@calimero-network/mero-js 29.4.0 → 29.6.0

package/dist/index.cjs

@@ -37,6 +37,7 @@ __export(index_exports, {
   BadOrigin: () => BadOrigin,
   CalimeroClient: () => CalimeroClient,
   CalimeroError: () => CalimeroError,
+  ClusterNotUpgraded: () => ClusterNotUpgraded,
   ConfirmCancelled: () => ConfirmCancelled,
   ConfirmRequired: () => ConfirmRequired,
   ConsentStale: () => ConsentStale,
@@ -55,6 +56,7 @@ __export(index_exports, {
   MOCK_QUOTE_HEADER: () => MOCK_QUOTE_HEADER,
   NODE_RELEASE_SIGNER: () => NODE_RELEASE_SIGNER,
   NotFound: () => NotFound,
+  NotServing: () => NotServing,
   ORG_CAPABILITIES: () => ORG_CAPABILITIES,
   OriginNotRegistered: () => OriginNotRegistered,
   OriginTaken: () => OriginTaken,
@@ -62,6 +64,7 @@ __export(index_exports, {
   QuotaExceeded: () => QuotaExceeded,
   RECOVERY_DOMAIN: () => RECOVERY_DOMAIN,
   RELEASE_VERIFIER: () => RELEASE_VERIFIER,
+  RecoveryNotReady: () => RecoveryNotReady,
   ReleaseDeadlineError: () => ReleaseDeadlineError,
   SEALED_CONTENT_TYPE: () => SEALED_CONTENT_TYPE,
   SEALED_PATH: () => SEALED_PATH,
@@ -71,6 +74,7 @@ __export(index_exports, {
   TrapError: () => TrapError,
   UnavailableError: () => UnavailableError,
   WrongNode: () => WrongNode,
+  WrongRecoveryCode: () => WrongRecoveryCode,
   agentKeyBinding: () => agentKeyBinding,
   agentQuoteVerifier: () => agentQuoteVerifier,
   attestAgent: () => attestAgent,
@@ -1545,6 +1549,31 @@ var OriginTaken = class extends CalimeroError {
     this.name = "OriginTaken";
   }
 };
+var NotServing = class extends CalimeroError {
+  constructor(message, details = {}) {
+    super(400, "NOT_SERVING", message, details);
+    this.name = "NotServing";
+  }
+};
+var ClusterNotUpgraded = class extends CalimeroError {
+  constructor(message, details = {}) {
+    super(409, "CLUSTER_NOT_UPGRADED", message, details);
+    this.name = "ClusterNotUpgraded";
+  }
+};
+var RecoveryNotReady = class extends CalimeroError {
+  constructor(message, details = {}) {
+    super(409, "RECOVERY_NOT_READY", message, details);
+    this.name = "RecoveryNotReady";
+    this.readyAt = typeof details.readyAt === "number" ? details.readyAt : void 0;
+  }
+};
+var WrongRecoveryCode = class extends CalimeroError {
+  constructor(message, details = {}) {
+    super(401, "UNAUTHENTICATED", message || "unknown or used recovery code", details);
+    this.name = "WrongRecoveryCode";
+  }
+};
 var SignUpRefused = class extends CalimeroError {
   constructor(message, details = {}) {
     super(403, "SIGN_UP_REFUSED", message, details);
@@ -1632,8 +1661,14 @@ function errorFrom(status, body, retryAfterHeader) {
       return new BadOrigin(code, message, details);
     case "409 ORIGIN_TAKEN":
       return new OriginTaken(message, details);
+    case "400 NOT_SERVING":
+      return new NotServing(message, details);
+    case "409 CLUSTER_NOT_UPGRADED":
+      return new ClusterNotUpgraded(message, details);
     case "429 QUOTA_EXCEEDED":
       return new QuotaExceeded(message, details);
+    case "409 RECOVERY_NOT_READY":
+      return new RecoveryNotReady(message, details);
     case "403 SIGN_UP_REFUSED":
       return new SignUpRefused(message, details);
     case "412 CONFIRM_REQUIRED":
@@ -1980,8 +2015,9 @@ function retryDelayMs(retry, options) {
   return Math.min(options.baseDelayMs * 2 ** retry, options.maxDelayMs);
 }
 function ceremony(path) {
-  return path === "auth/refresh" || path.startsWith("auth/passkey/");
+  return path === "auth/refresh" || path.startsWith("auth/passkey/") || RECOVERY_CEREMONIES.has(path);
 }
+var RECOVERY_CEREMONIES = /* @__PURE__ */ new Set(["auth/recovery/begin", "auth/recovery/start", "auth/recovery/finish"]);
 var CalimeroClient = class _CalimeroClient {
   constructor(options) {
     /** The one in use: an index into {@link nodeUrls}. */
@@ -2004,7 +2040,13 @@ var CalimeroClient = class _CalimeroClient {
       add: (pkg, origin, passkey, options = {}) => this.confirmed(
         "POST",
         `package-origins/${seg(pkg)}`,
-        options.rpId === void 0 ? { origin } : { origin, rpId: options.rpId },
+        // Only the fields set: the node refuses unknown ones, and one that
+        // predates served origins takes a plain add unchanged.
