@calimero-network/mero-js 19.5.0 → 19.7.0

package/dist/account/account.d.ts

@@ -0,0 +1,76 @@
+/** An account root: the secret, the key it derives, and the account it names. */
+export interface AccountRoot {
+    /**
+     * The root signing secret, 64 hex.
+     *
+     * The whole account. It signs device certificates and cloud links, and there
+     * is no recovery path that does not go through it or its phrase — so it is
+     * never sent anywhere, and in a browser it does not belong in `localStorage`.
+     */
+    secret: string;
+    /** The root's ed25519 public key, 64 hex. Safe to publish. */
+    publicKey: string;
+    /** The account this root names, 64 hex — the content address of its genesis. */
+    accountId: string;
+}
+/** An account root together with the phrase that restores it. */
+export interface RecoverableAccountRoot extends AccountRoot {
+    /**
+     * A 24-word BIP39 English recovery phrase, single-space separated.
+     *
+     * Show it once, have the holder write it down, and do not keep it: it is the
+     * secret in a form a person can copy by hand without transcription errors.
+     */
+    phrase: string;
+}
+/**
+ * Mint a brand-new account root from the platform CSPRNG.
+ *
+ * This is the "generate a new key" half of cloud registration — the other half
+ * being a root the holder already has, on a desktop app or a hardware key, which
+ * signs without this ever running.
+ *
+ * **Interop note, and it matters.** The phrase encodes the root secret as BIP39
+ * *entropy*, not as a BIP39 *seed*. A tool restoring it must call the equivalent
+ * of `mnemonicToEntropy(phrase)` — 32 bytes — and use those bytes as the ed25519
+ * secret directly. `mnemonicToSeed(phrase)`, which most wallet libraries reach
+ * for first, runs PBKDF2 and returns 64 different bytes; feeding those in names
+ * a different account and fails as "wrong account", not as a decoding error.
+ * There is no passphrase and no BIP32 derivation path: the 24 words are the key.
+ */
+export declare function generateAccountRoot(): Promise<RecoverableAccountRoot>;
+/**
+ * Restore an account root from its recovery phrase.
+ *
+ * Whitespace and case are normalised, so a phrase pasted out of a text editor
+ * with a trailing newline or a stray double space restores fine. A word outside
+ * the list, a wrong word count, or a failed checksum throws rather than
+ * returning some other account — a single mistyped word is the common case, and
+ * BIP39's checksum catches all but 1 in 256 of them.
+ */
+export declare function accountRootFromPhrase(phrase: string): Promise<RecoverableAccountRoot>;
+/** The public half of a root you already hold, without re-deriving it by hand. */
+export declare function accountRootFromSecret(secret: string): Promise<AccountRoot>;
+/** What {@link signAccountLink} needs. */
+export interface AccountLinkInput {
+    /** The account root's signing secret, 64 hex. */
+    rootSecret: string;
+    /**
+     * The challenge from `GET /api/cloud/me/accounts/challenge`, verbatim.
+     *
+     * Signed as its UTF-8 bytes, not decoded first: mdma seals it as an opaque
+     * string and verifies over the same string it issued.
+     */
+    nonce: string;
+}
+/**
+ * Sign a cloud link challenge with the account root. Returns base64.
+ *
+ * Standard base64, not base64url — mdma decodes it with `validate=True`, so the
+ * `-`/`_` alphabet is rejected outright rather than silently mis-decoded.
+ *
+ * Root-signed rather than device-signed on purpose: this is the credential
+ * someone still holds after losing a device, which is the case linking exists to
+ * serve.
+ */
+export declare function signAccountLink(input: AccountLinkInput): Promise<string>;

package/dist/account/index.d.ts

@@ -0,0 +1,2 @@
+export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, signAccountLink, } from './account.js';
+export type { AccountRoot, RecoverableAccountRoot, AccountLinkInput, } from './account.js';

package/dist/account/index.js

@@ -0,0 +1,2 @@
+// Account roots — minting one, restoring it from a phrase, and proving you hold it.
+export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, signAccountLink, } from './account.js';

package/dist/account/wordlist.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The BIP39 English wordlist, verbatim — 2048 words, index order significant.
+ *
+ * Vendored rather than depended on because this package ships with no runtime
+ * dependencies, and a recovery phrase is useless if the list it was written
+ * against is not the one everybody else implements. The list is content-checked
+ * in `account.test.ts` against its canonical SHA-256
+ * (`2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda` over the
+ * newline-joined, newline-terminated file), so a stray edit here fails the suite
+ * instead of silently minting phrases no other wallet can restore.
+ *
+ * Its own module so bundlers can drop it: nothing outside `account/` imports it,
+ * and the package is `sideEffects: false`, so a consumer who only signs never
+ * pays for the ~13 KB.
+ */
+export declare const ENGLISH_WORDLIST: readonly string[];

package/dist/account/wordlist.js

@@ -0,0 +1,273 @@
+/**
+ * The BIP39 English wordlist, verbatim — 2048 words, index order significant.
+ *
+ * Vendored rather than depended on because this package ships with no runtime
+ * dependencies, and a recovery phrase is useless if the list it was written
+ * against is not the one everybody else implements. The list is content-checked
+ * in `account.test.ts` against its canonical SHA-256
+ * (`2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda` over the
+ * newline-joined, newline-terminated file), so a stray edit here fails the suite
+ * instead of silently minting phrases no other wallet can restore.
