient.get(path, { parse: "text" });
-    } catch (error) {
-      if (error instanceof HTTPError && error.status === 404) {
-        throw new WarrantNonceRouteUnavailableError(path, error);
-      }
-      throw error;
-    }
-    return parseWarrantNonce(raw);
-  }
-  /**
-   * The same answer, asked for the way a delegated client has to ask.
-   *
-   * {@link getWarrantNonce} is on the protected admin router, so a keyholder
-   * writing through a relay — the client this whole facility exists for — is
-   * refused it: measured `403` for a session carrying exactly
-   * `context:intent`, `context:query`, `context:subscribe`. That client has no
-   * admin credential and cannot be given one without defeating the point of the
-   * delegated surface.
-   *
-   * What it does have is the credential proving the device is its own, which it
-   * already sends on every write. Presenting it here makes the request
-   * self-scoped: you learn a device's position only by proving, at call time,
-   * that the device is yours. So there is no oracle to protect against, and no
-   * reason for an admin gate.
-   *
-   * The device key is NOT a parameter. It is read from the verified
-   * certificate server-side, which is the only reading that cannot disagree
-   * with the signature — a key supplied alongside would be a second spelling of
-   * the same fact, and two spellings can differ.
-   *
-   * Returns the identical shape {@link getWarrantNonce} returns, so a caller can
-   * swap one for the other without touching what it does with the answer.
-   *
-   * @param authorProof hex-encoded borsh `AccountProof<DeviceCert>` — the same
-   *        value passed as `authorProof` to the relay client.
-   */
-  async getWarrantNonceAsAuthor(contextId, authorProof) {
-    const path = `/admin-api/contexts/${pathSegment(contextId)}/warrant-nonce`;
-    let raw;
-    try {
-      raw = await this.httpClient.post(path, { authorProof }, { parse: "text" });
-    } catch (error) {
-      if (error instanceof HTTPError && error.status === 404) {
-        throw new WarrantNonceRouteUnavailableError(path, error);
-      }
-      throw error;
-    }
-    return parseWarrantNonce(raw);
-  }
   /**
    * Member accounts in the group and the devices bound to each. An admin node
    * sees every account; a plain member only its own. `403` if this node is not a
@@ -2591,15 +2418,6 @@ var AdminApiClient = class {
   async teeAttest(request) {
     return unwrap(await this.httpClient.post("/admin-api/tee/attest", request));
   }
-  /**
-   * @deprecated Nodes no longer serve `/admin-api/tee/verify-quote` (removed in
-   * core#3262), so this fails. Verify quotes with `createQuoteVerifier`.
-   */
-  async teeVerifyQuote(request) {
-    return unwrap(
-      await this.httpClient.post("/admin-api/tee/verify-quote", request)
-    );
-  }
   // ---- Network ----
   async getPeersCount() {
     return this.httpClient.get("/admin-api/peers");
@@ -3028,7 +2846,8 @@ var SseClient = class {
       return;
     }
     this.closed = false;
-    this.abortController = new AbortController();
+    const controller = new AbortController();
+    this.abortController = controller;
     try {
       const url2 = `${this.baseUrl}/sse`;
       const headers = {
@@ -3038,7 +2857,7 @@ var SseClient = class {
       const proofAttached = carriesProof(headers);
       const response = await this.fetchImpl(url2, {
         headers,
-        signal: this.abortController.signal,
+        signal: controller.signal,
         ...proofAttached && { redirect: "manual" }
       });
       if (proofAttached) refuseProofRedirect(response, url2);
@@ -3066,21 +2885,31 @@ var SseClient = class {
       if (!response.body) {
         throw new Error("SSE response has no body");
       }
-      this.readStream(response.body).catch((err) => {
-        if (this.closed) return;
+      this.readStream(response.body, controller).catch((err) => {
+        if (this.superseded(controller)) return;
         const error = err instanceof Error ? err : new Error(String(err));
         this.emit("error", error);
         this.scheduleReconnect();
       });
     } catch (err) {
-      if (this.closed) return;
+      if (this.superseded(controller)) return;
       const error = err instanceof Error ? err : new Error(String(err));
       this.emit("error", error);
       if (error instanceof AuthRevokedError) return;
       this.scheduleReconnect();
     }
   }
-  async readStream(body) {
+  /**
+   * Whether `controller`'s connection is no longer the one this client holds:
+   * closed, or replaced by a later connect. Its abort lands asynchronously,
+   * after a `close()` + `connect()` has already cleared `closed`, so `closed`
+   * alone cannot tell; reporting it, and reconnecting for it, would abort the
+   * live connection, whose own abort would do the same, without end.
