@calimero-network/mero-js 26.10.0 → 27.0.0

package/dist/namespace-op/namespace-op.js

@@ -1,191 +0,0 @@
-import { encodeGroupInvitation } from '../invitation/invitation.js';
-import { concat, fromHex, hex, u32le, u64le } from '../crypto/internal.js';
-import { resolveSigner } from '../signer/signer.js';
-/**
- * Core's `SIGNED_NAMESPACE_OP_SCHEMA_VERSION`. A node refuses any other value.
- *
- * 15: core went to 13 (TEE rows locked to the TEE roles, a TEE's relay role
- * read at its namespace root row, inherited read-only roles read-only in Open
- * subgroups), then 14 (`GroupOp::ContextRegisteredOnBehalf`) and 15
- * (`GroupOp::OnBehalf` / `RootOp::OnBehalf`) for delegated context creation and
- * governance through a relay. None of these changes a layout this module
- * signs; the version moves with core's so nodes on different versions never
- * share a namespace.
- *
- * 16: a namespace can be founded through a relay (a delegated
- * `NamespaceCreatedV2`), and `GroupOp::FoundingRelayAttested` lets that relay
- * admit itself as the namespace's first TEE. Again no layout this module signs.
- *
- * 17: `RootOp::GroupCreated` carries a `salt`, and its `group_id` must be the
- * one `createdSubgroupId(admin, parentId, restricted, salt)` derives
- * (calimero-network/core#4244), so two concurrent creates for one id can never
- * name different creators. The layout of that variant changed.
- *
- * 18: owner-level ops need the account ROOT, not only a device of it
- * (calimero-network/core, root-guarded owner ops). `GroupOp::RootGuarded` and
- * `RootOp::RootGuarded` are appended and carry a root-signed proof, and the bare
- * `TransferOwnership`, `AdminChanged`, `GroupDelete` and TEE policy ops are
- * refused. No layout this module signs changes; see `../owner-op` for the proof.
- *
- * 19 is reserved for calimero-network/core#4269.
- *
- * 20: no layout change. A delegated `GroupCreated` whose executor is a TEE at
- * the namespace root now seats that TEE in the new subgroup
- * (calimero-network/core#4276), an apply-time rule older peers disagree on.
- * Core signs and checks at 20, so every op this module signs must too.
- *
- * 21: no layout change. An op concurrent with its signer's removal is void
- * (calimero-network/core#4275), an apply-time rule older peers disagree on.
- * Core signs and checks at 21 from 0.11.0-rc.75. 23.4.0 and 23.4.1 still sign
- * at 20, so against rc.75 every namespace op an account signs with them (a
- * join, a create, any governance op) is refused "schema version mismatch:
- * expected 21, got 20".
- *
- * 22: `GroupOp::SharedWritersRotated` is appended, a `SharedStorage` cell's
- * writer-set step (calimero-network/core#4263), and a capability revoke voids
- * the member's concurrent ops that needed a removed bit
- * (calimero-network/core#4453). No layout this module signs changes.
- *
- * 23: a TEE admission op carries the quote it was admitted on and a TEE
- * authority evidence op the credential it was made for
- * (calimero-network/core#4265). Neither is an op this module signs, so only
- * the version byte moves. Core signs and checks at 23 from 0.11.0-rc.81, the
- * first release with both 22 and 23.
- *
- * 24: no layout change. Only a subgroup's creator may open it - flip it to
- * `Open` (calimero-network/core#4522) - an apply-time rule older peers
- * disagree on, since they let any of its admins open it. A UI that offers
- * "make public" should offer it to the creator alone.
- *
- * 25: no layout change; refused device link/unlink/descope ops are never logged.
- *
- * 26: no layout change. A device link's scope is judged against every
- * application the group may have targeted at the link's cut, not its live
- * target (calimero-network/core#4603), so replicas agree on a link that races
- * a target change; older peers judge it by fold order.
- *
- * 27: no layout change. The namespace founder is seated as an admin by the
- * genesis op itself, so a founder who transfers ownership stays a member
- * (calimero-network/core#4625); older peers seat her from the root's current
- * owner and drop her.
- */
-export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 27;
-/** Domain prefixed to the signable bytes; core's `NAMESPACE_GOVERNANCE_SIGN_DOMAIN`. */
-const NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode('calimero.namespace.v1');
-/** `NamespaceOp::Root` is the first variant. */
-const NAMESPACE_OP_ROOT = 0;
-/**
- * `RootOp` discriminants, in declaration order. Only the two join variants are
- * emitted here; the rest are listed so the numbering is checkable against core
- * rather than inferred from the two in use.
- */
-const ROOT_OP = {
-    GroupCreated: 0,
-    GroupReparented: 1,
-    GroupDeleted: 2,
-    AdminChanged: 3,
-    PolicyUpdated: 4,
-    MemberJoined: 5,
-    KeyDelivery: 6,
-    MemberJoinedOpen: 7,
-    MemberJoinedAt: 8,
-    NamespaceCreatedV2: 9,
-    MemberJoinedViaTeeAttestation: 10,
-};
-/**
- * Borsh `Option<[u8; 32]>` from the byte array JSON carries it as.
- *
- * `[u8; 32]` crosses JSON as 32 numbers, not as hex — the hex spelling belongs to
- * `AccountId`, which has its own representation. Encoding one of these from a hex
- * string would silently produce the wrong 32 bytes.
- */
-function optionalBytes32(value, label) {
-    if (value === null || value === undefined) {
-        return new Uint8Array([0]);
-    }
-    if (value.length !== 32) {