+ *
+ * Its own module so bundlers can drop it: nothing outside `account/` imports it,
+ * and the package is `sideEffects: false`, so a consumer who only signs never
+ * pays for the ~13 KB.
+ */
+export const ENGLISH_WORDLIST = [
+    'abandon', 'ability', 'able', 'about', 'above', 'absent', 'absorb', 'abstract',
+    'absurd', 'abuse', 'access', 'accident', 'account', 'accuse', 'achieve', 'acid',
+    'acoustic', 'acquire', 'across', 'act', 'action', 'actor', 'actress', 'actual',
+    'adapt', 'add', 'addict', 'address', 'adjust', 'admit', 'adult', 'advance',
+    'advice', 'aerobic', 'affair', 'afford', 'afraid', 'again', 'age', 'agent',
+    'agree', 'ahead', 'aim', 'air', 'airport', 'aisle', 'alarm', 'album',
+    'alcohol', 'alert', 'alien', 'all', 'alley', 'allow', 'almost', 'alone',
+    'alpha', 'already', 'also', 'alter', 'always', 'amateur', 'amazing', 'among',
+    'amount', 'amused', 'analyst', 'anchor', 'ancient', 'anger', 'angle', 'angry',
+    'animal', 'ankle', 'announce', 'annual', 'another', 'answer', 'antenna', 'antique',
+    'anxiety', 'any', 'apart', 'apology', 'appear', 'apple', 'approve', 'april',
+    'arch', 'arctic', 'area', 'arena', 'argue', 'arm', 'armed', 'armor',
+    'army', 'around', 'arrange', 'arrest', 'arrive', 'arrow', 'art', 'artefact',
+    'artist', 'artwork', 'ask', 'aspect', 'assault', 'asset', 'assist', 'assume',
+    'asthma', 'athlete', 'atom', 'attack', 'attend', 'attitude', 'attract', 'auction',
+    'audit', 'august', 'aunt', 'author', 'auto', 'autumn', 'average', 'avocado',
+    'avoid', 'awake', 'aware', 'away', 'awesome', 'awful', 'awkward', 'axis',
+    'baby', 'bachelor', 'bacon', 'badge', 'bag', 'balance', 'balcony', 'ball',
+    'bamboo', 'banana', 'banner', 'bar', 'barely', 'bargain', 'barrel', 'base',
+    'basic', 'basket', 'battle', 'beach', 'bean', 'beauty', 'because', 'become',
+    'beef', 'before', 'begin', 'behave', 'behind', 'believe', 'below', 'belt',
+    'bench', 'benefit', 'best', 'betray', 'better', 'between', 'beyond', 'bicycle',
+    'bid', 'bike', 'bind', 'biology', 'bird', 'birth', 'bitter', 'black',
+    'blade', 'blame', 'blanket', 'blast', 'bleak', 'bless', 'blind', 'blood',
+    'blossom', 'blouse', 'blue', 'blur', 'blush', 'board', 'boat', 'body',
+    'boil', 'bomb', 'bone', 'bonus', 'book', 'boost', 'border', 'boring',
+    'borrow', 'boss', 'bottom', 'bounce', 'box', 'boy', 'bracket', 'brain',
+    'brand', 'brass', 'brave', 'bread', 'breeze', 'brick', 'bridge', 'brief',
+    'bright', 'bring', 'brisk', 'broccoli', 'broken', 'bronze', 'broom', 'brother',
+    'brown', 'brush', 'bubble', 'buddy', 'budget', 'buffalo', 'build', 'bulb',
+    'bulk', 'bullet', 'bundle', 'bunker', 'burden', 'burger', 'burst', 'bus',
+    'business', 'busy', 'butter', 'buyer', 'buzz', 'cabbage', 'cabin', 'cable',
+    'cactus', 'cage', 'cake', 'call', 'calm', 'camera', 'camp', 'can',
+    'canal', 'cancel', 'candy', 'cannon', 'canoe', 'canvas', 'canyon', 'capable',
+    'capital', 'captain', 'car', 'carbon', 'card', 'cargo', 'carpet', 'carry',
+    'cart', 'case', 'cash', 'casino', 'castle', 'casual', 'cat', 'catalog',
+    'catch', 'category', 'cattle', 'caught', 'cause', 'caution', 'cave', 'ceiling',
+    'celery', 'cement', 'census', 'century', 'cereal', 'certain', 'chair', 'chalk',
+    'champion', 'change', 'chaos', 'chapter', 'charge', 'chase', 'chat', 'cheap',
+    'check', 'cheese', 'chef', 'cherry', 'chest', 'chicken', 'chief', 'child',
+    'chimney', 'choice', 'choose', 'chronic', 'chuckle', 'chunk', 'churn', 'cigar',
+    'cinnamon', 'circle', 'citizen', 'city', 'civil', 'claim', 'clap', 'clarify',
+    'claw', 'clay', 'clean', 'clerk', 'clever', 'click', 'client', 'cliff',
+    'climb', 'clinic', 'clip', 'clock', 'clog', 'close', 'cloth', 'cloud',
+    'clown', 'club', 'clump', 'cluster', 'clutch', 'coach', 'coast', 'coconut',
+    'code', 'coffee', 'coil', 'coin', 'collect', 'color', 'column', 'combine',
+    'come', 'comfort', 'comic', 'common', 'company', 'concert', 'conduct', 'confirm',
+    'congress', 'connect', 'consider', 'control', 'convince', 'cook', 'cool', 'copper',
