@calimero-network/mero-js 15.0.0 → 15.2.0

package/dist/admin-api/admin-client.d.ts

@@ -1,5 +1,5 @@
 import { HttpClient } from '../http-client/index.js';
-import type { HealthStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextRequest, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceRequest, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, GroupInfoResponseData, DeleteGroupRequest, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupRequest, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, CascadeStatusEntry, RetryGroupUpgradeRequest, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, DetachContextFromGroupRequest, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData } from './admin-types.js';
+import type { HealthStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextRequest, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceRequest, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, GroupInfoResponseData, DeleteGroupRequest, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupRequest, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, CascadeStatusEntry, RetryGroupUpgradeRequest, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, DetachContextFromGroupRequest, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData, AdmitJoinRequest, AdmitJoinResponseData } from './admin-types.js';
 /**
  * Compare two version strings by SemVer 2.0 precedence, ascending: negative if
  * `a < b`, positive if `a > b`, `0` if equal. Build metadata (`+...`) is stripped
@@ -159,6 +159,24 @@ export declare class AdminApiClient {
     createNamespace(request: CreateNamespaceRequest): Promise<CreateNamespaceResponseData>;
     deleteNamespace(namespaceId: string, request?: DeleteNamespaceRequest): Promise<DeleteNamespaceResponseData>;
     createNamespaceInvitation(namespaceId: string, request?: CreateNamespaceInvitationRequest): Promise<CreateNamespaceInvitationResponseData | CreateRecursiveInvitationResponseData>;
+    /**
+     * Present a join this caller signed to a node the inviter named as an
+     * admitter.
+     *
+     * For a member with no node. `joinNamespace` publishes the membership op from
+     * the node making the call; this hands an already-signed op to somebody else's
+     * node to publish. The distinction matters because a keyholder has nowhere to
+     * publish from.
+     *
+     * The op must be signed by the **device key** in the credential it carries —
+     * every peer checks that when applying a join. So the admitter cannot author
+     * this, only carry it: a hostile one can refuse, and nothing else. It cannot
+     * admit a different account, change the group, or grant a role.
+     *
+     * @param namespaceId the namespace being joined, 64 hex
+     * @param request the invitation and the hex-encoded signed op
+     */
+    admitJoin(namespaceId: string, request: AdmitJoinRequest): Promise<AdmitJoinResponseData>;
     joinNamespace(namespaceId: string, request: JoinNamespaceRequest): Promise<JoinNamespaceResponseData>;
     createGroupInNamespace(namespaceId: string, request?: CreateGroupInNamespaceRequest): Promise<CreateGroupInNamespaceResponseData>;
     listNamespaceGroups(namespaceId: string): Promise<SubgroupEntry[]>;

package/dist/admin-api/admin-client.js

@@ -466,6 +466,26 @@ export class AdminApiClient {
     async createNamespaceInvitation(namespaceId, request) {
         return unwrap(await this.httpClient.post(`/admin-api/namespaces/${namespaceId}/invite`, request ?? {}));
     }
+    /**
+     * Present a join this caller signed to a node the inviter named as an
+     * admitter.
+     *
+     * For a member with no node. `joinNamespace` publishes the membership op from
+     * the node making the call; this hands an already-signed op to somebody else's
+     * node to publish. The distinction matters because a keyholder has nowhere to
+     * publish from.
+     *
+     * The op must be signed by the **device key** in the credential it carries —
+     * every peer checks that when applying a join. So the admitter cannot author
+     * this, only carry it: a hostile one can refuse, and nothing else. It cannot
+     * admit a different account, change the group, or grant a role.
+     *
+     * @param namespaceId the namespace being joined, 64 hex
+     * @param request the invitation and the hex-encoded signed op
+     */
+    async admitJoin(namespaceId, request) {
+        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${namespaceId}/admit`, request, { timeoutMs: 65000 }));
+    }
     async joinNamespace(namespaceId, request) {
         const data = unwrap(await this.httpClient.post(`/admin-api/namespaces/${namespaceId}/join`, request, { timeoutMs: 65000 }));
         // core 0.11.0-rc.25 renamed this response's `groupId` to `namespaceId`

