@calimero-network/mero-js 26.11.0 → 27.0.0

package/dist/sealed/verify.js

@@ -5,9 +5,8 @@
  * signatures against Intel's root, the TCB status of the platform, the
  * measurements of the image, and that its report data is the nonce and the
  * binding this client asked for. {@link createQuoteVerifier} does all of that
- * here, with nothing but the node: the node hands over the Intel-signed
- * collateral with its quote (`includeCollateral`), and a node cannot forge
- * collateral, only choose which valid collateral to serve.
+ * here. A Calimero 1.0 node sends no collateral: the verifier fetches Intel's
+ * (`fetchCollateral`), which the node can neither forge nor choose.
  *
  * The DCAP verification itself — parsing the quote, checking its signature
  * chain and appraising its TCB level against the collateral — comes from a
@@ -41,10 +40,7 @@ const REGISTERS = ['mrtd', 'rtmr0', 'rtmr1', 'rtmr2', 'rtmr3'];
  *   dcapVerify,
  *   ...trustedMeasurementsFromReleases([publishedMrtds], { profile: 'locked-read-only' }),
  * });
- * const fetch = createSealedFetch({
- *   baseUrl,
- *   transportPublicKey: () => fetchAttestedTransportKey(admin, verifier),
- * });
+ * const client = new CalimeroClient({ baseUrl, policy: { verifyQuote: verifier } });
  * ```
  */
 export function createQuoteVerifier(options) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "26.11.0",
-  "description": "Pure JavaScript SDK for Calimero",
+  "version": "27.0.0",
+  "description": "JavaScript client for Calimero 1.0: attested TEE nodes, a sealed channel, passkeys and API keys",
   "type": "module",
   "exports": {
     ".": {
@@ -41,24 +41,18 @@
   },
   "scripts": {
     "build": "tsc && esbuild src/index.ts --bundle --platform=neutral --external:@phala/dcap-qvl --target=es2020 --format=esm --outfile=dist/index.mjs --sourcemap && esbuild src/index.ts --bundle --platform=neutral --external:@phala/dcap-qvl --target=es2020 --format=cjs --outfile=dist/index.cjs --sourcemap && esbuild src/index.ts --bundle --platform=browser --external:@phala/dcap-qvl --target=es2020 --format=esm --outfile=dist/index.browser.mjs --sourcemap --minify",
+    "prepare": "npm run build",
     "test": "vitest run --passWithNoTests",
     "test:unit": "vitest run --config vitest.config.ts",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "test:e2e:watch": "vitest --config vitest.e2e.config.ts",
-    "test:e2e:auth": "vitest run --config vitest.e2e.config.ts tests/e2e/auth-api.test.ts",
-    "test:e2e:admin": "vitest run --config vitest.e2e.config.ts tests/e2e/admin-api.test.ts",
-    "test:e2e:examples": "vitest run --config vitest.e2e.config.ts tests/e2e/examples.test.ts",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "eslint": "eslint .",
     "typecheck": "tsc --noEmit",
-    "typecheck:contract": "tsc --noEmit -p tsconfig.contract.json",
     "typecheck:consumer": "tsc --noEmit -p tsconfig.consumer.json",
-    "typecheck:e2e": "tsc --noEmit -p tsconfig.e2e.json",
-    "test:contract": "vitest run --config vitest.config.ts src/__contract__",
     "tsc": "tsc -b",
     "clean": "pnpm rimraf dist",
-    "prepublishOnly": "pnpm clean && pnpm build && pnpm test:unit && pnpm lint && pnpm typecheck && pnpm typecheck:consumer && pnpm typecheck:contract"
+    "prepublishOnly": "pnpm clean && pnpm build && pnpm test:unit && pnpm lint && pnpm typecheck && pnpm typecheck:consumer",
+    "test:cloud-v2": "vitest run --config vitest.cloud-v2.config.ts"
   },
   "files": [
     "dist"
@@ -67,8 +61,9 @@
     "calimero",
     "mero",
     "javascript",
-    "p2p",
-    "blockchain",
+    "tee",
+    "confidential-computing",
+    "passkeys",
     "sdk"
   ],
   "license": "MIT",

package/dist/account/account-admin.d.ts

@@ -1,80 +0,0 @@
-/**
- * An account's admin API: the same method names and types as mero-js's
- * `AdminApiClient`, so an app written against a node's admin needs no second
- * code path. Reads go to the relay's caller-scoped admin client; writes go
- * through the relay as governance ops, delegated context and namespace
- * creation, or an invitation the account signs itself. A write with no
- * account form (upgrades, installs) is refused by name.