+    'copy', 'coral', 'core', 'corn', 'correct', 'cost', 'cotton', 'couch',
+    'country', 'couple', 'course', 'cousin', 'cover', 'coyote', 'crack', 'cradle',
+    'craft', 'cram', 'crane', 'crash', 'crater', 'crawl', 'crazy', 'cream',
+    'credit', 'creek', 'crew', 'cricket', 'crime', 'crisp', 'critic', 'crop',
+    'cross', 'crouch', 'crowd', 'crucial', 'cruel', 'cruise', 'crumble', 'crunch',
+    'crush', 'cry', 'crystal', 'cube', 'culture', 'cup', 'cupboard', 'curious',
+    'current', 'curtain', 'curve', 'cushion', 'custom', 'cute', 'cycle', 'dad',
+    'damage', 'damp', 'dance', 'danger', 'daring', 'dash', 'daughter', 'dawn',
+    'day', 'deal', 'debate', 'debris', 'decade', 'december', 'decide', 'decline',
+    'decorate', 'decrease', 'deer', 'defense', 'define', 'defy', 'degree', 'delay',
+    'deliver', 'demand', 'demise', 'denial', 'dentist', 'deny', 'depart', 'depend',
+    'deposit', 'depth', 'deputy', 'derive', 'describe', 'desert', 'design', 'desk',
+    'despair', 'destroy', 'detail', 'detect', 'develop', 'device', 'devote', 'diagram',
+    'dial', 'diamond', 'diary', 'dice', 'diesel', 'diet', 'differ', 'digital',
+    'dignity', 'dilemma', 'dinner', 'dinosaur', 'direct', 'dirt', 'disagree', 'discover',
+    'disease', 'dish', 'dismiss', 'disorder', 'display', 'distance', 'divert', 'divide',
+    'divorce', 'dizzy', 'doctor', 'document', 'dog', 'doll', 'dolphin', 'domain',
+    'donate', 'donkey', 'donor', 'door', 'dose', 'double', 'dove', 'draft',
+    'dragon', 'drama', 'drastic', 'draw', 'dream', 'dress', 'drift', 'drill',
+    'drink', 'drip', 'drive', 'drop', 'drum', 'dry', 'duck', 'dumb',
+    'dune', 'during', 'dust', 'dutch', 'duty', 'dwarf', 'dynamic', 'eager',
+    'eagle', 'early', 'earn', 'earth', 'easily', 'east', 'easy', 'echo',
+    'ecology', 'economy', 'edge', 'edit', 'educate', 'effort', 'egg', 'eight',
+    'either', 'elbow', 'elder', 'electric', 'elegant', 'element', 'elephant', 'elevator',
+    'elite', 'else', 'embark', 'embody', 'embrace', 'emerge', 'emotion', 'employ',
+    'empower', 'empty', 'enable', 'enact', 'end', 'endless', 'endorse', 'enemy',
+    'energy', 'enforce', 'engage', 'engine', 'enhance', 'enjoy', 'enlist', 'enough',
+    'enrich', 'enroll', 'ensure', 'enter', 'entire', 'entry', 'envelope', 'episode',
+    'equal', 'equip', 'era', 'erase', 'erode', 'erosion', 'error', 'erupt',
+    'escape', 'essay', 'essence', 'estate', 'eternal', 'ethics', 'evidence', 'evil',
+    'evoke', 'evolve', 'exact', 'example', 'excess', 'exchange', 'excite', 'exclude',
+    'excuse', 'execute', 'exercise', 'exhaust', 'exhibit', 'exile', 'exist', 'exit',
+    'exotic', 'expand', 'expect', 'expire', 'explain', 'expose', 'express', 'extend',
+    'extra', 'eye', 'eyebrow', 'fabric', 'face', 'faculty', 'fade', 'faint',
+    'faith', 'fall', 'false', 'fame', 'family', 'famous', 'fan', 'fancy',
+    'fantasy', 'farm', 'fashion', 'fat', 'fatal', 'father', 'fatigue', 'fault',
+    'favorite', 'feature', 'february', 'federal', 'fee', 'feed', 'feel', 'female',
+    'fence', 'festival', 'fetch', 'fever', 'few', 'fiber', 'fiction', 'field',
+    'figure', 'file', 'film', 'filter', 'final', 'find', 'fine', 'finger',
+    'finish', 'fire', 'firm', 'first', 'fiscal', 'fish', 'fit', 'fitness',
+    'fix', 'flag', 'flame', 'flash', 'flat', 'flavor', 'flee', 'flight',
+    'flip', 'float', 'flock', 'floor', 'flower', 'fluid', 'flush', 'fly',
+    'foam', 'focus', 'fog', 'foil', 'fold', 'follow', 'food', 'foot',
+    'force', 'forest', 'forget', 'fork', 'fortune', 'forum', 'forward', 'fossil',
+    'foster', 'found', 'fox', 'fragile', 'frame', 'frequent', 'fresh', 'friend',
+    'fringe', 'frog', 'front', 'frost', 'frown', 'frozen', 'fruit', 'fuel',
+    'fun', 'funny', 'furnace', 'fury', 'future', 'gadget', 'gain', 'galaxy',
+    'gallery', 'game', 'gap', 'garage', 'garbage', 'garden', 'garlic', 'garment',
+    'gas', 'gasp', 'gate', 'gather', 'gauge', 'gaze', 'general', 'genius',
+    'genre', 'gentle', 'genuine', 'gesture', 'ghost', 'giant', 'gift', 'giggle',
