@calimero-network/mero-js 26.5.0 → 26.7.0

package/dist/account/index.d.ts

@@ -20,5 +20,7 @@ export { applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromR
 export type { RegistryBundle, ResolvedApplication } from './application-id.js';
 export { createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, } from './account-admin.js';
 export type { AccountAdminDeps } from './account-admin.js';
+export { RelayLoginError } from './relay-login-error.js';
+export type { RelayLoginFailureKind } from './relay-login-error.js';
 export { createNodeAdmin } from './node-admin.js';
 export type { NodeAdminDeps } from './node-admin.js';

package/dist/account/index.js

@@ -11,4 +11,5 @@ export { createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNa
 export { governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace } from './govern.js';
 export { applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, } from './application-id.js';
 export { createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, } from './account-admin.js';
+export { RelayLoginError } from './relay-login-error.js';
 export { createNodeAdmin } from './node-admin.js';

package/dist/account/relay-login-error.d.ts

@@ -0,0 +1,32 @@
+import { RequestAuthError } from '../http-client/web-client.js';
+/**
+ * Why a relay login failed, as far as it decides what the app does next.
+ *
+ * - `signed-out` — the relay answered and refused the credential (401 or 403):
+ *   it expired or was revoked, and signing in again is the way forward.
+ * - `unavailable` — the login never got an answer about the credential: the
+ *   relay could not be reached (DNS, TLS, offline, a timeout), or it failed
+ *   with a 5xx, or answered something else. Trying again later may work.
+ */
+export type RelayLoginFailureKind = 'signed-out' | 'unavailable';
+/**
+ * The relay session a request needed could not be minted.
+ *
+ * Thrown by the admin requests of a delegated client (`client.admin.*`) in
+ * place of sending them without a token, so the caller sees the login's own
+ * failure rather than the node's 401 for the unauthenticated request — or, for
+ * a relay that is down, the same transport error a second time. Nothing is
+ * remembered: the next request logs in again.
+ */
+export declare class RelayLoginError extends RequestAuthError {
+    name: string;
+    readonly relayUrl: string;
+    /** The login's own failure: an `HTTPError` (status 0 for no response) or what it threw. */
+    readonly cause: unknown;
+    readonly kind: RelayLoginFailureKind;
+    /** The HTTP status the login answered, 0 when no response arrived; undefined when not an HTTP failure. */
+    readonly loginStatus: number | undefined;
+    constructor(relayUrl: string, cause: unknown);
+}
+/** `signed-out` for a login answered 401/403, `unavailable` for anything else. */
+export declare function relayLoginFailureKind(cause: unknown): RelayLoginFailureKind;

package/dist/account/relay-login-error.js

@@ -0,0 +1,34 @@
+import { RequestAuthError } from '../http-client/web-client.js';
+/**
+ * The relay session a request needed could not be minted.
+ *
+ * Thrown by the admin requests of a delegated client (`client.admin.*`) in
+ * place of sending them without a token, so the caller sees the login's own
+ * failure rather than the node's 401 for the unauthenticated request — or, for
+ * a relay that is down, the same transport error a second time. Nothing is
+ * remembered: the next request logs in again.
+ */
+export class RelayLoginError extends RequestAuthError {
+    constructor(relayUrl, cause) {
+        const kind = relayLoginFailureKind(cause);
+        const detail = cause instanceof Error ? cause.message : String(cause);
+        super(kind === 'signed-out'
+            ? `the relay ${relayUrl} refused this device's credential (${detail}); sign in again`
+            : `could not log in to the relay ${relayUrl}: ${detail}`);
+        this.name = 'RelayLoginError';
+        this.cause = cause;
+        this.relayUrl = relayUrl;
+        this.kind = kind;
+        this.loginStatus = loginStatusOf(cause);
+    }
+}
+/** `signed-out` for a login answered 401/403, `unavailable` for anything else. */
+export function relayLoginFailureKind(cause) {
+    const status = loginStatusOf(cause);
+    return status === 401 || status === 403 ? 'signed-out' : 'unavailable';
+}
+/** The status a login failure carries (`HTTPError.status`), if any. */
+function loginStatusOf(cause) {
+    const status = cause?.status;
+    return typeof status === 'number' && Number.isFinite(status) ? status : undefined;
+}

