@calimero-network/mero-js 26.11.0 → 27.0.1

package/dist/owner-op/owner-op.js

@@ -1,214 +0,0 @@
-/**
- * Root proofs for owner-level governance ops (core schema 18).
- *
- * A device key speaks for its account everywhere in governance, so a stolen
- * device used to be enough to take a group from its owner: promote an
- * accomplice, transfer ownership, remove the owner. Core now refuses the ops
- * that can do that unless they carry an authorisation signed by the account's
- * **root** key, which a device does not hold:
- *
- * - `GroupOp::TransferOwnership`, `GroupOp::GroupDelete` and
- *   `RootOp::AdminChanged`, which are owner-only;
- * - the TEE admission, release-admission and authoring policies, which stay
- *   admin-level but need the signing admin's own root.
- *
- * A node that holds the account root (as `merod init` provisions) signs the
- * proof itself, so a caller on such a node passes nothing. This module is for
- * the other case: a nodeless account, or a root kept cold, signing offline and
- * passing the hex proof as `rootProof`.
- *
- * What the root signs binds the account, the namespace, the group, the kind of
- * op, a digest of the op's own borsh bytes, the root epoch, and the group's
- * guarded-op counter. Read that counter (`ownerOpCounter`, with `namespaceId`)
- * from `getGroupInfo` first: the node applies a proof only while the group is
- * still at that count, and advances it once the op applies, so each proof is
- * single-use. For `AdminChanged` and the TEE policies the group is the
- * namespace root.
- *
- * Byte layouts follow core's `calimero_account::OwnerOpAuthorization` and
- * `calimero_governance_types::{GroupOp, RootOp}`. They are pinned against core's
- * own vectors (`crates/account/src/tests/owner_op.rs`,
- * `root_guarded_vectors_are_stable` in `crates/governance-types/src/tests.rs`)
- * in `owner-op.test.ts`.
- */
-import { concat, derivePublicKey, domainHash, fromHex, fromHexUnsized, hex, importSigningKey, u32le, u64le, } from '../crypto/internal.js';
-/** core's `OWNER_OP_SIGN_DOMAIN`: what the root signs under. */
-const OWNER_OP_SIGN_DOMAIN = new TextEncoder().encode('calimero.account.owner-op.v1');
-/** core's `OWNER_OP_BODY_DOMAIN`: what the op's bytes are hashed under. */
-const OWNER_OP_BODY_DOMAIN = new TextEncoder().encode('calimero.account.owner-op.body.v1');
-/** core's `ACCOUNT_ID_DOMAIN`. */
-const ACCOUNT_ID_DOMAIN = new TextEncoder().encode('calimero.account.genesis.v1');
-/** core's `ACCOUNT_GENESIS_VERSION`. */
-const ACCOUNT_GENESIS_VERSION = 2;
-/**
- * Which owner-level op a proof authorises. The value is the byte core signs,
- * its `OwnerOpKind` discriminant.
- */
-export const OWNER_OP_KIND = {
-    transferOwnership: 0,
-    adminChanged: 1,
-    groupDelete: 2,
-    teeAdmissionPolicy: 3,
-    teeAuthoringPolicy: 4,
-    teeReleaseAdmissionPolicy: 5,
-};
-/** `GroupOp` discriminants, by position in core's enum. */
-const GROUP_OP = {
-    GroupDelete: 14,
-    TransferOwnership: 21,
-    TeeAuthoringPolicySet: 33,
-    TeeAdmissionPolicySetV2: 37,
-    TeeReleaseAdmissionPolicySetV2: 38,
-    RootGuarded: 42,
-};
-/** `RootOp` discriminants, by position in core's enum. */
-const ROOT_OP = {
