@calimero-network/mero-js 27.0.2 → 27.2.0

package/dist/cloud-v2/client.js

@@ -11,9 +11,10 @@
  */
 import { SealedTransportError, createSealedFetch } from '../sealed/sealed.js';
 import { fetchAttestedKey } from './attestation.js';
-import { CalimeroError, ConfirmCancelled, ConfirmRequired, UnavailableError, errorFrom } from './errors.js';
+import { CalimeroError, ConfirmCancelled, ConfirmRequired, LoginRequired, UnavailableError, WrongNode, errorFrom, } from './errors.js';
 import { b64url, fromB64url } from './passkey.js';
-export { AppError, ArgsTooLarge, CalimeroError, ConfirmCancelled, ConfirmRequired, IdempotencyMismatch, LoginRequired, NotFound, TrapError, UnavailableError, errorFrom, } from './errors.js';
+import { pageQuery, pendingApprovalsFrom, } from './approvals.js';
+export { AppError, ArgsTooLarge, CalimeroError, ConfirmCancelled, ConfirmRequired, IdempotencyMismatch, LoginRequired, ConsentStale, NotFound, ReleaseDeadlineError, TrapError, UnavailableError, WrongNode, errorFrom, } from './errors.js';
 /** One URL path segment, so an id cannot reach another route. */
 function seg(value) {
     return encodeURIComponent(value);
@@ -102,11 +103,27 @@ export const DEFAULT_RETRY = { retries: 6, baseDelayMs: 200, maxDelayMs: 2000 };
 export function retryDelayMs(retry, options) {
     return Math.min(options.baseDelayMs * 2 ** retry, options.maxDelayMs);
 }
+/**
+ * The ceremonies that mint a session, which {@link CalimeroClient.send} never
+ * repeats by itself: a sign-in or sign-up is started again by its caller (with
+ * the passkey), and a refresh moves through the nodes in
+ * {@link CalimeroClient.exchangeRefresh}. A node answers them `421 WRONG_NODE`
+ * before it spends the challenge or the refresh token (core #4774).
+ */
+function ceremony(path) {
+    return path === 'auth/refresh' || path.startsWith('auth/passkey/');
+}
 export class CalimeroClient {
     constructor(options) {
+        /** The one in use: an index into {@link nodeUrls}. */
+        this.at = 0;
+        /** A sealed fetch per node, each attesting its own node on first use. */
+        this.channels = new Map();
         /** Rejections of the underlying `fetch` itself: the node could not be reached or dropped the connection. */
         this.networkFailures = new WeakSet();
-        this.base = options.baseUrl.replace(/\/+$/, '');
+        const trim = (url) => url.replace(/\/+$/, '');
+        this.nodeUrls = [...new Set([options.baseUrl, ...(options.nodes ?? [])].map(trim))];
+        this.policy = options.policy;
         this.retry = { ...DEFAULT_RETRY, ...options.retry };
         const given = options.fetch ?? ((input, init) => fetch(input, init));
         // `fetch` rejects with a `TypeError` when it gets no answer: the connection
@@ -124,11 +141,35 @@ export class CalimeroClient {
             }
         };
         this.raw = raw;
-        this.sealed = createSealedFetch({
-            baseUrl: this.base,
-            transportPublicKey: () => fetchAttestedKey(this.base, options.policy, raw),
-            fetch: raw,
-        });
+    }
+    /** The node requests go to now: `baseUrl`, until a `421 WRONG_NODE` moved the client on. */
+    get nodeUrl() {
+        return this.nodeUrls[this.at];
+    }
+    /** The sealed channel to `url`, attested under the client's policy before its first request. */
+    channel(url) {
+        let sealed = this.channels.get(url);
+        if (!sealed) {
+            sealed = createSealedFetch({
+                baseUrl: url,
+                transportPublicKey: () => fetchAttestedKey(url, this.policy, this.raw),
+                fetch: this.raw,
+            });
+            this.channels.set(url, sealed);
+        }
+        return sealed;
+    }
+    /**
+     * Move on from node `from` (the one that answered `421 WRONG_NODE`) to the
+     * next one. False when there is no other. A request that saw the same node
+     * refuse after another request moved on already does not move again.