package/dist/admin-api/admin-types.d.ts

@@ -240,6 +240,18 @@ export interface GroupInvitationFromAdmin {
     /** Per-invitation nonce; core keeps the legacy `secret_salt` wire name. */
     readonly secret_salt: number[];
     readonly invited_role: number;
+    /**
+     * Accounts permitted to admit a claim of this invitation, 64 hex characters
+     * each — the same spelling every other account-addressing field uses.
+     *
+     * Empty means admission by broadcast: the joiner announces itself on the
+     * namespace topic and any ready peer answers — which publishes the invitation
+     * to every subscriber of that topic. Naming admitters keeps it off the topic,
+     * and the joiner presents it to one of them directly.
+     *
+     * Inside the inviter's signature, so it cannot be redirected.
+     */
+    readonly admitters?: readonly string[];
 }
 /**
  * An invitation blob the node signed. **Opaque: pass it through unchanged.**
@@ -260,6 +272,22 @@ export interface GroupInvitationFromAdmin {
 export interface SignedGroupOpenInvitation {
     readonly invitation: GroupInvitationFromAdmin;
     readonly inviter_signature: string;
+    /**
+     * Where to reach the accounts in {@link GroupInvitationFromAdmin.admitters}.
+     *
+     * Outside the signature, like the other bootstrap hints: an account is reached
+     * through a peer id, and a joiner that has synced nothing cannot resolve one.
+     * A wrong hint costs a failed connection — the admitting node still has to be
+     * in the signed list for its admission to count.
+     *
+     * `{ multiaddr }` for a joiner that runs a node, `{ url }` for one that holds
+     * only a key and reaches the admin API over HTTPS.
+     */
+    readonly admitter_hints?: ReadonlyArray<{
+        readonly multiaddr: string;
+    } | {
+        readonly url: string;
+    }>;
     /**
      * The account the inviter acts as, as 64 hex characters — not the
      * `inviter_identity` key inside the signed body is written in. Governance
@@ -798,6 +826,18 @@ export interface CreateGroupInvitationRequest {
     requester?: string;
     expirationTimestamp?: number;
     recursive?: boolean;
+    /**
+     * Accounts permitted to admit a claim of this invitation, 64 hex each.
+     *
+     * Omitted or empty leaves admission open to broadcast, which publishes the
+     * invitation to every subscriber of the namespace topic. Naming admitters
+     * keeps it off the topic: the joiner presents the claim to one of them and
+     * every other peer refuses to answer for it.
+     *
+     * Core signs this list into the invitation, so it cannot be redirected after
+     * the fact.
+     */
+    admitters?: string[];
 }
 export interface CreateGroupInvitationResponseData {
     invitation: SignedGroupOpenInvitation;
@@ -884,3 +924,26 @@ export interface AdminApiClientConfig {
     getAuthToken?: () => Promise<string | undefined>;
     timeoutMs?: number;
 }
+/** A join signed by its subject, handed to an admitter to publish. */
+export interface AdmitJoinRequest {
+    /** The invitation being claimed. Must name the admitter in `admitters`. */
+    readonly invitation: SignedGroupOpenInvitation;
+    /**
+     * The signed `SignedNamespaceOp`, borsh-encoded and hex.
+     *
+     * Signed by the joiner's device key, which is what stops an admitter
+     * substituting a different member: peers check the op's signer against the
+     * credential the op carries.
+     */
+    readonly signedOp: string;
+}
+/** What the admitter did with it. */
+export interface AdmitJoinResponseData {
+    /**
+     * Whether the op reached the namespace topic.
+     *
+     * Not "joined" — membership lands when peers apply the op, which the admitter
+     * neither performs nor waits for.
+     */
+    readonly published: boolean;
+}

package/dist/crypto/internal.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Byte-level primitives shared by everything in this package that signs.
+ *
+ * Extracted from `warrant/warrant.ts` when the device-cert signer arrived and
+ * needed the same `domainHash`, hex handling and ed25519 import. Keeping one
+ * copy is the point: these have to stay byte-identical with core, and two
+ * copies drifting apart is exactly the failure the byte-parity e2e exists to
+ * catch. Internal — not exported from the package root.
+ */
+/** Little-endian u32, for borsh fixed-width fields and epoch counters. */
+export declare function u32le(value: number): Uint8Array;
+export declare function hex(bytes: Uint8Array): string;
+export declare function fromHex(value: string, label: string, expectedBytes: number): Uint8Array;
+export declare function u64le(value: number | bigint): Uint8Array;
+export declare function concat(...parts: Uint8Array[]): Uint8Array;
+/**
+ * core's `domain_hash`: SHA-256 over the length-prefixed domain, then each
+ * length-prefixed part. The lengths are what stop two different field splits from
+ * hashing alike.
+ */
+export declare function domainHash(domain: Uint8Array, parts: Uint8Array[]): Promise<Uint8Array>;
+export declare function importSigningKey(secretHex: string): Promise<CryptoKey>;
+/**
+ * The public half of an ed25519 seed.
+ *
+ * Derived rather than taken as an argument, for the reason core does the same: a
+ * caller able to name a key it does not hold could produce a warrant it cannot
+ * sign, and the field would stop meaning "who authorised this".
+ */
+export declare function derivePublicKey(secretHex: string): Promise<Uint8Array>;

