@calimero-network/mero-js 16.1.0 → 17.0.0

package/dist/namespace-op/namespace-op.d.ts

@@ -15,7 +15,7 @@
  */
 import type { SignedGroupOpenInvitation } from '../admin-api/admin-types.js';
 /** Core's `SIGNED_NAMESPACE_OP_SCHEMA_VERSION`. A node refuses any other value. */
-export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 7;
+export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 8;
 /**
  * Borsh-encode a `SignedGroupOpenInvitation`.
  *

package/dist/namespace-op/namespace-op.js

@@ -1,6 +1,6 @@
 import { concat, derivePublicKey, fromHex, hex, importSigningKey, u32le, u64le, } from '../crypto/internal.js';
 /** Core's `SIGNED_NAMESPACE_OP_SCHEMA_VERSION`. A node refuses any other value. */
-export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 7;
+export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 8;
 /** Domain prefixed to the signable bytes; core's `NAMESPACE_GOVERNANCE_SIGN_DOMAIN`. */
 const NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode('calimero.namespace.v1');
 /** `NamespaceOp::Root` is the first variant. */
@@ -112,7 +112,19 @@ export async function signMemberJoinOp(input) {
     const signer = await derivePublicKey(input.deviceSecret);
     const signable = concat(new Uint8Array([SIGNED_NAMESPACE_OP_SCHEMA_VERSION]), fromHex(input.namespaceId, 'namespaceId', 32), u32le(parents.length), ...parents.map((p, i) => fromHex(p, `parentOpHashes[${i}]`, 32)), signer, u64le(input.nonce), op);
     const signature = new Uint8Array(await crypto.subtle.sign('Ed25519', key, concat(NAMESPACE_SIGN_DOMAIN, signable)));
-    // The signed struct repeats the signable fields, then the signature. The domain
-    // is a signing prefix only and is never part of the encoded op.
-    return hex(concat(signable, signature));
+    // The signed struct repeats the signable fields, then the signature, then the
+    // admitter endorsement. The domain is a signing prefix only and is never part
+    // of the encoded op.
+    //
+    // The endorsement is written as borsh `None` — a single `0x00` — and that is
+    // the correct value from here, not a placeholder. It authorises the membership
+    // and can only be signed by an account the invitation named as an admitter,
+    // which a keyholder is not. The admitter attaches its own as it relays the op
+    // through `admitJoin`.
+    //
+    // It sits outside `signable`, so it is outside this signature and outside the
+    // op's id. That is what makes attaching it possible: the admitter changes
+    // neither what was signed here nor which op this is.
+    const unendorsed = new Uint8Array([0]);
+    return hex(concat(signable, signature, unendorsed));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "16.1.0",
+  "version": "17.0.0",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {