@calimero-network/mero-js 22.3.0 → 22.5.0

package/dist/index.cjs

@@ -79,6 +79,7 @@ __export(index_exports, {
   createSignedReleaseVerifier: () => createSignedReleaseVerifier,
   createTimeoutSignal: () => createTimeoutSignal,
   createUniversalHttpClient: () => createUniversalHttpClient,
+  creationInitHash: () => creationInitHash,
   deviceCertPayload: () => deviceCertPayload,
   discoverLocalNodes: () => discoverLocalNodes,
   encodeSignedInvitation: () => encodeSignedInvitation,
@@ -87,6 +88,10 @@ __export(index_exports, {
   fetchNodeReleaseVersion: () => fetchNodeReleaseVersion,
   generateAccountRoot: () => generateAccountRoot,
   generateSessionKey: () => generateSessionKey,
+  governanceOpHash: () => governanceOpHash,
+  groupCreatedOp: () => groupCreatedOp,
+  groupDeletedOp: () => groupDeletedOp,
+  groupReparentedOp: () => groupReparentedOp,
   hasCap: () => hasCap,
   hexEncodeUtf8: () => hexEncodeUtf8,
   intentHash: () => intentHash,
@@ -94,10 +99,16 @@ __export(index_exports, {
   jsonCodec: () => jsonCodec,
   localNodeUrl: () => localNodeUrl,
   login: () => login,
+  memberAddedOp: () => memberAddedOp,
+  memberLeftOp: () => memberLeftOp,
+  memberRemovedOp: () => memberRemovedOp,
+  memberRoleSetOp: () => memberRoleSetOp,
   mintDeviceId: () => mintDeviceId,
   nodeEndpoint: () => nodeEndpoint,
   nodeReleaseVersionFromImage: () => nodeReleaseVersionFromImage,
   parseAuthCallback: () => parseAuthCallback,
+  parseCreationWarrant: () => parseCreationWarrant,
+  parseGovernanceWarrant: () => parseGovernanceWarrant,
   probeNodeHealth: () => probeNodeHealth,
   redeemInvitation: () => redeemInvitation,
   requestBodyHash: () => requestBodyHash,
@@ -105,7 +116,9 @@ __export(index_exports, {
   shouldRetain: () => shouldRetain,
   signAccountLink: () => signAccountLink,
   signAccountLogin: () => signAccountLogin,
+  signCreationWarrant: () => signCreationWarrant,
   signDeviceCert: () => signDeviceCert,
+  signGovernanceWarrant: () => signGovernanceWarrant,
   signLoginStatement: () => signLoginStatement,
   signMemberJoinOp: () => signMemberJoinOp,
   signRequest: () => signRequest,
@@ -2306,11 +2319,11 @@ function u32le(value) {
 function hex(bytes) {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-function fromHex(value, label, expectedBytes) {
+function fromHex(value, label2, expectedBytes) {
   const clean = value.trim();
   if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length !== expectedBytes * 2) {
     throw new Error(
-      `${label} must be ${expectedBytes * 2} hex characters, got ${clean.length}`
+      `${label2} must be ${expectedBytes * 2} hex characters, got ${clean.length}`
     );
   }
   const bytes = new Uint8Array(expectedBytes);
@@ -2319,10 +2332,10 @@ function fromHex(value, label, expectedBytes) {
   }
   return bytes;
 }
-function fromHexUnsized(value, label) {
+function fromHexUnsized(value, label2) {
   const clean = value.trim();
   if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
-    throw new Error(`${label} must be an even number of hex characters`);
+    throw new Error(`${label2} must be an even number of hex characters`);
   }
   const bytes = new Uint8Array(clean.length / 2);
   for (let i = 0; i < bytes.length; i += 1) {
@@ -6636,14 +6649,300 @@ async function signWarrant(input) {
     )
   );
 }
-function citedHeads(heads, label) {
+function citedHeads(heads, label2) {
   const list = heads ?? [];
   if (list.length > MAX_CITED_HEADS) {
     throw new Error(
-      `${label} cites ${list.length} heads, over the ${MAX_CITED_HEADS} a node accepts`
+      `${label2} cites ${list.length} heads, over the ${MAX_CITED_HEADS} a node accepts`
     );
   }
-  return list.map((head, i) => fromHex(head, `${label}[${i}]`, 32));