+     */
+    moveOn(from) {
+        if (this.nodeUrls.length < 2)
+            return false;
+        if (this.at === from)
+            this.at = (from + 1) % this.nodeUrls.length;
+        return true;
     }
     /** Authenticate every request with an API key. */
     useApiKey(key) {
@@ -142,7 +183,11 @@ export class CalimeroClient {
     get session() {
         return this.current;
     }
-    async request(method, path, body, raw, contentType = 'application/wasm') {
+    /**
+     * Send one request to the node in use, with the credential held now, and
+     * answer the response, whatever its status. {@link send} judges it.
+     */
+    async request(method, path, body, raw, contentType = 'application/wasm', signal) {
         const headers = {};
         if (this.auth)
             headers.authorization = `Bearer ${this.auth}`;
@@ -155,17 +200,71 @@ export class CalimeroClient {
             headers['content-type'] = 'application/json';
             payload = JSON.stringify(body);
         }
+        const url = this.nodeUrl;
         try {
-            return await this.sealed(`${this.base}/${path}`, { method, headers, body: payload });
+            return await this.channel(url)(`${url}/${path}`, { method, headers, body: payload, signal });
         }
         catch (error) {
             throw sealedError(error);
         }
     }
+    /**
+     * {@link request}, answering what a lost issuing node or a node on the
+     * wrong release does to a session: a successful response, or the refusal as a
+     * typed error ({@link errorFrom}).
+     *
+     * - `401 UNAUTHENTICATED` to a request that carried a session: the node that
+     *   signed the session may be gone, replaced, or out of reach of the node
+     *   asked, which any node of the cluster answers with a refresh. The client
+     *   refreshes once, shared by every request that needs it at the same time
+     *   ({@link refresh}), and repeats the request once. A refresh that is
+     *   refused surfaces as {@link LoginRequired}.
+     * - `421 WRONG_NODE`: this node's release may not serve the account. The
+     *   client moves to the next node it knows and repeats the request once; with
+     *   none, the {@link WrongNode} reaches the caller.
+     *
+     * Repeating is safe even for a request that is not idempotent: the node
+     * answers `401` and `421` when it judges the credential, before it reads what
+     * the request asks, so the first attempt ran nothing. The exceptions are the
+     * ceremonies that mint a session ({@link ceremony}), never repeated here.
+     */
+    async send(method, path, body, raw, contentType, signal) {
+        let refreshed = false;
+        let moved = false;
+        for (;;) {
+            const [token, at] = [this.auth, this.at];
+            const response = await this.request(method, path, body, raw, contentType, signal);
+            if (response.ok)
+                return response;
+            const error = await refusal(response);
+            if (error instanceof WrongNode && !moved) {
+                moved = true;
+                if (this.moveOn(at) && !ceremony(path))
+                    continue;
+            }
+            else if (error instanceof LoginRequired && !refreshed && this.mayRefresh(token, path)) {
+                refreshed = true;
+                await this.renew(token);
+                continue;
+            }
+            throw error;
+        }
+    }
+    /** Whether a `401` to a request sent with `token` is one a refresh may answer. */
+    mayRefresh(token, path) {
+        return token !== undefined && this.current !== undefined && !ceremony(path);
+    }
+    /**
+     * A fresh session in place of the one `token` belonged to: by the refresh
+     * another request already made, or by one this request starts.