-        throw new Error(`${label} must be 32 bytes, got ${value.length}`);
-    }
-    return concat(new Uint8Array([1]), new Uint8Array(value));
-}
-/** Borsh `String`: u32 length then UTF-8 bytes. */
-function borshString(value) {
-    const bytes = new TextEncoder().encode(value);
-    return concat(u32le(bytes.length), bytes);
-}
-/**
- * Borsh-encode a `SignedGroupOpenInvitation`.
- *
- * Re-encoded rather than passed through, because it has to go inside the op that
- * gets signed. That makes this function version-locked to core: a field added to
- * the invitation and omitted here produces an op whose inner invitation no longer
- * matches the inviter's signature over it. That exact drift, in client-py, broke
- * 93 scenarios — the failure surfaces as `invalid invitation signature` and points
- * nowhere near the encoder.
- */
-export function encodeSignedInvitation(signed) {
-    const body = signed.invitation;
-    const admitterAddrs = signed.admitter_addrs ?? [];
-    return concat(
-    // GroupInvitationFromAdmin, from the one encoder the SDK's own invitation
-    // signer uses: the bytes signed and the bytes carried must not drift.
-    encodeGroupInvitation(body), 
-    // ...then the enclosing SignedGroupOpenInvitation, in declaration order.
-    // `inviter_account` sits between the signature and the addresses; putting it
-    // anywhere else still encodes 32 bytes and still verifies as nothing.
-    borshString(signed.inviter_signature), signed.inviter_account
-        ? concat(new Uint8Array([1]), fromHex(signed.inviter_account, 'inviter_account', 32))
-        : new Uint8Array([0]), 
-    // A `Vec<String>`, so each entry is a bare borsh string. This carried an
-    // enum until core dropped the URL variant, and an enum writes a
-    // discriminant byte ahead of each entry — encoding one here now would shift
-    // every following byte and fail as `invalid invitation signature`, pointing
-    // nowhere near this line.
-    u32le(admitterAddrs.length), ...admitterAddrs.map(borshString), optionalBytes32(signed.application_id, 'application_id'), 
-    // Borsh order follows core's field order, where this is `bytecode_id`; the
-    // JSON key is `app_key`, a rename covering both directions that core pins in
-    // a test. Encoding by the Rust name would read `undefined` and emit a None
-    // where the inviter signed a Some.
-    optionalBytes32(signed.app_key, 'app_key'));
-}
-/**
- * Sign a `MemberJoined` (or `MemberJoinedAt`) namespace op and return it
- * borsh-encoded and hex — the `signedOp` that `admitJoin` takes.
- */
-export async function signMemberJoinOp(input) {
-    const parents = input.parentOpHashes ?? [];
-    const credential = fromHex(input.credential, 'credential', input.credential.length / 2);
-    // An invitation that expires must be claimed with `MemberJoinedAt`, which
-    // carries `joined_at` between the invitation and the credential. Choosing the
-    // variant from the invitation keeps the two in step: the discriminant and the
-    // presence of that field are one decision, and splitting them produces bytes
-    // that decode into the wrong shape rather than failing to decode.
-    const expires = BigInt(input.invitation.invitation.expiration_timestamp ?? 0) !== 0n;
-    const joinedAt = input.joinedAt ?? BigInt(Math.floor(Date.now() / 1000));
-    const rootOp = expires
-        ? concat(new Uint8Array([ROOT_OP.MemberJoinedAt]), fromHex(input.member, 'member', 32), encodeSignedInvitation(input.invitation), u64le(joinedAt), credential)
-        : concat(new Uint8Array([ROOT_OP.MemberJoined]), fromHex(input.member, 'member', 32), encodeSignedInvitation(input.invitation), credential);
-    const op = concat(new Uint8Array([NAMESPACE_OP_ROOT]), rootOp);
-    const signingKey = await resolveSigner(input.deviceSecret, input.signer, 'deviceSecret');
-    // Named apart from the signer itself: this is the public half the op carries
-    // as its `signer` field, which every peer compares with the credential's
-    // `sign_pk` before applying the join.
-    const signerPublicKey = fromHex(signingKey.publicKey, 'signer.publicKey', 32);
-    const signable = concat(new Uint8Array([SIGNED_NAMESPACE_OP_SCHEMA_VERSION]), fromHex(input.namespaceId, 'namespaceId', 32), u32le(parents.length), ...parents.map((p, i) => fromHex(p, `parentOpHashes[${i}]`, 32)), signerPublicKey, u64le(input.nonce), op);
-    const signature = await signingKey.sign(concat(NAMESPACE_SIGN_DOMAIN, signable));
-    // The signed struct repeats the signable fields, then the signature, then the
-    // admitter endorsement. The domain is a signing prefix only and is never part
-    // of the encoded op.
-    //
-    // The endorsement is written as borsh `None` — a single `0x00` — and that is
-    // the correct value from here, not a placeholder. It authorises the membership
-    // and can only be signed by an account the invitation named as an admitter,
-    // which a keyholder is not. The admitter attaches its own as it relays the op
-    // through `admitJoin`.
-    //
-    // It sits outside `signable`, so it is outside this signature and outside the
-    // op's id. That is what makes attaching it possible: the admitter changes
-    // neither what was signed here nor which op this is.
-    const unendorsed = new Uint8Array([0]);
-    return hex(concat(signable, signature, unendorsed));
-}