- */
-import { type AdminApiClient, type SignedGroupOpenInvitation } from '../admin-api/index.js';
-import { signGroupInvitation } from '../invitation/index.js';
-import type { DelegatedSession } from './session.js';
-import { governGroup, governRoot } from './govern.js';
-import { createDelegatedContext, foundDelegatedNamespace } from './create-context.js';
-export declare class NotForAccountError extends Error {
-    readonly method: string;
-    constructor(method: string);
-}
-/**
- * An account that has enrolled but joined nothing has no relay: nothing serves
- * it yet. Its listings are empty, which is true; anything else names this.
- */
-export declare class NoRelayError extends Error {
-    readonly method: string;
-    constructor(method: string);
-}
-/**
- * Why an account's invitation was not minted: nobody its claimant could reach
- * would admit them. A claimant with no node finds its admitter through the
- * cloud's routing, intersected with the invitation's signed admitters, so an
- * invitation the cloud routes to none of them can only fail in their hands.
- *
- * - `not-hosted` - the cloud lists no node holding the namespace. A relay it
- *   does not list cannot stand in: an address on the invitation is unsigned.
- * - `no-named-node` — the cloud's nodes are not among the admitters this
- *   invitation would name.
- */
-export declare class InvitationNotClaimableError extends Error {
-    readonly namespaceId: string;
-    readonly reason: 'not-hosted' | 'no-named-node';
-    constructor(namespaceId: string, reason: 'not-hosted' | 'no-named-node');
-}
-export interface AccountAdminDeps {
-    govern?: {
-        group: typeof governGroup;
-        root: typeof governRoot;
-    };
-    createContext?: typeof createDelegatedContext;
-    found?: typeof foundDelegatedNamespace;
-    latestVersion?: (registryUrl: string, pkg: string) => Promise<string>;
-    signInvitation?: typeof signGroupInvitation;
-    /**
-     * Redeem an invitation for this account: resolve the relay the invitation
-     * names, have it admit the account, and switch the session onto that relay.
-     * The provider supplies it (it owns the session); without it a join is
-     * refused by name. Rejects with the refusal's reason and HTTP `status`.
-     */
-    join?: (namespaceId: string, invitation: SignedGroupOpenInvitation) => Promise<{
-        namespaceId: string;
-    }>;
-    /**
-     * The cloud's routing for a namespace (`CloudClient.getNamespaceRouting`):
-     * the nodes a node-less invitee can be admitted through. Given, an
-     * invitation is minted only if one of them is an admitter it names; a lookup
-     * that fails does not block minting. The provider supplies it.
-     */
-    routing?: (namespaceId: string) => Promise<{
-        nodes: ReadonlyArray<{
-            account: string | null;
-        }>;
-    }>;
-}
-export declare function createAccountAdmin(input: {
-    session: DelegatedSession;
-    read: AdminApiClient | null;
-    app: {
-        packageName?: string;
-        packageVersion?: string;
-        registryUrl?: string;
-    };
-}, deps?: AccountAdminDeps): AdminApiClient;

package/dist/account/account-admin.js

@@ -1,346 +0,0 @@
-import { groupDeletedOp, groupMetadataSetOp, groupReparentedOp, memberAddedOp, memberCapabilitySetOp, memberJoinedOpenOp, memberLeftOp, memberMetadataSetOp, memberRemovedOp, contextMetadataSetOp, defaultCapabilitiesSetOp, subgroupCreation, subgroupVisibilitySetOp, memberRoleSetOp, contextDetachedOp, } from '../warrant/index.js';
-import { signGroupInvitation, } from '../invitation/index.js';
-import { governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace } from './govern.js';
-import { createDelegatedContext, foundDelegatedNamespace, latestPublishedVersion } from './create-context.js';
-export class NotForAccountError extends Error {
-    constructor(method) {
-        super(`${method} is not available for an account: it needs a node`);
-        this.method = method;
-        this.name = 'NotForAccountError';
-    }
-}
-/**
- * An account that has enrolled but joined nothing has no relay: nothing serves
- * it yet. Its listings are empty, which is true; anything else names this.