+  return list.map((head, i) => fromHex(head, `${label2}[${i}]`, 32));
+}
+
+// src/warrant/creation-warrant.ts
+var SIGN_DOMAIN3 = new TextEncoder().encode("calimero.context-creation-warrant.v1");
+var INIT_DOMAIN = new TextEncoder().encode("calimero.context-creation.init.v1");
+var MAX_LABEL_BYTES = 256;
+async function creationInitHash(initArgs) {
+  const bytes = new TextEncoder().encode(JSON.stringify(initArgs));
+  return domainHash(INIT_DOMAIN, [bytes]);
+}
+async function creationWarrantPreimage(p) {
+  return domainHash(SIGN_DOMAIN3, [
+    p.group,
+    p.seed,
+    p.authorAccount,
+    p.deviceKey,
+    p.executor,
+    p.applicationId,
+    new Uint8Array([p.serviceName === null ? 0 : 1]),
+    p.serviceName ?? new Uint8Array(0),
+    new Uint8Array([p.name === null ? 0 : 1]),
+    p.name ?? new Uint8Array(0),
+    p.initHash,
+    u64le(p.accountHeads.length),
+    ...p.accountHeads,
+    u64le(p.governanceFloor.length),
+    ...p.governanceFloor,
+    u64le(p.nonce),
+    u64le(p.notAfter)
+  ]);
+}
+async function signCreationWarrant(input) {
+  const group = fromHex(input.group, "group", 32);
+  const seed = input.seed === void 0 ? crypto.getRandomValues(new Uint8Array(32)) : fromHex(input.seed, "seed", 32);
+  const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
+  const executor = fromHex(input.executor, "executor", 32);
+  const applicationId = fromHex(input.applicationId, "applicationId", 32);
+  const serviceName = label(input.serviceName, "serviceName");
+  const name = label(input.name, "name");
+  const accountHeads = citedHeads(input.accountHeads, "accountHeads");
+  const governanceFloor = citedHeads(input.governanceFloor, "governanceFloor");
+  const key = await importSigningKey(input.deviceSecret);
+  const deviceKey = await derivePublicKey(input.deviceSecret);
+  const initHash = await creationInitHash(input.initArgs);
+  const preimage = await creationWarrantPreimage({
+    group,
+    seed,
+    authorAccount,
+    deviceKey,
+    executor,
+    applicationId,
+    serviceName,
+    name,
+    initHash,
+    accountHeads,
+    governanceFloor,
+    nonce: input.nonce,
+    notAfter: input.notAfter
+  });
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
+  );
+  const warrant = hex(
+    concat(
+      group,
+      seed,
+      authorAccount,
+      deviceKey,
+      executor,
+      applicationId,
+      borshOption(serviceName),
+      borshOption(name),
+      initHash,
+      u32le(accountHeads.length),
+      ...accountHeads,
+      u32le(governanceFloor.length),
+      ...governanceFloor,
+      u64le(input.nonce),
+      u64le(input.notAfter),
+      signature
+    )
+  );
+  return { warrant, seed: hex(seed) };
+}
+function parseCreationWarrant(warrant) {
+  const clean = warrant.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+    throw new Error("creation warrant must be an even number of hex characters");
+  }
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  const view = new DataView(bytes.buffer);
+  let o = 0;
+  const take = (n, what) => {
+    if (o + n > bytes.length) {
+      throw new Error(`creation warrant ends inside ${what} (${bytes.length} bytes)`);
+    }
+    const out = bytes.subarray(o, o + n);
+    o += n;
+    return out;
+  };
+  const u32 = (what) => view.getUint32(take(4, what).byteOffset, true);
+  const u64 = (what) => view.getBigUint64(take(8, what).byteOffset, true);
+  const option = (what) => {
+    const tag2 = take(1, what)[0];
+    if (tag2 === 0) return null;
+    if (tag2 !== 1) throw new Error(`${what} has option tag ${tag2}, expected 0 or 1`);
+    const len = u32(what);
+    if (len > MAX_LABEL_BYTES) {
+      throw new Error(`${what} is ${len} bytes, over the ${MAX_LABEL_BYTES} a node accepts`);
