@calimero-network/mero-js 26.5.0 → 26.7.0

package/dist/index.d.ts

@@ -28,8 +28,8 @@ export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 export type { Signer } from "./signer/index.js";
 export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, resolveRoot, resolveRootPair, } from "./account/index.js";
 export type { AccountRoot, RecoverableAccountRoot, AccountRootSigner, NewAccountRootSigner, AccountLinkInput, AccountLoginInput, RootSource, ResolvedRoot, } from "./account/index.js";
-export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, RelaysUnavailableError, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
-export type { DelegatedCredential, DelegatedAccountSession, RelayMap, RelayNodeKeyAttempt, RelayListingFailure, RelayResolutionStep, RelayResolutionFailure, ResolvedInvitationRelay, ResolveRelayResult, ResolveRelayFromInvitationInput, JoinWithNodeInput, JoinWithNodeResult, JoinWithNodeSuccess, JoinWithNodeFailure, JoinWithNodeStep, BootstrapStep, BootstrapResult, BootstrapSuccess, BootstrapFailure, BootstrapFromInvitationInput, CreateDelegatedContextRequest, FoundedDelegatedNamespace, RegistryBundle, ResolvedApplication, AccountAdminDeps, NodeAdminDeps, } from "./account/index.js";
+export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, RelaysUnavailableError, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, RelayLoginError, createNodeAdmin, } from "./account/index.js";
+export type { DelegatedCredential, DelegatedAccountSession, RelayMap, RelayNodeKeyAttempt, RelayLoginFailureKind, RelayListingFailure, RelayResolutionStep, RelayResolutionFailure, ResolvedInvitationRelay, ResolveRelayResult, ResolveRelayFromInvitationInput, JoinWithNodeInput, JoinWithNodeResult, JoinWithNodeSuccess, JoinWithNodeFailure, JoinWithNodeStep, BootstrapStep, BootstrapResult, BootstrapSuccess, BootstrapFailure, BootstrapFromInvitationInput, CreateDelegatedContextRequest, FoundedDelegatedNamespace, RegistryBundle, ResolvedApplication, AccountAdminDeps, NodeAdminDeps, } from "./account/index.js";
 export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
 export type { DeviceCertInput, DeviceCredential } from "./device-cert/index.js";
 export { signDeviceScope, deviceScopePayload } from "./device-cert/index.js";

package/dist/index.js

@@ -52,7 +52,7 @@ resolveRoot, resolveRootPair, } from "./account/index.js";
 // Framework-free; mero-react re-exports every one of these under the same name
 // (its `DelegatedSession` is `DelegatedAccountSession` here: the login module
 // already owns the bare name for the session `login()` mints).
-export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, RelaysUnavailableError, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, createNodeAdmin, } from "./account/index.js";
+export { readDelegatedSession, saveDelegatedSession, clearDelegatedSession, readDelegatedCredential, saveDelegatedCredential, clearDelegatedCredential, persistedNonces, markContextNonceSpent, pinRelayNodeKey, readPinnedRelayNodeKey, attemptRelayNodeKey, resolveRelayNodeKey, learnRelayNodeKey, RELAY_NODE_KEY_RETRY_MS, forgetMethodKinds, forgetRelaySealing, relayTransportFetch, buildDelegatedClient, readRelayMap, rememberRelay, relayForContext, carryExecutorAccount, knownRelays, listDelegatedContexts, listDelegatedNamespaces, RelaysUnavailableError, resolveRelayFromInvitation, normaliseAccount, joinWithNode, bootstrapFromInvitation, joinAsAccount, createDelegatedContext, createDelegatedPrivateContext, foundDelegatedNamespace, delegatedGovernance, latestPublishedVersion, HA_ACCOUNT_NOT_LINKED_MESSAGE, HA_REFUSAL_MESSAGES, governGroup, governRoot, namespaceOfGroup, rememberGroupNamespace, applicationIdForBundle, fetchRegistryBundles, resolveApplicationIdFromRegistry, selectLatestBundle, createAccountAdmin, InvitationNotClaimableError, NoRelayError, NotForAccountError, RelayLoginError, createNodeAdmin, } from "./account/index.js";
 export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, accountForRootPublicKey, parseDeviceCredential, verifyDeviceCredential, } from "./device-cert/index.js";
 // A device's scope — signed by the root beside its certificate, and what a relay
 // needs with it to bind the device of an account that has no node.

package/dist/index.mjs

@@ -317,6 +317,12 @@ var AuthRevokedError = class extends HTTPError {
     this.message = `Authentication revoked (${reason}): HTTP ${status} ${statusText}`;
   }
 };
+var RequestAuthError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.name = "RequestAuthError";
+  }
+};
 function headersToRecord(headers) {
   const record = {};
   headers.forEach((value, key) => {
@@ -644,6 +650,7 @@ var WebHttpClient = class {
           headers.Authorization = `Bearer ${token}`;
         }
       } catch (error) {
+        if (error instanceof RequestAuthError) throw error;
       }
     }
     if (initHeaders) {
@@ -1079,6 +1086,30 @@ function withoutCap(mask, cap) {
   return (mask & ~cap) >>> 0;
 }
 