-    AdminChanged: 3,
-    RootGuarded: 12,
-};
-/** core's `TeeAdmissionMode` discriminants. */
-const TEE_MODE = { replica: 0, relay: 1 };
-const te = new TextEncoder();
-function tag(byte) {
-    return new Uint8Array([byte]);
-}
-function borshString(value) {
-    const bytes = te.encode(value);
-    return concat(u32le(bytes.length), bytes);
-}
-function borshStrings(values) {
-    return concat(u32le(values.length), ...values.map(borshString));
-}
-function borshBool(value) {
-    return tag(value ? 1 : 0);
-}
-function teeMode(mode) {
-    const byte = TEE_MODE[mode ?? 'replica'];
-    if (byte === undefined) {
-        throw new Error(`mode must be replica or relay, got ${String(mode)}`);
-    }
-    return tag(byte);
-}
-/** Hand the group to `newOwner` (an account, hex), who must already be an admin. */
-export function transferOwnershipOp(newOwner) {
-    return {
-        kind: 'transferOwnership',
-        plane: 'group',
-        bytes: concat(tag(GROUP_OP.TransferOwnership), fromHex(newOwner, 'newOwner', 32)),
-    };
-}
-/** The owner-only deletion of a group that holds no contexts. */
-export function groupDeleteOp() {
-    return { kind: 'groupDelete', plane: 'group', bytes: tag(GROUP_OP.GroupDelete) };
-}
-/** Repoint the namespace's admin pin at `newAdmin` (an account, hex). A root op. */
-export function adminChangedOp(newAdmin) {
-    return {
-        kind: 'adminChanged',
-        plane: 'root',
-        bytes: concat(tag(ROOT_OP.AdminChanged), fromHex(newAdmin, 'newAdmin', 32)),
-    };
-}
-/** The TEE authoring policy `PUT`/`DELETE …/settings/tee-authoring-policy` publishes. */
-export function teeAuthoringPolicyOp(allowedMrtd) {
-    return {
-        kind: 'teeAuthoringPolicy',
-        plane: 'group',
-        bytes: concat(tag(GROUP_OP.TeeAuthoringPolicySet), borshStrings(allowedMrtd)),
-    };
-}
-/**
- * The measurement-list admission policy `PUT …/settings/tee-admission-policy`
- * publishes. Pass the fields exactly as you send them: the node signs over the
- * op it builds from them, and any difference is a different op.
- */
-export function teeAdmissionPolicyOp(input) {
-    return {
-        kind: 'teeAdmissionPolicy',
-        plane: 'group',
-        bytes: concat(tag(GROUP_OP.TeeAdmissionPolicySetV2), borshStrings(input.allowedMrtd), borshStrings(input.allowedRtmr0), borshStrings(input.allowedRtmr1), borshStrings(input.allowedRtmr2), borshStrings(input.allowedRtmr3), borshStrings(input.allowedTcbStatuses), borshBool(input.acceptMock), teeMode(input.mode)),
-    };
-}
-/** The signed-release admission policy `PUT …/settings/tee-admission-policy` publishes. */
-export function teeReleaseAdmissionPolicyOp(input) {
-    const minRelease = input.minReleaseVersion === undefined
-        ? tag(0)
-        : concat(tag(1), borshString(input.minReleaseVersion));
-    return {
-        kind: 'teeReleaseAdmissionPolicy',
-        plane: 'group',
-        bytes: concat(tag(GROUP_OP.TeeReleaseAdmissionPolicySetV2), borshStrings(input.allowedProfiles), minRelease, borshStrings(input.allowedTcbStatuses), borshBool(input.acceptMock), teeMode(input.mode)),
-    };
-}
-/** core's `OwnerOpAuthorization::op_digest`: the op's bytes, hashed under the body domain. */
