@calimero-network/mero-js 22.7.0 → 22.9.0

package/dist/index.mjs

@@ -170,8 +170,27 @@ var WebHttpClient = class {
     } else {
       headersObj = headers;
     }
+    const method = init?.method || "GET";
+    if (this.transport.authorizeRequest) {
+      const body = init?.body;
+      if (body !== void 0 && typeof body !== "string" && !(body instanceof Uint8Array)) {
+        throw new Error(
+          "this transport authorizes each request against its body, so the body must be a string or Uint8Array \u2014 a stream cannot be signed, because the signature would have to read bytes the request then cannot send."
+        );
+      }
+      Object.assign(
+        headersObj,
+        await this.transport.authorizeRequest({
+          method,
+          path: new URL(url).pathname,
+          // Narrowed by the guard above; `BodyInit` is wider than what can be
+          // signed.
+          body
+        })
+      );
+    }
     const requestInit = {
-      method: init?.method || "GET",
+      method,
       headers: headersObj
     };
     const isStreamBody = init?.body instanceof ReadableStream || typeof init?.body === "object" && init?.body !== null && "getReader" in init.body && !(init.body instanceof Blob);
@@ -931,6 +950,50 @@ async function redeemInvitation(parsed, redeemer) {
 }
 
 // src/admin-api/admin-client.ts
+var WarrantNonceRouteUnavailableError = class extends Error {
+  constructor(path, cause) {
+    super(
+      `this node does not serve warrant-nonce discovery (404 on ${path}); it predates the route, so a client must fall back to its own nonce counter`
+    );
+    this.path = path;
+    this.cause = cause;
+    this.name = "WarrantNonceRouteUnavailableError";
+  }
+};
+function u64FromBody(body, parsed, field) {
+  const value = parsed[field];
+  if (value === void 0 || value === null) return void 0;
+  const digits = new RegExp(`"${field}"\\s*:\\s*(\\d+)`).exec(body);
+  if (digits) return BigInt(digits[1]);
+  if (typeof value === "string" && /^\d+$/.test(value)) return BigInt(value);
+  throw new Error(`warrant-nonce response field \`${field}\` is not a u64: ${JSON.stringify(value)}`);
+}
+function parseWarrantNonce(body) {
+  const parsed = JSON.parse(body);
+  const data = parsed?.data;
+  if (!data || typeof data !== "object") {
+    throw new Error(`warrant-nonce response had no \`data\`: ${body.slice(0, 200)}`);
+  }
+  const common = {
+    contextId: String(data.contextId ?? ""),
+    authorDeviceKey: String(data.authorDeviceKey ?? ""),
+    seen: data.seen === true,
+    highWaterNonce: u64FromBody(body, data, "highWaterNonce"),
+    // Not defaulted: a node that stopped sending it is a node whose window this
+    // client would be guessing at, and the window is not a nonce input anyway.
+    windowWidth: u64FromBody(body, data, "windowWidth") ?? 0n
+  };
+  const nextNonce = u64FromBody(body, data, "nextNonce");
+  if (nextNonce === void 0) {
+    return {
+      ...common,
+      kind: "exhausted",
+      seen: true,
+      highWaterNonce: common.highWaterNonce ?? 0xffffffffffffffffn
+    };
+  }
+  return { ...common, kind: "open", nextNonce };
+}
 function unwrap(response) {
   return response?.data;
 }
@@ -1731,6 +1794,13 @@ var AdminApiClient = class {
    * `namespaceId` names where to publish from, not the extent of the revocation:
    * a device belongs to the account, so every namespace holding a binding for it
    * is withdrawn from and reported back.
+   *
+   * **Revocation is forward-only.** It withdraws the device's authority from
+   * here on and does NOT retract past authorship: ops the device already signed
+   * keep verifying and stay in the DAG, because the certificate that authorised
+   * them was valid when the signature was made. Nothing in this system can
+   * un-author what a device wrote, so a UI built on this call must not offer
+   * that - "this device can no longer act" is the only claim it supports.
    */
   async revokeAccountDevice(namespaceId, request) {
     return unwrap(
@@ -1740,6 +1810,29 @@ var AdminApiClient = class {
       )
     );
   }
+  /**
+   * Carry the device link of an account **this node does not hold**, so the
+   * namespace binds that device's key to the account.
+   *
+   * The relay half of a nodeless account minting invitations. An account added
+   * to a group by account holds its grants but has no device bound, so peers
+   * refuse whatever its device signs as "bound to no account". The credential
+   * and scope are root-signed and self-certifying; this node adds its own
+   * member endorsement and publishes the `AccountDeviceLinked`. After that the
+   * device signs invitations itself — see `signGroupInvitation`.
+   *
+   * Refusals: `400` when a proof does not verify or the scope does not reach
+   * this namespace (re-sign it), `403` when the device was revoked here or the
+   * account is a member of nothing in the namespace (add it first).
+   */
+  async linkAccountDevice(namespaceId, request) {
+    return unwrap(
+      await this.httpClient.post(
+        `/admin-api/namespaces/${namespaceId}/account/link-device`,
+        request
+      )
+    );
+  }
   // ---- Group Management ----
   async getGroupInfo(groupId) {
     return unwrap(await this.httpClient.get(`/admin-api/groups/${groupId}`));
@@ -1773,6 +1866,138 @@ var AdminApiClient = class {
     }
     return response;
   }
+  /**
+   * Account -> devices for the members of a group, as its live bindings record
+   * them.
+   *
+   * The join between a group member listing, which names accounts, and a
+   * context's identities, which name bare signing keys - both 64 hex, and
+   * nothing but the source tells them apart. Batch rather than per-account
+   * because the key -> account direction gets asked about arbitrary authors,
+   * which a per-account route would answer in N calls.
+   *
+   * What comes back is **caller-scoped by the node**: an admin of the group sees
+   * every member's devices, a plain member only its own entry. A single-entry
+   * answer is therefore a statement about this caller's role, not about the
+   * group's size.
+   *
+   * Only live bindings appear, so a revoked device is absent here - use
+   * {@link listAccountDevices} for the account's own devices, which keeps a
+   * revoked one with `revoked: true`. Absence here never means the device never
+   * acted: revocation is forward-only and its past ops remain in the DAG.
+   *
+   * Wrapped in `members` on the wire rather than `data`, unwrapped here for the
+   * same reason {@link listAccountDevices} unwraps `devices`.
+   */
+  async listGroupMemberDevices(groupId, options) {
+    const params = new URLSearchParams();
+    if (options?.offset !== void 0) params.set("offset", String(options.offset));
+    if (options?.limit !== void 0) params.set("limit", String(options.limit));
+    const query = params.toString();
+    const base = `/admin-api/groups/${encodeURIComponent(groupId)}/member-devices`;
+    const response = await this.httpClient.get(
+      query ? `${base}?${query}` : base
+    );
+    return response.members;
+  }
+  /**
+   * Where `authorDeviceKey` stands in its warrant-nonce sequence in `contextId`.
+   *
+   * # What this is for
+   *
+   * The nonce is the one input to a warrant that is stateful on the *client*.
+   * Everything else an author needs it either holds (its keys, the method, the
+   * args) or can read from the relay ({@link RelayClient.describe} gives the
+   * executor account and the grant). So an author that has lost its counter —
+   * a browser keyholder in partitioned or periodically cleared storage, which
+   * is its normal lifecycle rather than a fault — otherwise has exactly one
+   * strategy: guess upward and burn a refused round trip per wrong guess, with
+   * each refusal indistinguishable at the API from a genuinely spent nonce.
+   *
+   * Read {@link WarrantNonceOpen.nextNonce} and mint there. If you still hold
+   * your own counter, mint at `max(ownNext, nextNonce)`: nonce state folds per
+   * peer, so a node can only be BEHIND a client whose warrants it has not
+   * applied — never ahead of the truth. An author spread across several relays
+   * asks each and takes the highest answer. {@link createRecoveringNonceSource}
+   * does all of that.
+   *
+   * Purely a read. It spends nothing and advances nothing, so it may be called
+   * as often as you like.
+   *
+   * # Forward compatibility — this route is NEW
+   *
+   * It is not on core `master` yet, so a current node answers **404**, which
+   * this method surfaces as {@link WarrantNonceRouteUnavailableError} rather
+   * than as an opaque {@link HTTPError}. That distinction matters because the
+   * handler itself never 404s: a device with no row is a `200` with
+   * `seen: false`, and a malformed id is a `400`. So a 404 here means the node
+   * does not serve the route at all — an older build, or a deployment that has
+   * not re-mounted it — and the answer is to fall back to a local counter, not
+   * to retry.
+   *
+   * # Authentication
+   *
+   * On the PROTECTED admin router, unlike the two delegated-execution routes it
+   * sits beside: it takes another principal's device key as input and reports
+   * that principal's activity. A `--public-intents` deployment does not serve
+   * this anonymously, so an admin credential is required.
+   *
+   * @param authorDeviceKey the device's signing key, base58 (43-44 chars) or
+   *        hex (exactly 64). The node accepts either; the two never collide.
+   */
+  async getWarrantNonce(contextId, authorDeviceKey) {
+    const path = `/admin-api/contexts/${encodeURIComponent(contextId)}/warrant-nonce/${encodeURIComponent(authorDeviceKey)}`;
+    let raw;
+    try {
+      raw = await this.httpClient.get(path, { parse: "text" });
+    } catch (error) {
+      if (error instanceof HTTPError && error.status === 404) {
+        throw new WarrantNonceRouteUnavailableError(path, error);
+      }
+      throw error;
+    }
+    return parseWarrantNonce(raw);
+  }
+  /**
+   * The same answer, asked for the way a delegated client has to ask.
+   *
+   * {@link getWarrantNonce} is on the protected admin router, so a keyholder
+   * writing through a relay — the client this whole facility exists for — is
+   * refused it: measured `403` for a session carrying exactly
+   * `context:intent`, `context:query`, `context:subscribe`. That client has no
+   * admin credential and cannot be given one without defeating the point of the
+   * delegated surface.
+   *
+   * What it does have is the credential proving the device is its own, which it
+   * already sends on every write. Presenting it here makes the request
+   * self-scoped: you learn a device's position only by proving, at call time,
+   * that the device is yours. So there is no oracle to protect against, and no
+   * reason for an admin gate.
+   *
+   * The device key is NOT a parameter. It is read from the verified
+   * certificate server-side, which is the only reading that cannot disagree
+   * with the signature — a key supplied alongside would be a second spelling of
+   * the same fact, and two spellings can differ.
+   *
+   * Returns the identical shape {@link getWarrantNonce} returns, so a caller can
+   * swap one for the other without touching what it does with the answer.
+   *
+   * @param authorProof hex-encoded borsh `AccountProof<DeviceCert>` — the same
+   *        value passed as `authorProof` to the relay client.
+   */
+  async getWarrantNonceAsAuthor(contextId, authorProof) {
+    const path = `/admin-api/contexts/${encodeURIComponent(contextId)}/warrant-nonce`;
+    let raw;
+    try {
+      raw = await this.httpClient.post(path, { authorProof }, { parse: "text" });
+    } catch (error) {
+      if (error instanceof HTTPError && error.status === 404) {
+        throw new WarrantNonceRouteUnavailableError(path, error);
+      }
+      throw error;
+    }
+    return parseWarrantNonce(raw);
+  }
   /**
    * Member accounts in the group and the devices bound to each. An admin node
    * sees every account; a plain member only its own. `403` if this node is not a
@@ -2283,6 +2508,16 @@ async function importSigningKey(secretHex) {
     );
   }
 }
+async function verifySignature(publicKey, signature, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    fromHex(publicKey, "publicKey", 32),
+    { name: "Ed25519" },
+    false,
+    ["verify"]
+  );
+  return crypto.subtle.verify({ name: "Ed25519" }, key, signature, payload);
+}
 async function derivePublicKey(secretHex) {
   const seed = fromHex(secretHex, "deviceSecret", 32);
   const pkcs8 = concat(PKCS8_ED25519_PREFIX, seed);
@@ -2406,6 +2641,15 @@ async function jsonRpcCall(httpClient, method, params) {
 }
 var RpcClient = class {
   constructor(opts) {
+    /**
+     * Which write path this is. Present so `RpcClient` satisfies
+     * `ExecuteTransport` as-is — the transport abstraction adopted *this* class's
+     * `execute` shape as the canonical one, so the node side is the interface
+     * rather than an adapter onto it.
