@calimero-network/mero-js 26.11.0 → 27.0.0

package/dist/auth-api/auth-types.d.ts

@@ -1,130 +0,0 @@
-export { ApiResponse } from '../http-client/index.js';
-export interface HealthResponse {
-    status: 'alive' | 'not_alive';
-    storage: boolean;
-    uptime_seconds: number;
-}
-export interface IdentityResponse {
-    service: string;
-    version: string;
-    authentication_mode: string;
-    providers: string[];
-}
-export interface ProvidersResponse {
-    providers: Array<{
-        name: string;
-        type: string;
-        description: string;
-        configured: boolean;
-        config: Record<string, unknown>;
-    }>;
-    count: number;
-    /**
-     * App origins, besides the node's own and the registry-declared frontends,
-     * that this node's login page may hand a token pair to (`callback-url`):
-     * exact `http(s)` origins from the node's
-     * `[server.embedded_auth.development] trusted_callback_origins`. Absent on
-     * nodes from before it existed; treat that as none.
-     */
-    trusted_callback_origins?: string[];
-}
-export interface TokenRequest {
-    auth_method: string;
-    public_key: string;
-    client_name: string;
-    permissions?: string[];
-    timestamp: number;
-    provider_data: Record<string, unknown>;
-}
-export interface TokenResponse {
-    data: {
-        access_token: string;
-        refresh_token: string;
-        error?: string | null;
-    };
-    error?: string | null;
-}
-export interface RefreshTokenRequest {
-    access_token: string;
-    refresh_token: string;
-}
-export interface MockTokenRequest {
-    client_name: string;
-    permissions?: string[];
-    node_url?: string;
-    access_token_expiry?: number;
-    refresh_token_expiry?: number;
-}
-export interface RevokeTokenRequest {
-    client_id: string;
-}
-export interface RevokeTokenResponse {
-    success: boolean;
-    message: string;
-}
-export interface CreateKeyRequest {
-    /** Public key to register as a root key. */
-    public_key: string;
-    /** Auth method / provider name (e.g. "user_password"). */
-    auth_method: string;
-    /** Provider-specific data. */
-    provider_data: Record<string, unknown>;
-    /** Target node URL to scope the root key to (optional). */
-    target_node_url?: string;
-}
-export interface CreateKeyResponse {
-    status: boolean;
-    message: string;
-}
-export interface DeleteKeyResponse {
-    success: boolean;
-    message: string;
-}
-export interface RootKey {
-    key_id: string;
-    public_key: string;
-    auth_method: string;
-    created_at: number;
-    revoked_at?: number | null;
-    permissions: string[];
-}
-export interface ClientKey {
-    client_id: string;
-    root_key_id: string;
-    name: string;
-    permissions: string[];
-    created_at: number;
-    revoked_at?: number | null;
-    is_valid: boolean;
-}
-export interface GenerateClientKeyRequest {
-    /** Context the client key is scoped to (optional). */
-    context_id?: string;
-    /** Context identity (executor public key) the client key is for (optional). */
-    context_identity?: string;
-    /** Additional permissions to request (validated against the root key). */
-    permissions?: string[];
-    /** Target node URL to scope the client key/tokens to (optional). */
-    target_node_url?: string;
-}
-export interface DeleteClientResponse {
-    success: boolean;
-    message: string;
-}
-export interface UpdateKeyPermissionsRequest {
-    /** Permission strings to add (OR-ed onto the key's current set). */
-    add?: string[];
-    /** Permission strings to remove (applied before `add`). */
-    remove?: string[];
-}
-export interface PermissionResponse {
-    data: {
-        permissions: string[];
-    };
-    error?: string | null;
-}
-export interface AuthApiClientConfig {
-    baseUrl: string;
-    getAuthToken?: () => Promise<string | undefined>;
-    timeoutMs?: number;
-}

package/dist/auth-api/auth-types.js

@@ -1,2 +0,0 @@
-// Auth API Types - Generated from OpenAPI 3.0.3 specification
-export {};

package/dist/auth-api/index.d.ts

@@ -1,3 +0,0 @@
-export * from './auth-client.js';
-export * from './auth-types.js';
-export * from './auth-factory.js';

package/dist/auth-api/index.js

@@ -1,4 +0,0 @@
-// Auth API client
-export * from './auth-client.js';
-export * from './auth-types.js';
-export * from './auth-factory.js';

