@calimero-network/mero-js 22.4.0 → 22.5.1

package/dist/namespace-op/namespace-op.d.ts

@@ -17,11 +17,19 @@ import type { SignedGroupOpenInvitation } from '../admin-api/admin-types.js';
 /**
  * Core's `SIGNED_NAMESPACE_OP_SCHEMA_VERSION`. A node refuses any other value.
  *
- * 12: core gained the `RelayTee` role and the TEE admission policy's
- * replica/relay mode. No layout this module signs changed; the version moves
- * with core's so a v11 node and a v12 node never share a namespace.
+ * 15: core went to 13 (TEE rows locked to the TEE roles, a TEE's relay role
+ * read at its namespace root row, inherited read-only roles read-only in Open
+ * subgroups), then 14 (`GroupOp::ContextRegisteredOnBehalf`) and 15
+ * (`GroupOp::OnBehalf` / `RootOp::OnBehalf`) for delegated context creation and
+ * governance through a relay. None of these changes a layout this module
+ * signs; the version moves with core's so nodes on different versions never
+ * share a namespace.
+ *
+ * 16: a namespace can be founded through a relay (a delegated
+ * `NamespaceCreatedV2`), and `GroupOp::FoundingRelayAttested` lets that relay
+ * admit itself as the namespace's first TEE. Again no layout this module signs.
  */
-export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 12;
+export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 16;
 /**
  * Borsh-encode a `SignedGroupOpenInvitation`.
  *

package/dist/namespace-op/namespace-op.js

@@ -2,11 +2,19 @@ import { concat, derivePublicKey, fromHex, hex, importSigningKey, u32le, u64le,
 /**
  * Core's `SIGNED_NAMESPACE_OP_SCHEMA_VERSION`. A node refuses any other value.
  *
- * 12: core gained the `RelayTee` role and the TEE admission policy's
- * replica/relay mode. No layout this module signs changed; the version moves
- * with core's so a v11 node and a v12 node never share a namespace.
+ * 15: core went to 13 (TEE rows locked to the TEE roles, a TEE's relay role
+ * read at its namespace root row, inherited read-only roles read-only in Open
+ * subgroups), then 14 (`GroupOp::ContextRegisteredOnBehalf`) and 15
+ * (`GroupOp::OnBehalf` / `RootOp::OnBehalf`) for delegated context creation and
+ * governance through a relay. None of these changes a layout this module
+ * signs; the version moves with core's so nodes on different versions never
+ * share a namespace.
+ *
+ * 16: a namespace can be founded through a relay (a delegated
+ * `NamespaceCreatedV2`), and `GroupOp::FoundingRelayAttested` lets that relay
+ * admit itself as the namespace's first TEE. Again no layout this module signs.
  */
-export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 12;
+export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 16;
 /** Domain prefixed to the signable bytes; core's `NAMESPACE_GOVERNANCE_SIGN_DOMAIN`. */
 const NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode('calimero.namespace.v1');
 /** `NamespaceOp::Root` is the first variant. */

package/dist/relay/index.d.ts

@@ -1,4 +1,4 @@
 export { RelayClient, IntentRefusedError } from './relay-client.js';
-export type { RelayClientConfig, RelayDescription, IntentResult, CreationDescription, CreateContextInput, CreatedContext, } from './relay-client.js';
+export type { RelayClientConfig, RelayDescription, IntentResult, CreationDescription, CreateContextInput, CreatedContext, GovernanceDescription, GovernInput, GovernResult, } from './relay-client.js';
 export { createMemoryNonceSource, createLocalStorageNonceSource } from './nonce-source.js';
 export type { NonceSource } from './nonce-source.js';