package/dist/account/session.js

@@ -17,6 +17,7 @@ import { attestRelayNodeKey, } from '../relay-attestation/index.js';
 import { cloudNodeReleaseUrl, createAttestedSealedFetch, createSignedReleaseVerifier, DEFAULT_RELEASE_MIRROR, fetchNodeRelease, fetchNodeReleaseVersion, } from '../sealed/index.js';
 import { createMeroClient, defaultAudience, } from '../transport/index.js';
 import { login, } from '../login/index.js';
+import { RelayLoginError } from './relay-login-error.js';
 import { SseClient, } from '../events/index.js';
 /** Where the per-tab record lives. */
 const KEY = 'calimero.delegated.connection';
@@ -517,9 +518,12 @@ export function relayTransportFetch(relayUrl) {
  * A hosted relay's `/admin-api/` sits behind the node's forward-auth, which
  * knows no request proof — it answers a Bearer token or 401. Logging in with
  * the device certificate is how a keyholder gets that token. Minted on first
- * use and re-minted once it has expired. On failure it yields `undefined`, the
- * admin request then goes out unauthenticated and the node's 401 is what the
- * caller sees; the next call tries to log in again.
+ * use and re-minted once it has expired. On failure it throws a
+ * {@link RelayLoginError}, which the HTTP client lets through instead of sending
+ * the admin request unauthenticated: the caller sees why the login failed —
+ * `signed-out` for a refused credential, `unavailable` for a relay that did not
+ * answer — rather than the node's 401 or the same transport error twice.
+ * Nothing is cached on failure, so the next call tries to log in again.
  */
 function relaySession(s, nodeKey) {
     let token = null;
@@ -543,9 +547,8 @@ function relaySession(s, nodeKey) {
                 return token;
             })
                 .catch((e) => {
-                console.warn('[mero-js] relay login failed', e);
                 token = null;
-                return undefined;
+                throw new RelayLoginError(s.relayUrl, e);
             })
                 .finally(() => {
                 inflight = null;

package/dist/admin-api/admin-client.d.ts

@@ -219,6 +219,13 @@ export declare class AdminApiClient {
      */
     admitJoin(namespaceId: string, request: AdmitJoinRequest): Promise<AdmitJoinResponseData>;
     joinNamespace(namespaceId: string, request: JoinNamespaceRequest): Promise<JoinNamespaceResponseData>;
+    /**
+     * Bring back a namespace the user removed from this node while the account
+     * stayed a member (POST /admin-api/namespaces/:namespace_id/join, no
+     * invitation). Such namespaces are the `forgotten` ones in
+     * {@link listNamespacesForApplication}.
+     */
+    restoreNamespace(namespaceId: string): Promise<JoinNamespaceResponseData>;
     /**
      * Join the namespace an invitation grants, and say what happened — including
      * when the request failed but the join landed anyway.
@@ -623,8 +630,15 @@ export declare class AdminApiClient {
     leaveGroup(groupId: string): Promise<void>;
     /** Leave a context (POST /admin-api/contexts/:context_id/leave). */
     leaveContext(contextId: string): Promise<void>;
-    /** Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave). */
-    leaveNamespace(namespaceId: string): Promise<void>;
+    /**
+     * Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave).
+     *
+     * With `purge`, every device of the account also takes the namespace off its
+     * disk. Core reads `purge` from the query string, so it is not in the body.
+     */
+    leaveNamespace(namespaceId: string, options?: {
+        purge?: boolean;
+    }): Promise<void>;
     /** Issue a group ownership proof (POST /admin-api/groups/:group_id/issue-ownership-proof). */
     issueOwnershipProof(groupId: string, request: IssueOwnershipProofRequest): Promise<IssueOwnershipProofResponseData>;
     /** Issue a namespace ownership proof (POST /admin-api/groups/:group_id/issue-namespace-ownership-proof). */