package/dist/capabilities.d.ts

@@ -1,84 +0,0 @@
-/**
- * Capability bits as defined by core's `MemberCapabilities`.
- *
- * The per-member value is a u32 bitmask. Core currently assigns bits 0..=9
- * (the entries below); bits 10 and above are unassigned — do not repurpose
- * them for application data, as a future core release may claim them.
- */
-export declare const CAPABILITIES: {
-    readonly CAN_CREATE_CONTEXT: number;
-    readonly CAN_INVITE_MEMBERS: number;
-    readonly CAN_JOIN_OPEN_SUBGROUPS: number;
-    readonly MANAGE_MEMBERS: number;
-    readonly MANAGE_APPLICATION: number;
-    readonly CAN_CREATE_SUBGROUP: number;
-    readonly CAN_DELETE_SUBGROUP: number;
-    readonly CAN_MANAGE_VISIBILITY: number;
-    readonly CAN_MANAGE_METADATA: number;
-    /**
-     * Publish writes attributed to ANOTHER member, under a warrant that member
-     * signed — the grant delegated execution runs on.
-     *
-     * Implied by nothing: not by membership, not by admin, and not propagated by
-     * the subgroup-admit cascade. So every group is authorship-closed until an
-     * admin sets this bit, and a relay without it is refused at
-     * `performIntent` before anything executes. That is why it is worth naming
-     * here rather than leaving callers to write `1 << 9`: a client granting it
-     * has to be able to say what it is granting.
-     */
-    readonly CAN_AUTHOR_ON_BEHALF: number;
-};
-export type CapabilityName = keyof typeof CAPABILITIES;
-export type CapabilityBit = (typeof CAPABILITIES)[CapabilityName];
-/**
- * Ready-made masks for `setDefaultCapabilities` / `setMemberCapabilities` and
- * `RelayClient.foundNamespace({ defaultCapabilities })`, so an app can name the
- * default it gives members instead of passing a bare number.
- *
- * Why this matters: a namespace's default mask is copied into a non-admin
- * member's row when they join, and a namespace starts without
- * `CAN_CREATE_CONTEXT` in it. An app that never sets a default leaves every
- * invited member unable to create a context until an admin grants it by hand.
- *
- * None of these include `CAN_AUTHOR_ON_BEHALF`; grant that deliberately (see
- * `AdminApiClient.grantAuthorship` / `openToDelegatedExecution`).
- */
-export declare const CAPABILITY_PRESETS: {
-    /** No capabilities. */
-    readonly NONE: 0;
-    /** Join Open subgroups only: what a namespace starts with. */
-    readonly JOIN_ONLY: number;
-    /**
-     * Create contexts, invite members, join Open subgroups (= 7). A member who
-     * can work in the namespace but not reshape it.
-     */
-    readonly CONTRIBUTOR: number;
-    /**
-     * `CONTRIBUTOR` plus create and delete subgroups and manage their visibility
-     * (= 231). What mero-chat gives members, so they can start and close their
-     * own channels.
-     */
-    readonly COLLABORATOR: number;
-};
-export type CapabilityPreset = keyof typeof CAPABILITY_PRESETS;
-/**
- * Builds a u32 mask from capability names and/or bit values:
- * `capMask('CAN_CREATE_CONTEXT', 'CAN_INVITE_MEMBERS') === 3`.
- * Throws on a name core does not assign, so a typo can't silently yield 0.
- */
-export declare function capMask(...caps: Array<CapabilityName | number>): number;
-/**
- * The names of the assigned capability bits set in `mask`, in bit order.
- * Unassigned bits (10 and above) are not reported.
- */
-export declare function capNames(mask: number): CapabilityName[];
-/**
- * Returns true if `mask` has every bit of `cap` set. Both operands are
- * coerced to unsigned 32-bit (`>>> 0`) before comparing so a high bit such
- * as `1 << 31` doesn't fall foul of `&` yielding a signed result.
- */
-export declare function hasCap(mask: number, cap: number): boolean;
-/** Returns `mask` with every bit of `cap` set (u32-normalized). */
-export declare function withCap(mask: number, cap: number): number;
-/** Returns `mask` with every bit of `cap` cleared (u32-normalized). */
-export declare function withoutCap(mask: number, cap: number): number;