- */
-export class NoRelayError extends Error {
-    constructor(method) {
-        super(`${method} needs a relay, and this account has none yet: join from an invitation first`);
-        this.method = method;
-        this.name = 'NoRelayError';
-    }
-}
-/**
- * Why an account's invitation was not minted: nobody its claimant could reach
- * would admit them. A claimant with no node finds its admitter through the
- * cloud's routing, intersected with the invitation's signed admitters, so an
- * invitation the cloud routes to none of them can only fail in their hands.
- *
- * - `not-hosted` - the cloud lists no node holding the namespace. A relay it
- *   does not list cannot stand in: an address on the invitation is unsigned.
- * - `no-named-node` — the cloud's nodes are not among the admitters this
- *   invitation would name.
- */
-export class InvitationNotClaimableError extends Error {
-    constructor(namespaceId, reason) {
-        super(reason === 'not-hosted'
-            ? `nobody could claim an invitation to ${namespaceId} yet: the cloud lists no node holding the namespace, so an invitee with no node of their own has no relay to be admitted through.`
-            : `nobody could claim an invitation to ${namespaceId}: the cloud routes to none of the relays or admins it would name as admitters`);
-        this.namespaceId = namespaceId;
-        this.reason = reason;
-        this.name = 'InvitationNotClaimableError';
-    }
-}
-/** What an account with no relay answers: it is a member of nothing. */
-const EMPTY_READS = {
-    listNamespaces: async () => [],
-    listNamespacesForApplication: async () => [],
-    getContexts: async () => ({ contexts: [] }),
-};
-/**
- * Calls with no account form: refused by name, so an app sees why rather than
- * the bare 403 a relay gives a call its session may not make. Everything not
- * listed and not overridden below is a read, answered by the relay.
- *
- * - Upgrades, installs, a node's own context identity: a node's to do.
- * - `deleteContext`: a node drops its own copy and the group keeps the context.
- *   An account's copy is the relay's, shared with every account it serves;
- *   removing a context for the group is `detachContextFromGroup` or
- *   `deleteGroup`.
- * - Aliases, read or written: they are a node's own names, and a relay's are the
- *   relay's. Core gives an account session no alias permission.
- * - Deleting a namespace, legacy group invitations and joins, TEE policy, blob
- *   deletion: core has no delegated form for them.
- * - Account devices: the wallet manages them, not an app.
- *
- * Upgrade, cascade and migration status are NOT here: core serves an account
- * its own groups' status (#4392, rc.76), and migration status to the account
- * that administers the namespace (#4400, rc.77), so they go to the relay.
- */
-const NODE_ONLY = new Set([
-    'upgradeGroup', 'retryGroupUpgrade', 'activateGroupUpgrade', 'abortMigration', 'installApplication', 'installDevApplication',
-    'uninstallApplication', 'generateContextIdentity', 'deleteContext',
-    // A node's leaveContext is a local opt-out (a tombstone, its own identity rows)
-    // and publishes nothing; an account has nothing local to opt out of, and
-    // leaving the context's group instead is leaveGroup.