+     */
+    async renew(token) {
+        if (this.auth !== token)
+            return;
+        await this.refresh();
+    }
     async json(method, path, body, raw, contentType) {
-        const response = await this.request(method, path, body, raw, contentType);
-        if (!response.ok)
-            throw await refusal(response);
+        const response = await this.send(method, path, body, raw, contentType);
         const text = await response.text();
         return (text ? JSON.parse(text) : {});
     }
@@ -234,12 +333,44 @@ export class CalimeroClient {
         this.useSession(session);
         return session;
     }
-    /** Swap the refresh token for a new session. */
-    async refresh() {
-        if (!this.current)
+    /**
+     * Swap the refresh token for a new session, on whichever node the client
+     * uses: any node of the cluster takes it. A refresh token is used once, so
+     * calls made while one refresh is under way share it rather than sending the
+     * same token again (which would revoke the session).
+     */
+    refresh() {
+        if (!this.refreshing) {
+            const pending = this.exchangeRefresh();
+            this.refreshing = pending;
+            const clear = () => {
+                if (this.refreshing === pending)
+                    this.refreshing = undefined;
+            };
+            pending.then(clear, clear);
+        }
+        return this.refreshing;
+    }
+    async exchangeRefresh() {
+        const current = this.current;
+        if (!current)
             throw new Error('no session to refresh');
-        const session = await this.post('auth/refresh', { refreshToken: this.current.refreshToken });
-        this.useSession(session);
+        let session;
+        // A node that may not serve the account answers `421 WRONG_NODE` before it
+        // spends the refresh token (core #4774), so the same token goes to the next
+        // node (`send` moved there already): once per node, at most.
+        for (let tried = 1; session === undefined; tried++) {
+            try {
+                session = await this.post('auth/refresh', { refreshToken: current.refreshToken });
+            }
+            catch (error) {
+                if (!(error instanceof WrongNode) || tried >= this.nodeUrls.length)
+                    throw error;
+            }
+        }
+        // A sign-in or another session taken while this one was refreshing wins.
+        if (this.current === current)
+            this.useSession(session);
         return session;
     }
     async signOut() {
@@ -284,7 +415,7 @@ export class CalimeroClient {
      */
     async attestation() {
         const nonce = toHex(crypto.getRandomValues(new Uint8Array(32)));
-        const response = await this.raw(`${this.base}/attestation?nonce=${nonce}`);
+        const response = await this.raw(`${this.nodeUrl}/attestation?nonce=${nonce}`);
         if (!response.ok)
             throw await refusal(response);
         return (await response.json());
@@ -313,9 +444,7 @@ export class CalimeroClient {
     }
     /** One of `app`'s blobs, by id (base58 or hex). */
     async downloadBlob(app, id) {
-        const response = await this.request('GET', `apps/${seg(app)}/blobs/${seg(id)}`);
-        if (!response.ok)
-            throw await refusal(response);
+        const response = await this.send('GET', `apps/${seg(app)}/blobs/${seg(id)}`);
         return new Uint8Array(await response.arrayBuffer());
     }
     /** `app`'s blobs. */
@@ -399,8 +528,11 @@ export class CalimeroClient {
      * Move an app to another release of its package (`{ version }`), another
      * package, or a bundle hash, running its migration. Answers the upgrade's
      * entry; a failed migration rejects with code `UPGRADE_FAILED` (422).
-     * Where the owner holds app upgrades, the node asks for the owner's approval
-     * (`412 CONFIRM_REQUIRED`), which `passkey` gives.
+     * Where owners hold app upgrades, the node asks for the approval of
+     * whoever the package's manifest names (`412 CONFIRM_REQUIRED`), which
+     * `passkey` gives. Refused (`403`) to a session opened on an app's
+     * frontend: an app asks its user with {@link requestConsent} instead. Past
+     * a release deadline its approver has not met: {@link ReleaseDeadlineError}.