-export async function ownerOpDigest(opBytes) {
-    return domainHash(OWNER_OP_BODY_DOMAIN, [opBytes]);
-}
-/** core's `OwnerOpTerms::signing_payload`. */
-export async function ownerOpSigningPayload(input) {
-    return domainHash(OWNER_OP_SIGN_DOMAIN, [
-        fromHex(input.account, 'account', 32),
-        fromHex(input.namespaceId, 'namespaceId', 32),
-        fromHex(input.groupId, 'groupId', 32),
-        tag(kindByte(input.kind)),
-        input.opDigest,
-        u64le(input.counter),
-        u32le(input.keyEpoch),
-    ]);
-}
-function kindByte(kind) {
-    const byte = OWNER_OP_KIND[kind];
-    if (byte === undefined) {
-        throw new Error(`unknown owner-op kind ${String(kind)}`);
-    }
-    return byte;
-}
-const HANDOFF_BYTES = 32 + 4 + 32 + 64;
-/**
- * Sign a root proof for `op` and return it as core's `rootProof`: the hex
- * borsh of an `AccountProof<OwnerOpAuthorization>`.
- *
- * Layout: `AccountGenesis` (version u8 + root pk 32), the handoff chain (u32
- * count + 132 bytes each), then `OwnerOpAuthorization` (account 32, namespace
- * 32, group 32, kind u8, op digest 32, counter u64, key epoch u32, signature
- * 64).
- */
-export async function signOwnerOpProof(input) {
-    const rootPublicKey = await derivePublicKey(input.rootSecret);
-    const genesis = concat(tag(ACCOUNT_GENESIS_VERSION), rootPublicKey);
-    const account = hex(await domainHash(ACCOUNT_ID_DOMAIN, [genesis]));
-    const keyEpoch = input.keyEpoch ?? 0;
-    const chain = (input.chain ?? []).map((handoff, index) => {
-        const bytes = fromHexUnsized(handoff, `chain[${index}]`);
-        if (bytes.length !== HANDOFF_BYTES) {
-            throw new Error(`chain[${index}] must be a ${HANDOFF_BYTES}-byte RootKeyHandoff, got ${bytes.length}`);
-        }
-        return bytes;
-    });
-    if (keyEpoch > chain.length) {
-        throw new Error(`keyEpoch ${keyEpoch} needs ${keyEpoch} handoffs in chain, got ${chain.length}`);
-    }
-    const opDigest = await ownerOpDigest(input.op.bytes);
-    const payload = await ownerOpSigningPayload({
-        account,
-        namespaceId: input.namespaceId,
-        groupId: input.groupId,
-        kind: input.op.kind,
-        opDigest,
-        counter: input.counter,
-        keyEpoch,
-    });
-    const key = await importSigningKey(input.rootSecret);
-    const signature = new Uint8Array(await crypto.subtle.sign('Ed25519', key, payload));
-    return hex(concat(genesis, u32le(chain.length), ...chain, fromHex(account, 'account', 32), fromHex(input.namespaceId, 'namespaceId', 32), fromHex(input.groupId, 'groupId', 32), tag(kindByte(input.op.kind)), opDigest, u64le(input.counter), u32le(keyEpoch), signature));
-}
-/**
- * The `RootGuarded` wrapper core publishes: the op and its proof, as one
- * `GroupOp` or `RootOp`. A client never sends this to a node (the endpoints
- * take the proof and build the wrapper); it is here so the whole encoding is
- * checkable against core's vector.
- */
-export function rootGuardedOpBytes(op, rootProof) {
-    const wrapper = op.plane === 'group' ? GROUP_OP.RootGuarded : ROOT_OP.RootGuarded;
-    return concat(tag(wrapper), op.bytes, fromHexUnsized(rootProof, 'rootProof'));
-}