package/dist/nodeDiscovery.d.ts

@@ -1,47 +0,0 @@
-/**
- * Local-node discovery.
- *
- * Calimero dev/desktop nodes expose a public, unauthenticated health endpoint
- * at `GET {nodeUrl}/admin-api/health` that returns `{ "data": { "status":
- * "alive" } }`. The most common local layouts run on a small, well-known set of
- * ports, so instead of forcing the user to type a URL we probe those ports and
- * offer whatever is actually running.
- */
-/**
- * Default ports probed when discovering local nodes. Covers the two-node dev
- * stacks used across the Calimero apps (RPC + alt ports for node1 / node2).
- */
-export declare const DEFAULT_LOCAL_NODE_PORTS: readonly [2428, 2429, 2528, 2529];
-export interface DiscoverLocalNodesOptions {
-    /** Ports to probe. Defaults to {@link DEFAULT_LOCAL_NODE_PORTS}. */
-    ports?: readonly number[];
-    /** Per-probe timeout in ms. Defaults to 2000. */
-    timeoutMs?: number;
-    /** Abort the whole discovery (e.g. when the modal closes). */
-    signal?: AbortSignal;
-}
-/** Build the canonical base URL for a local node on the given port. */
-export declare function localNodeUrl(port: number): string;
-/**
- * Resolve an API `path` against a node `baseUrl`. Ensures the base ends with a
- * slash first, so a base that carries a path prefix (e.g. a `NODE_PATH_PREFIX`
- * deployment like `http://host/node1`) keeps that segment instead of having it
- * stripped by relative URL resolution.
- */
-export declare function nodeEndpoint(baseUrl: string, path: string): string;
-/**
- * Probe a single node's health endpoint. Resolves `true` only when the node
- * answers with a 2xx and (when the body is JSON) reports a non-dead status.
- * Any network error, timeout, or non-ok response resolves `false` — never
- * throws (except on an external abort, which is swallowed as `false`).
- */
-export declare function probeNodeHealth(baseUrl: string, options?: {
-    timeoutMs?: number;
-    signal?: AbortSignal;
-}): Promise<boolean>;
-/**
- * Probe the configured local ports in parallel and return the base URLs that
- * responded as healthy, in the same order as the `ports` argument (which
- * defaults to ascending). Returns an empty array when nothing local is running.
- */
-export declare function discoverLocalNodes(options?: DiscoverLocalNodesOptions): Promise<string[]>;