+   */
+  superseded(controller) {
+    return this.closed || controller.signal.aborted || this.abortController !== controller;
+  }
+  async readStream(body, controller) {
     const reader = body.getReader();
     const decoder = new TextDecoder();
     let buffer = "";
@@ -3108,11 +2937,11 @@ var SseClient = class {
         }
       }
     } catch (err) {
-      if (this.closed) return;
+      if (this.superseded(controller)) return;
       const error = err instanceof Error ? err : new Error(String(err));
       this.emit("error", error);
     }
-    if (!this.closed) {
+    if (!this.superseded(controller)) {
       this.scheduleReconnect();
     }
   }
@@ -9772,81 +9601,6 @@ function createLocalStorageNonceSource(key, storage) {
     }
   };
 }
-function authorNonceLookup(options) {
-  return {
-    getWarrantNonce: (contextId, _authorDeviceKey) => options.client.getWarrantNonceAsAuthor(contextId, options.authorProof)
-  };
-}
-var WarrantNonceExhaustedError = class extends Error {
-  constructor(contextId, authorDeviceKey) {
-    super(
-      `author device ${authorDeviceKey} has spent every nonce in context ${contextId}; it must re-key to write again`
-    );
-    this.contextId = contextId;
-    this.authorDeviceKey = authorDeviceKey;
-    this.name = "WarrantNonceExhaustedError";
-  }
-};
-function createRecoveringNonceSource(options) {
-  const lookups = Array.isArray(options.lookups) ? options.lookups : [options.lookups];
-  if (lookups.length === 0) {
-    throw new Error("a recovering nonce source needs at least one node to ask");
-  }
-  const local = options.local ?? createMemoryNonceSource(1);
-  const onLookupFailure = options.onLookupFailure ?? "throw";
-  let floor = null;
-  let pending = null;
-  const resolveFloor = async () => {
-    const answers = await Promise.allSettled(
-      lookups.map(
-        (lookup) => lookup.getWarrantNonce(options.contextId, options.authorDeviceKey)
-      )
-    );
-    let highest = null;
-    let exhausted = false;
-    for (const answer of answers) {
-      if (answer.status !== "fulfilled") continue;
-      const state = answer.value;
-      if (state.kind === "exhausted") {
-        exhausted = true;
-        continue;
-      }
-      if (highest === null || state.nextNonce > highest) highest = state.nextNonce;
-    }
-    if (highest === null && exhausted) {
-      throw new WarrantNonceExhaustedError(options.contextId, options.authorDeviceKey);
-    }
-    if (highest === null) {
-      const first = answers.find((a) => a.status === "rejected");
-      const reason = first && first.status === "rejected" ? first.reason : void 0;
-      if (onLookupFailure === "local") {
-        floor = 0n;
-        return;
-      }
-      throw reason instanceof Error ? reason : new Error(`no node could answer where the warrant-nonce sequence stands: ${String(reason)}`);
-    }
-    floor = highest;
-    await local.advanceTo?.(highest);
-  };
-  return {
-    async next() {
-      if (floor === null) {
-        pending ?? (pending = resolveFloor().finally(() => {
-          pending = null;
-        }));
-        await pending;
-      }
-      const mine = await local.next();
-      const value = floor !== null && floor > mine ? floor : mine;
-      floor = value + 1n;
-      return value;
-    },
-    async advanceTo(wanted) {
-      if (floor === null || wanted > floor) floor = wanted;
-      await local.advanceTo?.(wanted);
-    }
-  };
-}
 
 // src/cloud/connect.ts
 async function connectCloud(options) {
@@ -13296,8 +13050,6 @@ export {
   SseClient,
   StaleTransportKeyError,
   UnknownRelayError,
-  WarrantNonceExhaustedError,
-  WarrantNonceRouteUnavailableError,
   WebHttpClient,
   WsClient,
   accountForRoot,
@@ -13314,7 +13066,6 @@ export {
   attestAgent,
   attestKeyBinding,
   attestRelayNodeKey,
-  authorNonceLookup,
   beginCloudLink,
   beginDeviceEnrolment,
   bootstrapFromInvitation,
@@ -13365,7 +13116,6 @@ export {
   createProofAuthorizer,
   createProofSigner,
   createQuoteVerifier,
-  createRecoveringNonceSource,
   createRetryableMethod,
   createSealedFetch,
   createSignedReleaseSealedFetch,
@@ -13439,7 +13189,6 @@ export {
   parseCreationWarrant,
   parseDeviceCredential,
   parseGovernanceWarrant,
-  parseWarrantNonce,
   persistedNonces,
   pinRelayNodeKey,
   presenceStatementBytes,