package/dist/relay/relay-client.d.ts

@@ -27,6 +27,7 @@
  * monotonic per-device sequence, and one minted against the wrong executor is
  * unspendable: the number is gone and the write never happened.
  */
+import type { GovernanceOp } from '../warrant/governance-op.js';
 import type { NonceSource } from './nonce-source.js';
 /** Where and as whom to write, plus the key that consents. */
 export interface RelayClientConfig {
@@ -129,6 +130,34 @@ export interface CreatedContext {
     /** The relay's identity in the new context, hex. */
     memberPublicKey: string;
 }
+/** What a relay says about publishing governance ops for members of one group. */
+export interface GovernanceDescription {
+    /** The account a governance warrant must name as `executor`, hex. */
+    executorAccount: string;
+    /** The group asked about, hex. */
+    groupId: string;
+    /**
+     * Whether the relay may act for members here (a `RelayTee` role or
+     * `CAN_AUTHOR_ON_BEHALF`). It needs no right to the op itself: that is
+     * checked on the author, as the op is applied as the author.
+     */
+    canActOnBehalf: boolean;
+}
+/** What {@link RelayClient.govern} publishes. */
+export interface GovernInput {
+    /**
+     * Where the op is published, hex: the group itself for a group op, the
+     * **namespace** for a root op (creating, moving or deleting a subgroup).
+     */
+    groupId: string;
+    /** The op, from one of the encoders (`memberAddedOp`, `groupCreatedOp`, ...). */
+    op: GovernanceOp;
+}
+/** Where a delegated governance op landed. */
+export interface GovernResult {
+    /** The group the op acted on, hex: the new subgroup, for a creation. */
+    groupId: string;
+}
 /** Where an accepted intent landed. */
 export interface IntentResult<T = unknown> {
     /** The context's scope root after the run — did this change anything? */
@@ -216,5 +245,32 @@ export declare class RelayClient {
      * `403 sealed_route_unguarded`.
      */
     createContext(input: CreateContextInput): Promise<CreatedContext>;
+    /**
+     * Ask the relay whether it may publish governance ops for members of
+     * `groupId`, and which account a warrant must name.
+     */
+    describeGovernance(groupId: string): Promise<GovernanceDescription>;
+    /**
+     * Publish one governance op through the relay, as the author.
+     *
+     * The warrant commits to the op's exact bytes and is scoped to `groupId`, so
+     * the relay can neither change what the op does nor spend it elsewhere. Every
+     * peer applies the op as the author, so the author's own rights decide
+     * (`MANAGE_MEMBERS` to add a member, `CAN_CREATE_SUBGROUP` to create a
+     * subgroup, and so on); a lack of them comes back as an
+     * {@link IntentRefusedError} from the relay.
+     *
+     * Always asks {@link describeGovernance} first and refuses *before* taking a
+     * nonce when the relay has no standing, for the reason `createContext` does.
+     * The nonce comes from the configured {@link NonceSource}; it is spent in a
+     * per-group ledger, and a monotonic source is correct for it as for every
+     * other warrant.
+     */
+    govern(input: GovernInput): Promise<GovernResult>;
+    /**
+     * The executor a warrant must name: the one the relay answered with, which a
+     * configured account must agree with. Remembered for later calls.
+     */
+    private checkedExecutor;
     private json;
 }