      */
     upgradeApp(app, target, passkey) {
         const path = `apps/${seg(app)}/upgrade`;
@@ -485,12 +617,7 @@ export class CalimeroClient {
     }
     /** A server-sent event stream on `path`, sealed like every other answer. */
     async *stream(path, signal) {
-        const headers = {};
-        if (this.auth)
-            headers.authorization = `Bearer ${this.auth}`;
-        const response = await this.sealed(`${this.base}/${path}`, { headers, signal });
-        if (!response.ok)
-            throw await refusal(response);
+        const response = await this.send('GET', path, undefined, undefined, undefined, signal);
         if (!response.body)
             throw new CalimeroError(response.status, 'EVENTS', 'the event stream has no body');
         yield* sseFrames(response.body);
@@ -578,8 +705,11 @@ export class CalimeroClient {
     /**
      * Approve a mero-tee release to hold the apps of `org`, or of this account
      * outside any organization (`org` `null`); `approved: false` withdraws it.
-     * Until then, nodes on that release get none of those apps' data. The owner
-     * approves with `passkey`.
+     * Until then, nodes on that release get none of those apps' data. For an
+     * organization, a member holding `APPROVE_RELEASES` approves with `passkey`;
+     * the node binds the release's measurements itself. Refused (`403`) to a
+     * session opened on an app's frontend: an app asks its user with
+     * {@link requestConsent} instead.
      */
     async approveRelease(org, version, passkey, approved = true) {
         const path = org === null ? 'auth/releases' : `orgs/${seg(org)}/releases`;
@@ -590,12 +720,148 @@ export class CalimeroClient {
      * `org`'s apps or this account's own (`org` `null`). `prefixes` `'manifest'`
      * (the default) approves every prefix the package's latest release declares;
      * `replace` sets exactly `prefixes`, which is how one is revoked. Approved
-     * with `passkey`.
+     * with `passkey`. Refused (`403`) to a session opened on an app's frontend:
+     * an app asks with {@link requestConsent} (`kind: 'outbound'`) instead.
      */
     async approveOutbound(org, pkg, passkey, options = {}) {
         const path = org === null ? 'auth/outbound' : `orgs/${seg(org)}/outbound`;
         return this.postConfirmed(path, { package: pkg, prefixes: options.prefixes ?? 'manifest', replace: options.replace ?? false }, passkey);
     }
+    // ---------------------------------------------------------------- approvals
+    /**
+     * One page of the report of a scope's apps: an organization's (any member;
+     * `404` to anyone else) or, with `org` `null`, the account's own outside any
+     * organization (a session bound to an app's frontend: that package's apps).
+     * The governance, the scope's approved releases, the releases the cluster's
+     * nodes run and whether each is approved, and per app its release, newer
+     * releases it may move to, last upgrade and replicas.
+     */
+    appsReport(org, page = {}) {
+        const path = org === null ? 'auth/apps' : `orgs/${seg(org)}/apps`;
+        return this.get(`${path}${pageQuery(page)}`);
+    }
+    /** {@link appsReport}, every page, with the apps of all of them in `apps`. */
+    async appsReportAll(org) {
+        const first = await this.appsReport(org);
+        const apps = [...first.apps];
+        let next = first.next;
+        while (next !== null) {
+            const page = await this.appsReport(org, { after: next });
+            apps.push(...page.apps);
+            next = page.next;
+        }
+        return { ...first, apps, next: null };
+    }
+    /** `GET /releases`: the cluster's governance and every release deadline. Public. */
+    releaseRules() {
+        return this.get('releases');
+    }
+    /**
+     * What waits for a decision in a scope (`org`, or the account's own apps
+     * with `null`): mero-tee releases the cluster's nodes run that the scope has
+     * not approved, apps with newer releases of their package, and whether a
+     * passed deadline stops new work. Read over the sealed channel; act on an
+     * item by sending the user to the consent page ({@link requestConsent},
+     * `releaseConsent`, `upgradeConsent`).