package/dist/nodeDiscovery.js

@@ -1,101 +0,0 @@
-/**
- * Local-node discovery.
- *
- * Calimero dev/desktop nodes expose a public, unauthenticated health endpoint
- * at `GET {nodeUrl}/admin-api/health` that returns `{ "data": { "status":
- * "alive" } }`. The most common local layouts run on a small, well-known set of
- * ports, so instead of forcing the user to type a URL we probe those ports and
- * offer whatever is actually running.
- */
-/**
- * Default ports probed when discovering local nodes. Covers the two-node dev
- * stacks used across the Calimero apps (RPC + alt ports for node1 / node2).
- */
-export const DEFAULT_LOCAL_NODE_PORTS = [2428, 2429, 2528, 2529];
-/** Host used to build local candidate URLs. */
-const LOCAL_HOST = 'localhost';
-/** Per-probe timeout. A reachable local node answers almost instantly; a
- * closed port rejects fast, but a firewalled/black-holed one can hang, so we
- * cap each probe. */
-const DEFAULT_PROBE_TIMEOUT_MS = 2000;
-/** Build the canonical base URL for a local node on the given port. */
-export function localNodeUrl(port) {
-    return `http://${LOCAL_HOST}:${port}`;
-}
-/**
- * Resolve an API `path` against a node `baseUrl`. Ensures the base ends with a
- * slash first, so a base that carries a path prefix (e.g. a `NODE_PATH_PREFIX`
- * deployment like `http://host/node1`) keeps that segment instead of having it
- * stripped by relative URL resolution.
- */
-export function nodeEndpoint(baseUrl, path) {
-    const base = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
-    return new URL(path, base).toString();
-}
-/**
- * Probe a single node's health endpoint. Resolves `true` only when the node
- * answers with a 2xx and (when the body is JSON) reports a non-dead status.
- * Any network error, timeout, or non-ok response resolves `false` — never
- * throws (except on an external abort, which is swallowed as `false`).
- */
-export async function probeNodeHealth(baseUrl, options = {}) {
-    const { timeoutMs = DEFAULT_PROBE_TIMEOUT_MS, signal } = options;
-    // Already cancelled before we start — don't fetch, and don't register a
-    // timer or listener that would then need cleanup.
-    if (signal?.aborted)
-        return false;
-    // Per-probe timeout, also linked to the caller's abort signal so closing the
-    // modal cancels every in-flight probe. Bind the signal to a local so the
-    // cleanup below stays symmetric with registration without re-narrowing.
-    const controller = new AbortController();
-    const onAbort = () => controller.abort();
-    const abortSignal = signal;
-    if (abortSignal)
-        abortSignal.addEventListener('abort', onAbort, { once: true });
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        const url = nodeEndpoint(baseUrl, 'admin-api/health');
-        const res = await fetch(url, {
-            method: 'GET',
-            signal: controller.signal,
-        });
-        if (!res.ok)
-            return false;
-        // Health body is `{ data: { status: "alive" } }`, but tolerate plain
-        // `{ status }` and non-JSON 2xx responses. A *missing* status is treated as
-        // alive (the 2xx is enough); a status that is present but not "alive"
-        // (including an explicit `null`) is treated as unhealthy.
-        try {
-            const body = (await res.json());
-            const status = body?.data?.status !== undefined ? body?.data?.status : body?.status;
-            if (status === undefined)
-                return true;
-            return typeof status === 'string' && status.toLowerCase() === 'alive';
-        }
-        catch {
-            return true;
-        }
-    }
-    catch {
-        return false;
-    }
-    finally {
-        clearTimeout(timer);
-        if (abortSignal)
-            abortSignal.removeEventListener('abort', onAbort);
-    }
-}
-/**
- * Probe the configured local ports in parallel and return the base URLs that
- * responded as healthy, in the same order as the `ports` argument (which
- * defaults to ascending). Returns an empty array when nothing local is running.
- */
-export async function discoverLocalNodes(options = {}) {
-    const { ports = DEFAULT_LOCAL_NODE_PORTS, timeoutMs, signal } = options;
-    const results = await Promise.all(ports.map(async (port) => {
-        const url = localNodeUrl(port);
-        const ok = await probeNodeHealth(url, { timeoutMs, signal });
-        return ok ? url : null;
-    }));
-    return results.filter((url) => url !== null);
-}