+    'ginger', 'giraffe', 'girl', 'give', 'glad', 'glance', 'glare', 'glass',
+    'glide', 'glimpse', 'globe', 'gloom', 'glory', 'glove', 'glow', 'glue',
+    'goat', 'goddess', 'gold', 'good', 'goose', 'gorilla', 'gospel', 'gossip',
+    'govern', 'gown', 'grab', 'grace', 'grain', 'grant', 'grape', 'grass',
+    'gravity', 'great', 'green', 'grid', 'grief', 'grit', 'grocery', 'group',
+    'grow', 'grunt', 'guard', 'guess', 'guide', 'guilt', 'guitar', 'gun',
+    'gym', 'habit', 'hair', 'half', 'hammer', 'hamster', 'hand', 'happy',
+    'harbor', 'hard', 'harsh', 'harvest', 'hat', 'have', 'hawk', 'hazard',
+    'head', 'health', 'heart', 'heavy', 'hedgehog', 'height', 'hello', 'helmet',
+    'help', 'hen', 'hero', 'hidden', 'high', 'hill', 'hint', 'hip',
+    'hire', 'history', 'hobby', 'hockey', 'hold', 'hole', 'holiday', 'hollow',
+    'home', 'honey', 'hood', 'hope', 'horn', 'horror', 'horse', 'hospital',
+    'host', 'hotel', 'hour', 'hover', 'hub', 'huge', 'human', 'humble',
+    'humor', 'hundred', 'hungry', 'hunt', 'hurdle', 'hurry', 'hurt', 'husband',
+    'hybrid', 'ice', 'icon', 'idea', 'identify', 'idle', 'ignore', 'ill',
+    'illegal', 'illness', 'image', 'imitate', 'immense', 'immune', 'impact', 'impose',
+    'improve', 'impulse', 'inch', 'include', 'income', 'increase', 'index', 'indicate',
+    'indoor', 'industry', 'infant', 'inflict', 'inform', 'inhale', 'inherit', 'initial',
+    'inject', 'injury', 'inmate', 'inner', 'innocent', 'input', 'inquiry', 'insane',
+    'insect', 'inside', 'inspire', 'install', 'intact', 'interest', 'into', 'invest',
+    'invite', 'involve', 'iron', 'island', 'isolate', 'issue', 'item', 'ivory',
+    'jacket', 'jaguar', 'jar', 'jazz', 'jealous', 'jeans', 'jelly', 'jewel',
+    'job', 'join', 'joke', 'journey', 'joy', 'judge', 'juice', 'jump',
+    'jungle', 'junior', 'junk', 'just', 'kangaroo', 'keen', 'keep', 'ketchup',
+    'key', 'kick', 'kid', 'kidney', 'kind', 'kingdom', 'kiss', 'kit',
+    'kitchen', 'kite', 'kitten', 'kiwi', 'knee', 'knife', 'knock', 'know',
+    'lab', 'label', 'labor', 'ladder', 'lady', 'lake', 'lamp', 'language',
+    'laptop', 'large', 'later', 'latin', 'laugh', 'laundry', 'lava', 'law',
+    'lawn', 'lawsuit', 'layer', 'lazy', 'leader', 'leaf', 'learn', 'leave',
+    'lecture', 'left', 'leg', 'legal', 'legend', 'leisure', 'lemon', 'lend',
+    'length', 'lens', 'leopard', 'lesson', 'letter', 'level', 'liar', 'liberty',
+    'library', 'license', 'life', 'lift', 'light', 'like', 'limb', 'limit',
+    'link', 'lion', 'liquid', 'list', 'little', 'live', 'lizard', 'load',
+    'loan', 'lobster', 'local', 'lock', 'logic', 'lonely', 'long', 'loop',
+    'lottery', 'loud', 'lounge', 'love', 'loyal', 'lucky', 'luggage', 'lumber',
+    'lunar', 'lunch', 'luxury', 'lyrics', 'machine', 'mad', 'magic', 'magnet',
+    'maid', 'mail', 'main', 'major', 'make', 'mammal', 'man', 'manage',
+    'mandate', 'mango', 'mansion', 'manual', 'maple', 'marble', 'march', 'margin',
+    'marine', 'market', 'marriage', 'mask', 'mass', 'master', 'match', 'material',
+    'math', 'matrix', 'matter', 'maximum', 'maze', 'meadow', 'mean', 'measure',
+    'meat', 'mechanic', 'medal', 'media', 'melody', 'melt', 'member', 'memory',
+    'mention', 'menu', 'mercy', 'merge', 'merit', 'merry', 'mesh', 'message',
+    'metal', 'method', 'middle', 'midnight', 'milk', 'million', 'mimic', 'mind',
+    'minimum', 'minor', 'minute', 'miracle', 'mirror', 'misery', 'miss', 'mistake',
+    'mix', 'mixed', 'mixture', 'mobile', 'model', 'modify', 'mom', 'moment',
+    'monitor', 'monkey', 'monster', 'month', 'moon', 'moral', 'more', 'morning',
+    'mosquito', 'mother', 'motion', 'motor', 'mountain', 'mouse', 'move', 'movie',
+    'much', 'muffin', 'mule', 'multiply', 'muscle', 'museum', 'mushroom', 'music',
+    'must', 'mutual', 'myself', 'mystery', 'myth', 'naive', 'name', 'napkin',
+    'narrow', 'nasty', 'nation', 'nature', 'near', 'neck', 'need', 'negative',
+    'neglect', 'neither', 'nephew', 'nerve', 'nest', 'net', 'network', 'neutral',
