@calimero-network/mero-js 26.4.1 → 26.6.0

package/dist/index.d.ts

@@ -28,8 +28,8 @@ export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 export type { Signer } from "./signer/index.js";
 export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, resolveRoot, resolveRootPair, } from "./account/index.js";
 export type { AccountRoot, RecoverableAccountRoot, AccountRootSigner, NewAccountRootSigner, AccountLinkInput, AccountLoginInput, RootSource, ResolvedRoot, } from "./account/index.js";
-export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
-export type { DelegatedCredential, DelegatedAccountSession, RelayMap, RelayNodeKeyAttempt, RelayResolutionStep, RelayResolutionFailure, ResolvedInvitationRelay, ResolveRelayResult, ResolveRelayFromInvitationInput, JoinWithNodeInput, JoinWithNodeResult, JoinWithNodeSuccess, JoinWithNodeFailure, JoinWithNodeStep, BootstrapStep, BootstrapResult, BootstrapSuccess, BootstrapFailure, BootstrapFromInvitationInput, CreateDelegatedContextRequest, FoundedDelegatedNamespace, RegistryBundle, ResolvedApplication, AccountAdminDeps, NodeAdminDeps, } from "./account/index.js";
+export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, RelaysUnavailableError, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, RelayLoginError, createNodeAdmin, } from "./account/index.js";
+export type { DelegatedCredential, DelegatedAccountSession, RelayMap, RelayNodeKeyAttempt, RelayLoginFailureKind, RelayListingFailure, RelayResolutionStep, RelayResolutionFailure, ResolvedInvitationRelay, ResolveRelayResult, ResolveRelayFromInvitationInput, JoinWithNodeInput, JoinWithNodeResult, JoinWithNodeSuccess, JoinWithNodeFailure, JoinWithNodeStep, BootstrapStep, BootstrapResult, BootstrapSuccess, BootstrapFailure, BootstrapFromInvitationInput, CreateDelegatedContextRequest, FoundedDelegatedNamespace, RegistryBundle, ResolvedApplication, AccountAdminDeps, NodeAdminDeps, } from "./account/index.js";
 export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
 export type { DeviceCertInput, DeviceCredential } from "./device-cert/index.js";
 export { signDeviceScope, deviceScopePayload } from "./device-cert/index.js";

package/dist/index.js

@@ -52,7 +52,7 @@ resolveRoot, resolveRootPair, } from "./account/index.js";
 // Framework-free; mero-react re-exports every one of these under the same name
 // (its `DelegatedSession` is `DelegatedAccountSession` here: the login module
 // already owns the bare name for the session `login()` mints).
-export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
+export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, RelaysUnavailableError, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, RelayLoginError, createNodeAdmin, } from "./account/index.js";
 export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
 // A device's scope — signed by the root beside its certificate, and what a relay
 // needs with it to bind the device of an account that has no node.

package/dist/index.mjs

@@ -317,6 +317,12 @@ var AuthRevokedError = class extends HTTPError {
     this.message = `Authentication revoked (${reason}): HTTP ${status} ${statusText}`;
   }
 };
+var RequestAuthError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.name = "RequestAuthError";
+  }
+};
 function headersToRecord(headers) {
   const record = {};
   headers.forEach((value, key) => {
@@ -644,6 +650,7 @@ var WebHttpClient = class {
           headers.Authorization = `Bearer ${token}`;
         }
       } catch (error) {
+        if (error instanceof RequestAuthError) throw error;
       }
     }
     if (initHeaders) {
@@ -1079,6 +1086,30 @@ function withoutCap(mask, cap) {
   return (mask & ~cap) >>> 0;
 }
 