+     */
+    async pendingApprovals(org = null) {
+        const [report, rules] = await Promise.all([this.appsReportAll(org), this.releaseRules()]);
+        return pendingApprovalsFrom(report, rules);
+    }
+    /**
+     * Ask the node to ask the user: a release, upgrade or outbound approval
+     * that only the account holder may make, decided on the node's own consent
+     * page, never in the app. Needs a passkey session (a session bound to the
+     * app's frontend is fine). Send the person to the answer's `url`; the page
+     * sends them back to `returnTo?request_id=…&result=approved|declined`
+     * (`consentReturn`), and {@link consentResult} confirms the decision.
+     */
+    requestConsent(request) {
+        return this.post('consent/requests', request);
+    }
+    /**
+     * {@link requestConsent}, then send the browser to the consent page
+     * (`navigate`, by default `window.location.assign`). Answers the request
+     * once `navigate` returns: with a popup (`url => window.open(url)`), poll it
+     * with {@link waitForConsent}.
+     */
+    async openConsentPage(request, navigate = (url) => {
+        const w = globalThis.window;
+        if (!w)
+            throw new Error('no window to open the consent page in; pass `navigate`');
+        w.location.assign(url);
+    }) {
+        const started = await this.requestConsent(request);
+        navigate(started.url);
+        return started;
+    }
+    /** The decision on a consent request (any node answers, for the account that asked). */
+    consentResult(requestId) {
+        return this.get(`consent/${seg(requestId)}/result`);
+    }
+    /**
+     * Poll {@link consentResult} until the request is decided, every
+     * `intervalMs` (2 s), until `signal` aborts or `expiresAt` (Unix seconds)
+     * passes, when it answers the last `pending` result.
+     */
+    async waitForConsent(requestId, options = {}) {
+        const interval = options.intervalMs ?? 2000;
+        for (;;) {
+            const result = await this.consentResult(requestId);
+            if (result.status !== 'pending')
+                return result;
+            if (options.signal?.aborted)
+                return result;
+            if (options.expiresAt !== undefined && Date.now() / 1000 >= options.expiresAt)
+                return result;
+            await new Promise((resolve) => setTimeout(resolve, interval));
+        }
+    }
+    /** `GET /publishers/{signerId}`: the cluster name and binding generation a key signs to bind it next. */
+    publisherBinding(signerId) {
+        return this.get(`publishers/${seg(signerId)}`);
+    }
+    /**
+     * Bind a package signing key to `org`, which then approves the node images
+     * every instance of the key's packages runs on, and upgrades those whose
+     * package declares `upgrades: publisher`. `proof` is the key's signature
+     * over `publisherBindingMessage(cluster, org, signerId, generation)`; a
+     * member holding `APPROVE_RELEASES` sends it with `passkey`.
+     */
+    bindPublisher(org, proof, passkey) {
+        return this.postConfirmed(`orgs/${seg(org)}/publishers`, { ...proof }, passkey);
+    }
+    /**
+     * Upgrade every instance of `pkg` whose release declares `upgrades:
+     * publisher`, whoever owns it, as its publisher `org` (a
+     * `MANAGE_APPLICATION` holder there), with one passkey approval. Answers
+     * the run, kept on the publisher.
+     */
+    upgradePublished(org, pkg, target, passkey) {
+        return this.postConfirmed(`orgs/${seg(org)}/packages/${seg(pkg)}/upgrade`, { ...target }, passkey);
+    }
+    // ---------------------------------------------------------------- operator
+    /** `GET /ops/apps`: what every app runs, without names or accounts. Operator token (`useApiKey`). */
+    opsApps(page = {}) {
+        return this.get(`ops/apps${pageQuery(page)}`);
+    }
+    /** `GET /ops/orgs`: each organization's approved releases. Operator token. */
+    opsOrgs(page = {}) {
+        return this.get(`ops/orgs${pageQuery(page)}`);
+    }
+    /**
+     * Announce when work on images older than `version` ends: from `after` on,
+     * a scope that has not approved it (or newer) starts no new work. Operator
+     * token.