+     */
+    this.kind = "node";
+    /** A node serves `/sse` and `/ws` to the credential it issued. */
+    this.canSubscribe = true;
     this.httpClient = opts.httpClient;
   }
   async execute(params) {
@@ -2419,6 +2663,17 @@ var RpcClient = class {
     }
     return result;
   }
+  /**
+   * The same call, in the shape the transport abstraction shares with the
+   * relay.
+   *
+   * `rootHash` is left absent rather than synthesized: JSON-RPC `execute` does
+   * not report the context's scope root, and inventing a value — or a `''` —
+   * would make "the node does not tell us" indistinguishable from an answer.
+   */
+  async executeWithMetadata(params) {
+    return { returns: await this.execute(params), transport: "node" };
+  }
   /**
    * One-tap owner-driven convert: re-signs the caller's identity-gated entries
    * to the current schema. The export converts all of the caller's
@@ -2464,7 +2719,14 @@ var SseClient = class {
     this.closed = false;
     this.listeners = { connect: [], event: [], error: [] };
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.getAuthToken = opts.getAuthToken;
+    if (opts.authorize) {
+      this.authorize = opts.authorize;
+    } else if (opts.getAuthToken) {
+      const getAuthToken = opts.getAuthToken;
+      this.authorize = async () => ({ Authorization: `Bearer ${await getAuthToken()}` });
+    } else {
+      throw new Error("SseClient needs either `getAuthToken` or `authorize`");
+    }
     this.reconnectDelayMs = opts.reconnectDelayMs ?? 3e3;
     this.fetchImpl = (url, init) => opts.fetch ? opts.fetch(url, init) : globalThis.fetch(url, init);
   }
@@ -2531,11 +2793,10 @@ var SseClient = class {
     this.closed = false;
     this.abortController = new AbortController();
     try {
-      const token = await this.getAuthToken();
       const url = `${this.baseUrl}/sse`;
       const response = await this.fetchImpl(url, {
         headers: {
-          "Authorization": `Bearer ${token}`,
+          ...await this.authorize({ method: "GET", path: new URL(url).pathname }),
           "Accept": "text/event-stream"
         },
         signal: this.abortController.signal
@@ -2688,21 +2949,18 @@ var SseClient = class {
   }
   async sendSubscription(method, ids) {
     try {
-      const token = await this.getAuthToken();
       const params = {};
       if (ids.contextIds && ids.contextIds.length > 0) params.contextIds = ids.contextIds;
       if (ids.groupIds && ids.groupIds.length > 0) params.groupIds = ids.groupIds;
-      const response = await this.fetchImpl(`${this.baseUrl}/sse/subscription`, {
+      const url = `${this.baseUrl}/sse/subscription`;
+      const body = JSON.stringify({ id: this.sessionId, method, params });
+      const response = await this.fetchImpl(url, {
         method: "POST",
         headers: {
-          "Authorization": `Bearer ${token}`,
+          ...await this.authorize({ method: "POST", path: new URL(url).pathname, body }),
           "Content-Type": "application/json"
         },
-        body: JSON.stringify({
-          id: this.sessionId,
-          method,
-          params
-        })
+        body
       });
       if (!response.ok) {
         const terminal = isTerminalAuthFailure(response);
@@ -3021,11 +3279,123 @@ var EphemeralClient = class {
   }
 };
 
+// src/signer/signer.ts
+var PKCS8_ED25519_PREFIX2 = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  112,
+  4,
+  34,
+  4,
+  32
+]);
+function unsupported(cause) {
+  const detail = cause instanceof Error ? `: ${cause.message}` : "";
+  return new Error(
+    "this runtime has no WebCrypto Ed25519, so nothing can be signed here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it" + detail
+  );
+}
+async function signerFromSecret(secret, label2 = "secret") {
+  const seed = fromHex(secret, label2, 32);
+  const pkcs8 = concat(PKCS8_ED25519_PREFIX2, seed);
+  let privateKey;
+  let publicKey;
+  try {
+    const exportable = await crypto.subtle.importKey(
+      "pkcs8",
+      pkcs8,
+      { name: "Ed25519" },
+      true,
+      ["sign"]
+    );
+    const jwk = await crypto.subtle.exportKey("jwk", exportable);
+    publicKey = hex(
+      Uint8Array.from(
+        atob(jwk.x.replace(/-/g, "+").replace(/_/g, "/")),
+        (c) => c.charCodeAt(0)
+      )
+    );
+    privateKey = await crypto.subtle.importKey(
+      "pkcs8",
+      pkcs8,
+      { name: "Ed25519" },
+      false,
+      ["sign"]
+    );
+  } catch (cause) {
+    throw unsupported(cause);
+  }
+  return fromKeyAndPublic(privateKey, publicKey);
+}
+async function signerFromCryptoKey(privateKey, publicKey) {
+  if (privateKey.type !== "private") {
+    throw new Error(
+      `signerFromCryptoKey needs the private half of the pair, got a ${privateKey.type} key`
+    );
+  }
+  if (!privateKey.usages.includes("sign")) {
+    throw new Error(
+      "this CryptoKey cannot sign: generate it with usages ['sign', 'verify']"
+    );
+  }
+  let publicHex;
+  if (typeof publicKey === "string") {
+    fromHex(publicKey, "publicKey", 32);
+    publicHex = publicKey.trim().toLowerCase();
+  } else {
+    try {
+      publicHex = hex(
+        new Uint8Array(await crypto.subtle.exportKey("raw", publicKey))
+      );
+    } catch (cause) {
+      const detail = cause instanceof Error ? `: ${cause.message}` : "";
+      throw new Error(
+        "could not read the public half of this key pair; pass the public key as 64 hex instead" + detail
+      );
+    }
+  }
+  return fromKeyAndPublic(privateKey, publicHex);
+}
+function fromKeyAndPublic(privateKey, publicKey) {
+  return {
+    publicKey,
+    async sign(payload) {
+      try {
+        return new Uint8Array(
+          await crypto.subtle.sign({ name: "Ed25519" }, privateKey, payload)
+        );
+      } catch (cause) {
+        throw unsupported(cause);
+      }
+    }
+  };
+}
+async function resolveSigner(secret, signer, label2) {
+  if (signer && secret !== void 0) {
+    throw new Error(
+      `pass either ${label2} or signer, not both \u2014 they may name different keys`
+    );
+  }
+  if (signer) return signer;
+  if (secret !== void 0) return signerFromSecret(secret, label2);
+  throw new Error(`${label2} or signer is required`);
+}
+
 // src/device-cert/device-cert.ts
 var CERT_DOMAIN = new TextEncoder().encode("calimero.device.cert.v1");
 var ACCOUNT_ID_DOMAIN = new TextEncoder().encode("calimero.account.genesis.v1");
 var DEVICE_ID_DOMAIN = new TextEncoder().encode("calimero.device.id.v1");
 var ACCOUNT_GENESIS_VERSION = 2;
+var ACCOUNT_PROOF_BYTES = 237;
 async function mintDeviceId(account, nonce2) {
   if (nonce2.length !== 16) {
     throw new Error(`nonce must be 16 bytes, got ${nonce2.length}`);
@@ -3058,12 +3428,9 @@ function accountProofBytes(input) {
   );
 }
 async function signDeviceCert(input) {
-  const rootPublicKey = await derivePublicKey(input.rootSecret);
-  const account = hex(
-    await domainHash(ACCOUNT_ID_DOMAIN, [
-      concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), rootPublicKey)
-    ])
-  );
+  const signer = await resolveSigner(input.rootSecret, input.signer, "rootSecret");
+  const rootPublicKey = fromHex(signer.publicKey, "signer.publicKey", 32);
+  const account = await accountForRootPublicKey(signer.publicKey);
   const keyEpoch = 0;
   const payload = await deviceCertPayload({
     account,
@@ -3073,10 +3440,7 @@ async function signDeviceCert(input) {
     keyEpoch,
     deviceEpoch: input.deviceEpoch
   });
-  const key = await importSigningKey(input.rootSecret);
-  const signature = new Uint8Array(
-    await crypto.subtle.sign("Ed25519", key, payload)
-  );
+  const signature = await signer.sign(payload);
   const credential = accountProofBytes({
     rootPublicKey,
     account,
@@ -3089,15 +3453,119 @@ async function signDeviceCert(input) {
   });
   return hex(credential);
 }
+function parseDeviceCredential(credential) {
+  const bytes = fromHex(
+    credential,
+    "credential",
+    // Fixed-width with an empty chain: 1 + 32 + 4 + 32*4 + 4 + 4 + 64.