-    'leaveContext',
-    'createContextAlias', 'createApplicationAlias', 'createDeviceAlias',
-    'deleteContextAlias', 'deleteApplicationAlias', 'deleteDeviceAlias',
-    'lookupContextAlias', 'lookupApplicationAlias', 'lookupDeviceAlias',
-    'listContextAliases', 'listApplicationAliases', 'listDeviceAliases',
-    'deleteNamespace', 'createGroupInvitation', 'joinGroup',
-    'setTeeAdmissionPolicy', 'getTeeAdmissionPolicy', 'deleteBlob',
-    'listAccountDevices', 'revokeAccountDevice',
-]);
-/**
- * Core's refusal of a MemberJoinedOpen from someone already a direct member
- * (`AlreadyDirectMember`, answered 409): "signer … is a direct member; use
- * MemberJoined or add_group_members instead". Not to be confused with "is not a
- * direct member", which a leave by an inherited member gets.
- */
-function isAlreadyDirectMember(e) {
-    if (!(e instanceof Error))
-        return false;
-    const status = e.status;
-    return (status === undefined || status === 409) && /signer [0-9a-f]+ is a direct member/i.test(e.message);
-}
-export function createAccountAdmin(input, deps = {}) {
-    const { session: s, read, app } = input;
-    const governGroupOp = deps.govern?.group ?? governGroup;
-    const governRootOp = deps.govern?.root ?? governRoot;
-    const createContext = deps.createContext ?? createDelegatedContext;
-    const found = deps.found ?? foundDelegatedNamespace;
-    const latestVersion = deps.latestVersion ?? latestPublishedVersion;
-    const signInvitation = deps.signInvitation ?? signGroupInvitation;
-    const join = deps.join;
-    const routing = deps.routing;
-    // Reachable with or without a relay: the join is how an account gets one.
-    async function joinNamespace(namespaceId, req) {
-        if (!join)
-            throw new NotForAccountError('joinNamespace without a join handler');
-        return join(namespaceId, req.invitation);
-    }
-    // Only reached through the relay proxy below, so a null here is unreachable;
-    // the guard keeps the types honest rather than asserting it away.
-    const relay = () => {
-        if (read === null)
-            throw new NoRelayError('this call');
-        return read;
-    };
-    // A group or root op is posted to the group's namespace. A subgroup this
-    // account neither created nor joined (an open channel someone else made) is
-    // one the relay can name: ask it once, as `createContext` does, and remember.
-    async function knowNamespaceOf(groupId) {
-        if (namespaceOfGroup(s, groupId))
-            return;
-        const info = await relay().getGroupInfo(groupId);
-        rememberGroupNamespace(s.account, groupId, info.namespaceId ?? groupId);
-    }
-    const group = async (session, groupId, op) => {
-        await knowNamespaceOf(groupId);
-        return governGroupOp(session, groupId, op);
-    };
-    const root = async (session, groupId, op) => {
-        await knowNamespaceOf(groupId);
-        return governRootOp(session, groupId, op);
-    };
-    // MemberJoinedOpen on `groupId`, as a node's join sends it: a member who only
-    // inherits becomes a direct one, and a direct member's join is a no-op. The
-    // member list cannot tell those two apart (it lists inherited members too), so
-    // the join is sent and core's refusal of a direct member is the no-op.
-    // Returns whether this join made the account a member.
-    async function joinOpen(groupId) {
-        try {
-            await root(s, groupId, memberJoinedOpenOp({ member: s.account, groupId, credential: s.credential }));
-            return true;
-        }
-        catch (e) {
-            if (isAlreadyDirectMember(e))
-                return false;
-            throw e;
-        }
-    }
-    async function isMemberOfContextGroup(contextId, knownGroupId) {
-        const groupId = knownGroupId ?? String(await relay().getContextGroup(contextId));
-        const { members } = await relay().listGroupMembers(groupId);
-        return members.some((m) => m.identity.toLowerCase() === s.account.toLowerCase());
-    }
-    const writes = {
-        // The node-wide `for-application` listing is not caller-scoped, so a relay
-        // refuses it to an account. Its own scoped list, filtered, is the answer.