package/dist/presence/relay-presence.d.ts

@@ -1,56 +0,0 @@
-/**
- * An account's ephemeral presence, through its relay.
- *
- * A node publishes and heartbeats its own presence; an account has no node, so
- * this client signs each update with the device key, posts it to the relay's
- * `presence-intents`, and resends the last state every 2.5 s until
- * `set(contextId, null)` or `close()`. The relay checks the update and seals
- * and gossips it; other members verify the device's signature and certificate
- * themselves, so the relay cannot invent or alter an account's presence.
- */
-import type { SseClient } from '../events/index.js';
-import type { Codec, EphemeralEntry } from '../ephemeral/types.js';
-import type { RelayClient } from '../relay/relay-client.js';
-type PresenceRelay = Pick<RelayClient, 'authorProof' | 'authorSigner' | 'presenceIntent'>;
-export declare class RelayPresenceClient {
-    private readonly relay;
-    private readonly events;
-    private readonly heartbeatMs;
-    private readonly now;
-    private readonly timers;
-    private readonly lastSeq;
-    private readonly refused;
-    /**
-     * Bumped by every `set` and `close`, per context. A `set` installs its
-     * resends only if nothing newer happened while its first send was in flight,
-     * so a retract (or a newer state) can never be overtaken by an older one.
-     */
-    private readonly generation;
-    /**
-     * @param opts.events the relay's event stream, asked for only on `subscribe`:
-     *   publishing needs none, so a client with no node key can still publish.
-     */
-    constructor(opts: {
-        relay: PresenceRelay;
-        events: () => SseClient;
-        heartbeatMs?: number;
-        now?: () => number;
-    });
-    /**
-     * Set this account's presence in `contextId`, or retract it with `null`.
-     * Throws when the relay refuses this first send for good (a 4xx other than
-     * 429), which also stops the resends. A rate limit, a network failure or a
-     * 5xx is not thrown: the next resend covers it.
-     */
-    set<T>(contextId: string, state: T | null, codec?: Codec<T>): Promise<void>;
-    subscribe<T>(contextId: string, handler: (entry: EphemeralEntry<T>) => void, codec?: Codec<T>): () => void;
-    /** Stop every resend. Entries expire on the relay and its peers within 7 s. */
-    close(): void;
-    /** Stop the context's resends and invalidate any `set` still in flight. */
-    private bump;
-    private stop;
-    /** Wall-clock seeded and strictly rising, so a relay restart never sees an old seq. */
-    private nextSeq;
-    private send;
-}
-export {};

package/dist/presence/relay-presence.js

@@ -1,107 +0,0 @@
-import { hex } from '../crypto/internal.js';
-import { jsonCodec, subscribePresence } from '../ephemeral/index.js';
-import { presenceStatementBytes } from './statement.js';
-/** The node's own heartbeat interval, so a relayed entry never outlives the 7 s TTL. */
-const HEARTBEAT_MS = 2500;
-export class RelayPresenceClient {
-    /**
-     * @param opts.events the relay's event stream, asked for only on `subscribe`:
-     *   publishing needs none, so a client with no node key can still publish.
-     */
-    constructor(opts) {
-        this.timers = new Map();
-        this.lastSeq = new Map();
-        this.refused = new Set();
-        /**
-         * Bumped by every `set` and `close`, per context. A `set` installs its
-         * resends only if nothing newer happened while its first send was in flight,
-         * so a retract (or a newer state) can never be overtaken by an older one.
-         */
-        this.generation = new Map();
-        this.relay = opts.relay;
-        this.events = opts.events;
-        this.heartbeatMs = opts.heartbeatMs ?? HEARTBEAT_MS;
-        this.now = opts.now ?? Date.now;
-    }
-    /**
-     * Set this account's presence in `contextId`, or retract it with `null`.
-     * Throws when the relay refuses this first send for good (a 4xx other than
-     * 429), which also stops the resends. A rate limit, a network failure or a
-     * 5xx is not thrown: the next resend covers it.
-     */
-    async set(contextId, state, codec = jsonCodec()) {
-        const generation = this.bump(contextId);
-        this.refused.delete(contextId);
-        const bytes = state === null ? null : new Uint8Array(codec.encode(state));
-        await this.send(contextId, bytes);
-        if (bytes === null || this.refused.has(contextId))
-            return;
-        if (this.generation.get(contextId) !== generation)
-            return; // a newer set or close won
-        this.timers.set(contextId, setInterval(() => void this.send(contextId, bytes).catch(() => undefined), this.heartbeatMs));
-    }
-    subscribe(contextId, handler, codec = jsonCodec()) {
-        return subscribePresence(this.events(), contextId, handler, codec);
-    }
-    /** Stop every resend. Entries expire on the relay and its peers within 7 s. */
-    close() {
-        for (const contextId of new Set([...this.timers.keys(), ...this.generation.keys()])) {
-            this.bump(contextId);
-        }
-    }
-    /** Stop the context's resends and invalidate any `set` still in flight. */
-    bump(contextId) {
-        this.stop(contextId);
-        const next = (this.generation.get(contextId) ?? 0) + 1;
-        this.generation.set(contextId, next);
-        return next;
-    }
-    stop(contextId) {
-        const timer = this.timers.get(contextId);
-        if (timer !== undefined)
-            clearInterval(timer);
-        this.timers.delete(contextId);
-    }
-    /** Wall-clock seeded and strictly rising, so a relay restart never sees an old seq. */
-    nextSeq(contextId) {
-        const seq = Math.max(this.now(), (this.lastSeq.get(contextId) ?? 0) + 1);
-        this.lastSeq.set(contextId, seq);
-        return seq;
-    }
-    async send(contextId, state) {
-        if (this.refused.has(contextId))
-            return;
-        const signer = await this.relay.authorSigner();
-        const seq = this.nextSeq(contextId);
-        const sentAtMs = this.now();
-        const statement = await presenceStatementBytes({
-            contextId,
-            author: signer.publicKey,
-            seq: BigInt(seq),
-            sentAtMs: BigInt(sentAtMs),
-            state,
-        });
-        const signature = hex(await signer.sign(statement));
-        try {
-            await this.relay.presenceIntent(contextId, {
-                state: state === null ? null : hex(state),
-                seq,
-                sentAtMs,
-                signature,
-                authorProof: this.relay.authorProof,
-            });
-        }
-        catch (err) {
-            const status = err.status;
-            // Rate limited, a network failure, or the relay unable right now (5xx,
-            // e.g. no current key mid-rotation): the next resend covers it.
-            if (status === undefined || status === 0 || status === 429 || status >= 500)
-                return;
-            // Any other refusal (403: not a member or revoked; 400: malformed or a
-            // clock outside the relay's window) cannot be fixed by resending.
-            this.refused.add(contextId);
-            this.stop(contextId);
-            throw err;
-        }
-    }
-}