+    }
+    return new TextDecoder("utf-8", { fatal: true }).decode(take(len, what));
+  };
+  const heads = (what) => {
+    const count = u32(what);
+    if (count > 64) {
+      throw new Error(`${what} cites ${count} heads, over the 64 a node accepts`);
+    }
+    return Array.from({ length: count }, () => hex(take(32, what)));
+  };
+  const fields = {
+    group: hex(take(32, "group")),
+    seed: hex(take(32, "seed")),
+    authorAccount: hex(take(32, "authorAccount")),
+    deviceKey: hex(take(32, "deviceKey")),
+    executor: hex(take(32, "executor")),
+    applicationId: hex(take(32, "applicationId")),
+    serviceName: option("serviceName"),
+    name: option("name"),
+    initHash: hex(take(32, "initHash")),
+    accountHeads: heads("accountHeads"),
+    governanceFloor: heads("governanceFloor"),
+    nonce: u64("nonce"),
+    notAfter: u64("notAfter"),
+    signature: hex(take(64, "signature"))
+  };
+  if (o !== bytes.length) {
+    throw new Error(
+      `creation warrant is ${bytes.length} bytes but its fields account for ${o}`
+    );
+  }
+  return fields;
+}
+function label(value, what) {
+  if (value === void 0) return null;
+  const bytes = new TextEncoder().encode(value);
+  if (bytes.length > MAX_LABEL_BYTES) {
+    throw new Error(
+      `${what} is ${bytes.length} UTF-8 bytes, over the ${MAX_LABEL_BYTES} a node accepts`
+    );
+  }
+  return bytes;
+}
+function borshOption(bytes) {
+  if (bytes === null) return new Uint8Array([0]);
+  return concat(new Uint8Array([1]), u32le(bytes.length), bytes);
+}
+
+// src/warrant/governance-warrant.ts
+var SIGN_DOMAIN4 = new TextEncoder().encode("calimero.governance-warrant.v1");
+var OP_DOMAIN = new TextEncoder().encode("calimero.governance-warrant.op.v1");
+var KIND_BYTE = { group: 0, root: 1 };
+async function governanceOpHash(op) {
+  return domainHash(OP_DOMAIN, [new Uint8Array([kindByte(op.kind)]), op.bytes]);
+}
+async function governanceWarrantPreimage(p) {
+  return domainHash(SIGN_DOMAIN4, [
+    p.scope,
+    new Uint8Array([kindByte(p.kind)]),
+    p.authorAccount,
+    p.deviceKey,
+    p.executor,
+    p.opHash,
+    u64le(p.accountHeads.length),
+    ...p.accountHeads,
+    u64le(p.governanceFloor.length),
+    ...p.governanceFloor,
+    u64le(p.nonce),
+    u64le(p.notAfter)
+  ]);
+}
+async function signGovernanceWarrant(input) {
+  const scope = fromHex(input.scope, "scope", 32);
+  const authorAccount = fromHex(input.authorAccount, "authorAccount", 32);
+  const executor = fromHex(input.executor, "executor", 32);
+  const accountHeads = citedHeads(input.accountHeads, "accountHeads");
+  const governanceFloor = citedHeads(input.governanceFloor, "governanceFloor");
+  const kind = kindByte(input.op.kind);
+  const key = await importSigningKey(input.deviceSecret);
+  const deviceKey = await derivePublicKey(input.deviceSecret);
+  const opHash = await governanceOpHash(input.op);
+  const preimage = await governanceWarrantPreimage({
+    scope,
+    kind: input.op.kind,
+    authorAccount,
+    deviceKey,
+    executor,
+    opHash,
+    accountHeads,
+    governanceFloor,
+    nonce: input.nonce,
+    notAfter: input.notAfter
+  });
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
+  );
+  return hex(
+    concat(
+      scope,
+      new Uint8Array([kind]),
+      authorAccount,
+      deviceKey,
+      executor,
+      opHash,
+      u32le(accountHeads.length),
+      ...accountHeads,
+      u32le(governanceFloor.length),
+      ...governanceFloor,
+      u64le(input.nonce),
+      u64le(input.notAfter),
+      signature
+    )
+  );
+}
+function parseGovernanceWarrant(warrant) {
+  const clean = warrant.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+    throw new Error("governance warrant must be an even number of hex characters");