package/dist/crypto/internal.js

@@ -0,0 +1,93 @@
+/**
+ * Byte-level primitives shared by everything in this package that signs.
+ *
+ * Extracted from `warrant/warrant.ts` when the device-cert signer arrived and
+ * needed the same `domainHash`, hex handling and ed25519 import. Keeping one
+ * copy is the point: these have to stay byte-identical with core, and two
+ * copies drifting apart is exactly the failure the byte-parity e2e exists to
+ * catch. Internal — not exported from the package root.
+ */
+const PKCS8_ED25519_PREFIX = new Uint8Array([
+    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04,
+    0x22, 0x04, 0x20,
+]);
+/** Little-endian u32, for borsh fixed-width fields and epoch counters. */
+export function u32le(value) {
+    const out = new Uint8Array(4);
+    new DataView(out.buffer).setUint32(0, value, true);
+    return out;
+}
+export function hex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+export function fromHex(value, label, expectedBytes) {
+    const clean = value.trim();
+    if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length !== expectedBytes * 2) {
+        throw new Error(`${label} must be ${expectedBytes * 2} hex characters, got ${clean.length}`);
+    }
+    // Indexed rather than `match(/../g)!`: the length is already validated above,
+    // so the assertion would only be telling the compiler what the guard proved,
+    // and this needs no assertion at all.
+    const bytes = new Uint8Array(expectedBytes);
+    for (let i = 0; i < expectedBytes; i += 1) {
+        bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+export function u64le(value) {
+    const out = new Uint8Array(8);
+    new DataView(out.buffer).setBigUint64(0, BigInt(value), true);
+    return out;
+}
+export function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((total, p) => total + p.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+/**
+ * core's `domain_hash`: SHA-256 over the length-prefixed domain, then each
+ * length-prefixed part. The lengths are what stop two different field splits from
+ * hashing alike.
+ */
+export async function domainHash(domain, parts) {
+    const chunks = [u64le(domain.length), domain];
+    for (const part of parts) {
+        chunks.push(u64le(part.length), part);
+    }
+    return new Uint8Array(await crypto.subtle.digest('SHA-256', concat(...chunks)));
+}
+export async function importSigningKey(secretHex) {
+    const seed = fromHex(secretHex, 'deviceSecret', 32);
+    const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
+    try {
+        return await crypto.subtle.importKey('pkcs8', pkcs8, { name: 'Ed25519' }, false, ['sign']);
+    }
+    catch (cause) {
+        // The original message is folded in rather than passed as `cause`: this
+        // package targets ES2020, where `Error` has no `cause` option.
+        const detail = cause instanceof Error ? `: ${cause.message}` : '';
+        throw new Error('this runtime has no WebCrypto Ed25519, so a warrant cannot be signed ' +
+            'here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it; ' +
+            'otherwise mint the warrant with `merod account warrant`' +
+            detail);
+    }
+}
+/**
+ * The public half of an ed25519 seed.
+ *
+ * Derived rather than taken as an argument, for the reason core does the same: a
+ * caller able to name a key it does not hold could produce a warrant it cannot
+ * sign, and the field would stop meaning "who authorised this".
+ */
+export async function derivePublicKey(secretHex) {
+    const seed = fromHex(secretHex, 'deviceSecret', 32);
+    const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
+    const key = await crypto.subtle.importKey('pkcs8', pkcs8, { name: 'Ed25519' }, true, ['sign']);
+    const jwk = await crypto.subtle.exportKey('jwk', key);
+    const raw = jwk.x;
+    return Uint8Array.from(atob(raw.replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0));
+}