+    ACCOUNT_PROOF_BYTES
+  );
+  if (bytes[0] !== ACCOUNT_GENESIS_VERSION) {
+    throw new Error(
+      `this credential has account genesis version ${bytes[0]}, not ${ACCOUNT_GENESIS_VERSION} \u2014 it names a different account than its root key derives here, and core would refuse it`
+    );
+  }
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const chainLength = view.getUint32(33, true);
+  if (chainLength !== 0) {
+    throw new Error(
+      `this credential carries a ${chainLength}-handoff root chain, which this SDK cannot verify yet \u2014 the signing root is not the genesis root, so checking it means walking the chain`
+    );
+  }
+  const at = (offset, length) => hex(bytes.subarray(offset, offset + length));
+  return {
+    rootPublicKey: at(1, 32),
+    account: at(37, 32),
+    device: at(69, 32),
+    signPublicKey: at(101, 32),
+    kemPublicKey: at(133, 32),
+    keyEpoch: view.getUint32(165, true),
+    deviceEpoch: view.getUint32(169, true),
+    signature: at(173, 64)
+  };
+}
+async function verifyDeviceCredential(credential) {
+  const parsed = parseDeviceCredential(credential);
+  const derived = await accountForRootPublicKey(parsed.rootPublicKey);
+  if (derived !== parsed.account) {
+    throw new Error(
+      `this credential names account ${parsed.account}, but its root key derives ${derived} \u2014 the certificate was re-pointed at another account`
+    );
+  }
+  const signed = await verifySignature(
+    parsed.rootPublicKey,
+    fromHex(parsed.signature, "signature", 64),
+    await deviceCertPayload(parsed)
+  );
+  if (!signed) {
+    throw new Error(
+      `the root key of account ${parsed.account} did not sign this certificate`
+    );
+  }
+  return parsed;
+}
 async function accountForRoot(rootSecret) {
-  const rootPublicKey = await derivePublicKey(rootSecret);
+  return accountForRootPublicKey(hex(await derivePublicKey(rootSecret)));
+}
+async function accountForRootPublicKey(rootPublicKey) {
   return hex(
     await domainHash(ACCOUNT_ID_DOMAIN, [
-      concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), rootPublicKey)
+      concat(
+        new Uint8Array([ACCOUNT_GENESIS_VERSION]),
+        fromHex(rootPublicKey, "rootPublicKey", 32)
+      )
     ])
   );
 }
 
+// src/device-cert/device-scope.ts
+var SCOPE_DOMAIN = new TextEncoder().encode("calimero.device.scope.v1");
+async function deviceScopePayload(input) {
+  return domainHash(SCOPE_DOMAIN, [
+    fromHex(input.account, "account", 32),
+    fromHex(input.device, "device", 32),
+    u32le(input.scopeEpoch),
+    u32le(input.keyEpoch),
+    ...input.applications.map((a, i) => fromHex(a, `applications[${i}]`, 32))
+  ]);
+}
+async function signDeviceScope(input) {
+  const signer = await resolveSigner(input.rootSecret, input.signer, "rootSecret");
+  const rootPublicKey = fromHex(signer.publicKey, "signer.publicKey", 32);
+  const account = await accountForRootPublicKey(hex(rootPublicKey));
+  const applications = input.applications ?? [];
+  const scopeEpoch = input.scopeEpoch ?? 0;
+  if (!Number.isInteger(scopeEpoch) || scopeEpoch < 0 || scopeEpoch > 4294967295) {
+    throw new Error(`scopeEpoch must be a u32, got ${scopeEpoch}`);
+  }
+  const keyEpoch = 0;
+  const payload = await deviceScopePayload({
+    account,
+    device: input.device,
+    applications,
+    scopeEpoch,
+    keyEpoch
+  });
+  const signature = await signer.sign(payload);
+  if (signature.length !== 64) {
+    throw new Error(`signer returned ${signature.length} bytes, expected a 64-byte Ed25519 signature`);
+  }
+  return hex(
+    concat(
+      new Uint8Array([ACCOUNT_GENESIS_VERSION]),
+      rootPublicKey,
+      u32le(0),
+      fromHex(account, "account", 32),
+      fromHex(input.device, "device", 32),
+      u32le(applications.length),
+      ...applications.map((a, i) => fromHex(a, `applications[${i}]`, 32)),
+      u32le(scopeEpoch),
+      u32le(keyEpoch),
+      signature
+    )
+  );
+}
+
 // src/account/wordlist.ts
 var ENGLISH_WORDLIST = [
   "abandon",
@@ -5176,27 +5644,50 @@ async function accountRootFromSecret(secret) {
     accountId: await accountForRoot(secret)
   };
 }
+async function createAccountRootSigner() {
+  const entropy = crypto.getRandomValues(new Uint8Array(ENTROPY_BITS / 8));
+  const phrase = await encodePhrase(entropy);
+  return { ...await rootSignerFromEntropy(entropy), phrase };
+}
+async function accountRootSignerFromPhrase(phrase) {
+  return rootSignerFromEntropy(await decodePhrase(normalisePhrase(phrase)));
+}
+async function rootSignerFromEntropy(entropy) {
+  const signer = await signerFromSecret(hex(entropy), "rootSecret");
+  entropy.fill(0);
+  return {
+    publicKey: signer.publicKey,
+    accountId: await accountForRootPublicKey(signer.publicKey),
+    signer
+  };
+}
+async function resolveRoot(source) {
+  const signer = typeof source === "string" ? await signerFromSecret(source, "rootSecret") : source;
+  return identify(signer);
+}
+async function resolveRootPair(rootSecret, signer) {
+  return identify(await resolveSigner(rootSecret, signer, "rootSecret"));
+}
+async function identify(signer) {
+  return {
+    signer,
+    publicKey: signer.publicKey,
+    accountId: await accountForRootPublicKey(signer.publicKey)
+  };
+}
 async function signAccountLink(input) {
   if (!input.nonce) throw new Error("nonce is required to sign an account link");
-  const key = await importSigningKey(input.rootSecret);
-  const signature = new Uint8Array(
-    await crypto.subtle.sign(
-      "Ed25519",
-      key,
-      concat(ACCOUNT_LINK_DOMAIN, new TextEncoder().encode(input.nonce))
-    )
+  const signer = await resolveSigner(input.rootSecret, input.signer, "rootSecret");
+  const signature = await signer.sign(
+    concat(ACCOUNT_LINK_DOMAIN, new TextEncoder().encode(input.nonce))
   );
   return base64(signature);
 }
 async function signAccountLogin(input) {
   if (!input.nonce) throw new Error("nonce is required to sign an account login");
-  const key = await importSigningKey(input.rootSecret);
-  const signature = new Uint8Array(
-    await crypto.subtle.sign(
-      "Ed25519",
-      key,
-      concat(ACCOUNT_LOGIN_DOMAIN, new TextEncoder().encode(input.nonce))
-    )
+  const signer = await resolveSigner(input.rootSecret, input.signer, "rootSecret");
+  const signature = await signer.sign(
+    concat(ACCOUNT_LOGIN_DOMAIN, new TextEncoder().encode(input.nonce))
   );
   return base64(signature);
 }
@@ -5290,7 +5781,7 @@ function base642(bytes) {
 }
 
 // src/cloud/cloud-client.ts
-var DEFAULT_CLOUD_BASE_URL = "https://cloud.calimero.network";
+var DEFAULT_CLOUD_BASE_URL = "https://manager.cloud.calimero.network";
 function canExecuteOf(row, legacy) {
   return typeof row.can_execute === "boolean" ? row.can_execute : legacy;
 }
@@ -5354,8 +5845,10 @@ var CloudClient = class {
    * account behind those reads was claimed by its owner. The claim is recorded
    * even when the session is refused.
    *
-   * @param rootSecret the account root's signing secret, 64 hex. It never
-   *   leaves this process — only a signature over the cloud's nonce travels.
+   * @param root the account root: its 64-hex secret, or a `Signer` over a root
+   *   this process may use and cannot read — the form a phrase-held root in a
+   *   browser takes. Either way nothing but a signature over the cloud's nonce
+   *   travels.
    *
    * A `403` means either the signature did not verify, or the account is not
    * linked to a cloud login: ownership alone says who you are, and the link
@@ -5363,13 +5856,13 @@ var CloudClient = class {
    * on the proof alone would authenticate perfectly and authorize nothing. The
    * ownership claim is recorded either way, so linking later needs no re-proof.
    */
-  async signInWithAccount(rootSecret) {
-    const root = await accountRootFromSecret(rootSecret);
+  async signInWithAccount(root) {
+    const { signer, publicKey } = await resolveRoot(root);
     const { nonce: nonce2 } = await this.getAccountLoginChallenge();
     return this.submitAccountLogin({
-      rootPublicKey: root.publicKey,
+      rootPublicKey: publicKey,
       nonce: nonce2,
-      signature: await signAccountLogin({ rootSecret, nonce: nonce2 })
+      signature: await signAccountLogin({ signer, nonce: nonce2 })
     });
   }
   /**
@@ -5466,6 +5959,7 @@ var CloudClient = class {
         peerId: String(row.peer_id ?? ""),
         relayUrl,
         executorAccount,
+        nodeKey: row.node_key ?? row.node_public_key ?? null,
         status: String(row.status ?? ""),
         authorshipReady,
         teeRole: teeRoleOf(row),
@@ -5808,22 +6302,23 @@ var CloudClient = class {
    * an intent; the cloud needs it to know whose plan a hosted node is spending,
    * and to sign that account back in later.
    *
-   * @param rootSecret the account root's signing secret, 64 hex — from
-   *   {@link generateAccountRoot}, from a restored recovery phrase, or from a
-   *   desktop app or hardware key that already holds one.
+   * @param root the account root: its 64-hex secret — from
+   *   {@link generateAccountRoot}, a restored recovery phrase, or a desktop app
+   *   or hardware key that already holds one — or a `Signer` over a root this
+   *   process cannot read, which is what a phrase-held browser root is.
    *
    * Idempotent for the same login. An account already linked to a *different*
    * cloud login is a `409`; a replayed or expired challenge is a `403`; and
    * exceeding the plan's account limit is a `402`.
    */
-  async linkAccount(rootSecret) {
-    const root = await accountRootFromSecret(rootSecret);
+  async linkAccount(root) {
+    const { signer, publicKey, accountId } = await resolveRoot(root);
     const { nonce: nonce2 } = await this.getAccountLinkChallenge();
     return this.submitAccountLink({
-      accountId: root.accountId,
-      rootPublicKey: root.publicKey,
+      accountId,
+      rootPublicKey: publicKey,
       nonce: nonce2,
-      signature: await signAccountLink({ rootSecret, nonce: nonce2 })
+      signature: await signAccountLink({ signer, nonce: nonce2 })
     });
   }
   /**
@@ -5943,16 +6438,19 @@ var CloudClient = class {
    * login; `402` that the plan is full.
    */
   async linkAccountWithGrant(options) {
-    const root = await accountRootFromSecret(options.rootSecret);
+    const { signer, publicKey, accountId } = await resolveRootPair(
+      options.rootSecret,
+      options.signer
+    );
     const body = await this.request(
       "POST",
       "/api/cloud/accounts/link",
       {
         body: {
           grant: options.grant,
-          root_public_key: root.publicKey,
+          root_public_key: publicKey,
           signature: await signAccountLink({
-            rootSecret: options.rootSecret,
+            signer,
             nonce: options.grant
           })
         },
@@ -5960,7 +6458,7 @@ var CloudClient = class {
       }
     );
     return {
-      accountId: String(body.account_id ?? root.accountId),
+      accountId: String(body.account_id ?? accountId),
       linkedAt: body.linked_at ?? null,
       alreadyLinked: body.already_linked === true
     };
@@ -6484,117 +6982,6 @@ var LocalStorageTokenStore = class {
   }
 };
 
-// src/signer/signer.ts
-var PKCS8_ED25519_PREFIX2 = new Uint8Array([
-  48,
-  46,
-  2,
-  1,
-  0,
-  48,
-  5,
-  6,
-  3,
-  43,
-  101,
-  112,
-  4,
-  34,
-  4,
-  32
-]);
-function unsupported(cause) {
-  const detail = cause instanceof Error ? `: ${cause.message}` : "";
-  return new Error(
-    "this runtime has no WebCrypto Ed25519, so nothing can be signed here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it" + detail
-  );
-}
-async function signerFromSecret(secret, label2 = "secret") {
-  const seed = fromHex(secret, label2, 32);
-  const pkcs8 = concat(PKCS8_ED25519_PREFIX2, seed);
-  let privateKey;
-  let publicKey;
-  try {
-    const exportable = await crypto.subtle.importKey(
-      "pkcs8",
-      pkcs8,
-      { name: "Ed25519" },
-      true,
-      ["sign"]
-    );
-    const jwk = await crypto.subtle.exportKey("jwk", exportable);
-    publicKey = hex(
-      Uint8Array.from(
-        atob(jwk.x.replace(/-/g, "+").replace(/_/g, "/")),
-        (c) => c.charCodeAt(0)
-      )
-    );
-    privateKey = await crypto.subtle.importKey(
-      "pkcs8",
-      pkcs8,
-      { name: "Ed25519" },
-      false,
-      ["sign"]
-    );
-  } catch (cause) {
-    throw unsupported(cause);
-  }
-  return fromKeyAndPublic(privateKey, publicKey);
-}
-async function signerFromCryptoKey(privateKey, publicKey) {
-  if (privateKey.type !== "private") {
-    throw new Error(
-      `signerFromCryptoKey needs the private half of the pair, got a ${privateKey.type} key`
-    );
-  }
-  if (!privateKey.usages.includes("sign")) {
-    throw new Error(
-      "this CryptoKey cannot sign: generate it with usages ['sign', 'verify']"
-    );
-  }
-  let publicHex;
-  if (typeof publicKey === "string") {
-    fromHex(publicKey, "publicKey", 32);
-    publicHex = publicKey.trim().toLowerCase();
-  } else {
-    try {
-      publicHex = hex(
-        new Uint8Array(await crypto.subtle.exportKey("raw", publicKey))
-      );
-    } catch (cause) {
-      const detail = cause instanceof Error ? `: ${cause.message}` : "";
-      throw new Error(
-        "could not read the public half of this key pair; pass the public key as 64 hex instead" + detail
-      );
-    }
-  }
-  return fromKeyAndPublic(privateKey, publicHex);
-}
-function fromKeyAndPublic(privateKey, publicKey) {
-  return {
-    publicKey,
-    async sign(payload) {
-      try {
-        return new Uint8Array(
-          await crypto.subtle.sign({ name: "Ed25519" }, privateKey, payload)
-        );
-      } catch (cause) {
-        throw unsupported(cause);
-      }
-    }
-  };
-}
-async function resolveSigner(secret, signer, label2) {
-  if (signer && secret !== void 0) {
-    throw new Error(
-      `pass either ${label2} or signer, not both \u2014 they may name different keys`
-    );
-  }
-  if (signer) return signer;
-  if (secret !== void 0) return signerFromSecret(secret, label2);
-  throw new Error(`${label2} or signer is required`);
-}
-
 // src/warrant/warrant.ts
 var SIGN_DOMAIN2 = new TextEncoder().encode("calimero.warrant.v2");
 var INTENT_DOMAIN = new TextEncoder().encode("calimero.warrant.intent.v1");
@@ -7099,6 +7486,16 @@ var IntentRefusedError = class extends Error {
     this.name = "IntentRefusedError";
   }
 };
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function retryAfterMs(headers) {
+  const raw = headers?.get?.("Retry-After");
+  if (!raw) return null;
+  const seconds = Number.parseInt(raw, 10);
+  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+  const at = Date.parse(raw);
+  if (Number.isFinite(at)) return Math.max(0, at - Date.now());
+  return null;
+}
 var RelayClient = class {
   constructor(config) {
     this.config = config;
@@ -7107,11 +7504,40 @@ var RelayClient = class {
     const injected = config.fetch;
     this.fetchImpl = injected ? (input, init) => injected(input, init) : (input, init) => globalThis.fetch(input, init);
     this.timeoutMs = config.timeoutMs ?? 1e4;
+    this.rateLimitRetries = config.rateLimitRetries ?? 3;
+  }
+  /**
+   * The relay's origin, trailing slash stripped.