+  }
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  const view = new DataView(bytes.buffer);
+  let o = 0;
+  const take = (n, what) => {
+    if (o + n > bytes.length) {
+      throw new Error(`governance warrant ends inside ${what} (${bytes.length} bytes)`);
+    }
+    const out = bytes.subarray(o, o + n);
+    o += n;
+    return out;
+  };
+  const u32 = (what) => view.getUint32(take(4, what).byteOffset, true);
+  const u64 = (what) => view.getBigUint64(take(8, what).byteOffset, true);
+  const heads = (what) => {
+    const count = u32(what);
+    if (count > 64) {
+      throw new Error(`${what} cites ${count} heads, over the 64 a node accepts`);
+    }
+    return Array.from({ length: count }, () => hex(take(32, what)));
+  };
+  const kind = () => {
+    const byte = take(1, "kind")[0];
+    if (byte === 0) return "group";
+    if (byte === 1) return "root";
+    throw new Error(`governance warrant has kind ${byte}, expected 0 (group) or 1 (root)`);
+  };
+  const fields = {
+    scope: hex(take(32, "scope")),
+    kind: kind(),
+    authorAccount: hex(take(32, "authorAccount")),
+    deviceKey: hex(take(32, "deviceKey")),
+    executor: hex(take(32, "executor")),
+    opHash: hex(take(32, "opHash")),
+    accountHeads: heads("accountHeads"),
+    governanceFloor: heads("governanceFloor"),
+    nonce: u64("nonce"),
+    notAfter: u64("notAfter"),
+    signature: hex(take(64, "signature"))
+  };
+  if (o !== bytes.length) {
+    throw new Error(
+      `governance warrant is ${bytes.length} bytes but its fields account for ${o}`
+    );
+  }
+  return fields;
+}
+function kindByte(kind) {
+  const byte = KIND_BYTE[kind];
+  if (byte === void 0) {
+    throw new Error(`op kind must be 'group' or 'root', got ${String(kind)}`);
+  }
+  return byte;
 }
 
 // src/relay/relay-client.ts
@@ -6706,6 +7005,156 @@ var RelayClient = class {
     );
     return { rootHash: body.data.rootHash, returns: body.data.returns ?? null };
   }
+  /**
+   * Ask the relay what it can do about creating contexts in `groupId`.
+   *
+   * Pass `author` (an account, hex) to also learn whether that account may
+   * create here — `authorMayCreate` is present only then.
+   */
+  async describeCreation(groupId, opts = {}) {
+    const query = opts.author ? `?author=${encodeURIComponent(opts.author)}` : "";
+    const body = await this.json(
+      "GET",
+      `/admin-api/groups/${encodeURIComponent(groupId)}/context-intents${query}`
+    );
+    return body.data;
+  }
+  /**
+   * Create a context in a group through the relay, as the author.
+   *
+   * Always asks {@link describeCreation} first — with the author, so both
+   * standing checks happen before anything is signed. A relay without standing
+   * in the group, or an author without `CAN_CREATE_CONTEXT`, is refused here as
+   * an {@link IntentRefusedError} *before* a nonce is taken: the nonce source
+   * is monotonic, and a warrant nobody will spend burns one for nothing.
+   *
+   * The creation warrant's nonce is spent in the new context's per-device
+   * ledger — the same one later `execute` calls in that context draw from — so
+   * it comes from the configured {@link NonceSource} like any other warrant.
+   *
+   * Sealing: nothing here is plaintext-specific. The request goes through the
+   * injected `fetch`, so a `createAttestedSealedFetch` seals it exactly as it
+   * seals `execute`. Whether the relay *accepts* it sealed is the node's call:
+   * a proxy-auth relay only admits sealed requests for routes `merod` serves
+   * without a credential, so `/admin-api/groups/:id/context-intents` must be on
+   * that list on the core side or the request comes back
+   * `403 sealed_route_unguarded`.