package/dist/capabilities.js

@@ -1,117 +0,0 @@
-// Member capability bitmask constants — mirrors core's `MemberCapabilities`
-// (crates/context/config/src/lib.rs). The value stored per-member is a u32
-// bitmask. Core currently assigns bits 0..=9; bits 10 and above are unassigned
-// and may be claimed by future core versions, so an application MUST NOT
-// assume any particular bit is safe for its own use unless core documents it
-// as reserved for applications.
-/**
- * Capability bits as defined by core's `MemberCapabilities`.
- *
- * The per-member value is a u32 bitmask. Core currently assigns bits 0..=9
- * (the entries below); bits 10 and above are unassigned — do not repurpose
- * them for application data, as a future core release may claim them.
- */
-export const CAPABILITIES = {
-    CAN_CREATE_CONTEXT: 1 << 0,
-    CAN_INVITE_MEMBERS: 1 << 1,
-    CAN_JOIN_OPEN_SUBGROUPS: 1 << 2,
-    MANAGE_MEMBERS: 1 << 3,
-    MANAGE_APPLICATION: 1 << 4,
-    CAN_CREATE_SUBGROUP: 1 << 5,
-    CAN_DELETE_SUBGROUP: 1 << 6,
-    CAN_MANAGE_VISIBILITY: 1 << 7,
-    CAN_MANAGE_METADATA: 1 << 8,
-    /**
-     * Publish writes attributed to ANOTHER member, under a warrant that member
-     * signed — the grant delegated execution runs on.
-     *
-     * Implied by nothing: not by membership, not by admin, and not propagated by
-     * the subgroup-admit cascade. So every group is authorship-closed until an
-     * admin sets this bit, and a relay without it is refused at
-     * `performIntent` before anything executes. That is why it is worth naming
-     * here rather than leaving callers to write `1 << 9`: a client granting it
-     * has to be able to say what it is granting.
-     */
-    CAN_AUTHOR_ON_BEHALF: 1 << 9,
-};
-/**
- * Ready-made masks for `setDefaultCapabilities` / `setMemberCapabilities` and
- * `RelayClient.foundNamespace({ defaultCapabilities })`, so an app can name the
- * default it gives members instead of passing a bare number.
- *
- * Why this matters: a namespace's default mask is copied into a non-admin
- * member's row when they join, and a namespace starts without
- * `CAN_CREATE_CONTEXT` in it. An app that never sets a default leaves every
- * invited member unable to create a context until an admin grants it by hand.
- *
- * None of these include `CAN_AUTHOR_ON_BEHALF`; grant that deliberately (see
- * `AdminApiClient.grantAuthorship` / `openToDelegatedExecution`).
- */
-export const CAPABILITY_PRESETS = {
-    /** No capabilities. */
-    NONE: 0,
-    /** Join Open subgroups only: what a namespace starts with. */
-    JOIN_ONLY: CAPABILITIES.CAN_JOIN_OPEN_SUBGROUPS,
-    /**
-     * Create contexts, invite members, join Open subgroups (= 7). A member who
-     * can work in the namespace but not reshape it.
-     */
-    CONTRIBUTOR: CAPABILITIES.CAN_CREATE_CONTEXT |
-        CAPABILITIES.CAN_INVITE_MEMBERS |
-        CAPABILITIES.CAN_JOIN_OPEN_SUBGROUPS,
-    /**
-     * `CONTRIBUTOR` plus create and delete subgroups and manage their visibility
-     * (= 231). What mero-chat gives members, so they can start and close their
-     * own channels.
-     */
-    COLLABORATOR: CAPABILITIES.CAN_CREATE_CONTEXT |
-        CAPABILITIES.CAN_INVITE_MEMBERS |
-        CAPABILITIES.CAN_JOIN_OPEN_SUBGROUPS |
-        CAPABILITIES.CAN_CREATE_SUBGROUP |
-        CAPABILITIES.CAN_DELETE_SUBGROUP |
-        CAPABILITIES.CAN_MANAGE_VISIBILITY,
-};
-/**
- * Builds a u32 mask from capability names and/or bit values:
- * `capMask('CAN_CREATE_CONTEXT', 'CAN_INVITE_MEMBERS') === 3`.
- * Throws on a name core does not assign, so a typo can't silently yield 0.
- */
-export function capMask(...caps) {
-    let mask = 0;
-    for (const cap of caps) {
-        if (typeof cap === 'number') {
-            mask |= cap;
-        }
-        else if (Object.prototype.hasOwnProperty.call(CAPABILITIES, cap)) {
-            mask |= CAPABILITIES[cap];
-        }
-        else {
-            throw new Error(`unknown capability: ${String(cap)}`);
-        }
-    }
-    return mask >>> 0;
-}
-/**
- * The names of the assigned capability bits set in `mask`, in bit order.
- * Unassigned bits (10 and above) are not reported.
- */
-export function capNames(mask) {
-    return Object.keys(CAPABILITIES).filter((name) => hasCap(mask, CAPABILITIES[name]));
-}
-/**
- * Returns true if `mask` has every bit of `cap` set. Both operands are
- * coerced to unsigned 32-bit (`>>> 0`) before comparing so a high bit such
- * as `1 << 31` doesn't fall foul of `&` yielding a signed result.
- */
-export function hasCap(mask, cap) {
-    const capU32 = cap >>> 0;
-    return ((mask & capU32) >>> 0) === capU32;
-}
-/** Returns `mask` with every bit of `cap` set (u32-normalized). */
-export function withCap(mask, cap) {
-    return (mask | cap) >>> 0;
-}
-/** Returns `mask` with every bit of `cap` cleared (u32-normalized). */
-export function withoutCap(mask, cap) {
-    return (mask & ~cap) >>> 0;
-}