+   *
+   * Exposed because a relay **is a node**: the same origin that answers the
+   * intents routes also answers `/auth/challenge`, `/auth/token`, `/sse` and
+   * `/ws`. Anything building an observing session over this relay needs the
+   * URL, and asking the caller to pass it a second time is how the two drift.
+   */
+  get relayUrl() {
+    return this.baseUrl;
+  }
+  /** The author's account, hex — whose consent every warrant here carries. */
+  get authorAccount() {
+    return this.config.authorAccount;
+  }
+  /**
+   * The author's `AccountProof<DeviceCert>`, hex.
+   *
+   * The same credential `login()` wants, which is why it is readable: a caller
+   * that already handed it to this client should not have to hand an identical
+   * copy to the login as well, where the two could disagree.
+   */
+  get authorProof() {
+    return this.config.authorProof;
   }
   /**
-   * The author device's signer, built from `deviceSecret` when that is what was
-   * configured. A {@link Signer} and never the secret, so no caller of a
-   * `RelayClient` gains the ability to read key material.
+   * The author device's signer.
+   *
+   * A {@link Signer} and never the secret: this returns something that can
+   * *sign*, so no caller of a `RelayClient` gains the ability to read a key
+   * that was passed in as `deviceSecret`. That asymmetry is the point — the
+   * login needs a signature, not key material.
    */
   async authorSigner() {
     return resolveSigner(this.config.deviceSecret, this.config.signer, "deviceSecret");
@@ -7390,7 +7816,37 @@ var RelayClient = class {
     this.executorAccount = answered;
     return answered;
   }
+  /**
+   * One request, waiting out a rate limit rather than failing the caller.
+   *
+   * The relay's ingress limits the delegated-execution routes to 20 requests a
+   * second per source IP, burst 40 — tighter than everything else it serves,
+   * because those two routes are the ones it answers to anonymous callers.
+   *
+   * Retrying a 429 is safe here in a way retrying most refusals is not: the
+   * limiter sits *first* in the middleware chain, so a throttled request never
+   * reached the node and its warrant nonce was never spent. The same bytes can
+   * go again. Contrast the spent-nonce 403 below, which needs a fresh warrant.
+   *
+   * `Retry-After` is honoured when the ingress sends one; otherwise the wait
+   * doubles from a little over the limiter's own window, which is the shortest
+   * delay that can actually clear.
+   */
   async json(method, path, body) {
+    let wait = 250;
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await this.jsonOnce(method, path, body);
+      } catch (err) {
+        const limited = err instanceof HTTPError && err.status === 429;
+        if (!limited || attempt >= this.rateLimitRetries) throw err;
+        const after = retryAfterMs(err.headers);
+        await sleep(after ?? wait);
+        wait *= 2;
+      }
+    }
+  }
+  async jsonOnce(method, path, body) {
     const headers = { Accept: "application/json" };
     if (body !== void 0) headers["Content-Type"] = "application/json";
     const controller = new AbortController();
@@ -7443,133 +7899,879 @@ function extractReason(bodyText) {
   return bodyText;
 }
 
-// src/relay/nonce-source.ts
-function createMemoryNonceSource(start = 1) {
-  let next = BigInt(start);
-  if (next < 1n) {
-    throw new Error("nonce sequence starts at 1");
-  }
-  return {
-    next() {
-      const value = next;
-      next += 1n;
-      return Promise.resolve(value);
-    }
-  };
-}
-function createLocalStorageNonceSource(key, storage) {
-  const store = storage ?? globalThis.localStorage;
-  if (!store) {
-    throw new Error(
-      "no localStorage in this runtime: pass a storage implementation, or use createMemoryNonceSource for a process that owns its whole sequence"
-    );
-  }
-  return {
-    next() {
-      const raw = store.getItem(key);
-      let current = 0n;
-      if (raw !== null && raw !== "") {
-        try {
-          const parsed = BigInt(raw);
-          if (parsed > 0n) current = parsed;
-        } catch {
-          current = 0n;
-        }
-      }
-      const value = current + 1n;
-      store.setItem(key, value.toString());
-      return Promise.resolve(value);
-    }
-  };
-}
-
-// src/sealed/noise.ts
-var PROTOCOL_NAME = "Noise_NK_25519_AESGCM_SHA256";
-var DH_LEN = 32;
-var TAG_LEN = 16;
-var PKCS8_X25519_PREFIX = new Uint8Array([
-  48,
-  46,
-  2,
-  1,
-  0,
-  48,
-  5,
-  6,
-  3,
-  43,
-  101,
-  110,
-  4,
-  34,
-  4,
-  32
-]);
-var SymmetricState = class _SymmetricState {
-  constructor(h) {
-    this.k = null;
-    this.n = 0;
-    this.ck = h;
-    this.h = h;
+// src/transport/relay-transport.ts
+var RelayTransport = class {
+  constructor(relay, observer = null) {
+    this.relay = relay;
+    this.observer = observer;
+    this.kind = "relay";
   }
-  static async initialize() {
-    const name = new TextEncoder().encode(PROTOCOL_NAME);
-    const h = new Uint8Array(32);
-    h.set(name);
-    return new _SymmetricState(h);
+  /**
+   * Whether this relay can be observed — a fact, not a constant.
+   *
+   * A relay IS a node: it serves `/auth/challenge`, `/auth/token`, `/sse` and
+   * `/ws`, and the `account_proof` provider grants `context:subscribe` by
+   * default. What decides the answer is therefore not the transport but whether
+   * a caller supplied the node's device signing key, which cannot be inferred
+   * from the node or from its `peerId`. See `./relay-observer.ts`.
+   */
+  get canSubscribe() {
+    return this.observer !== null;
   }
-  async mixHash(data) {
-    this.h = await sha256(concat(this.h, data));
+  /** The event session, or `null` when no node key was supplied. */
+  get events() {
+    return this.observer;
   }
-  async mixKey(inputKeyMaterial) {
-    const [ck, key] = await hkdf2(this.ck, inputKeyMaterial);
-    this.ck = ck;
-    this.k = await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["encrypt", "decrypt"]);
-    this.n = 0;
+  /** The underlying client, for `describe()` and anything else relay-specific. */
+  get client() {
+    return this.relay;
   }
-  async encryptAndHash(plaintext) {
-    if (!this.k) throw new Error("Noise: no cipher key yet");
-    const ciphertext = new Uint8Array(
-      await crypto.subtle.encrypt(
-        { name: "AES-GCM", iv: noiseNonce(this.n), additionalData: this.h },
-        this.k,
-        plaintext
-      )
+  async execute(params) {
+    const { returns } = await this.executeWithMetadata(params);
+    return returns;
+  }
+  async executeWithMetadata(params) {
+    const result = await this.relay.execute(
+      params.contextId,
+      params.method,
+      // The node defaults a missing `argsJson` to `{}`; matching that here keeps
+      // a zero-argument call identical on both transports rather than sending
+      // `undefined` and letting the relay's JSON body decide.
+      params.argsJson ?? {}
     );
-    this.n += 1;
-    await this.mixHash(ciphertext);
-    return ciphertext;
+    return {
+      // Verbatim. `RelayClient` has already normalized a missing `returns` to
+      // `null`, which is what a node reports for a null output — see the
+      // module note on why this is not rewritten to `undefined`.
+      returns: result.returns,
+      transport: "relay",
+      rootHash: result.rootHash
+    };
   }
-  async decryptAndHash(ciphertext) {
-    if (!this.k) throw new Error("Noise: no cipher key yet");
-    const plaintext = new Uint8Array(
-      await crypto.subtle.decrypt(
-        { name: "AES-GCM", iv: noiseNonce(this.n), additionalData: this.h },
-        this.k,
-        ciphertext
-      )
-    );
-    this.n += 1;
-    await this.mixHash(ciphertext);
-    return plaintext;
+  /**
+   * Both of these are plain context methods, so they work through a relay
+   * exactly as they do on a node — the warrant names `migrate_my_entries` and
+   * the delta is attributed to the author, which is precisely the identity the
+   * convert is scoped to. They are re-declared rather than inherited because
+   * `ExecuteTransport` is an interface, not a base class.
+   */
+  async migrateMyEntries(contextId) {
+    return this.execute({
+      contextId,
+      method: "migrate_my_entries"
+    });
   }
-  /** The initiator-to-responder key, then the responder-to-initiator key. */
-  split() {
-    return hkdf2(this.ck, new Uint8Array());
+  /** Read-only count of the caller's entries still below the target schema. */
+  async countMyPending(contextId) {
+    return this.execute({ contextId, method: "count_my_pending" });
   }
 };
-async function initiate(remoteStatic, prologue, fixedEphemeral) {
-  const state = await SymmetricState.initialize();
-  await state.mixHash(prologue);
-  await state.mixHash(remoteStatic);
-  const ephemeral = await x25519KeyPair(fixedEphemeral);
-  await state.mixHash(ephemeral.publicKey);
-  await state.mixKey(await dh(ephemeral.privateKey, remoteStatic));
-  const message1 = concat(ephemeral.publicKey, await state.encryptAndHash(new Uint8Array()));
-  return {
-    message1,
-    async finish(message2) {
-      if (message2.length < DH_LEN + TAG_LEN) throw new Error("Noise: message 2 is too short");
+
+// src/login/login.ts
+var SIGN_DOMAIN5 = new TextEncoder().encode("calimero.auth.login.v1");
+var AUDIENCE_TAG = {
+  webOrigin: 0,
+  codeSigningId: 1,
+  cli: 2
+};
+function audienceBody(audience) {
+  const encoder = new TextEncoder();
+  switch (audience.kind) {
+    case "webOrigin":
+      return encoder.encode(audience.origin);
+    case "codeSigningId":
+      return encoder.encode(audience.id);
+    case "cli":
+      return new Uint8Array(0);
+  }
+}
+function audienceSigningBytes(audience) {
+  return concat(
+    Uint8Array.from([AUDIENCE_TAG[audience.kind]]),
+    audienceBody(audience)
+  );
+}
+function audienceWire(audience) {
+  const tag2 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
+  if (audience.kind === "cli") {
+    return tag2;
+  }
+  const body = audienceBody(audience);
+  return concat(tag2, u32le(body.length), body);
+}
+async function signLoginStatement(input) {
+  const node = fromHex(input.node, "node", 32);
+  const challenge = fromHex(input.challenge, "challenge", 32);
+  const sessionKey = fromHex(input.sessionKey, "sessionKey", 32);
+  const signer = await resolveSigner(
+    input.deviceSecret,
+    input.signer,
+    "deviceSecret"
+  );
+  const deviceKey = fromHex(signer.publicKey, "signer.publicKey", 32);
+  const issuedAt = u64le(input.issuedAt);
+  const expiresAt = u64le(input.expiresAt);
+  const preimage = await domainHash(SIGN_DOMAIN5, [
+    node,
+    audienceSigningBytes(input.audience),
+    challenge,
+    sessionKey,
+    deviceKey,
+    issuedAt,
+    expiresAt
+  ]);
+  const signature = await signer.sign(preimage);
+  return hex(
+    concat(
+      node,
+      audienceWire(input.audience),
+      challenge,
+      sessionKey,
+      deviceKey,
+      issuedAt,
+      expiresAt,
+      signature
+    )
+  );
+}
+
+// src/login/session.ts
+var DEFAULT_TTL_SECONDS2 = 300;
+async function generateSessionKey() {
+  const secret = hex(crypto.getRandomValues(new Uint8Array(32)));
+  return { publicKey: hex(await derivePublicKey(secret)), secret };
+}
+async function login(config) {
+  const baseUrl = config.nodeUrl.replace(/\/+$/, "");
+  const timeoutMs = config.timeoutMs ?? 1e4;
+  const request = async (path, init) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      const requestInit = { ...init, signal: controller.signal };
+      response = config.fetch ? await config.fetch(`${baseUrl}${path}`, requestInit) : await globalThis.fetch(`${baseUrl}${path}`, requestInit);
+    } catch (err) {
+      throw new HTTPError(
+        0,
+        err instanceof Error ? err.name : "NetworkError",
+        `${baseUrl}${path}`,
+        new Headers(),
+        err instanceof Error ? err.message : String(err)
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    const text = await response.text().catch(() => "");
+    if (!response.ok) {
+      throw new HTTPError(
+        response.status,
+        response.statusText,
+        `${baseUrl}${path}`,
+        response.headers,
+        text
+      );
+    }
+    return text ? JSON.parse(text) : {};
+  };
+  const challengeBody = await request("/auth/challenge", {
+    method: "GET",
+    headers: { Accept: "application/json" }
+  });
+  const challenge = challengeBody.challenge ?? challengeBody.data?.challenge;
+  if (!challenge) {
+    throw new Error("the node issued no challenge");
+  }
+  const session = await generateSessionKey();
+  const issuedAt = Math.floor(Date.now() / 1e3);
+  const statement = await signLoginStatement({
+    node: config.node,
+    audience: config.audience,
+    challenge,
+    sessionKey: session.publicKey,
+    issuedAt,
+    expiresAt: issuedAt + (config.ttlSeconds ?? DEFAULT_TTL_SECONDS2),
+    // Resolved once and handed on, so a config carrying a secret and a config
+    // carrying a `CryptoKey` take exactly the same path from here down.