package/dist/presence/statement.d.ts

@@ -1,12 +0,0 @@
-/** core's `PRESENCE_DOMAIN`: part of the signed bytes. */
-export declare const PRESENCE_DOMAIN: Uint8Array;
-/** `sha256(borsh(Option<Vec<u8>>))`: `None` is `[0]`, `Some(v)` is `[1] ‖ u32le(len) ‖ v`. */
-export declare function stateHash(state: Uint8Array | null): Promise<Uint8Array>;
-/** What the device key signs, raw: domain ‖ context ‖ author ‖ seq ‖ sentAtMs ‖ stateHash. */
-export declare function presenceStatementBytes(input: {
-    contextId: string;
-    author: string;
-    seq: bigint;
-    sentAtMs: bigint;
-    state: Uint8Array | null;
-}): Promise<Uint8Array>;

package/dist/presence/statement.js

@@ -1,17 +0,0 @@
-/**
- * The bytes a device signs for one presence update: the borsh of core's
- * `PresenceStatement` (`calimero_node_primitives::presence`). Pinned to core's
- * vector in `statement.test.ts`, so the two encoders cannot drift.
- */
-import { concat, fromHex, u32le, u64le } from '../crypto/internal.js';
-/** core's `PRESENCE_DOMAIN`: part of the signed bytes. */
-export const PRESENCE_DOMAIN = new TextEncoder().encode('calimero/presence/1');
-/** `sha256(borsh(Option<Vec<u8>>))`: `None` is `[0]`, `Some(v)` is `[1] ‖ u32le(len) ‖ v`. */
-export async function stateHash(state) {
-    const borsh = state === null ? new Uint8Array([0]) : concat(new Uint8Array([1]), u32le(state.length), state);
-    return new Uint8Array(await crypto.subtle.digest('SHA-256', borsh));
-}
-/** What the device key signs, raw: domain ‖ context ‖ author ‖ seq ‖ sentAtMs ‖ stateHash. */
-export async function presenceStatementBytes(input) {
-    return concat(PRESENCE_DOMAIN, fromHex(input.contextId, 'contextId', 32), fromHex(input.author, 'author', 32), u64le(input.seq), u64le(input.sentAtMs), await stateHash(input.state));
-}