package/dist/cloud/account-ownership.d.ts

@@ -1,63 +0,0 @@
-import { type Signer } from '../signer/signer.js';
-/**
- * The `ownership_proof` body for `POST /api/cloud/me/namespaces/{ns}/enable-ha`
- * and for `POST /api/cloud/accounts/{account}/namespaces/{ns}/enable-ha`.
- */
-export interface AccountOwnershipProof {
-    kind: 'account';
-    /** hex `AccountProof<DeviceCert>`, the account's credential. */
-    credential: string;
-    /** base64 UTF-8 JSON, the claim. */
-    signed_payload: string;
-    /** base64 ed25519 by the certified device key. */
-    signature: string;
-}
-/** What every account claim needs; the audience and `subject` differ per route. */
-interface AccountClaimBase {
-    /** The namespace, hex: the id `foundNamespace` returned. */
-    namespaceId: string;
-    /** The founding account, hex. */
-    accountId: string;
-    /** The salt `foundNamespace` returned, hex (32 bytes). */
-    salt: string;
-    /** The account's credential, hex `AccountProof<DeviceCert>`. */
-    credential: string;
-    deviceSecret?: string;
-    signer?: Signer;
-    /** Lifetime in ms; default one minute, at most five. */
-    ttlMs?: number;
-    /** For tests. */
-    now?: () => number;
-}
-export interface AccountOwnershipClaimInput extends AccountClaimBase {
-    /** The cloud login's email: the claim is for this login only. */
-    subject: string;
-}
-/**
- * Input for {@link signAccountHaClaim}: the same as the session claim, minus
- * `subject` — there is no login to bind it to.
- */
-export interface AccountHaClaimInput extends AccountClaimBase {
-    /**
-     * The relay that founded the namespace (the delegated session's `relayUrl`).
-     * Signed into the claim so nobody forwarding it can swap it: the cloud
-     * resolves it to one of its own fleet relays and hands that relay's
-     * addresses to the fleet node as its admitter. Leave it out when unknown.
-     */
-    relayUrl?: string;
-}
-/** The audience of the session route's claim (`/api/cloud/me/...`). */
-export declare const ACCOUNT_OWNERSHIP_AUDIENCE = "mdma:enable-ha-namespace";
-/** The audience of the anonymous account route's claim (`/api/cloud/accounts/...`). */
-export declare const ACCOUNT_HA_AUDIENCE = "mdma:enable-ha-namespace-as-account";
-/** The founder's claim for the SESSION route, bound to one cloud login (`subject`). */
-export declare function signAccountOwnershipClaim(input: AccountOwnershipClaimInput): Promise<AccountOwnershipProof>;
-/**
- * The founder's claim for the ANONYMOUS account route
- * (`POST /api/cloud/accounts/{account}/namespaces/{ns}/enable-ha`): no cloud
- * session, so no `subject`, and its own audience so a claim minted for one
- * route can never be replayed on the other. The cloud finds the user to bill
- * through the account's wallet link instead.
- */
-export declare function signAccountHaClaim(input: AccountHaClaimInput): Promise<AccountOwnershipProof>;
-export {};