package/dist/relay/relay-client.js

@@ -29,7 +29,9 @@
  */
 import { signWarrant } from '../warrant/warrant.js';
 import { signCreationWarrant } from '../warrant/creation-warrant.js';
+import { signGovernanceWarrant } from '../warrant/governance-warrant.js';
 import { HTTPError } from '../http-client/web-client.js';
+import { hex } from '../crypto/internal.js';
 /** How long a freshly minted warrant stays presentable, in seconds. */
 const DEFAULT_TTL_SECONDS = 300;
 /**
@@ -153,13 +155,7 @@ export class RelayClient {
                 `${described.groupId}; it needs CAN_CREATE_CONTEXT or admin ` +
                 '(checked before signing — no nonce was spent)', false, 403);
         }
-        const configured = this.config.executorAccount;
-        if (configured && configured.toLowerCase() !== described.executorAccount.toLowerCase()) {
-            throw new Error(`configured executorAccount ${configured} is not the relay's account ` +
-                `${described.executorAccount}; a warrant naming it would be unspendable`);
-        }
-        const executor = described.executorAccount;
-        this.executorAccount = executor;
+        const executor = this.checkedExecutor(described.executorAccount);
         const initArgs = input.initArgs ?? {};
         const nonce = await this.config.nonces.next();
         const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
@@ -183,6 +179,65 @@ export class RelayClient {
             memberPublicKey: body.data.memberPublicKey,
         };
     }
+    /**
+     * Ask the relay whether it may publish governance ops for members of
+     * `groupId`, and which account a warrant must name.
+     */
+    async describeGovernance(groupId) {
+        const body = await this.json('GET', `/admin-api/groups/${encodeURIComponent(groupId)}/governance-intents`);
+        return body.data;
+    }
+    /**
+     * Publish one governance op through the relay, as the author.
+     *
+     * The warrant commits to the op's exact bytes and is scoped to `groupId`, so
+     * the relay can neither change what the op does nor spend it elsewhere. Every
+     * peer applies the op as the author, so the author's own rights decide
+     * (`MANAGE_MEMBERS` to add a member, `CAN_CREATE_SUBGROUP` to create a
+     * subgroup, and so on); a lack of them comes back as an
+     * {@link IntentRefusedError} from the relay.
+     *
+     * Always asks {@link describeGovernance} first and refuses *before* taking a
+     * nonce when the relay has no standing, for the reason `createContext` does.
+     * The nonce comes from the configured {@link NonceSource}; it is spent in a
+     * per-group ledger, and a monotonic source is correct for it as for every
+     * other warrant.
+     */
+    async govern(input) {
+        const described = await this.describeGovernance(input.groupId);
+        if (!described.canActOnBehalf) {
+            throw new IntentRefusedError(`the relay (${described.executorAccount}) has no standing to act for members of group ` +
+                `${described.groupId}; an admin must admit it as a relay or grant it CAN_AUTHOR_ON_BEHALF ` +
+                '(checked before signing, no nonce was spent)', false, 403);
+        }
+        const executor = this.checkedExecutor(described.executorAccount);
+        const nonce = await this.config.nonces.next();
+        const ttl = this.config.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+        const warrant = await signGovernanceWarrant({
+            scope: input.groupId,
+            op: input.op,
+            authorAccount: this.config.authorAccount,
+            executor,
+            nonce,
+            notAfter: BigInt(Math.floor(Date.now() / 1000)) + BigInt(ttl),
+            deviceSecret: this.config.deviceSecret,
+        });
+        const body = await this.json('POST', `/admin-api/groups/${encodeURIComponent(input.groupId)}/governance-intents`, { warrant, authorProof: this.config.authorProof, op: hex(input.op.bytes) });
+        return { groupId: body.data.groupId };
+    }
+    /**
+     * The executor a warrant must name: the one the relay answered with, which a
+     * configured account must agree with. Remembered for later calls.
+     */
+    checkedExecutor(answered) {
+        const configured = this.config.executorAccount;
+        if (configured && configured.toLowerCase() !== answered.toLowerCase()) {
+            throw new Error(`configured executorAccount ${configured} is not the relay's account ` +
+                `${answered}; a warrant naming it would be unspendable`);
+        }
+        this.executorAccount = answered;
+        return answered;
+    }
     async json(method, path, body) {
         const headers = { Accept: 'application/json' };
         if (body !== undefined)