+    'never', 'news', 'next', 'nice', 'night', 'noble', 'noise', 'nominee',
+    'noodle', 'normal', 'north', 'nose', 'notable', 'note', 'nothing', 'notice',
+    'novel', 'now', 'nuclear', 'number', 'nurse', 'nut', 'oak', 'obey',
+    'object', 'oblige', 'obscure', 'observe', 'obtain', 'obvious', 'occur', 'ocean',
+    'october', 'odor', 'off', 'offer', 'office', 'often', 'oil', 'okay',
+    'old', 'olive', 'olympic', 'omit', 'once', 'one', 'onion', 'online',
+    'only', 'open', 'opera', 'opinion', 'oppose', 'option', 'orange', 'orbit',
+    'orchard', 'order', 'ordinary', 'organ', 'orient', 'original', 'orphan', 'ostrich',
+    'other', 'outdoor', 'outer', 'output', 'outside', 'oval', 'oven', 'over',
+    'own', 'owner', 'oxygen', 'oyster', 'ozone', 'pact', 'paddle', 'page',
+    'pair', 'palace', 'palm', 'panda', 'panel', 'panic', 'panther', 'paper',
+    'parade', 'parent', 'park', 'parrot', 'party', 'pass', 'patch', 'path',
+    'patient', 'patrol', 'pattern', 'pause', 'pave', 'payment', 'peace', 'peanut',
+    'pear', 'peasant', 'pelican', 'pen', 'penalty', 'pencil', 'people', 'pepper',
+    'perfect', 'permit', 'person', 'pet', 'phone', 'photo', 'phrase', 'physical',
+    'piano', 'picnic', 'picture', 'piece', 'pig', 'pigeon', 'pill', 'pilot',
+    'pink', 'pioneer', 'pipe', 'pistol', 'pitch', 'pizza', 'place', 'planet',
+    'plastic', 'plate', 'play', 'please', 'pledge', 'pluck', 'plug', 'plunge',
+    'poem', 'poet', 'point', 'polar', 'pole', 'police', 'pond', 'pony',
+    'pool', 'popular', 'portion', 'position', 'possible', 'post', 'potato', 'pottery',
+    'poverty', 'powder', 'power', 'practice', 'praise', 'predict', 'prefer', 'prepare',
+    'present', 'pretty', 'prevent', 'price', 'pride', 'primary', 'print', 'priority',
+    'prison', 'private', 'prize', 'problem', 'process', 'produce', 'profit', 'program',
+    'project', 'promote', 'proof', 'property', 'prosper', 'protect', 'proud', 'provide',
+    'public', 'pudding', 'pull', 'pulp', 'pulse', 'pumpkin', 'punch', 'pupil',
+    'puppy', 'purchase', 'purity', 'purpose', 'purse', 'push', 'put', 'puzzle',
+    'pyramid', 'quality', 'quantum', 'quarter', 'question', 'quick', 'quit', 'quiz',
+    'quote', 'rabbit', 'raccoon', 'race', 'rack', 'radar', 'radio', 'rail',
+    'rain', 'raise', 'rally', 'ramp', 'ranch', 'random', 'range', 'rapid',
+    'rare', 'rate', 'rather', 'raven', 'raw', 'razor', 'ready', 'real',
+    'reason', 'rebel', 'rebuild', 'recall', 'receive', 'recipe', 'record', 'recycle',
+    'reduce', 'reflect', 'reform', 'refuse', 'region', 'regret', 'regular', 'reject',
+    'relax', 'release', 'relief', 'rely', 'remain', 'remember', 'remind', 'remove',
+    'render', 'renew', 'rent', 'reopen', 'repair', 'repeat', 'replace', 'report',
+    'require', 'rescue', 'resemble', 'resist', 'resource', 'response', 'result', 'retire',
+    'retreat', 'return', 'reunion', 'reveal', 'review', 'reward', 'rhythm', 'rib',
+    'ribbon', 'rice', 'rich', 'ride', 'ridge', 'rifle', 'right', 'rigid',
+    'ring', 'riot', 'ripple', 'risk', 'ritual', 'rival', 'river', 'road',
+    'roast', 'robot', 'robust', 'rocket', 'romance', 'roof', 'rookie', 'room',
+    'rose', 'rotate', 'rough', 'round', 'route', 'royal', 'rubber', 'rude',
+    'rug', 'rule', 'run', 'runway', 'rural', 'sad', 'saddle', 'sadness',
+    'safe', 'sail', 'salad', 'salmon', 'salon', 'salt', 'salute', 'same',
+    'sample', 'sand', 'satisfy', 'satoshi', 'sauce', 'sausage', 'save', 'say',
+    'scale', 'scan', 'scare', 'scatter', 'scene', 'scheme', 'school', 'science',
+    'scissors', 'scorpion', 'scout', 'scrap', 'screen', 'script', 'scrub', 'sea',
+    'search', 'season', 'seat', 'second', 'secret', 'section', 'security', 'seed',
+    'seek', 'segment', 'select', 'sell', 'seminar', 'senior', 'sense', 'sentence',
+    'series', 'service', 'session', 'settle', 'setup', 'seven', 'shadow', 'shaft',
+    'shallow', 'share', 'shed', 'shell', 'sheriff', 'shield', 'shift', 'shine',
+    'ship', 'shiver', 'shock', 'shoe', 'shoot', 'shop', 'short', 'shoulder',
+    'shove', 'shrimp', 'shrug', 'shuffle', 'shy', 'sibling', 'sick', 'side',