package/dist/relay/index.d.ts

@@ -1,4 +0,0 @@
-export { RelayClient, IntentRefusedError } from './relay-client.js';
-export type { RelayClientConfig, RelayExecutor, RelayDescription, IntentResult, CreationDescription, CreateContextInput, CreatedContext, GovernanceDescription, GovernInput, GovernResult, FoundNamespaceInput, FoundedNamespace, } from './relay-client.js';
-export { createMemoryNonceSource, createLocalStorageNonceSource, } from './nonce-source.js';
-export type { NonceSource } from './nonce-source.js';

package/dist/relay/index.js

@@ -1,2 +0,0 @@
-export { RelayClient, IntentRefusedError } from './relay-client.js';
-export { createMemoryNonceSource, createLocalStorageNonceSource, } from './nonce-source.js';

package/dist/relay/nonce-source.d.ts

@@ -1,72 +0,0 @@
-/**
- * Where a warrant's nonce comes from.
- *
- * # Why this is a named concept and not a counter in the relay client
- *
- * A warrant's nonce is spent, once, per `(context, author device)` on every
- * node that applies the delta. So the sequence a client emits is not a local
- * detail — it is state the network remembers, and the client is the only party
- * that can keep it.
- *
- * The receiving ledger is a **sliding window** 64 wide, not a high-water mark,
- * which is what makes the two failure modes so different:
- *
- * - **Skipping** numbers is free. Gossip gives no ordering, so the window
- *   exists precisely to accept whatever unseen nonce arrives.
- * - **Restarting** the sequence is fatal. A tab that reloads and resumes at `1`
- *   re-presents nonces the network has already spent, and every one of those
- *   writes is refused as a replay — indistinguishable, to the user, from the
- *   app silently not saving.
- *
- * That asymmetry is why persistence is the default here and an in-memory source
- * is the one you have to ask for. It is also why a source may jump: reserving a
- * block and losing the tail is the correct trade.
- */
-/** Produces the next nonce for one author device. Must never go backwards. */
-export interface NonceSource {
-    next(): Promise<bigint>;
-    /**
-     * Raise the floor of the sequence to `floor`, if this source can record it.
-     *
-     * Optional, and additive: a source that does not implement it still works
-     * everywhere a `NonceSource` is taken. Implementing it is what lets a caller
-     * that learns a higher spent nonce out of band — a refusal naming the nonce,
-     * say — skip ahead, and lets a *persistent* source remember that jump across
-     * a cold start.
-     *
-     * Never lowers: a smaller `floor` than the source's own position is ignored.
-     */
-    advanceTo?(floor: bigint): Promise<void>;
-}
-/**
- * A counter in memory, starting at `start`.
- *
- * Correct only for a process whose lifetime is the whole sequence — a script, a
- * server-side worker that owns its own device key, a test. In a browser tab it
- * resets on reload and replays; use {@link createLocalStorageNonceSource}
- * there.
- */
-export declare function createMemoryNonceSource(start?: number | bigint): NonceSource;
-/**
- * A counter persisted in `localStorage`, so a reload continues the sequence.
- *
- * Key it per author **device**, not per account: two devices of one account are
- * independent replicas with independent sequences, and sharing a counter would
- * have them refusing each other's warrants.
- *
- * **Reserve-then-hand-out.** The stored value is advanced *before* the nonce is
- * returned, so a crash between the two loses a number rather than reusing one.
- * Losing a number costs nothing (the window accepts gaps); reusing one costs a
- * write.
- *
- * Concurrent tabs are the case this cannot fully solve, because `localStorage`
- * has no atomic read-modify-write. Two tabs racing can hand out the same nonce,
- * and the loser's write is refused as a replay rather than silently
- * misattributed — a visible error, not corruption. An app that genuinely writes
- * from several tabs at once should hold a Web Lock around `next()` or give each
- * tab its own device.
- */
-export declare function createLocalStorageNonceSource(key: string, storage?: {
-    getItem(k: string): string | null;
-    setItem(k: string, v: string): void;
-}): NonceSource;