+     */
+    async setReleaseDeadline(version, after) {
+        const at = typeof after === 'string' ? after : after.toISOString();
+        await this.post(`ops/releases/${seg(version)}/deadline`, { after: at });
+    }
+    /** Lift a release's deadline. Operator token. */
+    async liftReleaseDeadline(version) {
+        await this.delete(`ops/releases/${seg(version)}/deadline`);
+    }
     /** Add a member, or change their role. */
     async setMember(org, account, role) {
         await this.post(`orgs/${seg(org)}/members`, { account, role });

package/dist/cloud-v2/errors.d.ts

@@ -19,10 +19,35 @@ export declare class CalimeroError extends Error {
     readonly details: Record<string, unknown>;
     constructor(status: number, code: string, message: string, details?: Record<string, unknown>);
 }
-/** `401 UNAUTHENTICATED`: sign in (again) and repeat the request. */
+/**
+ * `401 UNAUTHENTICATED` that refreshing could not answer: sign in (again) and
+ * repeat the request.
+ *
+ * A session token is signed by the node that issued it, and other nodes take
+ * it only while they can vouch for that node's signing key: a `401` often
+ * means only that the issuer was replaced or cannot be reached, not that the
+ * user signed out. The client answers that itself when it holds a refresh
+ * token: it refreshes once (any node takes the refresh) and repeats the
+ * request. This error reaches a caller when there is no refresh token (an API
+ * key, say), or the refresh was refused.
+ */
 export declare class LoginRequired extends CalimeroError {
     constructor(message: string, details?: Record<string, unknown>);
 }
+/**
+ * `421 WRONG_NODE`: this node runs a mero-tee release the account's owners have
+ * not approved, so it neither issues nor takes the account's sessions. Use
+ * another node of the cluster; refreshing here would not help.
+ *
+ * The client moves to the next node it was given (`nodes`) and repeats the
+ * request once by itself (a refresh: once per node). This error reaches a
+ * caller when it knows no other node, when the next one refused too (for a
+ * refresh, every node), or after a sign-in (which needs the passkey again:
+ * repeat it, and it goes to the next node).
+ */
+export declare class WrongNode extends CalimeroError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
 /**
  * `404 NOT_FOUND`: what the request names does not exist for this caller. For
  * an app this does not say whether it exists: an account the app does not
@@ -52,6 +77,29 @@ export declare class ArgsTooLarge extends CalimeroError {
 export declare class IdempotencyMismatch extends CalimeroError {
     constructor(message: string, details?: Record<string, unknown>);
 }
+/**
+ * `409 RELEASE_DEADLINE`: a mero-tee release's deadline has passed and the
+ * set that governs this work (the app's publisher's, or its owner's) has not
+ * approved it or a newer one, so new work (creating an app, installing a
+ * release, upgrading an app) is refused. Apps already running keep running.
+ * Approving `release` lifts it at once.
+ */
+export declare class ReleaseDeadlineError extends CalimeroError {
+    /** The release to approve. */
+    readonly release: string;
+    /** Its deadline, RFC 3339 (`''` when the node did not say). */
+    readonly after: string;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * `409 CONSENT_STALE`: what a consent page showed (the app's bundle, the
+ * target release, the release's measurements) changed before the person
+ * approved. Nothing was approved; ask for a new consent request so they see
+ * the new facts.
+ */
+export declare class ConsentStale extends CalimeroError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
 /**
  * `422 APP_ERROR`: the app refused the call. `appCode` is the app's declared
  * error (`Taken`, `Forbidden`, ...) and `fields` its named fields. The call was

package/dist/cloud-v2/errors.js

@@ -22,13 +22,41 @@ export class CalimeroError extends Error {
         this.name = 'CalimeroError';
     }
 }
-/** `401 UNAUTHENTICATED`: sign in (again) and repeat the request. */
+/**
+ * `401 UNAUTHENTICATED` that refreshing could not answer: sign in (again) and
+ * repeat the request.