+    'siege', 'sight', 'sign', 'silent', 'silk', 'silly', 'silver', 'similar',
+    'simple', 'since', 'sing', 'siren', 'sister', 'situate', 'six', 'size',
+    'skate', 'sketch', 'ski', 'skill', 'skin', 'skirt', 'skull', 'slab',
+    'slam', 'sleep', 'slender', 'slice', 'slide', 'slight', 'slim', 'slogan',
+    'slot', 'slow', 'slush', 'small', 'smart', 'smile', 'smoke', 'smooth',
+    'snack', 'snake', 'snap', 'sniff', 'snow', 'soap', 'soccer', 'social',
+    'sock', 'soda', 'soft', 'solar', 'soldier', 'solid', 'solution', 'solve',
+    'someone', 'song', 'soon', 'sorry', 'sort', 'soul', 'sound', 'soup',
+    'source', 'south', 'space', 'spare', 'spatial', 'spawn', 'speak', 'special',
+    'speed', 'spell', 'spend', 'sphere', 'spice', 'spider', 'spike', 'spin',
+    'spirit', 'split', 'spoil', 'sponsor', 'spoon', 'sport', 'spot', 'spray',
+    'spread', 'spring', 'spy', 'square', 'squeeze', 'squirrel', 'stable', 'stadium',
+    'staff', 'stage', 'stairs', 'stamp', 'stand', 'start', 'state', 'stay',
+    'steak', 'steel', 'stem', 'step', 'stereo', 'stick', 'still', 'sting',
+    'stock', 'stomach', 'stone', 'stool', 'story', 'stove', 'strategy', 'street',
+    'strike', 'strong', 'struggle', 'student', 'stuff', 'stumble', 'style', 'subject',
+    'submit', 'subway', 'success', 'such', 'sudden', 'suffer', 'sugar', 'suggest',
+    'suit', 'summer', 'sun', 'sunny', 'sunset', 'super', 'supply', 'supreme',
+    'sure', 'surface', 'surge', 'surprise', 'surround', 'survey', 'suspect', 'sustain',
+    'swallow', 'swamp', 'swap', 'swarm', 'swear', 'sweet', 'swift', 'swim',
+    'swing', 'switch', 'sword', 'symbol', 'symptom', 'syrup', 'system', 'table',
+    'tackle', 'tag', 'tail', 'talent', 'talk', 'tank', 'tape', 'target',
+    'task', 'taste', 'tattoo', 'taxi', 'teach', 'team', 'tell', 'ten',
+    'tenant', 'tennis', 'tent', 'term', 'test', 'text', 'thank', 'that',
+    'theme', 'then', 'theory', 'there', 'they', 'thing', 'this', 'thought',
+    'three', 'thrive', 'throw', 'thumb', 'thunder', 'ticket', 'tide', 'tiger',
+    'tilt', 'timber', 'time', 'tiny', 'tip', 'tired', 'tissue', 'title',
+    'toast', 'tobacco', 'today', 'toddler', 'toe', 'together', 'toilet', 'token',
+    'tomato', 'tomorrow', 'tone', 'tongue', 'tonight', 'tool', 'tooth', 'top',
+    'topic', 'topple', 'torch', 'tornado', 'tortoise', 'toss', 'total', 'tourist',
+    'toward', 'tower', 'town', 'toy', 'track', 'trade', 'traffic', 'tragic',
+    'train', 'transfer', 'trap', 'trash', 'travel', 'tray', 'treat', 'tree',
+    'trend', 'trial', 'tribe', 'trick', 'trigger', 'trim', 'trip', 'trophy',
+    'trouble', 'truck', 'true', 'truly', 'trumpet', 'trust', 'truth', 'try',
+    'tube', 'tuition', 'tumble', 'tuna', 'tunnel', 'turkey', 'turn', 'turtle',
+    'twelve', 'twenty', 'twice', 'twin', 'twist', 'two', 'type', 'typical',
+    'ugly', 'umbrella', 'unable', 'unaware', 'uncle', 'uncover', 'under', 'undo',
+    'unfair', 'unfold', 'unhappy', 'uniform', 'unique', 'unit', 'universe', 'unknown',
+    'unlock', 'until', 'unusual', 'unveil', 'update', 'upgrade', 'uphold', 'upon',
+    'upper', 'upset', 'urban', 'urge', 'usage', 'use', 'used', 'useful',
+    'useless', 'usual', 'utility', 'vacant', 'vacuum', 'vague', 'valid', 'valley',
+    'valve', 'van', 'vanish', 'vapor', 'various', 'vast', 'vault', 'vehicle',
+    'velvet', 'vendor', 'venture', 'venue', 'verb', 'verify', 'version', 'very',
+    'vessel', 'veteran', 'viable', 'vibrant', 'vicious', 'victory', 'video', 'view',
+    'village', 'vintage', 'violin', 'virtual', 'virus', 'visa', 'visit', 'visual',
+    'vital', 'vivid', 'vocal', 'voice', 'void', 'volcano', 'volume', 'vote',
+    'voyage', 'wage', 'wagon', 'wait', 'walk', 'wall', 'walnut', 'want',
+    'warfare', 'warm', 'warrior', 'wash', 'wasp', 'waste', 'water', 'wave',
+    'way', 'wealth', 'weapon', 'wear', 'weasel', 'weather', 'web', 'wedding',
+    'weekend', 'weird', 'welcome', 'west', 'wet', 'whale', 'what', 'wheat',
+    'wheel', 'when', 'where', 'whip', 'whisper', 'wide', 'width', 'wife',