+    signer: await resolveSigner(config.deviceSecret, config.signer, "deviceSecret")
+  });
+  const tokenBody = await request("/auth/token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      auth_method: "account_proof",
+      public_key: session.publicKey,
+      client_name: config.clientName ?? baseUrl,
+      timestamp: issuedAt,
+      provider_data: {
+        challenge,
+        login_statement: statement,
+        account_proof: config.accountProof
+      }
+    })
+  });
+  const accessToken = tokenBody.access_token ?? tokenBody.data?.access_token;
+  const refreshToken = tokenBody.refresh_token ?? tokenBody.data?.refresh_token;
+  if (!accessToken) {
+    throw new Error("the node minted no session");
+  }
+  return {
+    accessToken,
+    refreshToken: refreshToken ?? "",
+    sessionKey: session.publicKey,
+    sessionSecret: session.secret
+  };
+}
+
+// src/transport/relay-observer.ts
+var EXPIRY_SKEW_MS = 3e4;
+function defaultAudience() {
+  const origin = globalThis.location?.origin;
+  return origin ? { kind: "webOrigin", origin } : { kind: "cli" };
+}
+function jwtExpiryMs(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    while (b64.length % 4) b64 += "=";
+    const payload = JSON.parse(atob(b64));
+    return typeof payload.exp === "number" ? payload.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+var RelayObserver = class {
+  constructor(config) {
+    this.session = null;
+    this.sessionExpiresAt = null;
+    /** In-flight login, so two surfaces asking at once mint one session, not two. */
+    this.pending = null;
+    this.sseClient = null;
+    this.wsClient = null;
+    this.config = config;
+  }
+  /** The node key this observer logs in with. Read for diagnostics. */
+  get nodeKey() {
+    return this.config.nodeKey;
+  }
+  /**
+   * A usable access token, logging in if there is not one.
+   *
+   * Re-mints once the current token is within {@link EXPIRY_SKEW_MS} of
+   * expiring, and on every call when the token's lifetime cannot be read —
+   * reconnects are backed off, so an extra handshake costs far less than a
+   * stream that silently stops. The refresh token is *held* but not spent:
+   * rotating it is tracked in #87/#88 and a second login is correct in the
+   * meantime, where re-presenting an unrotated refresh token would not be.
+   */
+  async accessToken() {
+    const now = Date.now();
+    if (this.session && this.sessionExpiresAt !== null && this.sessionExpiresAt - EXPIRY_SKEW_MS > now) {
+      return this.session.accessToken;
+    }
+    if (!this.pending) {
+      this.pending = this.loginNow().finally(() => {
+        this.pending = null;
+      });
+    }
+    const session = await this.pending;
+    return session.accessToken;
+  }
+  async loginNow() {
+    const session = await login({
+      nodeUrl: this.config.nodeUrl,
+      node: this.config.nodeKey,
+      signer: await this.config.signer(),
+      accountProof: this.config.accountProof,
+      audience: this.config.audience,
+      clientName: this.config.clientName,
+      ttlSeconds: this.config.ttlSeconds,
+      fetch: this.config.fetch,
+      timeoutMs: this.config.timeoutMs
+    });
+    this.session = session;
+    this.sessionExpiresAt = jwtExpiryMs(session.accessToken);
+    return session;
+  }
+  /**
+   * SSE events over the relay node — the same `SseClient` a node client hands
+   * out, constructed the same way, so nothing downstream can tell which
+   * transport produced it.
+   */
+  get events() {
+    if (!this.sseClient) {
+      this.sseClient = new SseClient({
+        baseUrl: this.config.nodeUrl,
+        getAuthToken: () => this.accessToken()
+      });
+    }
+    return this.sseClient;
+  }
+  /** WebSocket events over the relay node. @experimental — prefer `events`. */
+  get ws() {
+    if (!this.wsClient) {
+      this.wsClient = new WsClient({
+        baseUrl: this.config.nodeUrl,
+        getAuthToken: () => this.accessToken()
+      });
+    }
+    return this.wsClient;
+  }
+  /** Close whatever was opened. Never touches the relay's write path. */
+  close() {
+    this.sseClient?.close();
+    this.wsClient?.close();
+  }
+};
+
+// src/request-proof/request-proof.ts
+var utf8 = (text) => new TextEncoder().encode(text);
+var REQUEST_SIGN_DOMAIN = utf8("calimero.auth.request.v1");
+var REQUEST_BODY_DOMAIN = utf8("calimero.auth.request.body.v1");
+var REQUEST_PROOF_HEADER = "X-Calimero-Proof";
+var DEFAULT_VALID_FOR = 300;
+async function signRequestProof(input) {
+  const { method, path, credential } = input;
+  if (!method) throw new Error("signRequestProof needs the method the request will use");
+  if (!path.startsWith("/")) {
+    throw new Error(`signRequestProof needs a path, got ${JSON.stringify(path)}`);
+  }
+  if (path.includes("?")) {
+    throw new Error(
+      `the path must carry no query string, got ${JSON.stringify(path)} \u2014 a query is excluded from the signature on purpose, because a proxy may rewrite one. Anything that must be bound belongs in the body.`
+    );
+  }
+  const bodyBytes2 = input.body === void 0 ? new Uint8Array() : typeof input.body === "string" ? utf8(input.body) : input.body;
+  const bodyHash = await domainHash(REQUEST_BODY_DOMAIN, [bodyBytes2]);
+  const issuedAt = Math.floor(input.now ?? Date.now() / 1e3);
+  const expiresAt = issuedAt + (input.validForSeconds ?? DEFAULT_VALID_FOR);
+  const payload = await domainHash(REQUEST_SIGN_DOMAIN, [
+    utf8(method),
+    utf8(path),
+    bodyHash,
+    u64le(issuedAt),
+    u64le(expiresAt)
+  ]);
+  const signature = await signPayload(payload, input);
+  if (signature.length !== 64) {
+    throw new Error(`the signer returned ${signature.length} bytes, not a 64-byte signature`);
+  }
+  const requestSig = concat(
+    u32le(utf8(method).length),
+    utf8(method),
+    u32le(utf8(path).length),
+    utf8(path),
+    bodyHash,
+    u64le(issuedAt),
+    u64le(expiresAt),
+    signature
+  );
+  const accountProof = hexToBytes(credential, "credential");
+  return hex(concat(accountProof, new Uint8Array([0]), requestSig));
+}
+async function signPayload(payload, input) {
+  if (input.signer) return input.signer.sign(payload);
+  if (!input.deviceSecret) {
+    throw new Error("signRequestProof needs either `deviceSecret` or `signer`");
+  }
+  const key = await importSigningKey(input.deviceSecret);
+  return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, key, payload));
+}
+function hexToBytes(value, label2) {
+  const clean = value.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+    throw new Error(`${label2} is not an even-length hex string`);
+  }
+  return fromHex(clean, label2, clean.length / 2);
+}
+
+// src/request-proof/authorizer.ts
+function createProofAuthorizer(credential) {
+  if (!credential.credential) {
+    throw new Error("a proof authorizer needs the `credential` from signDeviceCert");
+  }
+  if (!credential.deviceSecret && !credential.signer) {
+    throw new Error("a proof authorizer needs either `deviceSecret` or `signer`");
+  }
+  return async ({ method, path, body }) => {
+    const proof = await signRequestProof({
+      method,
+      path,
+      body,
+      credential: credential.credential,
+      deviceSecret: credential.deviceSecret,
+      signer: credential.signer,
+      validForSeconds: credential.validForSeconds
+    });
+    return { [REQUEST_PROOF_HEADER]: proof };
+  };
+}
+function signedPath(url) {
+  return new URL(url).pathname;
+}
+
+// src/transport/mero-client.ts
+function relayHasNo(surface, why) {
+  return new Error(
+    `this client was constructed with the relay transport, which has no ${surface}: ${why}. Construct a node client (createMeroClient({ baseUrl })) for that surface \u2014 nothing here will silently connect to a node you did not choose.`
+  );
+}
+function missingNodeKey(surface) {
+  return new Error(
+    `this relay-transport client cannot open ${surface}: it was given no relay node key. A relay is an ordinary node and does serve /sse and /ws \u2014 but the login statement must be signed against the node's device signing key, learned out of band (never read from the node, and never derived from its peerId). Pass it as \`observe: { nodeKey }\`. For a cloud-hosted relay the cloud does not publish it yet \u2014 see mdma #312.`
+  );
+}
+function buildObserver(relay, observe) {
+  const nodeKey = observe?.nodeKey;
+  if (!nodeKey) return null;
+  return new RelayObserver({
+    nodeUrl: observe?.nodeUrl ?? relay.relayUrl,
+    nodeKey,
+    accountProof: observe?.accountProof ?? relay.authorProof,
+    audience: observe?.audience ?? defaultAudience(),
+    signer: observe?.signer ? async () => observe.signer : () => relay.authorSigner(),
+    clientName: observe?.clientName,
+    ttlSeconds: observe?.ttlSeconds,
+    fetch: observe?.fetch,
+    timeoutMs: observe?.timeoutMs
+  });
+}
+var MeroClient = class {
+  constructor(config) {
+    /** The relay's event session, or `null` on a node client / with no node key. */
+    this.relayObserver = null;
+    /** Admin reads against the relay, when a session or a proof was supplied. */
+    this.relayAdmin = null;
+    /**
+     * Events off the relay authenticated by a request proof, built lazily.
+     *
+     * Separate from {@link relayObserver} rather than a mode inside it: the
+     * observer's whole subject is a session addressed to a node key, and a proof
+     * has neither. Holding the authorizer instead of the client keeps construction
+     * free of the first signature.
+     */
+    this.proofAuthorizer = null;
+    this.relayUrl = null;
+    this.proofEvents = null;
+    if (config.transport === "relay") {
+      this.transport = "relay";
+      this.nodeClient = null;
+      const relay = config.relay instanceof RelayClient ? config.relay : new RelayClient(config.relay);
+      this.relayObserver = buildObserver(relay, config.observe);
+      this.rpcTransport = new RelayTransport(relay, this.relayObserver);
+      this.relayUrl = relay.relayUrl;
+      if (config.proof) {
+        this.proofAuthorizer = createProofAuthorizer(config.proof);
+      }
+      if (config.session) {
+        const token = config.session;
+        this.relayAdmin = createAdminApiClient({
+          baseUrl: relay.relayUrl,
+          getAuthToken: typeof token === "string" ? async () => token : token
+        });
+      } else if (this.proofAuthorizer) {
+        const authorizeRequest = this.proofAuthorizer;
+        this.relayAdmin = createAdminApiClientFromHttpClient(
+          createHttpClient({
+            fetch: (url, init) => globalThis.fetch(url, init),
+            baseUrl: relay.relayUrl,
+            authorizeRequest
+          }),
+          { baseUrl: relay.relayUrl }
+        );
+      }
+      return;
+    }
+    this.transport = "node";
+    const { transport: _ignored, ...nodeConfig } = config;
+    this.nodeClient = new MeroJs(nodeConfig);
+    this.rpcTransport = this.nodeClient.rpc;
+  }
+  /**
+   * The write surface. Identical on both transports — this is the whole point.