package/dist/admin-api/admin-client.js

@@ -523,6 +523,15 @@ export class AdminApiClient {
         }
         return data;
     }
+    /**
+     * Bring back a namespace the user removed from this node while the account
+     * stayed a member (POST /admin-api/namespaces/:namespace_id/join, no
+     * invitation). Such namespaces are the `forgotten` ones in
+     * {@link listNamespacesForApplication}.
+     */
+    async restoreNamespace(namespaceId) {
+        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/join`, {}, { timeoutMs: 65000 }));
+    }
     /**
      * Join the namespace an invitation grants, and say what happened — including
      * when the request failed but the join landed anyway.
@@ -1137,9 +1146,15 @@ export class AdminApiClient {
     async leaveContext(contextId) {
         await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/leave`, {});
     }
-    /** Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave). */
-    async leaveNamespace(namespaceId) {
-        await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/leave`, {});
+    /**
+     * Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave).
+     *
+     * With `purge`, every device of the account also takes the namespace off its
+     * disk. Core reads `purge` from the query string, so it is not in the body.
+     */
+    async leaveNamespace(namespaceId, options = {}) {
+        const query = options.purge ? '?purge=true' : '';
+        await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/leave${query}`, {});
     }
     /** Issue a group ownership proof (POST /admin-api/groups/:group_id/issue-ownership-proof). */
     async issueOwnershipProof(groupId, request) {

package/dist/admin-api/admin-types.d.ts

@@ -377,6 +377,12 @@ export interface Namespace {
      * current on another. Absent when nothing is held, and on nodes that predate it.
      */
     heldOps?: NamespaceHeldOps;
+    /**
+     * The user removed this namespace from this node and the account is still a
+     * member. Set only by {@link AdminApiClient.listNamespacesForApplication};
+     * {@link AdminApiClient.restoreNamespace} brings it back.
+     */
+    forgotten?: boolean;
 }
 /** The group ops a namespace holds unapplied on the node that answered. */
 export interface NamespaceHeldOps {
@@ -669,6 +675,8 @@ export interface JoinNamespaceResponseData {
      * is how the caller addresses the member it just became.
      */
     memberAccount: string;
+    /** The name a restored namespace had when it was removed. Set only by a restore. */
+    name?: string;
 }
 export interface CreateGroupInNamespaceRequest {
     groupName?: string;

package/dist/admin-api/redeem-invitation.js

@@ -16,6 +16,7 @@
 // the request resolving, and the namespace being listed. Either one is enough,
 // which matters because either one can be missing.
 import { classifyError, messageOf } from '../errors/classify.js';
+import { RelayLoginError } from '../account/relay-login-error.js';
 /** Whether an outcome means the invitation is finished with. */
 export function isSettled(outcome) {
     return outcome.status !== 'failed' || !outcome.retryable;
@@ -111,6 +112,11 @@ const FINAL_FROM_TEXT = new Set(['already-used', 'removed']);
  * invitation, and a 404 is not specific enough to throw a link away on.
  */
 function classifyJoinFailure(err, message) {
+    // The join never left: the relay session it needed could not be minted. Says
+    // nothing about the invitation, which is kept for after a sign-in or a retry.
+    if (err instanceof RelayLoginError) {
+        return { reason: err.kind === 'signed-out' ? 'signed-out' : 'node-unreachable', retryable: true };
+    }
     const { kind, status } = classifyError(err);
     const fromText = reasonFromMessage(message);
     // A code is the node naming the refusal itself: nothing below can know better.

package/dist/errors/classify.js

@@ -1,16 +1,4 @@
-// ── What a failed request means, in terms a caller can act on ────────────────
-//
-// Core rc.56 onwards (calimero-network/core#4151 to #4164) answers a refused
-// admin request with the status that names the refusal: a malformed body is a
-// 400, a caller the node will not serve a 403, a missing resource a 404, a
-// state the request contradicts (an expired invitation, a removed member) a
-// 409, an oversized upload a 413, and a request the node cannot serve *yet*
-// (no member online to hand over a group key) a 503. Before that, every one of
-// them was a bare 500 and the only way to tell them apart was to match text.
-//
-// Every caller asks the same two questions of such an error: what kind of
-// failure is this, and would doing it again later help? This answers both once,
-// so apps stop keeping their own copies of the status table.
+import { RelayLoginError } from '../account/relay-login-error.js';
 const RETRYABLE = {
     invalid: false,
     // The session, not the request: signing in again and repeating it works.
@@ -106,6 +94,14 @@ export function messageOf(err, fallback = 'Request failed') {
  * own status-0 `HTTPError`.
  */
 export function classifyError(err) {
+    // A relay login that failed before the request was sent: its own status is
+    // about the login, so it is read by what it means for the request — a
+    // refused credential is this client's session, anything else the relay's.
+    if (err instanceof RelayLoginError) {
+        const status = err.loginStatus;
+        const kind = err.kind === 'signed-out' ? 'unauthorized' : status ? kindForStatus(status) : 'unreachable';
+        return { kind, status, retryable: RETRYABLE[kind], message: messageOf(err) };
+    }
     const status = statusOf(err);
     let kind;
     if (status !== undefined) {