+// src/account/relay-login-error.ts
+var RelayLoginError = class extends RequestAuthError {
+  constructor(relayUrl, cause) {
+    const kind = relayLoginFailureKind(cause);
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(
+      kind === "signed-out" ? `the relay ${relayUrl} refused this device's credential (${detail}); sign in again` : `could not log in to the relay ${relayUrl}: ${detail}`
+    );
+    this.name = "RelayLoginError";
+    this.cause = cause;
+    this.relayUrl = relayUrl;
+    this.kind = kind;
+    this.loginStatus = loginStatusOf(cause);
+  }
+};
+function relayLoginFailureKind(cause) {
+  const status = loginStatusOf(cause);
+  return status === 401 || status === 403 ? "signed-out" : "unavailable";
+}
+function loginStatusOf(cause) {
+  const status = cause?.status;
+  return typeof status === "number" && Number.isFinite(status) ? status : void 0;
+}
+
 // src/errors/classify.ts
 var RETRYABLE = {
   invalid: false,
@@ -1149,6 +1180,11 @@ function messageOf(err, fallback = "Request failed") {
   return fallback;
 }
 function classifyError(err) {
+  if (err instanceof RelayLoginError) {
+    const status2 = err.loginStatus;
+    const kind2 = err.kind === "signed-out" ? "unauthorized" : status2 ? kindForStatus(status2) : "unreachable";
+    return { kind: kind2, status: status2, retryable: RETRYABLE[kind2], message: messageOf(err) };
+  }
   const status = statusOf(err);
   let kind;
   if (status !== void 0) {
@@ -1203,6 +1239,9 @@ function reasonFromMessage(message) {
 }
 var FINAL_FROM_TEXT = /* @__PURE__ */ new Set(["already-used", "removed"]);
 function classifyJoinFailure(err, message) {
+  if (err instanceof RelayLoginError) {
+    return { reason: err.kind === "signed-out" ? "signed-out" : "node-unreachable", retryable: true };
+  }
   const { kind, status } = classifyError(err);
   const fromText = reasonFromMessage(message);
   const code = refusalCodeOf(err);
@@ -1793,6 +1832,21 @@ var AdminApiClient = class {
     }
     return data;
   }
+  /**
+   * Bring back a namespace the user removed from this node while the account
+   * stayed a member (POST /admin-api/namespaces/:namespace_id/join, no
+   * invitation). Such namespaces are the `forgotten` ones in
+   * {@link listNamespacesForApplication}.
+   */
+  async restoreNamespace(namespaceId) {
+    return unwrap(
+      await this.httpClient.post(
+        `/admin-api/namespaces/${pathSegment(namespaceId)}/join`,
+        {},
+        { timeoutMs: 65e3 }
+      )
+    );
+  }
   /**
    * Join the namespace an invitation grants, and say what happened — including
    * when the request failed but the join landed anyway.
@@ -2481,9 +2535,15 @@ var AdminApiClient = class {
   async leaveContext(contextId) {
     await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/leave`, {});
   }
-  /** Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave). */
-  async leaveNamespace(namespaceId) {
-    await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/leave`, {});
+  /**
+   * Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave).
+   *
+   * With `purge`, every device of the account also takes the namespace off its
+   * disk. Core reads `purge` from the query string, so it is not in the body.
+   */
+  async leaveNamespace(namespaceId, options = {}) {
+    const query = options.purge ? "?purge=true" : "";
+    await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/leave${query}`, {});
   }
   /** Issue a group ownership proof (POST /admin-api/groups/:group_id/issue-ownership-proof). */
   async issueOwnershipProof(groupId, request) {
@@ -9406,9 +9466,8 @@ function relaySession(s, nodeKey) {
         token = minted.accessToken;
         return token;
       }).catch((e) => {
-        console.warn("[mero-js] relay login failed", e);
         token = null;
-        return void 0;
+        throw new RelayLoginError(s.relayUrl, e);
       }).finally(() => {
         inflight = null;
       });
@@ -13165,11 +13224,13 @@ export {
   RELAY_NODE_KEY_RETRY_MS,
   REQUEST_PROOF_HEADER,
   RelayClient,
+  RelayLoginError,
   RelayNotDialableError,
   RelayObserver,
   RelayPresenceClient,
   RelayTransport,
   RelaysUnavailableError,
+  RequestAuthError,
   RpcClient,
   RpcError,
   SEALED_CONTENT_TYPE,