package/dist/owner-op/index.d.ts

@@ -1,2 +0,0 @@
-export { OWNER_OP_KIND, transferOwnershipOp, groupDeleteOp, adminChangedOp, teeAuthoringPolicyOp, teeAdmissionPolicyOp, teeReleaseAdmissionPolicyOp, ownerOpDigest, ownerOpSigningPayload, signOwnerOpProof, rootGuardedOpBytes, } from './owner-op.js';
-export type { OwnerOp, OwnerOpKind, OwnerOpPlane, OwnerOpProofInput, TeeAdmissionPolicyOpInput, TeeReleaseAdmissionPolicyOpInput, } from './owner-op.js';

package/dist/owner-op/index.js

@@ -1,3 +0,0 @@
-// Root proofs for owner-level governance ops: what a nodeless or cold-root
-// account signs offline so a stolen device alone cannot take a group.
-export { OWNER_OP_KIND, transferOwnershipOp, groupDeleteOp, adminChangedOp, teeAuthoringPolicyOp, teeAdmissionPolicyOp, teeReleaseAdmissionPolicyOp, ownerOpDigest, ownerOpSigningPayload, signOwnerOpProof, rootGuardedOpBytes, } from './owner-op.js';

package/dist/owner-op/owner-op.d.ts

@@ -1,119 +0,0 @@
-/**
- * Which owner-level op a proof authorises. The value is the byte core signs,
- * its `OwnerOpKind` discriminant.
- */
-export declare const OWNER_OP_KIND: {
-    readonly transferOwnership: 0;
-    readonly adminChanged: 1;
-    readonly groupDelete: 2;
-    readonly teeAdmissionPolicy: 3;
-    readonly teeAuthoringPolicy: 4;
-    readonly teeReleaseAdmissionPolicy: 5;
-};
-export type OwnerOpKind = keyof typeof OWNER_OP_KIND;
-/** Which plane the op is on: a `GroupOp` on a group, or a `RootOp` on the namespace. */
-export type OwnerOpPlane = 'group' | 'root';
-/** An encoded owner-level op: its borsh bytes, its kind and its plane. */
-export interface OwnerOp {
-    kind: OwnerOpKind;
-    plane: OwnerOpPlane;
-    /** The op's borsh bytes: exactly what the node builds, and what the digest covers. */
-    bytes: Uint8Array;
-}
-/** Hand the group to `newOwner` (an account, hex), who must already be an admin. */
-export declare function transferOwnershipOp(newOwner: string): OwnerOp;
-/** The owner-only deletion of a group that holds no contexts. */
-export declare function groupDeleteOp(): OwnerOp;
-/** Repoint the namespace's admin pin at `newAdmin` (an account, hex). A root op. */
-export declare function adminChangedOp(newAdmin: string): OwnerOp;
-/** The TEE authoring policy `PUT`/`DELETE …/settings/tee-authoring-policy` publishes. */
-export declare function teeAuthoringPolicyOp(allowedMrtd: string[]): OwnerOp;
-/** A measurement-list admission policy, as the node publishes it (the V2 form). */
-export interface TeeAdmissionPolicyOpInput {
-    allowedMrtd: string[];
-    allowedRtmr0: string[];
-    allowedRtmr1: string[];
-    allowedRtmr2: string[];
-    allowedRtmr3: string[];
-    allowedTcbStatuses: string[];
-    acceptMock: boolean;
-    mode?: 'replica' | 'relay';
-}
-/**
- * The measurement-list admission policy `PUT …/settings/tee-admission-policy`
- * publishes. Pass the fields exactly as you send them: the node signs over the
- * op it builds from them, and any difference is a different op.
- */
-export declare function teeAdmissionPolicyOp(input: TeeAdmissionPolicyOpInput): OwnerOp;
-/** A signed-release admission policy, as the node publishes it (the V2 form). */