+   *
+   * On a node this IS the `RpcClient` a `MeroJs` would have handed out, not a
+   * wrapper around it, so `client.rpc` and `client.node.rpc` are the same
+   * object.
+   */
+  get rpc() {
+    return this.rpcTransport;
+  }
+  /**
+   * Whether `events` / `ws` will work on this client.
+   *
+   * Always `true` on the node transport. On the relay transport it says whether
+   * a node key was supplied — the relay can be observed, but only by a caller
+   * who can name the key the login statement is signed against.
+   */
+  get canSubscribe() {
+    return this.rpcTransport.canSubscribe || this.proofAuthorizer !== null;
+  }
+  /** The underlying `MeroJs`. Node transport only. */
+  get node() {
+    if (!this.nodeClient) {
+      throw relayHasNo("node connection", "it holds a signing key and a relay URL, not a node");
+    }
+    return this.nodeClient;
+  }
+  /** The underlying `RelayClient`, for `describe()`. Relay transport only. */
+  get relay() {
+    if (!(this.rpcTransport instanceof RelayTransport)) {
+      throw new Error("this client was constructed with the node transport and has no relay");
+    }
+    return this.rpcTransport.client;
+  }
+  /**
+   * Admin API. Node transport only.
+   *
+   * Two different things live behind this accessor today, and only one of them
+   * is genuinely unavailable through a relay.
+   *
+   * The **mutations** — `createNamespace`, `setMemberCapabilities`,
+   * `upgradeGroup` and the rest — are operator actions on somebody else's
+   * machine. A keyholder does not get those, and should not; admin is for
+   * admins.
+   *
+   * The **reads** are a different matter. `getContext`, `getContexts`,
+   * `getApplication`, `listNamespaces`, `getBlob` are an app asking what it is
+   * looking at, not an operator administering anything. They sit under
+   * `/admin-api/` for historical reasons, and a delegated session is refused
+   * them (measured: `403`, while the same session reads context state through
+   * `POST /contexts/{ctx}/query` and writes through `/intents` quite happily).
+   *
+   * So this is the one place where "the same code runs on both transports"
+   * does not hold yet, and it is a missing surface rather than a missing
+   * permission. A transport-independent read API is designed but not built; the
+   * throw below is deliberate until it exists, because the alternative — quietly
+   * reaching for a node the caller did not choose — is worse than a clear stop.
+   */
+  /**
+   * The admin surface.
+   *
+   * On a node client this is the node's own. On a relay client it exists only
+   * when a `session` was supplied, and it is **the relay's admin API
+   * authenticated as the account** — so the caller-scoped reads answer:
+   * `getContexts` and `listNamespaces` return this account's own, because
+   * `account_proof` grants `context:list-own` and `namespace:list-own`.
+   *
+   * Mutations are not filtered out here, deliberately. A delegated session does
+   * not carry the grants they require, so the node refuses them with a `403`
+   * that names the missing permission — which is a better answer than a
+   * client-side guess, and keeps the policy in the one place that owns it.
+   */
+  get admin() {
+    if (this.nodeClient) return this.nodeClient.admin;
+    if (this.relayAdmin) return this.relayAdmin;
+    throw new Error(
+      "this relay-transport client has no admin surface because it was given neither a `proof` nor a `session`. A warrant authorises one intent and is not a credential for reading. The caller-scoped reads (getContexts, listNamespaces) want one of the other two: pass `proof: { credential, deviceSecret }` \u2014 the device cert you already hold, which needs no login and no node key \u2014 or a `session` minted with `login()`. Context STATE reads work through execute/query either way."
+    );
+  }
+  /** Auth API. Node transport only — a relay issues no node credential. */
+  get auth() {
+    return this.node.auth;
+  }
+  /**
+   * SSE events — on **both** transports.
+   *
+   * On a relay client this is an `SseClient` against the relay node, fed by a
+   * session minted with the author's account proof. The session is minted
+   * lazily, on the first token the stream asks for, so reading this getter
+   * performs no network call.
+   *
+   * Throws only when the relay client was given no node key: the one input
+   * that cannot be inferred. See {@link missingNodeKey}.
+   */
+  get events() {
+    if (this.nodeClient) return this.nodeClient.events;
+    if (this.relayObserver) return this.relayObserver.events;
+    if (this.proofAuthorizer && this.relayUrl) {
+      this.proofEvents ?? (this.proofEvents = new SseClient({
+        baseUrl: this.relayUrl,
+        authorize: this.proofAuthorizer
+      }));
+      return this.proofEvents;
+    }
+    throw missingNodeKey("SSE events");
+  }
+  /** WebSocket events, on both transports. @experimental — prefer `events`. */
+  get ws() {
+    if (this.nodeClient) return this.nodeClient.ws;
+    if (this.relayObserver) return this.relayObserver.ws;
+    if (this.proofAuthorizer) {
+      throw new Error(
+        "this client authenticates with a request proof, which cannot open a WebSocket from a browser: `WebSocket` cannot set the X-Calimero-Proof header, and core's guard reads the proof from a header only (the ?token= query parameter is the session equivalent and has no proof counterpart). Use `client.events` \u2014 SSE is fetch-based, carries the header, and is the recommended transport anyway."
+      );
+    }
+    throw missingNodeKey("WebSocket events");
+  }
+  /**
+   * Ephemeral presence. Node transport only.
+   *
+   * Not extended to the relay even though a logged-in session could reach both
+   * halves of it mechanically. Publishing resolves the author from an *owned
+   * context identity on the node*, and whether a delegated session has one has
+   * not been established — a presence client that silently published nothing,
+   * or published as the wrong identity, is worse than one that says it is not
+   * available. The read half is not lost: presence arrives on `client.events`
+   * like any other context event, and can be filtered there.
+   *
+   * The rejected alternative was to expose it over the relay session and let
+   * `set` fail at the node. That trades a clear construction-time answer for a
+   * runtime failure inside a UI that has already rendered.
+   */
+  get ephemeral() {
+    if (!this.nodeClient) {
+      throw relayHasNo(
+        "ephemeral presence",
+        "publishing resolves the author from an owned context identity on the node, which a delegated session is not known to have \u2014 read presence off `client.events` instead"
+      );
+    }
+    return this.nodeClient.ephemeral;
+  }
+  /**
+   * Calimero Cloud.
+   *
+   * Available on both transports, because it is neither: the cloud session is
+   * independent of the node credential and of the relay's signing key, and a
+   * relay-transport app still needs it to list namespaces and manage billing.
+   */
+  get cloud() {
+    if (!this.nodeClient) {
+      throw relayHasNo(
+        "bundled cloud client",
+        "a relay client is built from a cloud connection rather than owning one \u2014 reach it through the `cloud` field that `connectCloud` returns, or construct a `CloudClient` directly"
+      );
+    }
+    return this.nodeClient.cloud;
+  }
+  /**
+   * Release whatever the transport is holding.
+   *
+   * Safe on a relay client, where there is nothing open to close — a caller
+   * that tears down on unmount should not have to know which transport it got.
+   */
+  close() {
+    this.nodeClient?.close();
+    this.relayObserver?.close();
+    this.proofEvents?.close();
+  }
+};
+function createMeroClient(config) {
+  return new MeroClient(config);
+}
+
+// src/relay/nonce-source.ts
+function createMemoryNonceSource(start = 1) {
+  let next = BigInt(start);
+  if (next < 1n) {
+    throw new Error("nonce sequence starts at 1");
+  }
+  return {
+    next() {
+      const value = next;
+      next += 1n;
+      return Promise.resolve(value);
+    },
+    advanceTo(floor) {
+      if (floor > next) next = floor;
+      return Promise.resolve();
+    }
+  };
+}
+function createLocalStorageNonceSource(key, storage) {
+  const store = storage ?? globalThis.localStorage;
+  if (!store) {
+    throw new Error(
+      "no localStorage in this runtime: pass a storage implementation, or use createMemoryNonceSource for a process that owns its whole sequence"
+    );
+  }
+  const lastHandedOut = () => {
+    const raw = store.getItem(key);
+    if (raw === null || raw === "") return 0n;
+    try {
+      const parsed = BigInt(raw);
+      return parsed > 0n ? parsed : 0n;
+    } catch {
+      return 0n;
+    }
+  };
+  return {
+    next() {
+      const value = lastHandedOut() + 1n;
+      store.setItem(key, value.toString());
+      return Promise.resolve(value);
+    },
+    advanceTo(floor) {
+      const wanted = floor > 0n ? floor - 1n : 0n;
+      if (wanted > lastHandedOut()) store.setItem(key, wanted.toString());
+      return Promise.resolve();
+    }
+  };
+}
+function authorNonceLookup(options) {
+  return {
+    getWarrantNonce: (contextId, _authorDeviceKey) => options.client.getWarrantNonceAsAuthor(contextId, options.authorProof)
+  };
+}
+var WarrantNonceExhaustedError = class extends Error {
+  constructor(contextId, authorDeviceKey) {
+    super(
+      `author device ${authorDeviceKey} has spent every nonce in context ${contextId}; it must re-key to write again`
+    );
+    this.contextId = contextId;
+    this.authorDeviceKey = authorDeviceKey;
+    this.name = "WarrantNonceExhaustedError";
+  }
+};
+function createRecoveringNonceSource(options) {
+  const lookups = Array.isArray(options.lookups) ? options.lookups : [options.lookups];
+  if (lookups.length === 0) {
+    throw new Error("a recovering nonce source needs at least one node to ask");
+  }
+  const local = options.local ?? createMemoryNonceSource(1);
+  const onLookupFailure = options.onLookupFailure ?? "throw";
+  let floor = null;
+  let pending = null;
+  const resolveFloor = async () => {
+    const answers = await Promise.allSettled(
+      lookups.map(
+        (lookup) => lookup.getWarrantNonce(options.contextId, options.authorDeviceKey)
+      )
+    );
+    let highest = null;
+    let exhausted = false;
+    for (const answer of answers) {
+      if (answer.status !== "fulfilled") continue;
+      const state = answer.value;
+      if (state.kind === "exhausted") {
+        exhausted = true;
+        continue;
+      }
+      if (highest === null || state.nextNonce > highest) highest = state.nextNonce;
+    }
+    if (highest === null && exhausted) {
+      throw new WarrantNonceExhaustedError(options.contextId, options.authorDeviceKey);
+    }
+    if (highest === null) {
+      const first = answers.find((a) => a.status === "rejected");
+      const reason = first && first.status === "rejected" ? first.reason : void 0;
+      if (onLookupFailure === "local") {
+        floor = 0n;
+        return;
+      }
+      throw reason instanceof Error ? reason : new Error(`no node could answer where the warrant-nonce sequence stands: ${String(reason)}`);
+    }
+    floor = highest;
+    await local.advanceTo?.(highest);
+  };
+  return {
+    async next() {
+      if (floor === null) {
+        pending ?? (pending = resolveFloor().finally(() => {
+          pending = null;
+        }));
+        await pending;
+      }
+      const mine = await local.next();
+      const value = floor !== null && floor > mine ? floor : mine;
+      floor = value + 1n;
+      return value;
+    },
+    async advanceTo(wanted) {
+      if (floor === null || wanted > floor) floor = wanted;
+      await local.advanceTo?.(wanted);
+    }
+  };
+}
+
+// src/sealed/noise.ts