-        async listNamespacesForApplication(applicationId) {
-            return (await relay().listNamespaces()).filter((ns) => ns.targetApplicationId === applicationId);
-        },
-        async getNodeIdentity() {
-            return { accountId: s.account, deviceId: null, publicKey: '', deviceCertified: true };
-        },
-        async createNamespace(req) {
-            if (!app.packageName)
-                throw new NotForAccountError('createNamespace without a packageName');
-            const version = app.packageVersion ?? (await latestVersion(app.registryUrl ?? 'https://apps.calimero.network', app.packageName));
-            const { namespaceId, haEnabled, haError } = await found(s, {
-                defaultCapabilities: 231,
-                application: { applicationId: req.applicationId, package: app.packageName, version },
-            });
-            if (req.name)
-                await group(s, namespaceId, groupMetadataSetOp({ name: req.name }));
-            // A node's result is `{ namespaceId }`; HA's outcome rides along as extra
-            // fields, so code typed against the node call is unaffected.
-            return { namespaceId, haEnabled, ...(haError !== undefined ? { haError } : {}) };
-        },
-        async createGroupInNamespace(namespaceId, req = {}) {
-            // Absent ⇒ Open, as on a node: a subgroup created Restricted and flipped
-            // Open strands every namespace member outside it.
-            const { op } = await subgroupCreation({ parentId: namespaceId, restricted: req.visibility === 'restricted', admin: s.account });
-            const { groupId } = await root(s, namespaceId, op);
-            rememberGroupNamespace(s.account, groupId, namespaceId);
-            if (req.groupName)
-                await group(s, groupId, groupMetadataSetOp({ name: req.groupName }));
-            return { groupId };
-        },
-        async addGroupMembers(groupId, req) {
-            for (const m of req.members)
-                await group(s, groupId, memberAddedOp(m.identity, (m.role ?? 'Member')));
-        },
-        async removeGroupMembers(groupId, req) {
-            for (const m of req.members)
-                await group(s, groupId, memberRemovedOp(m));
-        },
-        async setGroupMetadata(groupId, req) {
-            await group(s, groupId, groupMetadataSetOp(req));
-        },
-        async setMemberMetadata(groupId, identity, req) {
-            await group(s, groupId, memberMetadataSetOp(identity, req));
-        },
-        async setContextMetadata(groupId, contextId, req) {
-            await group(s, groupId, contextMetadataSetOp(contextId, req));
-        },
-        async setDefaultCapabilities(groupId, req) {
-            await group(s, groupId, defaultCapabilitiesSetOp(req.defaultCapabilities));
-        },
-        async setSubgroupVisibility(groupId, req) {
-            await group(s, groupId, subgroupVisibilitySetOp(req.subgroupVisibility === 'open' ? 'open' : 'restricted'));
-        },
-        async setMemberCapabilities(groupId, identity, req) {
-            await group(s, groupId, memberCapabilitySetOp(identity, req.capabilities));
-        },
-        async deleteGroup(groupId) {
-            await root(s, groupId, groupDeletedOp(groupId));
-            return { isDeleted: true };
-        },
-        async reparentGroup(childGroupId, req) {
-            await root(s, childGroupId, groupReparentedOp(childGroupId, req.newParentId));
-            return { reparented: true };
-        },
-        async leaveGroup(groupId) {
-            await group(s, groupId, memberLeftOp(s.account));
-        },
-        async leaveNamespace(namespaceId) {
-            await group(s, namespaceId, memberLeftOp(s.account));
-        },
-        // An account runs as itself in every context it can reach (the relay
-        // executes as the account), so its identity there is the account. Owned
-        // when its account is a member of the context's group, as on a node a
-        // context identity is owned once the node has joined.
-        async getContextIdentitiesOwned(contextId) {
-            return { identities: (await isMemberOfContextGroup(contextId)) ? [s.account] : [] };
-        },
-        async joinContext(contextId) {
-            await joinOpen(String(await relay().getContextGroup(contextId)));
-            return { contextId, memberPublicKey: s.account };
-        },
-        async createContext(req) {
-            const info = await relay().getGroupInfo(req.groupId);
-            const namespaceId = info.namespaceId ?? req.groupId;
-            // Every field with a place in the creation warrant; `identitySecret` has
-            // none for an account (see CreateDelegatedContextRequest).