package/dist/warrant/governance-op.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Encode the governance ops a member may have a relay publish for them.
+ *
+ * A governance warrant commits to an op's **borsh bytes**, not to a description
+ * of it, so the client has to produce exactly the bytes the node decodes. These
+ * encoders cover the delegable ops (core's `GroupOp::delegable_form` and
+ * `RootOp::delegable_form`) that a keyholder app is likely to need. Every
+ * discriminant is a variant's position in core's enum, which is how borsh
+ * encodes a Rust enum; they are pinned against core's own vectors in the test.
+ *
+ * **Delegable form.** A removal, a leave and a cascade delete carry fields only
+ * the publisher can compute (post-state hashes, the enumerated subtree). The
+ * member signs them cleared, and these encoders only ever produce the cleared
+ * form, which is the one a relay accepts. The relay fills them in afterwards.
+ *
+ * Sources in core, for the next person to check a discriminant:
+ * `crates/governance-types/src/lib.rs` (`GroupOp`, `RootOp`),
+ * `crates/primitives/src/context.rs` (`GroupMemberRole`), and the vectors in
+ * `crates/governance-types/src/tests.rs` (`delegated_governance_op_vectors_are_stable`).
+ */
+/**
+ * Which plane an op is published on: `group` is a `GroupOp` on the group's own
+ * log, `root` a `RootOp` on the namespace log. The kind is signed over, so
+ * consent to one can never be presented as the other.
+ */
+export type GovernanceOpKind = 'group' | 'root';
+/** An encoded governance op and the plane it belongs to. */
+export interface GovernanceOp {
+    kind: GovernanceOpKind;
+    /** The op's borsh bytes in delegable form: what the warrant commits to. */
+    bytes: Uint8Array;
+}
+/** A group member's role. Borsh discriminants follow core's `GroupMemberRole`. */
+export type GovernanceMemberRole = 'Admin' | 'Member' | 'ReadOnly';
+/**
+ * Add `member` (an account, hex) to the group with `role`.
+ *
+ * Applied as the author: adding a `Member` needs `MANAGE_MEMBERS` or admin,
+ * adding an `Admin` needs admin.
+ */
+export declare function memberAddedOp(member: string, memberRole: GovernanceMemberRole): GovernanceOp;
+/**
+ * Remove `member` (an account, hex) from the group, in delegable form: both
+ * post-state claims cleared, for the relay to compute from its own view.
+ */
+export declare function memberRemovedOp(member: string): GovernanceOp;
+/**
+ * The author leaves the group, in delegable form. The node applies it only when
+ * `member` is the author's own account.
+ */
+export declare function memberLeftOp(member: string): GovernanceOp;
+/** Set `member`'s role (an account, hex). */
+export declare function memberRoleSetOp(member: string, memberRole: GovernanceMemberRole): GovernanceOp;
+/** What a subgroup is created with. */
+export interface GroupCreatedInput {
+    /** The new subgroup's id, hex (32 bytes). Choose it fresh; a taken id is refused. */
+    groupId: string;
+    /** The group it is nested under, hex: the namespace root or an existing subgroup. */
+    parentId: string;
+    /** `true` for a Restricted subgroup (the usual default), `false` for born-Open. */
+    restricted: boolean;
+    /**
+     * The subgroup's founding admin, hex: the **author's** account. The node
+     * refuses any other, since the op is applied as the author.
+     */
+    admin: string;
+}
+/**
+ * Create a subgroup under `parentId`, a root op published on the namespace.
+ *
+ * Needs `CAN_CREATE_SUBGROUP` or admin on the parent; the author, not the
+ * relay, becomes the new subgroup's admin.
+ */
+export declare function groupCreatedOp(input: GroupCreatedInput): GovernanceOp;
+/** Move `childGroupId` under `newParentId`, a root op. */
+export declare function groupReparentedOp(childGroupId: string, newParentId: string): GovernanceOp;
+/**
+ * Delete `rootGroupId` and its subtree, in delegable form: both cascade lists
+ * empty, for the relay to enumerate.
+ */
+export declare function groupDeletedOp(rootGroupId: string): GovernanceOp;