+var PROTOCOL_NAME = "Noise_NK_25519_AESGCM_SHA256";
+var DH_LEN = 32;
+var TAG_LEN = 16;
+var PKCS8_X25519_PREFIX = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  110,
+  4,
+  34,
+  4,
+  32
+]);
+var SymmetricState = class _SymmetricState {
+  constructor(h) {
+    this.k = null;
+    this.n = 0;
+    this.ck = h;
+    this.h = h;
+  }
+  static async initialize() {
+    const name = new TextEncoder().encode(PROTOCOL_NAME);
+    const h = new Uint8Array(32);
+    h.set(name);
+    return new _SymmetricState(h);
+  }
+  async mixHash(data) {
+    this.h = await sha256(concat(this.h, data));
+  }
+  async mixKey(inputKeyMaterial) {
+    const [ck, key] = await hkdf2(this.ck, inputKeyMaterial);
+    this.ck = ck;
+    this.k = await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["encrypt", "decrypt"]);
+    this.n = 0;
+  }
+  async encryptAndHash(plaintext) {
+    if (!this.k) throw new Error("Noise: no cipher key yet");
+    const ciphertext = new Uint8Array(
+      await crypto.subtle.encrypt(
+        { name: "AES-GCM", iv: noiseNonce(this.n), additionalData: this.h },
+        this.k,
+        plaintext
+      )
+    );
+    this.n += 1;
+    await this.mixHash(ciphertext);
+    return ciphertext;
+  }
+  async decryptAndHash(ciphertext) {
+    if (!this.k) throw new Error("Noise: no cipher key yet");
+    const plaintext = new Uint8Array(
+      await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: noiseNonce(this.n), additionalData: this.h },
+        this.k,
+        ciphertext
+      )
+    );
+    this.n += 1;
+    await this.mixHash(ciphertext);
+    return plaintext;
+  }
+  /** The initiator-to-responder key, then the responder-to-initiator key. */
+  split() {
+    return hkdf2(this.ck, new Uint8Array());
+  }
+};
+async function initiate(remoteStatic, prologue, fixedEphemeral) {
+  const state = await SymmetricState.initialize();
+  await state.mixHash(prologue);
+  await state.mixHash(remoteStatic);
+  const ephemeral = await x25519KeyPair(fixedEphemeral);
+  await state.mixHash(ephemeral.publicKey);
+  await state.mixKey(await dh(ephemeral.privateKey, remoteStatic));
+  const message1 = concat(ephemeral.publicKey, await state.encryptAndHash(new Uint8Array()));
+  return {
+    message1,
+    async finish(message2) {
+      if (message2.length < DH_LEN + TAG_LEN) throw new Error("Noise: message 2 is too short");
       const remoteEphemeral = message2.slice(0, DH_LEN);
       await state.mixHash(remoteEphemeral);
       await state.mixKey(await dh(ephemeral.privateKey, remoteEphemeral));
@@ -7651,7 +8853,7 @@ var MAX_HANDSHAKE_REPLY = 1024;
 var RENEW_BEFORE_MS = 6e4;
 var TRANSPORT_BINDING_DOMAIN = "calimero.tee-attest.transport-key.v1";
 var NULL_BODY_STATUSES = [101, 204, 205, 304];
-var utf8 = new TextEncoder();
+var utf82 = new TextEncoder();
 var StaleTransportKeyError = class extends Error {
   constructor() {
     super("The node no longer holds the attested transport key; attest again for the current one");
@@ -7659,18 +8861,18 @@ var StaleTransportKeyError = class extends Error {
   }
 };
 var SealedTransportError = class extends Error {
-  constructor(status, code, message, retryAfterMs) {
+  constructor(status, code, message, retryAfterMs2) {
     super(message);
     this.status = status;
     this.code = code;
-    this.retryAfterMs = retryAfterMs;
+    this.retryAfterMs = retryAfterMs2;
     this.name = "SealedTransportError";
   }
 };
 async function transportKeyBinding(inner, transportKey) {
   const digest = await crypto.subtle.digest(
     "SHA-256",
-    concat(utf8.encode(TRANSPORT_BINDING_DOMAIN), inner, transportKey)
+    concat(utf82.encode(TRANSPORT_BINDING_DOMAIN), inner, transportKey)
   );
   return new Uint8Array(digest);
 }
@@ -7874,7 +9076,7 @@ function nonce(requestId, index) {
   return bytes;
 }
 function joinInner(head, body) {
-  const encoded = utf8.encode(JSON.stringify(head));
+  const encoded = utf82.encode(JSON.stringify(head));
   const len = new Uint8Array(4);
   new DataView(len.buffer).setUint32(0, encoded.length, false);
   return concat(len, encoded, body);
@@ -7983,8 +9185,8 @@ async function envelopeRefusal(response) {
   }
   if (code === "stale_transport_key") return new StaleTransportKeyError();
   const retryAfter = Number(response.headers.get("retry-after"));
-  const retryAfterMs = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter, 5) * 1e3 : void 0;
-  return new SealedTransportError(response.status, code, message, retryAfterMs);
+  const retryAfterMs2 = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter, 5) * 1e3 : void 0;
+  return new SealedTransportError(response.status, code, message, retryAfterMs2);
 }
 
 // src/cloud/connect.ts
@@ -7992,6 +9194,7 @@ async function connectCloud(options) {
   if (!options.sessionToken && !options.googleIdToken) {
     throw new Error("connectCloud needs either a sessionToken or a googleIdToken");
   }
+  const signer = await resolveSigner(options.deviceSecret, options.signer, "deviceSecret");
   const cloud = new CloudClient({
     cloudBaseUrl: options.cloudBaseUrl,
     sessionToken: options.sessionToken,
@@ -8017,8 +9220,8 @@ async function connectCloud(options) {
     executorAccount: relayInfo.executorAccount,
     authorAccount: options.authorAccount,
     authorProof: options.authorProof,
-    deviceSecret: options.deviceSecret,
-    nonces: options.nonces ?? await defaultNonceSource(options.deviceSecret),
+    signer,
+    nonces: options.nonces ?? defaultNonceSource(signer.publicKey),
     ttlSeconds: options.ttlSeconds,
     // Only the relay is sealed: a sealed fetch is bound to one node and refuses
     // any other URL, and the cloud calls above carry no intent.
@@ -8035,9 +9238,50 @@ async function connectCloud(options) {
     namespaceId: namespace.namespaceId,
     namespace,
     relayInfo,
-    execute: (contextId, method, argsJson) => relay.execute(contextId, method, argsJson)
+    execute: (contextId, method, argsJson) => relay.execute(contextId, method, argsJson),
+    // Built from the same `relay`, not a second one: one nonce sequence, one
+    // warrant signer. Two clients over one relay would hand out the same nonce
+    // twice and have the network refuse the loser as a replay.
+    //
+    // `observe` is always passed, with whatever key is known — the caller's if
+    // they had one, otherwise the cloud's, which is `null` until mdma #312. One
+    // code path rather than two, so the hosted case starts observing the day
+    // the field appears, without a line changing here or at the call site.
+    client: new MeroClient({
+      transport: "relay",
+      relay,
+      observe: {
+        nodeKey: options.relayNodeKey ?? relayInfo.nodeKey,
+        audience: options.observeAudience,
+        fetch: options.fetch,
+        timeoutMs: options.timeoutMs
+      }
+    })
   };
 }
+async function connectCloudWithAccount(options) {
+  const { root, authorAccount, ...rest } = options;
+  const signer = await resolveSigner(rest.deviceSecret, rest.signer, "deviceSecret");
+  const resolved = await resolveRoot(root);
+  const cloud = new CloudClient({
+    cloudBaseUrl: options.cloudBaseUrl,
+    // Reported here as well as on the connection's own client: this is where
+    // the session is first minted, and a caller persisting it would otherwise
+    // only hear about the rolling refreshes of a token it never saw.
+    onSession: options.onSession,
+    fetch: options.fetch,
+    timeoutMs: options.timeoutMs
+  });
+  const session = await cloud.signInWithAccount(resolved.signer);
+  return connectCloud({
+    ...rest,
+    // Already resolved above, and passing both forms on would be refused.
+    deviceSecret: void 0,
+    signer,
+    sessionToken: session.sessionToken,
+    authorAccount: authorAccount ?? resolved.accountId
+  });
+}
 function pickNamespace(namespaces, requested) {
   if (requested) {
     const found = namespaces.find((n) => n.namespaceId === requested);
@@ -8068,19 +9312,181 @@ function explainNoRelay(namespace, relays) {
   if (replicas.length === relays.length) {
     return `every node on namespace ${namespace.namespaceId} is a read-only TEE replica (ReadOnlyTee), which never relays delegated writes: an admin of the namespace must set its TEE admission policy with mode: 'relay' \u2014 AdminClient.setTeeAdmissionPolicy(namespaceId, { ..., mode: 'relay' }) \u2014 so fleet nodes are admitted as RelayTee`;
   }
-  const waitingOnGrant = relays.filter((r) => r.teeRole === null && !r.authorshipReady);
-  if (waitingOnGrant.length > 0 && waitingOnGrant.length + replicas.length === relays.length) {
-    return `every relay on namespace ${namespace.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${waitingOnGrant.map((r) => r.executorAccount ?? r.peerId).join(", ") || "the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`;
+  const waitingOnGrant = relays.filter((r) => r.teeRole === null && !r.authorshipReady);
+  if (waitingOnGrant.length > 0 && waitingOnGrant.length + replicas.length === relays.length) {
+    return `every relay on namespace ${namespace.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${waitingOnGrant.map((r) => r.executorAccount ?? r.peerId).join(", ") || "the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`;
+  }
+  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none is ready to relay yet (a URL, an executor account and a recent heartbeat) \u2014 retry shortly`;
+}
+function defaultNonceSource(devicePublicKey) {
+  const key = `mero-js:warrant-nonce:${devicePublicKey}`;
+  try {
+    return createLocalStorageNonceSource(key);
+  } catch {
+    return createMemoryNonceSource(1);
+  }
+}
+
+// src/cloud/link-redirect.ts
+var DEFAULT_CLOUD_WEB_URL = "https://cloud.calimero.network";
+function cloudLinkUrl(options) {
+  if (!/^[0-9a-f]{64}$/.test(options.accountId)) {
+    throw new Error("accountId must be 64 lowercase hex characters");
+  }
+  const url = new URL(options.cloudWebUrl ?? DEFAULT_CLOUD_WEB_URL);
+  url.searchParams.set("link-account", options.accountId);
+  url.searchParams.set("callback-url", options.returnTo);
+  return url.toString();
+}
+function beginCloudLink(options) {
+  window.location.assign(cloudLinkUrl(options));
+  throw new Error("redirecting to the cloud to authorise this link");
+}
+function readCloudLinkCallback(location2 = window.location) {
+  const params = new URLSearchParams(location2.hash.replace(/^#/, ""));
+  const error = params.get("error");
+  if (error) {
+    stripFragment();
+    throw new Error(
+      error === "denied" ? "the account link was declined at the cloud" : `the cloud refused this link: ${error}`
+    );
+  }
+  const grant = params.get("grant");
+  const account = params.get("account");
+  if (!grant || !account) return null;
+  stripFragment();
+  return { grant, account };
+}
+function stripFragment() {
+  if (typeof history === "undefined" || !history.replaceState) return;
+  history.replaceState(null, "", location.pathname + location.search);
+}
+async function completeCloudLink(options) {
+  const root = await resolveRoot(options.root);
+  if (root.accountId !== options.account) {
+    throw new Error(
+      `this grant is for account ${options.account}, but the root here derives ${root.accountId} \u2014 it was minted for a different account`
+    );
+  }
+  const cloud = new CloudClient({
+    cloudBaseUrl: options.cloudBaseUrl,
+    fetch: options.fetch
+  });
+  return cloud.linkAccountWithGrant({ grant: options.grant, signer: root.signer });
+}
+
+// src/cloud/enrol-redirect.ts
+var DEVICE_PARAM = "enrol-device";
+var KEM_PARAM = "enrol-kem";
+var CALLBACK_PARAM = "callback-url";
+var STATE_PARAM = "state";
+function deviceEnrolmentUrl(options) {
+  assertHex(options.devicePublicKey, "devicePublicKey");
+  assertHex(options.kemPublicKey, "kemPublicKey");
+  assertSafeReturnTo(options.returnTo);
+  warnOnForeignCallback(options.returnTo);