package/dist/device-cert/device-cert.d.ts

@@ -0,0 +1,68 @@
+/** What a root certifies about one device. */
+export interface DeviceCertInput {
+    /** The account root's signing secret, 64 hex. Signs the certificate. */
+    rootSecret: string;
+    /** The device being certified, 64 hex — see {@link mintDeviceId}. */
+    device: string;
+    /** The key that device signs with, 64 hex. */
+    signPublicKey: string;
+    /** The key the group key is delivered to, 64 hex (X25519). */
+    kemPublicKey: string;
+    /**
+     * Must strictly exceed any epoch already folded for this device.
+     *
+     * The projection refuses a link that does not advance it, so a re-issued
+     * certificate reusing an epoch is inert rather than a rollback.
+     */
+    deviceEpoch: number;
+}
+/**
+ * Mint a device id: `H(DEVICE_ID_DOMAIN, account ‖ nonce)`.
+ *
+ * Derived from the account and a fresh nonce rather than from the device's keys,
+ * so rotating a keypair keeps the replica identity — and with it the counter
+ * slots and HLC lineage — intact.
+ */
+export declare function mintDeviceId(account: string, nonce: Uint8Array): Promise<string>;
+/**
+ * The 32 bytes a root signs to certify a device.
+ *
+ * Both keys are covered, so neither the signing key nor the delivery key can be
+ * substituted into a certificate that otherwise verifies — which is what stops a
+ * relay carrying someone's credential from making itself the reader.
+ */
+export declare function deviceCertPayload(input: {
+    account: string;
+    device: string;
+    signPublicKey: string;
+    kemPublicKey: string;
+    keyEpoch: number;
+    deviceEpoch: number;
+}): Promise<Uint8Array>;
+/**
+ * Certify a device, returning the hex credential `merod account sign-cert`
+ * prints — a borsh-encoded `AccountProof<DeviceCert>`.
+ *
+ * The layout, field for field, is core's:
+ *
+ * ```
+ * AccountProof { genesis: AccountGenesis, chain: Vec<RootKeyHandoff>, statement: DeviceCert }
+ *   AccountGenesis { version: u8, root_sign_pk: [u8; 32] }
+ *   chain          → u32-LE count, then that many handoffs
+ *   DeviceCert     { account, device, sign_pk, kem_pk: [u8; 32] x4,
+ *                    key_epoch: u32, device_epoch: u32, signature: [u8; 64] }
+ * ```
+ *
+ * Borsh for plain fixed-width data is concatenation; the only variable part is
+ * the chain's length prefix. `chain` is empty here for the same reason it is in
+ * `sign-cert`: a root that has never been handed off signs directly, and a
+ * handoff chain is only needed once it has.
+ *
+ * `keyEpoch` is 0 for the same reason — it names the root epoch that signed, and
+ * an un-rotated root is at 0. Re-signing after a handoff is a separate flow that
+ * needs the chain, so this deliberately does not take it as an argument rather
+ * than accepting a value it would then have to ignore.
+ */
+export declare function signDeviceCert(input: DeviceCertInput): Promise<string>;
+/** The account this root owns — the content address of its genesis. */
+export declare function accountForRoot(rootSecret: string): Promise<string>;