+ *
+ * A session token is signed by the node that issued it, and other nodes take
+ * it only while they can vouch for that node's signing key: a `401` often
+ * means only that the issuer was replaced or cannot be reached, not that the
+ * user signed out. The client answers that itself when it holds a refresh
+ * token: it refreshes once (any node takes the refresh) and repeats the
+ * request. This error reaches a caller when there is no refresh token (an API
+ * key, say), or the refresh was refused.
+ */
 export class LoginRequired extends CalimeroError {
     constructor(message, details = {}) {
         super(401, 'UNAUTHENTICATED', message, details);
         this.name = 'LoginRequired';
     }
 }
+/**
+ * `421 WRONG_NODE`: this node runs a mero-tee release the account's owners have
+ * not approved, so it neither issues nor takes the account's sessions. Use
+ * another node of the cluster; refreshing here would not help.
+ *
+ * The client moves to the next node it was given (`nodes`) and repeats the
+ * request once by itself (a refresh: once per node). This error reaches a
+ * caller when it knows no other node, when the next one refused too (for a
+ * refresh, every node), or after a sign-in (which needs the passkey again:
+ * repeat it, and it goes to the next node).
+ */
+export class WrongNode extends CalimeroError {
+    constructor(message, details = {}) {
+        super(421, 'WRONG_NODE', message, details);
+        this.name = 'WrongNode';
+    }
+}
 /**
  * `404 NOT_FOUND`: what the request names does not exist for this caller. For
  * an app this does not say whether it exists: an account the app does not
@@ -73,6 +101,33 @@ export class IdempotencyMismatch extends CalimeroError {
         this.name = 'IdempotencyMismatch';
     }
 }
+/**
+ * `409 RELEASE_DEADLINE`: a mero-tee release's deadline has passed and the
+ * set that governs this work (the app's publisher's, or its owner's) has not
+ * approved it or a newer one, so new work (creating an app, installing a
+ * release, upgrading an app) is refused. Apps already running keep running.
+ * Approving `release` lifts it at once.
+ */
+export class ReleaseDeadlineError extends CalimeroError {
+    constructor(message, details = {}) {
+        super(409, 'RELEASE_DEADLINE', message, details);
+        this.name = 'ReleaseDeadlineError';
+        this.release = typeof details.release === 'string' ? details.release : '';
+        this.after = typeof details.after === 'string' ? details.after : '';
+    }
+}
+/**
+ * `409 CONSENT_STALE`: what a consent page showed (the app's bundle, the
+ * target release, the release's measurements) changed before the person
+ * approved. Nothing was approved; ask for a new consent request so they see
+ * the new facts.
+ */
+export class ConsentStale extends CalimeroError {
+    constructor(message, details = {}) {
+        super(409, 'CONSENT_STALE', message, details);
+        this.name = 'ConsentStale';
+    }
+}
 /**
  * `422 APP_ERROR`: the app refused the call. `appCode` is the app's declared
  * error (`Taken`, `Forbidden`, ...) and `fields` its named fields. The call was
@@ -147,10 +202,16 @@ export function errorFrom(status, body, retryAfterHeader) {
     switch (`${status} ${code}`) {
         case '401 UNAUTHENTICATED':
             return new LoginRequired(message, details);
+        case '421 WRONG_NODE':
+            return new WrongNode(message, details);
         case '404 NOT_FOUND':
             return new NotFound(message, details);
         case '409 IDEMPOTENCY_MISMATCH':
             return new IdempotencyMismatch(message, details);