-            const { contextId } = await createContext(s, {
-                namespaceId, groupId: req.groupId, applicationId: req.applicationId,
-                serviceName: req.serviceName, contextSeed: req.contextSeed,
-                name: req.name, initializationParams: req.initializationParams,
-            });
-            // The relay executes as the account, so the account is its member key
-            // here as it is in `joinContext` and `getContextIdentitiesOwned`. Apps
-            // record this key as the context's owner; an empty one was being stored.
-            return { contextId, memberPublicKey: s.account, groupId: req.groupId };
-        },
-        async createNamespaceInvitation(namespaceId) {
-            const [{ members }, info] = await Promise.all([relay().listGroupMembers(namespaceId), relay().getGroupInfo(namespaceId)]);
-            // The relays admit: whoever claims an account's invitation may have no
-            // node, and only a relay can admit a joiner with none. With no relay in
-            // the namespace, leave it to the admins (signGroupInvitation's default).
-            const relays = members
-                .filter((m) => m.role === 'RelayTee')
-                .map((m) => m.identity.toLowerCase());
-            if (routing) {
-                // Who the claimant's client will look for: the admitters this
-                // invitation names (the relays, else signGroupInvitation's admins).
-                const named = new Set(relays.length > 0
-                    ? relays
-                    : members.filter((m) => m.role === 'Admin').map((m) => m.identity.toLowerCase()));
-                let nodes = null;
-                try {
-                    nodes = (await routing(namespaceId)).nodes;
-                }
-                catch {
-                    // Nothing learned: the claimant's own lookup will say what is wrong.
-                }
-                if (nodes !== null) {
-                    if (nodes.length === 0)
-                        throw new InvitationNotClaimableError(namespaceId, 'not-hosted');
-                    if (!nodes.some((n) => n.account !== null && named.has(n.account.toLowerCase()))) {
-                        throw new InvitationNotClaimableError(namespaceId, 'no-named-node');
-                    }
-                }
-            }
-            const invitation = await signInvitation({
-                groupId: namespaceId,
-                inviterAccount: s.account,
-                deviceSecret: s.deviceSecret,
-                ...(relays.length > 0 ? { admitters: relays } : {}),
-                members: members,
-                applicationId: info.targetApplicationId,
-                appKey: info.appKey,
-            });
-            return { invitation };
-        },
-        // The relay syncs its own view; an account has nothing to pull.
-        async syncGroup(groupId) {
-            return { groupId, synced: true };
-        },
-        async syncContext() {
-            // Same: nothing for an account to pull.
-        },
-        joinNamespace,
-        async updateMemberRole(groupId, identity, req) {
-            await group(s, groupId, memberRoleSetOp(identity, req.role));
-        },
-        // An open subgroup is joined the way `joinContext` joins one: MemberJoinedOpen
-        // on the subgroup, and nothing to do for a member already in it.
-        async joinSubgroupInheritance(groupId) {
-            return { groupId, memberPublicKey: s.account, wasInherited: await joinOpen(groupId) };
-        },
-        async detachContextFromGroup(groupId, contextId) {
-            await group(s, groupId, contextDetachedOp(contextId));
-        },
-    };
-    if (read === null) {
-        return new Proxy({}, {
-            get(_target, prop) {
-                if (typeof prop !== 'string')
-                    return undefined;
-                if (prop === 'getNodeIdentity')
-                    return writes.getNodeIdentity;
-                if (prop === 'joinNamespace')
-                    return joinNamespace;
-                if (prop in EMPTY_READS)
-                    return EMPTY_READS[prop];
-                return async () => {
-                    throw new NoRelayError(prop);
-                };
-            },
-        });
-    }
-    return new Proxy(read, {
-        get(target, prop, receiver) {
-            if (typeof prop === 'string' && prop in writes)
-                return writes[prop];
-            if (typeof prop === 'string' && NODE_ONLY.has(prop)) {
-                return async () => {
-                    throw new NotForAccountError(prop);
-                };
-            }
-            return Reflect.get(target, prop, receiver);
-        },
-    });
-}