package/dist/warrant/governance-op.js

@@ -0,0 +1,125 @@
+/**
+ * Encode the governance ops a member may have a relay publish for them.
+ *
+ * A governance warrant commits to an op's **borsh bytes**, not to a description
+ * of it, so the client has to produce exactly the bytes the node decodes. These
+ * encoders cover the delegable ops (core's `GroupOp::delegable_form` and
+ * `RootOp::delegable_form`) that a keyholder app is likely to need. Every
+ * discriminant is a variant's position in core's enum, which is how borsh
+ * encodes a Rust enum; they are pinned against core's own vectors in the test.
+ *
+ * **Delegable form.** A removal, a leave and a cascade delete carry fields only
+ * the publisher can compute (post-state hashes, the enumerated subtree). The
+ * member signs them cleared, and these encoders only ever produce the cleared
+ * form, which is the one a relay accepts. The relay fills them in afterwards.
+ *
+ * Sources in core, for the next person to check a discriminant:
+ * `crates/governance-types/src/lib.rs` (`GroupOp`, `RootOp`),
+ * `crates/primitives/src/context.rs` (`GroupMemberRole`), and the vectors in
+ * `crates/governance-types/src/tests.rs` (`delegated_governance_op_vectors_are_stable`).
+ */
+import { concat, fromHex, u32le } from '../crypto/internal.js';
+/**
+ * `GroupMemberRole` discriminants. The two TEE roles (3 and 4) are minted only
+ * by attestation admission and never by a member's op, so they are not offered.
+ */
+const ROLE = {
+    Admin: 0,
+    Member: 1,
+    ReadOnly: 2,
+};
+/** `GroupOp` discriminants, by position in core's enum. */
+const GROUP_OP = {
+    MemberAdded: 1,
+    MemberRemoved: 2,
+    MemberLeft: 3,
+    MemberRoleSet: 4,
+};
+/** `RootOp` discriminants, by position in core's enum. */
+const ROOT_OP = {
+    GroupCreated: 0,
+    GroupReparented: 1,
+    GroupDeleted: 2,
+};
+/** A post-state hash left for the relay to compute: 32 zero bytes. */
+const CLEARED_HASH = new Uint8Array(32);
+/** An empty borsh `Vec`: a zero `u32` count. */
+const EMPTY_VEC = u32le(0);
+function role(value) {
+    const byte = ROLE[value];
+    if (byte === undefined) {
+        throw new Error(`role must be Admin, Member or ReadOnly, got ${String(value)}`);
+    }
+    return new Uint8Array([byte]);
+}
+function tag(byte) {
+    return new Uint8Array([byte]);
+}
+/**
+ * Add `member` (an account, hex) to the group with `role`.
+ *
+ * Applied as the author: adding a `Member` needs `MANAGE_MEMBERS` or admin,
+ * adding an `Admin` needs admin.
+ */
+export function memberAddedOp(member, memberRole) {
+    return {
+        kind: 'group',
+        bytes: concat(tag(GROUP_OP.MemberAdded), fromHex(member, 'member', 32), role(memberRole)),
+    };
+}
+/**
+ * Remove `member` (an account, hex) from the group, in delegable form: both
+ * post-state claims cleared, for the relay to compute from its own view.
+ */
+export function memberRemovedOp(member) {
+    return {
+        kind: 'group',
+        bytes: concat(tag(GROUP_OP.MemberRemoved), fromHex(member, 'member', 32), CLEARED_HASH, EMPTY_VEC),
+    };
+}
+/**
+ * The author leaves the group, in delegable form. The node applies it only when
+ * `member` is the author's own account.
+ */
+export function memberLeftOp(member) {
+    return {
+        kind: 'group',
+        bytes: concat(tag(GROUP_OP.MemberLeft), fromHex(member, 'member', 32), CLEARED_HASH, EMPTY_VEC),
+    };
+}
+/** Set `member`'s role (an account, hex). */
+export function memberRoleSetOp(member, memberRole) {
+    return {
+        kind: 'group',
+        bytes: concat(tag(GROUP_OP.MemberRoleSet), fromHex(member, 'member', 32), role(memberRole)),
+    };
+}
+/**
+ * Create a subgroup under `parentId`, a root op published on the namespace.
+ *
+ * Needs `CAN_CREATE_SUBGROUP` or admin on the parent; the author, not the
+ * relay, becomes the new subgroup's admin.
+ */
+export function groupCreatedOp(input) {
+    return {
+        kind: 'root',
+        bytes: concat(tag(ROOT_OP.GroupCreated), fromHex(input.groupId, 'groupId', 32), fromHex(input.parentId, 'parentId', 32), tag(input.restricted ? 1 : 0), fromHex(input.admin, 'admin', 32)),
+    };
+}
+/** Move `childGroupId` under `newParentId`, a root op. */
+export function groupReparentedOp(childGroupId, newParentId) {
+    return {
+        kind: 'root',
+        bytes: concat(tag(ROOT_OP.GroupReparented), fromHex(childGroupId, 'childGroupId', 32), fromHex(newParentId, 'newParentId', 32)),
+    };
+}
+/**
+ * Delete `rootGroupId` and its subtree, in delegable form: both cascade lists
+ * empty, for the relay to enumerate.
+ */
+export function groupDeletedOp(rootGroupId) {
+    return {
+        kind: 'root',
+        bytes: concat(tag(ROOT_OP.GroupDeleted), fromHex(rootGroupId, 'rootGroupId', 32), EMPTY_VEC, EMPTY_VEC),
+    };
+}