+        case '409 RELEASE_DEADLINE':
+            return new ReleaseDeadlineError(message, details);
+        case '409 CONSENT_STALE':
+            return new ConsentStale(message, details);
         case '412 CONFIRM_REQUIRED':
             return new ConfirmRequired(message, details);
         case '413 ARGS_TOO_LARGE':

package/dist/cloud-v2/index.d.ts

@@ -1,10 +1,12 @@
 export { CalimeroClient } from './client.js';
-export { AppError, ArgsTooLarge, CalimeroError, ConfirmCancelled, ConfirmRequired, IdempotencyMismatch, LoginRequired, NotFound, TrapError, UnavailableError, errorFrom, } from './errors.js';
+export { AppError, ArgsTooLarge, CalimeroError, ConfirmCancelled, ConfirmRequired, IdempotencyMismatch, LoginRequired, ConsentStale, NotFound, ReleaseDeadlineError, TrapError, UnavailableError, WrongNode, errorFrom, } from './errors.js';
 export type { Committed } from './errors.js';
-export type { AppInfo, BlobInfo, CallResult, CalimeroClientOptions, CloudEvent, CalimeroSession, PackageInfo, PackageInstalled, CloudRetryOptions, OrgUpgradeTarget, PresenceEntry, UpgradeRun, ViewResult, } from './client.js';
+export type { AppInfo, BlobInfo, CallResult, CalimeroClientOptions, CloudEvent, CalimeroSession, PackageInfo, PackageInstalled, CloudRetryOptions, OrgInfo, OrgUpgradeTarget, PresenceEntry, UpgradeRun, ViewResult, } from './client.js';
 export { claimedRelease, fetchAttestedKey, MOCK_QUOTE_HEADER } from './attestation.js';
 export type { AttestationDoc, CloudPolicy, CloudReleasePolicy } from './attestation.js';
 export { browserPasskey, b64url, fromB64url } from './passkey.js';
 export type { AssertionJSON, PasskeyProvider, RegistrationJSON } from './passkey.js';
+export { MAX_REPORT_PAGE, RELEASE_VERIFIER, compareVersions, consentReturn, pageQuery, pendingApprovalsFrom, publisherBindingBytes, publisherBindingMessage, releaseConsent, releaseNotesUrl, stalledBy, upgradeConsent, verifyReleaseUrl, withdrawConsent, } from './approvals.js';
+export type { ActorKind, AppsReport, Authority, ClusterRelease, ConsentReleaseModel, ConsentRequest, ConsentResult, ConsentScope, ConsentStarted, ConsentStatus, Governance, LastUpgrade, OpsAppsReport, OpsOrgsReport, PageOptions, PendingApprovals, PendingRelease, PendingUpgrade, PublisherBindingInfo, PublisherProof, ReleaseDeadline, ReleaseRules, ReportScope, ReportedApp, ReportedBundle, ReportedRelease, ReportedReplica, UpgradeAuthority, } from './approvals.js';
 export { DEFAULT_ORG_CAPABILITIES, ORG_CAPABILITIES, orgCapabilities } from './capabilities.js';
 export type { OrgCapability } from './capabilities.js';

package/dist/cloud-v2/index.js

@@ -1,5 +1,6 @@
 export { CalimeroClient } from './client.js';
-export { AppError, ArgsTooLarge, CalimeroError, ConfirmCancelled, ConfirmRequired, IdempotencyMismatch, LoginRequired, NotFound, TrapError, UnavailableError, errorFrom, } from './errors.js';
+export { AppError, ArgsTooLarge, CalimeroError, ConfirmCancelled, ConfirmRequired, IdempotencyMismatch, LoginRequired, ConsentStale, NotFound, ReleaseDeadlineError, TrapError, UnavailableError, WrongNode, errorFrom, } from './errors.js';
 export { claimedRelease, fetchAttestedKey, MOCK_QUOTE_HEADER } from './attestation.js';
 export { browserPasskey, b64url, fromB64url } from './passkey.js';
+export { MAX_REPORT_PAGE, RELEASE_VERIFIER, compareVersions, consentReturn, pageQuery, pendingApprovalsFrom, publisherBindingBytes, publisherBindingMessage, releaseConsent, releaseNotesUrl, stalledBy, upgradeConsent, verifyReleaseUrl, withdrawConsent, } from './approvals.js';
 export { DEFAULT_ORG_CAPABILITIES, ORG_CAPABILITIES, orgCapabilities } from './capabilities.js';