+   */
+  async createContext(input) {
+    const described = await this.describeCreation(input.groupId, {
+      author: this.config.authorAccount
+    });
+    if (!described.canCreateOnBehalf) {
+      throw new IntentRefusedError(
+        `the relay (${described.executorAccount}) has no standing to act for members of group ${described.groupId}; an admin must admit it as a relay or grant it CAN_AUTHOR_ON_BEHALF (checked before signing \u2014 no nonce was spent)`,
+        false,
+        403
+      );
+    }
+    if (described.authorMayCreate === false) {
+      throw new IntentRefusedError(
+        `the author (${this.config.authorAccount}) may not create contexts in group ${described.groupId}; it needs CAN_CREATE_CONTEXT or admin (checked before signing \u2014 no nonce was spent)`,
+        false,
+        403
+      );
+    }
+    const executor = this.checkedExecutor(described.executorAccount);
+    const initArgs = input.initArgs ?? {};
+    const nonce2 = await this.config.nonces.next();
+    const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    const { warrant } = await signCreationWarrant({
+      group: input.groupId,
+      seed: input.seed,
+      authorAccount: this.config.authorAccount,
+      executor,
+      applicationId: input.applicationId,
+      serviceName: input.serviceName,
+      name: input.name,
+      initArgs,
+      nonce: nonce2,
+      notAfter: BigInt(Math.floor(Date.now() / 1e3)) + BigInt(ttl),
+      deviceSecret: this.config.deviceSecret
+    });
+    const body = await this.json(
+      "POST",
+      `/admin-api/groups/${encodeURIComponent(input.groupId)}/context-intents`,
+      { warrant, authorProof: this.config.authorProof, initArgs }
+    );
+    return {
+      contextId: body.data.contextId,
+      groupId: body.data.groupId,
+      memberPublicKey: body.data.memberPublicKey
+    };
+  }
+  /**
+   * Ask the relay whether it may publish governance ops for members of
+   * `groupId`, and which account a warrant must name.
+   */
+  async describeGovernance(groupId) {
+    const body = await this.json(
+      "GET",
+      `/admin-api/groups/${encodeURIComponent(groupId)}/governance-intents`
+    );
+    return body.data;
+  }
+  /**
+   * Publish one governance op through the relay, as the author.
+   *
+   * The warrant commits to the op's exact bytes and is scoped to `groupId`, so
+   * the relay can neither change what the op does nor spend it elsewhere. Every
+   * peer applies the op as the author, so the author's own rights decide
+   * (`MANAGE_MEMBERS` to add a member, `CAN_CREATE_SUBGROUP` to create a
+   * subgroup, and so on); a lack of them comes back as an
+   * {@link IntentRefusedError} from the relay.
+   *
+   * Always asks {@link describeGovernance} first and refuses *before* taking a
+   * nonce when the relay has no standing, for the reason `createContext` does.
+   * The nonce comes from the configured {@link NonceSource}; it is spent in a
+   * per-group ledger, and a monotonic source is correct for it as for every
+   * other warrant.
+   */
+  async govern(input) {
+    const described = await this.describeGovernance(input.groupId);
+    if (!described.canActOnBehalf) {
+      throw new IntentRefusedError(
+        `the relay (${described.executorAccount}) has no standing to act for members of group ${described.groupId}; an admin must admit it as a relay or grant it CAN_AUTHOR_ON_BEHALF (checked before signing, no nonce was spent)`,
+        false,
+        403
+      );
+    }
+    const executor = this.checkedExecutor(described.executorAccount);
+    const nonce2 = await this.config.nonces.next();
+    const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    const warrant = await signGovernanceWarrant({
+      scope: input.groupId,
+      op: input.op,
+      authorAccount: this.config.authorAccount,
+      executor,
+      nonce: nonce2,
+      notAfter: BigInt(Math.floor(Date.now() / 1e3)) + BigInt(ttl),
+      deviceSecret: this.config.deviceSecret
+    });
+    const body = await this.json(
+      "POST",
+      `/admin-api/groups/${encodeURIComponent(input.groupId)}/governance-intents`,
+      { warrant, authorProof: this.config.authorProof, op: hex(input.op.bytes) }
+    );
+    return { groupId: body.data.groupId };
+  }
+  /**
+   * The executor a warrant must name: the one the relay answered with, which a
+   * configured account must agree with. Remembered for later calls.