+    'wild', 'will', 'win', 'window', 'wine', 'wing', 'wink', 'winner',
+    'winter', 'wire', 'wisdom', 'wise', 'wish', 'witness', 'wolf', 'woman',
+    'wonder', 'wood', 'wool', 'word', 'work', 'world', 'worry', 'worth',
+    'wrap', 'wreck', 'wrestle', 'wrist', 'write', 'wrong', 'yard', 'year',
+    'yellow', 'you', 'young', 'youth', 'zebra', 'zero', 'zone', 'zoo',
+];

package/dist/admin-api/admin-client.d.ts

@@ -343,6 +343,75 @@ export declare class AdminApiClient {
      */
     setMemberCapabilities(groupId: string, identity: string, request: SetMemberCapabilitiesRequest): Promise<void>;
     setDefaultCapabilities(groupId: string, request: SetDefaultCapabilitiesRequest): Promise<void>;
+    /**
+     * Make every member admitted to `groupId` from now on able to relay a
+     * delegated write, without a per-node governance op each time.
+     *
+     * `CAN_AUTHOR_ON_BEHALF` is implied by nothing — not membership, not admin —
+     * so every group is authorship-closed and each fleet relay otherwise needs an
+     * admin to grant it individually, at the moment the relay is assigned and the
+     * admin is not watching. Setting it in the group's DEFAULT mask is core's own
+     * answer to that: `add_member` seeds a non-admin's capability row from the
+     * default, so an attested node admitted afterwards lands open.
+     *
+     * Call it on the NAMESPACE (the root group). A grant resolves through the
+     * membership anchor, so one at the root reaches every Open subgroup beneath
+     * it, which is where contexts actually live; a `Restricted` subgroup is a
+     * membership boundary and needs its own call.
+     *
+     * ### Two things this does not do
+     *
+     * **It is not retroactive.** The default is copied into a member's row when
+     * that member is admitted, so nodes already admitted keep the row they got.
+     * Use {@link grantAuthorship} for those — or call this at namespace creation,
+     * which is the only point that needs no backfill at all.
+     *
+     * **It does not reach admins.** Core seeds the default only for non-admin
+     * roles, and `CAN_AUTHOR_ON_BEHALF` is deliberately not implied by admin. An
+     * admin's own node therefore stays closed and needs {@link grantAuthorship}.
+     *
+     * ### What it widens
+     *
+     * Every future non-admin member of the group, not only attested TEE nodes, so
+     * any of them may be named as a warrant's `executor`. The bound worth knowing
+     * before deciding: an executor cannot FORGE. A delegated write is authorized
+     * by the author's own warrant — signed by their device key, committed to one
+     * context, method and exact arguments, with its nonce checked unspent — so a
+     * holder can only spend a warrant it was deliberately handed. What it does
+     * gain is the arguments in cleartext and the choice of when, or whether, to
+     * publish.
+     *
+     * Read-modify-write rather than a blind set: core seeds a new group's default
+     * with `CAN_JOIN_OPEN_SUBGROUPS`, and overwriting that would quietly stop
+     * every later member inheriting into Open subgroups.
+     *
+     * Returns the resulting mask and whether an op was published — it is a no-op
+     * when the bit is already set, so it is safe to call on every startup.
+     */
+    openToDelegatedExecution(groupId: string): Promise<{
+        changed: boolean;
+        defaultCapabilities: number;
+    }>;
+    /**
+     * Grant `account` the authorship bit on `groupId`, leaving its other
+     * capabilities alone.
+     *
+     * The per-member counterpart to {@link openToDelegatedExecution}, and what
+     * closes the gap that method cannot: a relay admitted BEFORE the default was
+     * set, and an admin's own node, which never receives the default at all.
+     *
+     * `account` is the member's ACCOUNT id (64 hex) as `listGroupMembers` returns
+     * it — for a fleet relay, the `account` the cloud reports for that node. Not
+     * the signing key that added them; both are 64 hex, so nothing but the source
+     * tells them apart.