package/dist/warrant/governance-warrant.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Mint a governance warrant: the author's consent for one relay to publish one
+ * governance op in the author's name, once.
+ *
+ * The intent warrant lets an account with no node write to a context and the
+ * creation warrant lets it create one. This covers the governance around them:
+ * adding the other person to a DM, creating a channel's subgroup, changing a
+ * role. The relay wraps the op in `OnBehalf` and publishes it; every peer applies
+ * the inner op **as the author**, so the author's own authority decides
+ * (`MANAGE_MEMBERS` to add a member, `CAN_CREATE_SUBGROUP` to create a subgroup,
+ * and so on) and the relay needs only standing to act for members.
+ *
+ * **It commits to the op's bytes.** The warrant carries
+ * `H(kind || op bytes)` over the op's delegable form (see `governance-op.ts`), so
+ * what the op does, to whom and where is signed byte for byte and the relay
+ * chooses nothing about it. `kind` is inside the commitment, so a group op can
+ * never be presented as a root op whose bytes happen to coincide.
+ *
+ * **`scope` is where the op is published**: the group itself for a group op,
+ * the namespace for a root op.
+ *
+ * Same primitives and the same two-widths trap as `warrant.ts`: counts inside
+ * the encoding are borsh `u32`, counts in the signing preimage are `u64`.
+ *
+ * **The byte contract is pinned in core**, at
+ * `crates/account/src/tests/governance_wire_fixture.rs`, and this module's test
+ * asserts the same vectors. A drift would surface at a relay as a 400.
+ */
+import type { GovernanceOp, GovernanceOpKind } from './governance-op.js';
+/** What a governance warrant authorises. */
+export interface GovernanceWarrantInput {
+    /**
+     * Where the op is published, hex (32 bytes): the group for a group op, the
+     * namespace for a root op. The relay refuses a warrant presented anywhere else.
+     */
+    scope: string;
+    /** The op, from one of the encoders in `governance-op.ts`. Its kind is signed over. */
+    op: GovernanceOp;
+    /** The author's account, hex: whose authority the op is applied under. */
+    authorAccount: string;
+    /** The relay authorised to publish it, hex. An account, not a key. */
+    executor: string;
+    /**
+     * Monotonic per author **device**, spent in a per-group ledger. The same
+     * nonce source `RelayClient` uses for every other warrant is correct.
+     */
+    nonce: number | bigint;
+    /** Unix seconds after which the relay must refuse it. */
+    notAfter: number | bigint;
+    /** Account-log heads the author saw, each hex (32 bytes). At most 64. */
+    accountHeads?: string[];
+    /** Governance heads the author's view descended from, each hex (32 bytes). At most 64. */
+    governanceFloor?: string[];
+    /** The author device's ed25519 signing secret, hex (32 bytes). Never sent. */
+    deviceSecret: string;
+}
+/** A governance warrant's fields, decoded from the wire encoding. */
+export interface GovernanceWarrantFields {
+    scope: string;
+    kind: GovernanceOpKind;
+    authorAccount: string;
+    /** The author device key `signGovernanceWarrant` derived from the secret. */
+    deviceKey: string;
+    executor: string;
+    opHash: string;
+    accountHeads: string[];
+    governanceFloor: string[];
+    nonce: bigint;
+    notAfter: bigint;
+    signature: string;
+}
+/**
+ * The commitment a governance warrant carries in place of the op:
+ * `H(kind || op bytes)` under its own domain.
+ */
+export declare function governanceOpHash(op: GovernanceOp): Promise<Uint8Array>;
+/** The already-decoded fields the signature covers. Internal. */
+export interface GovernancePreimageParts {
+    scope: Uint8Array;
+    kind: GovernanceOpKind;
+    authorAccount: Uint8Array;
+    deviceKey: Uint8Array;
+    executor: Uint8Array;
+    opHash: Uint8Array;
+    accountHeads: Uint8Array[];
+    governanceFloor: Uint8Array[];
+    nonce: number | bigint;
+    notAfter: number | bigint;
+}
+/**
+ * The bytes the device key signs. Exported for the conformance test only, not
+ * from the package root.
+ */
+export declare function governanceWarrantPreimage(p: GovernancePreimageParts): Promise<Uint8Array>;
+/**
+ * Sign a governance warrant and return it hex-encoded (borsh
+ * `GovernanceWarrant`), ready for the relay alongside the op's own bytes.
+ */
+export declare function signGovernanceWarrant(input: GovernanceWarrantInput): Promise<string>;
+/**
+ * Decode a hex governance warrant back into its fields.
+ *
+ * Refuses truncated or trailing bytes and an unknown kind. Does not verify the
+ * signature.
+ */
+export declare function parseGovernanceWarrant(warrant: string): GovernanceWarrantFields;