+   */
+  checkedExecutor(answered) {
+    const configured = this.config.executorAccount;
+    if (configured && configured.toLowerCase() !== answered.toLowerCase()) {
+      throw new Error(
+        `configured executorAccount ${configured} is not the relay's account ${answered}; a warrant naming it would be unspendable`
+      );
+    }
+    this.executorAccount = answered;
+    return answered;
+  }
   async json(method, path, body) {
     const headers = { Accept: "application/json" };
     if (body !== void 0) headers["Content-Type"] = "application/json";
@@ -7405,8 +7854,8 @@ var REGISTERS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];
 function createQuoteVerifier(options) {
   const allowedMrtd = measurements(options.allowedMrtd ?? [], "allowedMrtd");
   const allowedImages = (options.allowedMeasurements ?? []).map((image, index) => {
-    const label = `allowedMeasurements[${index}]`;
-    return REGISTERS.map((register) => measurements([image?.[register] ?? ""], `${label}.${register}`)[0]).join();
+    const label2 = `allowedMeasurements[${index}]`;
+    return REGISTERS.map((register) => measurements([image?.[register] ?? ""], `${label2}.${register}`)[0]).join();
   });
   const allowedRtmr = [
     measurements(options.allowedRtmr0 ?? [], "allowedRtmr0"),
@@ -7475,11 +7924,11 @@ function createQuoteVerifier(options) {
   };
   return Object.assign(verifier, { includeCollateral: true });
 }
-function measurements(values, label) {
+function measurements(values, label2) {
   return values.map((value) => {
     const normalized = value.trim().toLowerCase();
     if (!MEASUREMENT_HEX.test(normalized)) {
-      throw new Error(`${label} holds ${JSON.stringify(value)}, which is not a 48-byte hex measurement`);
+      throw new Error(`${label2} holds ${JSON.stringify(value)}, which is not a 48-byte hex measurement`);
     }
     return normalized;
   });
@@ -7592,8 +8041,8 @@ var SIGNATURE_HASHES = {
 };
 function read(bytes, offset, limit) {
   if (offset + 2 > limit) throw new Error("it is truncated");
-  const tag = bytes[offset];
-  if ((tag & 31) === 31) throw new Error("it uses a tag this parser does not read");
+  const tag2 = bytes[offset];
+  if ((tag2 & 31) === 31) throw new Error("it uses a tag this parser does not read");
   let length = bytes[offset + 1];
   let start = offset + 2;
   if (length & 128) {
@@ -7605,7 +8054,7 @@ function read(bytes, offset, limit) {
   }
   const end = start + length;
   if (end > limit) throw new Error("it is truncated");
-  return { tag, bytes, offset, start, end };
+  return { tag: tag2, bytes, offset, start, end };
 }
 function parseDer(bytes) {
   const element = read(bytes, 0, bytes.length);
@@ -7621,8 +8070,8 @@ function children(element) {
   }
   return out;
 }
-function expectTag(element, tag, what) {
-  if (!element || element.tag !== tag) throw new Error(`${what} is not where it should be`);
+function expectTag(element, tag2, what) {
+  if (!element || element.tag !== tag2) throw new Error(`${what} is not where it should be`);
   return element;
 }
 function contents(element) {
@@ -8084,11 +8533,103 @@ function splitVersion2(version) {
   return [[Number(match[1]), Number(match[2]), Number(match[3])], match[4]];
 }
 
+// src/warrant/governance-op.ts
+var ROLE = {
+  Admin: 0,
+  Member: 1,
+  ReadOnly: 2
+};
+var GROUP_OP = {
+  MemberAdded: 1,
+  MemberRemoved: 2,
+  MemberLeft: 3,
+  MemberRoleSet: 4
+};
+var ROOT_OP = {
+  GroupCreated: 0,
+  GroupReparented: 1,
+  GroupDeleted: 2
+};
+var CLEARED_HASH = new Uint8Array(32);
+var EMPTY_VEC = u32le(0);
+function role(value) {
+  const byte = ROLE[value];
+  if (byte === void 0) {
+    throw new Error(`role must be Admin, Member or ReadOnly, got ${String(value)}`);
+  }
+  return new Uint8Array([byte]);
+}
+function tag(byte) {
+  return new Uint8Array([byte]);
+}
+function memberAddedOp(member, memberRole) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberAdded), fromHex(member, "member", 32), role(memberRole))
+  };
+}
+function memberRemovedOp(member) {
+  return {
+    kind: "group",
+    bytes: concat(
+      tag(GROUP_OP.MemberRemoved),
+      fromHex(member, "member", 32),
+      CLEARED_HASH,
+      EMPTY_VEC
+    )