-export interface TeeReleaseAdmissionPolicyOpInput {
-    allowedProfiles: string[];
-    /**
-     * The oldest release admitted. Give it in the node's normalised form
-     * (`X.Y.Z`, no tag prefix): the node normalises what it is sent before it
-     * builds the op, and the proof must be for the op it builds.
-     */
-    minReleaseVersion?: string;
-    allowedTcbStatuses: string[];
-    acceptMock: boolean;
-    mode?: 'replica' | 'relay';
-}
-/** The signed-release admission policy `PUT …/settings/tee-admission-policy` publishes. */
-export declare function teeReleaseAdmissionPolicyOp(input: TeeReleaseAdmissionPolicyOpInput): OwnerOp;
-/** core's `OwnerOpAuthorization::op_digest`: the op's bytes, hashed under the body domain. */
-export declare function ownerOpDigest(opBytes: Uint8Array): Promise<Uint8Array>;
-/** What an owner-op proof binds, apart from the op and the key that signs it. */
-export interface OwnerOpProofInput {
-    /** The account root's signing secret, 64 hex. Never sent anywhere. */
-    rootSecret: string;
-    /** The namespace the op is published in (`getGroupInfo(...).namespaceId`), hex. */
-    namespaceId: string;
-    /**
-     * The group the op acts on, hex. For `adminChanged` and the TEE policies,
-     * the namespace root.
-     */
-    groupId: string;
-    /** The op, from one of the encoders here. */
-    op: OwnerOp;
-    /** The group's current guarded-op counter (`getGroupInfo(groupId).ownerOpCounter`). */
-    counter: number | bigint;
-    /**
-     * The root epoch that signs, 0 for a root that has never been handed off.
-     * A later epoch needs `chain`.
-     */
-    keyEpoch?: number;
-    /**
-     * The account's root-key handoffs, epoch 0 upward, each the hex borsh of a
-     * `RootKeyHandoff` (account 32, from_epoch u32, new root key 32, signature
-     * 64). It must reach at least `keyEpoch`, and at least the epoch the group
-     * has recorded for the account, or the node refuses the proof.
-     */
-    chain?: string[];
-}
-/** core's `OwnerOpTerms::signing_payload`. */
-export declare function ownerOpSigningPayload(input: {
-    account: string;
-    namespaceId: string;
-    groupId: string;
-    kind: OwnerOpKind;
-    opDigest: Uint8Array;
-    counter: number | bigint;
-    keyEpoch: number;
-}): Promise<Uint8Array>;
-/**
- * Sign a root proof for `op` and return it as core's `rootProof`: the hex
- * borsh of an `AccountProof<OwnerOpAuthorization>`.
- *
- * Layout: `AccountGenesis` (version u8 + root pk 32), the handoff chain (u32
- * count + 132 bytes each), then `OwnerOpAuthorization` (account 32, namespace
- * 32, group 32, kind u8, op digest 32, counter u64, key epoch u32, signature
- * 64).
- */
-export declare function signOwnerOpProof(input: OwnerOpProofInput): Promise<string>;
-/**
- * The `RootGuarded` wrapper core publishes: the op and its proof, as one
- * `GroupOp` or `RootOp`. A client never sends this to a node (the endpoints
- * take the proof and build the wrapper); it is here so the whole encoding is
- * checkable against core's vector.
- */
-export declare function rootGuardedOpBytes(op: OwnerOp, rootProof: string): Uint8Array;