+        {
+          origin,
+          ...options.rpId === void 0 ? {} : { rpId: options.rpId },
+          ...options.served ? { served: true } : {}
+        },
         passkey
       ),
       remove: (pkg, origin, passkey) => this.confirmed("DELETE", `package-origins/${seg(pkg)}`, { origin }, passkey)
@@ -2416,6 +2458,71 @@ var CalimeroClient = class _CalimeroClient {
   async labelPasskey(credentialId, label) {
     await this.post(`auth/passkeys/${seg(credentialId)}`, { label });
   }
+  // ---------------------------------------------------------------- account recovery
+  //
+  // core #4844 (`docs/specs/account-recovery.md`): a recovery code, made with
+  // a passkey and shown once, lets someone who lost every passkey register a
+  // new one; it is added, and the account signed in, 72 hours later unless a
+  // passkey the account still has cancels it first.
+  /**
+   * Make the account's recovery code (replacing any it had), approved with
+   * `passkey` (`412 CONFIRM_REQUIRED`). Answers the code, once: show it to
+   * the person to keep offline; the node keeps only its public key. A passkey
+   * session on the cluster's own origin only (never an API key or a
+   * package-bound session).
+   */
+  async createRecoveryCode(passkey) {
+    const { code } = await this.postConfirmed("auth/recovery", {}, passkey);
+    return code;
+  }
+  /** Remove the account's recovery code, approved with `passkey`. */
+  async removeRecoveryCode(passkey) {
+    await this.deleteConfirmed("auth/recovery", passkey);
+  }
+  /**
+   * Signed out: start recovering the account `code` names. `passkey` makes a
+   * new passkey for it (the browser's create prompt, user verified); the
+   * node spends the code and keeps the passkey as pending. Nothing is added
+   * and no session opens: finish with {@link finishAccountRecovery} at
+   * `readyAt`. A code the cluster does not hold (mistyped, replaced or
+   * spent) is {@link WrongRecoveryCode}; an account with a recovery already
+   * under way `409 RECOVERY_PENDING`.
+   */
+  async startAccountRecovery(code, passkey) {
+    try {
+      const begin = await this.post("auth/recovery/begin", { code });
+      const registration = await passkey.create(begin.options);
+      return await this.post("auth/recovery/start", { challengeId: begin.challengeId, code, registration });
+    } catch (error) {
+      if (error instanceof LoginRequired) throw new WrongRecoveryCode(error.message.replace(/^401 UNAUTHENTICATED: /, ""), error.details);
+      throw error;
+    }
+  }
+  /**
+   * Cancel the recovery of the signed-in account under way, approved with
+   * `passkey` (one the account already has). The code stays spent: make a
+   * new one.
+   */
+  async cancelAccountRecovery(passkey) {
+    await this.postConfirmed("auth/recovery/cancel", {}, passkey);
+  }
+  /**
+   * Signed out, once the delay passed: finish the recovery with the passkey
+   * it registered (`passkey` signs the node's sign-in challenge). The passkey
+   * joins the account, every other session of the account ends, and this
+   * client is signed in. `accountId` (from the start) lets the node refuse
+   * early and offer only that passkey; before `readyAt` it is
+   * {@link RecoveryNotReady}, with no recovery under way {@link NotFound}.
+   */
+  async finishAccountRecovery(passkey, accountId) {
+    const session = await this.postConfirmed(
+      "auth/recovery/finish",
+      accountId ? { accountId } : {},
+      passkey
+    );
+    this.useSession(session);
+    return session;
+  }
   /** What this account uses (apps, bundle bytes, API keys, owned orgs), with the cluster's quotas. */
   usage() {
     return this.get("auth/usage");
@@ -2975,6 +3082,14 @@ var CalimeroClient = class _CalimeroClient {
   opsOrgs(page = {}) {
     return this.get(`ops/orgs${pageQuery(page)}`);
   }
+  /**
+   * `GET /ops/served-origins`: every served origin (custom domain) the
+   * cluster's log holds, with its package's label and no package name or
+   * account. Operator token.
+   */
+  opsServedOrigins() {
+    return this.get("ops/served-origins");
+  }
   /**
    * Announce when work on images older than `version` ends: from `after` on,
    * a scope that has not approved it (or newer) starts no new work. Operator