+  };
+}
+function memberLeftOp(member) {
+  return {
+    kind: "group",
+    bytes: concat(
+      tag(GROUP_OP.MemberLeft),
+      fromHex(member, "member", 32),
+      CLEARED_HASH,
+      EMPTY_VEC
+    )
+  };
+}
+function memberRoleSetOp(member, memberRole) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberRoleSet), fromHex(member, "member", 32), role(memberRole))
+  };
+}
+function groupCreatedOp(input) {
+  return {
+    kind: "root",
+    bytes: concat(
+      tag(ROOT_OP.GroupCreated),
+      fromHex(input.groupId, "groupId", 32),
+      fromHex(input.parentId, "parentId", 32),
+      tag(input.restricted ? 1 : 0),
+      fromHex(input.admin, "admin", 32)
+    )
+  };
+}
+function groupReparentedOp(childGroupId, newParentId) {
+  return {
+    kind: "root",
+    bytes: concat(
+      tag(ROOT_OP.GroupReparented),
+      fromHex(childGroupId, "childGroupId", 32),
+      fromHex(newParentId, "newParentId", 32)
+    )
+  };
+}
+function groupDeletedOp(rootGroupId) {
+  return {
+    kind: "root",
+    bytes: concat(tag(ROOT_OP.GroupDeleted), fromHex(rootGroupId, "rootGroupId", 32), EMPTY_VEC, EMPTY_VEC)
+  };
+}
+
 // src/namespace-op/namespace-op.ts
-var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 12;
+var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 15;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
 var NAMESPACE_OP_ROOT = 0;
-var ROOT_OP = {
+var ROOT_OP2 = {
   GroupCreated: 0,
   GroupReparented: 1,
   GroupDeleted: 2,
@@ -8101,18 +8642,18 @@ var ROOT_OP = {
   NamespaceCreatedV2: 9,
   MemberJoinedViaTeeAttestation: 10
 };
-function bytes32(value, label) {
+function bytes32(value, label2) {
   if (value.length !== 32) {
-    throw new Error(`${label} must be 32 bytes, got ${value.length}`);
+    throw new Error(`${label2} must be 32 bytes, got ${value.length}`);
   }
   return new Uint8Array(value);
 }
-function optionalBytes32(value, label) {
+function optionalBytes32(value, label2) {
   if (value === null || value === void 0) {
     return new Uint8Array([0]);
   }
   if (value.length !== 32) {
-    throw new Error(`${label} must be 32 bytes, got ${value.length}`);
+    throw new Error(`${label2} must be 32 bytes, got ${value.length}`);
   }
   return concat(new Uint8Array([1]), new Uint8Array(value));
 }
@@ -8163,13 +8704,13 @@ async function signMemberJoinOp(input) {
   const expires = BigInt(input.invitation.invitation.expiration_timestamp ?? 0) !== 0n;
   const joinedAt = input.joinedAt ?? BigInt(Math.floor(Date.now() / 1e3));
   const rootOp = expires ? concat(
-    new Uint8Array([ROOT_OP.MemberJoinedAt]),
+    new Uint8Array([ROOT_OP2.MemberJoinedAt]),
     fromHex(input.member, "member", 32),
     encodeSignedInvitation(input.invitation),
     u64le(joinedAt),
     credential
   ) : concat(
-    new Uint8Array([ROOT_OP.MemberJoined]),
+    new Uint8Array([ROOT_OP2.MemberJoined]),
     fromHex(input.member, "member", 32),
     encodeSignedInvitation(input.invitation),
     credential
@@ -8194,7 +8735,7 @@ async function signMemberJoinOp(input) {
 }
 
 // src/login/login.ts
-var SIGN_DOMAIN3 = new TextEncoder().encode("calimero.auth.login.v1");
+var SIGN_DOMAIN5 = new TextEncoder().encode("calimero.auth.login.v1");
 var AUDIENCE_TAG = {
   webOrigin: 0,
   codeSigningId: 1,
@@ -8218,12 +8759,12 @@ function audienceSigningBytes(audience) {
   );
 }
 function audienceWire(audience) {
-  const tag = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
+  const tag2 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
   if (audience.kind === "cli") {
-    return tag;
+    return tag2;
   }
   const body = audienceBody(audience);
-  return concat(tag, u32le(body.length), body);
+  return concat(tag2, u32le(body.length), body);
 }
 async function signLoginStatement(input) {
   const node = fromHex(input.node, "node", 32);
@@ -8233,7 +8774,7 @@ async function signLoginStatement(input) {
   const deviceKey = await derivePublicKey(input.deviceSecret);
   const issuedAt = u64le(input.issuedAt);
   const expiresAt = u64le(input.expiresAt);
-  const preimage = await domainHash(SIGN_DOMAIN3, [
+  const preimage = await domainHash(SIGN_DOMAIN5, [
     node,
     audienceSigningBytes(input.audience),
     challenge,