+// src/account/relay-login-error.ts
+var RelayLoginError = class extends RequestAuthError {
+  constructor(relayUrl, cause) {
+    const kind = relayLoginFailureKind(cause);
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(
+      kind === "signed-out" ? `the relay ${relayUrl} refused this device's credential (${detail}); sign in again` : `could not log in to the relay ${relayUrl}: ${detail}`
+    );
+    this.name = "RelayLoginError";
+    this.cause = cause;
+    this.relayUrl = relayUrl;
+    this.kind = kind;
+    this.loginStatus = loginStatusOf(cause);
+  }
+};
+function relayLoginFailureKind(cause) {
+  const status = loginStatusOf(cause);
+  return status === 401 || status === 403 ? "signed-out" : "unavailable";
+}
+function loginStatusOf(cause) {
+  const status = cause?.status;
+  return typeof status === "number" && Number.isFinite(status) ? status : void 0;
+}
+
 // src/errors/classify.ts
 var RETRYABLE = {
   invalid: false,
@@ -1149,6 +1180,11 @@ function messageOf(err, fallback = "Request failed") {
   return fallback;
 }
 function classifyError(err) {
+  if (err instanceof RelayLoginError) {
+    const status2 = err.loginStatus;
+    const kind2 = err.kind === "signed-out" ? "unauthorized" : status2 ? kindForStatus(status2) : "unreachable";
+    return { kind: kind2, status: status2, retryable: RETRYABLE[kind2], message: messageOf(err) };
+  }
   const status = statusOf(err);
   let kind;
   if (status !== void 0) {
@@ -1203,6 +1239,9 @@ function reasonFromMessage(message) {
 }
 var FINAL_FROM_TEXT = /* @__PURE__ */ new Set(["already-used", "removed"]);
 function classifyJoinFailure(err, message) {
+  if (err instanceof RelayLoginError) {
+    return { reason: err.kind === "signed-out" ? "signed-out" : "node-unreachable", retryable: true };
+  }
   const { kind, status } = classifyError(err);
   const fromText = reasonFromMessage(message);
   const code = refusalCodeOf(err);
@@ -9406,9 +9445,8 @@ function relaySession(s, nodeKey) {
         token = minted.accessToken;
         return token;
       }).catch((e) => {
-        console.warn("[mero-js] relay login failed", e);
         token = null;
-        return void 0;
+        throw new RelayLoginError(s.relayUrl, e);
       }).finally(() => {
         inflight = null;
       });
@@ -9570,24 +9608,53 @@ function knownRelays(s) {
   const all = [s.relayUrl, ...Object.values(map.namespaces), ...Object.values(map.contexts)].filter((u) => typeof u === "string" && u.length > 0).map(relayOrigin);
   return [...new Set(all)];
 }
+var RelaysUnavailableError = class extends Error {
+  constructor(failures) {
+    super(`none of this account's relays answered: ${failures.map((f) => `${f.relayUrl} (${f.kind})`).join(", ")}`);
+    this.failures = failures;
+    this.name = "RelaysUnavailableError";
+    this.relays = failures.map((f) => f.relayUrl);
+  }
+  /** Every relay refused its attestation: retrying will not help. */
+  get refused() {
+    return this.failures.every((f) => f.kind === "refused");
+  }
+};
+async function listingClient(s, relayUrl) {
+  const key = await attemptRelayNodeKey(relayUrl);
+  if (key.kind !== "learned") {
+    console.warn("[mero-js] could not learn the relay node key from its attestation", key.error);
+    return { failure: { relayUrl, kind: key.kind, error: key.error } };
+  }
+  const client2 = buildDelegatedClient({ ...s, relayUrl }, null);
+  if (!client2) return { failure: { relayUrl, kind: "unavailable", error: new Error(`no client for ${relayUrl}`) } };
+  return { client: client2 };
+}
 async function listDelegatedContexts(s) {
   const out = [];
   const map = readRelayMap(s.account);
-  for (const relayUrl of knownRelays(s)) {
+  const relays = knownRelays(s);
+  const failures = [];
+  for (const relayUrl of relays) {
+    const got = await listingClient(s, relayUrl);
+    if ("failure" in got) {
+      failures.push(got.failure);
+      continue;
+    }
+    const { client: client2 } = got;
     try {
-      if (!await resolveRelayNodeKey(relayUrl)) continue;
-      const client2 = buildDelegatedClient({ ...s, relayUrl }, null);
-      if (!client2) continue;
       const { contexts } = await client2.admin.getContexts();
       for (const c of contexts ?? []) {
         out.push({ ...c, relayUrl });
         map.contexts[c.id] = relayUrl;
       }
     } catch (e) {
+      failures.push({ relayUrl, kind: "unavailable", error: e });
       console.warn(`[mero-js] could not list contexts on ${relayUrl}`, e);
     }
   }
   writeRelayMap(s.account, map);
+  if (relays.length > 0 && failures.length === relays.length) throw new RelaysUnavailableError(failures);
   return out;
 }
 async function listDelegatedNamespaces(s) {
@@ -9595,11 +9662,16 @@ async function listDelegatedNamespaces(s) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   const map = readRelayMap(s.account);
-  for (const relayUrl of knownRelays(s)) {
+  const relays = knownRelays(s);
+  const failures = [];
+  for (const relayUrl of relays) {
+    const got = await listingClient(s, relayUrl);
+    if ("failure" in got) {
+      failures.push(got.failure);
+      continue;
+    }
+    const { client: client2 } = got;
     try {
-      if (!await resolveRelayNodeKey(relayUrl)) continue;
-      const client2 = buildDelegatedClient({ ...s, relayUrl }, null);
-      if (!client2) continue;
       for (const ns of await client2.admin.listNamespaces()) {
         if (seen.has(ns.namespaceId)) continue;
         seen.add(ns.namespaceId);
@@ -9607,10 +9679,12 @@ async function listDelegatedNamespaces(s) {
         (_a = map.namespaces)[_b = ns.namespaceId] ?? (_a[_b] = relayUrl);
       }
     } catch (e) {
+      failures.push({ relayUrl, kind: "unavailable", error: e });
       console.warn(`[mero-js] could not list namespaces on ${relayUrl}`, e);
     }
   }
   writeRelayMap(s.account, map);
+  if (relays.length > 0 && failures.length === relays.length) throw new RelaysUnavailableError(failures);
   return out;
 }
 
@@ -13129,10 +13203,13 @@ export {
   RELAY_NODE_KEY_RETRY_MS,
   REQUEST_PROOF_HEADER,
   RelayClient,
+  RelayLoginError,
   RelayNotDialableError,
   RelayObserver,
   RelayPresenceClient,
   RelayTransport,
+  RelaysUnavailableError,
+  RequestAuthError,
   RpcClient,
   RpcError,
   SEALED_CONTENT_TYPE,