package/dist/http-client/index.d.ts

@@ -1,6 +1,6 @@
 export * from './http-types.js';
 export * from './api-response.js';
-export { WebHttpClient, HTTPError, AuthRevokedError } from './web-client.js';
+export { WebHttpClient, HTTPError, AuthRevokedError, RequestAuthError } from './web-client.js';
 export { createHttpClient, createBrowserHttpClient, createNodeHttpClient, createUniversalHttpClient, } from './http-factory.js';
 export { withRetry, createRetryableMethod } from './retry.js';
 export type { RetryOptions } from './retry.js';

package/dist/http-client/index.js

@@ -2,7 +2,7 @@
 export * from './http-types.js';
 export * from './api-response.js';
 // Web Standards HTTP client implementation
-export { WebHttpClient, HTTPError, AuthRevokedError } from './web-client.js';
+export { WebHttpClient, HTTPError, AuthRevokedError, RequestAuthError } from './web-client.js';
 // Factory functions for easy client creation
 export { createHttpClient, createBrowserHttpClient, createNodeHttpClient, createUniversalHttpClient, } from './http-factory.js';
 // Retry functionality

package/dist/http-client/web-client.d.ts

@@ -36,6 +36,19 @@ export declare class AuthRevokedError extends HTTPError {
     /** Value of the `x-auth-error` header, e.g. `token_reuse` or `token_revoked`. */
     reason: string, status: number, statusText: string, url: string, headers: Headers, bodyText?: string);
 }
+/**
+ * A failure of a transport's `getAuthToken` that must stop the request.
+ *
+ * Any other error from `getAuthToken` is ignored and the request goes out
+ * without a token, which is right for a credential that is merely absent. This
+ * one says the credential could not be obtained at all — the login it needed
+ * was refused, or never reached the server — so sending the request anyway
+ * would only trade the real cause for the server's 401, or for the same
+ * transport error a second time. Thrown as is from the request.
+ */
+export declare class RequestAuthError extends Error {
+    name: string;
+}
 /** Whether `headers` carry a request proof, which must never follow a redirect. */
 export declare function carriesProof(headers: Record<string, string>): boolean;
 /**

package/dist/http-client/web-client.js

@@ -87,6 +87,22 @@ export class AuthRevokedError extends HTTPError {
         this.message = `Authentication revoked (${reason}): HTTP ${status} ${statusText}`;
     }
 }
+/**
+ * A failure of a transport's `getAuthToken` that must stop the request.
+ *
+ * Any other error from `getAuthToken` is ignored and the request goes out
+ * without a token, which is right for a credential that is merely absent. This
+ * one says the credential could not be obtained at all — the login it needed
+ * was refused, or never reached the server — so sending the request anyway
+ * would only trade the real cause for the server's 401, or for the same
+ * transport error a second time. Thrown as is from the request.
+ */
+export class RequestAuthError extends Error {
+    constructor() {
+        super(...arguments);
+        this.name = 'RequestAuthError';
+    }
+}
 // Helper function to convert Headers to Record
 function headersToRecord(headers) {
     const record = {};
@@ -477,7 +493,10 @@ export class WebHttpClient {
                 }
             }
             catch (error) {
-                // Ignore auth token errors
+                // A credential that could not be obtained stops the request; any other
+                // failure leaves it unauthenticated, as before.
+                if (error instanceof RequestAuthError)
+                    throw error;
             }
         }
         // Add init headers