+     *
+     * Read-modify-write, so it adds the bit rather than replacing the member's
+     * mask. A no-op when the member already holds it.
+     */
+    grantAuthorship(groupId: string, account: string): Promise<{
+        changed: boolean;
+        capabilities: number;
+    }>;
     setSubgroupVisibility(groupId: string, request: SetSubgroupVisibilityRequest): Promise<void>;
     setTeeAdmissionPolicy(groupId: string, request: SetTeeAdmissionPolicyRequest): Promise<void>;
     getTeeAdmissionPolicy(groupId: string): Promise<GetTeeAdmissionPolicyResponseData>;

package/dist/admin-api/admin-client.js

@@ -1,4 +1,5 @@
 import { withRetry } from '../http-client/index.js';
+import { CAPABILITIES, hasCap, withCap } from '../capabilities.js';
 /**
  * Helper: server wraps most responses in `{ data: T }`.
  * This extracts `.data` so callers get the inner payload directly. Null-safe so an
@@ -709,6 +710,85 @@ export class AdminApiClient {
     async setDefaultCapabilities(groupId, request) {
         await this.httpClient.put(`/admin-api/groups/${groupId}/settings/default-capabilities`, request);
     }
+    /**
+     * Make every member admitted to `groupId` from now on able to relay a
+     * delegated write, without a per-node governance op each time.
+     *
+     * `CAN_AUTHOR_ON_BEHALF` is implied by nothing — not membership, not admin —
+     * so every group is authorship-closed and each fleet relay otherwise needs an
+     * admin to grant it individually, at the moment the relay is assigned and the
+     * admin is not watching. Setting it in the group's DEFAULT mask is core's own
+     * answer to that: `add_member` seeds a non-admin's capability row from the
+     * default, so an attested node admitted afterwards lands open.
+     *
+     * Call it on the NAMESPACE (the root group). A grant resolves through the
+     * membership anchor, so one at the root reaches every Open subgroup beneath
+     * it, which is where contexts actually live; a `Restricted` subgroup is a
+     * membership boundary and needs its own call.
+     *
+     * ### Two things this does not do
+     *
+     * **It is not retroactive.** The default is copied into a member's row when
+     * that member is admitted, so nodes already admitted keep the row they got.
+     * Use {@link grantAuthorship} for those — or call this at namespace creation,
+     * which is the only point that needs no backfill at all.
+     *
+     * **It does not reach admins.** Core seeds the default only for non-admin
+     * roles, and `CAN_AUTHOR_ON_BEHALF` is deliberately not implied by admin. An
+     * admin's own node therefore stays closed and needs {@link grantAuthorship}.
+     *
+     * ### What it widens
+     *
+     * Every future non-admin member of the group, not only attested TEE nodes, so
+     * any of them may be named as a warrant's `executor`. The bound worth knowing
+     * before deciding: an executor cannot FORGE. A delegated write is authorized
+     * by the author's own warrant — signed by their device key, committed to one
+     * context, method and exact arguments, with its nonce checked unspent — so a
+     * holder can only spend a warrant it was deliberately handed. What it does
+     * gain is the arguments in cleartext and the choice of when, or whether, to
+     * publish.
+     *
+     * Read-modify-write rather than a blind set: core seeds a new group's default
+     * with `CAN_JOIN_OPEN_SUBGROUPS`, and overwriting that would quietly stop
+     * every later member inheriting into Open subgroups.
+     *
+     * Returns the resulting mask and whether an op was published — it is a no-op
+     * when the bit is already set, so it is safe to call on every startup.
+     */
+    async openToDelegatedExecution(groupId) {
+        const current = await this.getDefaultCapabilities(groupId);
+        if (hasCap(current, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
+            return { changed: false, defaultCapabilities: current };
+        }
+        const next = withCap(current, CAPABILITIES.CAN_AUTHOR_ON_BEHALF);
+        await this.setDefaultCapabilities(groupId, { defaultCapabilities: next });
+        return { changed: true, defaultCapabilities: next };
+    }
+    /**
+     * Grant `account` the authorship bit on `groupId`, leaving its other
+     * capabilities alone.
+     *
+     * The per-member counterpart to {@link openToDelegatedExecution}, and what
+     * closes the gap that method cannot: a relay admitted BEFORE the default was
+     * set, and an admin's own node, which never receives the default at all.
+     *
+     * `account` is the member's ACCOUNT id (64 hex) as `listGroupMembers` returns
+     * it — for a fleet relay, the `account` the cloud reports for that node. Not
+     * the signing key that added them; both are 64 hex, so nothing but the source
+     * tells them apart.
+     *
+     * Read-modify-write, so it adds the bit rather than replacing the member's
+     * mask. A no-op when the member already holds it.
+     */
+    async grantAuthorship(groupId, account) {
+        const { capabilities } = await this.getMemberCapabilities(groupId, account);
+        if (hasCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
+            return { changed: false, capabilities };
+        }
+        const next = withCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF);
+        await this.setMemberCapabilities(groupId, account, { capabilities: next });
+        return { changed: true, capabilities: next };
+    }
     async setSubgroupVisibility(groupId, request) {
         await this.httpClient.put(`/admin-api/groups/${groupId}/settings/subgroup-visibility`, request);
     }