package/dist/device-cert/device-cert.js

@@ -0,0 +1,110 @@
+/**
+ * Minting and certifying a device offline, with a key that never reaches a node.
+ *
+ * This is the second half of the keyholder story. `signWarrant` lets an account
+ * with no node *write*; this lets one exist in the first place — an account root
+ * certifies a device, and the resulting credential is what a joiner presents.
+ *
+ * As with the warrant signer, the risk is that this reproduces core's encoding
+ * and has to keep doing so. The answer is the same: a golden vector here, and an
+ * e2e that diffs this output against `merod account sign-cert` byte for byte.
+ *
+ * Everything below is derived from core:
+ *
+ * - `DeviceCert::signing_payload` — `crates/account/src/device.rs`
+ * - `DeviceId::mint`              — `crates/primitives/src/identity.rs`
+ * - `AccountProof` / `AccountGenesis` borsh layout — `crates/account/src/{signed,account}.rs`
+ */
+import { concat, derivePublicKey, domainHash, fromHex, hex, importSigningKey, u32le, } from '../crypto/internal.js';
+const CERT_DOMAIN = new TextEncoder().encode('calimero.device.cert.v1');
+const ACCOUNT_ID_DOMAIN = new TextEncoder().encode('calimero.account.genesis.v1');
+const DEVICE_ID_DOMAIN = new TextEncoder().encode('calimero.device.id.v1');
+/** `AccountGenesis::version`, which the credential's borsh encoding leads with. */
+const ACCOUNT_GENESIS_VERSION = 1;
+/**
+ * Mint a device id: `H(DEVICE_ID_DOMAIN, account ‖ nonce)`.
+ *
+ * Derived from the account and a fresh nonce rather than from the device's keys,
+ * so rotating a keypair keeps the replica identity — and with it the counter
+ * slots and HLC lineage — intact.
+ */
+export async function mintDeviceId(account, nonce) {
+    if (nonce.length !== 16) {
+        throw new Error(`nonce must be 16 bytes, got ${nonce.length}`);
+    }
+    const accountBytes = fromHex(account, 'account', 32);
+    return hex(await domainHash(DEVICE_ID_DOMAIN, [accountBytes, nonce]));
+}
+/**
+ * The 32 bytes a root signs to certify a device.
+ *
+ * Both keys are covered, so neither the signing key nor the delivery key can be
+ * substituted into a certificate that otherwise verifies — which is what stops a
+ * relay carrying someone's credential from making itself the reader.
+ */
+export async function deviceCertPayload(input) {
+    return domainHash(CERT_DOMAIN, [
+        fromHex(input.account, 'account', 32),
+        fromHex(input.device, 'device', 32),
+        fromHex(input.signPublicKey, 'signPublicKey', 32),
+        fromHex(input.kemPublicKey, 'kemPublicKey', 32),
+        u32le(input.keyEpoch),
+        u32le(input.deviceEpoch),
+    ]);
+}
+/**
+ * Certify a device, returning the hex credential `merod account sign-cert`
+ * prints — a borsh-encoded `AccountProof<DeviceCert>`.
+ *
+ * The layout, field for field, is core's:
+ *
+ * ```
+ * AccountProof { genesis: AccountGenesis, chain: Vec<RootKeyHandoff>, statement: DeviceCert }
+ *   AccountGenesis { version: u8, root_sign_pk: [u8; 32] }
+ *   chain          → u32-LE count, then that many handoffs
+ *   DeviceCert     { account, device, sign_pk, kem_pk: [u8; 32] x4,
+ *                    key_epoch: u32, device_epoch: u32, signature: [u8; 64] }
+ * ```
+ *
+ * Borsh for plain fixed-width data is concatenation; the only variable part is
+ * the chain's length prefix. `chain` is empty here for the same reason it is in
+ * `sign-cert`: a root that has never been handed off signs directly, and a
+ * handoff chain is only needed once it has.
+ *
+ * `keyEpoch` is 0 for the same reason — it names the root epoch that signed, and
+ * an un-rotated root is at 0. Re-signing after a handoff is a separate flow that
+ * needs the chain, so this deliberately does not take it as an argument rather
+ * than accepting a value it would then have to ignore.
+ */
+export async function signDeviceCert(input) {
+    const rootPublicKey = await derivePublicKey(input.rootSecret);
+    const account = hex(await domainHash(ACCOUNT_ID_DOMAIN, [
+        concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), rootPublicKey),
+    ]));
+    const keyEpoch = 0;
+    const payload = await deviceCertPayload({
+        account,
+        device: input.device,
+        signPublicKey: input.signPublicKey,
+        kemPublicKey: input.kemPublicKey,
+        keyEpoch,
+        deviceEpoch: input.deviceEpoch,
+    });
+    const key = await importSigningKey(input.rootSecret);
+    const signature = new Uint8Array(await crypto.subtle.sign('Ed25519', key, payload));
+    const credential = concat(
+    // AccountGenesis
+    new Uint8Array([ACCOUNT_GENESIS_VERSION]), rootPublicKey, 
+    // chain: Vec<RootKeyHandoff>, empty
+    u32le(0), 
+    // DeviceCert
+    fromHex(account, 'account', 32), fromHex(input.device, 'device', 32), fromHex(input.signPublicKey, 'signPublicKey', 32), fromHex(input.kemPublicKey, 'kemPublicKey', 32), u32le(keyEpoch), u32le(input.deviceEpoch), signature);
+    return hex(credential);
+}
+/** The account this root owns — the content address of its genesis. */
+export async function accountForRoot(rootSecret) {
+    const rootPublicKey = await derivePublicKey(rootSecret);
+    return hex(await domainHash(ACCOUNT_ID_DOMAIN, [
+        concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), rootPublicKey),
+    ]));
+}

package/dist/device-cert/index.d.ts

@@ -0,0 +1,2 @@
+export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, } from './device-cert.js';
+export type { DeviceCertInput } from './device-cert.js';

package/dist/device-cert/index.js

@@ -0,0 +1,2 @@
+// Offline device certification — the account-root half of the keyholder story.
+export { signDeviceCert, mintDeviceId, deviceCertPayload, accountForRoot, } from './device-cert.js';