package/dist/cloud/account-ownership.js

@@ -1,87 +0,0 @@
-/**
- * The ownership claim an account with no node presents to enable HA for a
- * namespace it founded through a relay (mdma#415).
- *
- * A node proves ownership with a proof signed by the namespace's group key,
- * which a nodeless account does not hold. The account instead proves it is the
- * FOUNDER: a namespace id is `domain_hash("calimero.namespace.id.v1",
- * [founder_account, salt])`, so only the founding account, with the salt its
- * founding returned, reproduces it. Its device key signs the claim, and its
- * certificate says whose device that is. The cloud also requires the login to
- * be linked to that account.
- *
- * Signature input: `"calimero.mdma.account-ownership-claim.v1\0" ‖ payload`,
- * where `payload` is the UTF-8 JSON sent (base64) as `signed_payload`.
- */
-import { concat } from '../crypto/internal.js';
-import { resolveSigner } from '../signer/signer.js';
-const DOMAIN = new TextEncoder().encode('calimero.mdma.account-ownership-claim.v1\0');
-/** What the cloud accepts; it caps a claim's lifetime at five minutes. */
-const DEFAULT_TTL_MS = 60000;
-const MAX_TTL_MS = 5 * 60000;
-/** The cloud's limit on `relay_url`. */
-const MAX_RELAY_URL = 1024;
-/** The audience of the session route's claim (`/api/cloud/me/...`). */
-export const ACCOUNT_OWNERSHIP_AUDIENCE = 'mdma:enable-ha-namespace';
-/** The audience of the anonymous account route's claim (`/api/cloud/accounts/...`). */
-export const ACCOUNT_HA_AUDIENCE = 'mdma:enable-ha-namespace-as-account';
-function base64(bytes) {
-    let binary = '';
-    for (const b of bytes)
-        binary += String.fromCharCode(b);
-    return btoa(binary);
-}
-const hex32 = (value, what) => {
-    if (!/^[0-9a-fA-F]{64}$/.test(value))
-        throw new Error(`${what} must be 64 hex characters`);
-    return value.toLowerCase();
-};
-/**
- * Sign one claim. `subject` is spliced in after `salt` only when given, so the
- * session claim keeps its exact field order and the account claim has no
- * `subject` key at all (not a null one: the cloud tells the two apart by it).
- */
-async function signClaim(input, audience, subject, relayUrl) {
-    if (relayUrl !== undefined && !(relayUrl.length > 0 && relayUrl.length <= MAX_RELAY_URL)) {
-        throw new Error(`relayUrl must be a non-empty string of at most ${MAX_RELAY_URL} characters`);
-    }
-    const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
-    if (!(ttl > 0 && ttl <= MAX_TTL_MS))
-        throw new Error(`ttlMs must be in (0, ${MAX_TTL_MS}]`);
-    const groupId = hex32(input.namespaceId, 'namespaceId');
-    const accountId = hex32(input.accountId, 'accountId');
-    const salt = hex32(input.salt, 'salt');
-    const signer = await resolveSigner(input.deviceSecret, input.signer, 'deviceSecret');
-    const issued = (input.now ?? Date.now)();
-    const nonce = Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, '0')).join('');
-    const payload = new TextEncoder().encode(JSON.stringify({
-        v: 1,
-        audience,
-        group_id: groupId,
-        account_id: accountId,
-        salt,
-        ...(subject === undefined ? {} : { subject }),
-        nonce,
-        issued_at_ms: issued,
-        expires_at_ms: issued + ttl,
-        ...(relayUrl === undefined ? {} : { relay_url: relayUrl }),
-    }));
-    const signature = await signer.sign(concat(DOMAIN, payload));
-    return { kind: 'account', credential: input.credential, signed_payload: base64(payload), signature: base64(signature) };
-}
-/** The founder's claim for the SESSION route, bound to one cloud login (`subject`). */
-export async function signAccountOwnershipClaim(input) {
-    if (!input.subject)
-        throw new Error('subject must be the cloud login email');
-    return signClaim(input, ACCOUNT_OWNERSHIP_AUDIENCE, input.subject);
-}
-/**
- * The founder's claim for the ANONYMOUS account route
- * (`POST /api/cloud/accounts/{account}/namespaces/{ns}/enable-ha`): no cloud
- * session, so no `subject`, and its own audience so a claim minted for one
- * route can never be replayed on the other. The cloud finds the user to bill
- * through the account's wallet link instead.
- */
-export async function signAccountHaClaim(input) {
-    return signClaim(input, ACCOUNT_HA_AUDIENCE, undefined, input.relayUrl);
-}