package/dist/relay/nonce-source.js

@@ -1,111 +0,0 @@
-/**
- * Where a warrant's nonce comes from.
- *
- * # Why this is a named concept and not a counter in the relay client
- *
- * A warrant's nonce is spent, once, per `(context, author device)` on every
- * node that applies the delta. So the sequence a client emits is not a local
- * detail — it is state the network remembers, and the client is the only party
- * that can keep it.
- *
- * The receiving ledger is a **sliding window** 64 wide, not a high-water mark,
- * which is what makes the two failure modes so different:
- *
- * - **Skipping** numbers is free. Gossip gives no ordering, so the window
- *   exists precisely to accept whatever unseen nonce arrives.
- * - **Restarting** the sequence is fatal. A tab that reloads and resumes at `1`
- *   re-presents nonces the network has already spent, and every one of those
- *   writes is refused as a replay — indistinguishable, to the user, from the
- *   app silently not saving.
- *
- * That asymmetry is why persistence is the default here and an in-memory source
- * is the one you have to ask for. It is also why a source may jump: reserving a
- * block and losing the tail is the correct trade.
- */
-/**
- * A counter in memory, starting at `start`.
- *
- * Correct only for a process whose lifetime is the whole sequence — a script, a
- * server-side worker that owns its own device key, a test. In a browser tab it
- * resets on reload and replays; use {@link createLocalStorageNonceSource}
- * there.
- */
-export function createMemoryNonceSource(start = 1) {
-    let next = BigInt(start);
-    if (next < 1n) {
-        throw new Error('nonce sequence starts at 1');
-    }
-    return {
-        next() {
-            const value = next;
-            next += 1n;
-            return Promise.resolve(value);
-        },
-        advanceTo(floor) {
-            if (floor > next)
-                next = floor;
-            return Promise.resolve();
-        },
-    };
-}
-/**
- * A counter persisted in `localStorage`, so a reload continues the sequence.
- *
- * Key it per author **device**, not per account: two devices of one account are
- * independent replicas with independent sequences, and sharing a counter would
- * have them refusing each other's warrants.
- *
- * **Reserve-then-hand-out.** The stored value is advanced *before* the nonce is
- * returned, so a crash between the two loses a number rather than reusing one.
- * Losing a number costs nothing (the window accepts gaps); reusing one costs a
- * write.
- *
- * Concurrent tabs are the case this cannot fully solve, because `localStorage`
- * has no atomic read-modify-write. Two tabs racing can hand out the same nonce,
- * and the loser's write is refused as a replay rather than silently
- * misattributed — a visible error, not corruption. An app that genuinely writes
- * from several tabs at once should hold a Web Lock around `next()` or give each
- * tab its own device.
- */
-export function createLocalStorageNonceSource(key, storage) {
-    const store = storage ?? globalThis.localStorage;
-    if (!store) {
-        throw new Error('no localStorage in this runtime: pass a storage implementation, or use createMemoryNonceSource for a process that owns its whole sequence');
-    }
-    // A missing, empty, or corrupted value means "no sequence recorded", and the
-    // safe reading of that is not 1 — a cleared storage on a device that has
-    // already written would replay. But the client cannot know, and 1 is the only
-    // defensible start, so it is what a fresh key gets. This is why the doc above
-    // tells apps to key per device: a device whose storage was cleared should be
-    // re-paired rather than resumed. No node serves a "where does my sequence
-    // stand" lookup, so the local counter is the only record there is.
-    const lastHandedOut = () => {
-        const raw = store.getItem(key);
-        if (raw === null || raw === '')
-            return 0n;
-        try {
-            const parsed = BigInt(raw);
-            return parsed > 0n ? parsed : 0n;
-        }
-        catch {
-            return 0n;
-        }
-    };
-    return {
-        next() {
-            const value = lastHandedOut() + 1n;
-            store.setItem(key, value.toString());
-            return Promise.resolve(value);
-        },
-        advanceTo(floor) {
-            // Stored is the last number handed out, so the floor is recorded as the
-            // one below it — persisted rather than held in memory, which is the whole
-            // point: the next cold start resumes above the jump even if the node
-            // cannot be reached then.
-            const wanted = floor > 0n ? floor - 1n : 0n;
-            if (wanted > lastHandedOut())
-                store.setItem(key, wanted.toString());
-            return Promise.resolve();
-        },
-    };
-}