+  const url = new URL(options.walletUrl);
+  url.searchParams.set(DEVICE_PARAM, options.devicePublicKey);
+  url.searchParams.set(KEM_PARAM, options.kemPublicKey);
+  url.searchParams.set(CALLBACK_PARAM, options.returnTo);
+  if (options.state) url.searchParams.set(STATE_PARAM, options.state);
+  return url.toString();
+}
+function beginDeviceEnrolment(options) {
+  window.location.assign(deviceEnrolmentUrl(options));
+  throw new Error("redirecting to the wallet to approve this device");
+}
+function readEnrolmentCallback(location2 = window.location) {
+  const params = new URLSearchParams(location2.hash.replace(/^#/, ""));
+  const error = params.get("error");
+  if (error) {
+    stripFragment2();
+    throw new Error(
+      error === "denied" || error === "cancelled" ? "the device was not approved at the wallet" : `the wallet refused this enrolment: ${error}`
+    );
+  }
+  const credential = params.get("credential");
+  const account = params.get("account");
+  const device = params.get("device");
+  if (!credential || !account || !device) return null;
+  stripFragment2();
+  const state = params.get("state");
+  return { credential, account, device, ...state ? { state } : {} };
+}
+function stripFragment2() {
+  if (typeof history === "undefined" || !history.replaceState) return;
+  history.replaceState(null, "", location.pathname + location.search);
+}
+async function completeDeviceEnrolment(options) {
+  if (options.expectState !== void 0 && options.expectState !== options.state) {
+    throw new Error(
+      "this enrolment answers a request this app did not make \u2014 the state it carries is not the one sent"
+    );
+  }
+  const certificate = await verifyDeviceCredential(options.credential);
+  if (certificate.signPublicKey !== normaliseHex(options.devicePublicKey)) {
+    throw new Error(
+      `this credential certifies device key ${certificate.signPublicKey}, but this app holds ${normaliseHex(options.devicePublicKey)} \u2014 it would sign with a key the certificate does not cover`
+    );
+  }
+  if (options.kemPublicKey !== void 0 && certificate.kemPublicKey !== normaliseHex(options.kemPublicKey)) {
+    throw new Error(
+      `this credential names delivery key ${certificate.kemPublicKey}, not the one this app asked about \u2014 group keys would be sealed to somebody else`
+    );
+  }
+  if (certificate.account !== normaliseHex(options.account)) {
+    throw new Error(
+      `the wallet reported account ${normaliseHex(options.account)}, but the credential names ${certificate.account}`
+    );
+  }
+  if (certificate.device !== normaliseHex(options.device)) {
+    throw new Error(
+      `the wallet reported device ${normaliseHex(options.device)}, but the credential names ${certificate.device}`
+    );
+  }
+  return {
+    credential: options.credential,
+    account: certificate.account,
+    device: certificate.device,
+    certificate
+  };
+}
+function assertHex(value, label2) {
+  if (!/^[0-9a-f]{64}$/.test(value)) {
+    throw new Error(`${label2} must be 64 lowercase hex characters`);
   }
-  return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none is ready to relay yet (a URL, an executor account and a recent heartbeat) \u2014 retry shortly`;
 }
-async function defaultNonceSource(deviceSecret) {
-  const key = `mero-js:warrant-nonce:${hex(await derivePublicKey(deviceSecret))}`;
+function normaliseHex(value) {
+  return value.trim().toLowerCase();
+}
+function callbackIsForeign(returnTo, pageOrigin) {
+  const here = pageOrigin ?? (typeof window === "undefined" ? void 0 : window.location.origin);
+  if (!here) return false;
   try {
-    return createLocalStorageNonceSource(key);
+    return new URL(returnTo).origin !== here;
   } catch {
-    return createMemoryNonceSource(1);
+    return false;
+  }
+}
+function warnOnForeignCallback(returnTo) {
+  if (!callbackIsForeign(returnTo)) return;
+  console.warn(
+    `[calimero] enrolling a device but sending the credential to ${new URL(returnTo).origin}, which is not this page's origin. Legitimate when deliberate; worth a second look otherwise.`
+  );
+}
+function assertSafeReturnTo(returnTo) {
+  let url;
+  try {
+    url = new URL(returnTo);
+  } catch {
+    throw new Error(`returnTo must be an absolute URL, got ${returnTo}`);
   }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol === "https:") return;
+  if (url.protocol === "http:" && loopback) return;
+  throw new Error(
+    `returnTo must be https:, or http: on localhost \u2014 got ${url.protocol}//${url.hostname}`
+  );
 }
 
 // src/sealed/verify.ts
@@ -8451,7 +9857,7 @@ var FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
 var SAN_URI = 134;
 var UTF8_STRING = 12;
 var SEQUENCE2 = 48;
-var utf82 = new TextEncoder();
+var utf83 = new TextEncoder();
 var fromUtf8 = (bytes) => new TextDecoder().decode(bytes);
 async function verifyCosignBundle(body, bundle, signer, signature) {
   const { base64Signature, cert, rekorBundle } = cosignBundle(bundle);
@@ -8464,7 +9870,7 @@ async function verifyCosignBundle(body, bundle, signer, signature) {
   const leaf = parseCertificate(leafDer);
   const log = REKOR_LOGS.find((candidate) => candidate.logId === payload.logID.toLowerCase());
   if (!log) throw new Error(`The bundle names Rekor log ${payload.logID}, which the Sigstore trust root does not know`);
-  const canonical = utf82.encode(
+  const canonical = utf83.encode(
     `{"body":${JSON.stringify(payload.body)},"integratedTime":${payload.integratedTime},"logID":${JSON.stringify(payload.logID)},"logIndex":${payload.logIndex}}`
   );
   const setVerifies = await verifyEcdsa(
@@ -8768,6 +10174,101 @@ function splitVersion2(version) {
   return [[Number(match[1]), Number(match[2]), Number(match[3])], match[4]];
 }
 
+// src/invitation/invitation.ts
+var MAX_INVITATION_VALIDITY_SECS = 24 * 60 * 60;
+var INVITED_ROLE = { Admin: 0, Member: 1, ReadOnly: 2 };
+function encodeGroupInvitation(body) {
+  const admitters = body.admitters ?? [];
+  return concat(
+    // `SignerId` and `ContextGroupId` cross JSON as 32 numbers; `AccountId`
+    // crosses as hex. Same width, different spelling.
+    bytes32(body.inviter_identity, "inviter_identity"),
+    bytes32(body.group_id, "group_id"),
+    u64le(body.expiration_timestamp),
+    bytes32(body.secret_salt, "secret_salt"),
+    new Uint8Array([body.invited_role]),
+    u32le(admitters.length),
+    ...admitters.map((a, i) => fromHex(a, `admitters[${i}]`, 32))
+  );
+}
+async function groupInvitationHash(body) {
+  return new Uint8Array(
+    await crypto.subtle.digest("SHA-256", encodeGroupInvitation(body))
+  );
+}
+function defaultAdmitters(members) {
+  const admins = new Set(
+    members.filter((m) => m.role === "Admin").map((m) => m.identity.toLowerCase())
+  );
+  return [...admins].sort();
+}
+async function signGroupInvitation(input) {
+  const signer = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
+  const inviterKey = fromHex(signer.publicKey, "signer.publicKey", 32);
+  const groupId = fromHex(input.groupId, "groupId", 32);
+  fromHex(input.inviterAccount, "inviterAccount", 32);
+  let admitters = [...input.admitters ?? []].map((a) => a.trim().toLowerCase());
+  if (admitters.length === 0) {
+    if (!input.members) {
+      throw new Error(
+        "name the admitters, or pass the group members to default them to its admins: an invitation with no admitters is claimable by broadcast"
+      );
+    }
+    admitters = defaultAdmitters(input.members);
+    if (admitters.length === 0) {
+      throw new Error(
+        "the member list names no admin, so there is nobody to default the admitters to"
+      );
+    }
+  }
+  admitters.forEach((a, i) => fromHex(a, `admitters[${i}]`, 32));
+  const invitedRole = input.invitedRole ?? INVITED_ROLE.Member;
+  if (![0, 1, 2].includes(invitedRole)) {
+    throw new Error(`invitedRole must be 0 (Admin), 1 (Member) or 2 (ReadOnly), got ${invitedRole}`);
+  }
+  const now = input.now ?? Math.floor(Date.now() / 1e3);
+  const validFor = Math.min(
+    input.validForSecs ?? MAX_INVITATION_VALIDITY_SECS,
+    MAX_INVITATION_VALIDITY_SECS
+  );
+  if (!Number.isInteger(validFor) || validFor <= 0) {
+    throw new Error(`validForSecs must be a positive whole number, got ${input.validForSecs}`);
+  }
+  const nonce2 = input.nonce ?? crypto.getRandomValues(new Uint8Array(32));
+  if (nonce2.length !== 32) {
+    throw new Error(`nonce must be 32 bytes, got ${nonce2.length}`);
+  }
+  const invitation = {
+    inviter_identity: Array.from(inviterKey),
+    group_id: Array.from(groupId),
+    expiration_timestamp: now + validFor,
+    secret_salt: Array.from(nonce2),
+    invited_role: invitedRole,
+    admitters
+  };
+  const signature = await signer.sign(await groupInvitationHash(invitation));
+  if (signature.length !== 64) {
+    throw new Error(`signer returned ${signature.length} bytes, expected a 64-byte Ed25519 signature`);
+  }
+  const signed = {
+    invitation,
+    inviter_signature: hex(signature),
+    inviter_account: input.inviterAccount.trim().toLowerCase()
+  };
+  if (input.admitterAddrs?.length) signed.admitter_addrs = [...input.admitterAddrs];
+  if (input.applicationId) {
+    signed.application_id = Array.from(fromHex(input.applicationId, "applicationId", 32));
+  }
+  if (input.appKey) signed.app_key = Array.from(fromHex(input.appKey, "appKey", 32));
+  return signed;
+}
+function bytes32(value, label2) {
+  if (value.length !== 32) {
+    throw new Error(`${label2} must be 32 bytes, got ${value.length}`);
+  }
+  return new Uint8Array(value);
+}
+
 // src/namespace-op/namespace-op.ts
 var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 16;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
@@ -8785,12 +10286,6 @@ var ROOT_OP2 = {
   NamespaceCreatedV2: 9,
   MemberJoinedViaTeeAttestation: 10
 };
-function bytes32(value, label2) {
-  if (value.length !== 32) {
-    throw new Error(`${label2} must be 32 bytes, got ${value.length}`);
-  }
-  return new Uint8Array(value);
-}
 function optionalBytes32(value, label2) {
   if (value === null || value === void 0) {
     return new Uint8Array([0]);
@@ -8806,21 +10301,11 @@ function borshString2(value) {
 }
 function encodeSignedInvitation(signed) {
   const body = signed.invitation;
-  const admitters = body.admitters ?? [];
   const admitterAddrs = signed.admitter_addrs ?? [];
   return concat(
-    // GroupInvitationFromAdmin.
-    //
-    // `SignerId` and `ContextGroupId` cross JSON as 32 numbers; `AccountId`
-    // crosses as hex. Same width, different spelling, and reading either the
-    // wrong way yields 32 bytes that encode cleanly and verify as nothing.
-    bytes32(body.inviter_identity, "inviter_identity"),
-    bytes32(body.group_id, "group_id"),
-    u64le(body.expiration_timestamp),
-    bytes32(body.secret_salt, "secret_salt"),
-    new Uint8Array([body.invited_role]),
-    u32le(admitters.length),
-    ...admitters.map((a, i) => fromHex(a, `admitters[${i}]`, 32)),
+    // GroupInvitationFromAdmin, from the one encoder the SDK's own invitation
+    // signer uses: the bytes signed and the bytes carried must not drift.
+    encodeGroupInvitation(body),
     // ...then the enclosing SignedGroupOpenInvitation, in declaration order.
     // `inviter_account` sits between the signature and the addresses; putting it
     // anywhere else still encodes 32 bytes and still verifies as nothing.
@@ -8859,186 +10344,22 @@ async function signMemberJoinOp(input) {
     credential
   );
   const op = concat(new Uint8Array([NAMESPACE_OP_ROOT]), rootOp);
-  const key = await importSigningKey(input.deviceSecret);
-  const signer = await derivePublicKey(input.deviceSecret);
+  const signingKey = await resolveSigner(input.deviceSecret, input.signer, "deviceSecret");
+  const signerPublicKey = fromHex(signingKey.publicKey, "signer.publicKey", 32);
   const signable = concat(
     new Uint8Array([SIGNED_NAMESPACE_OP_SCHEMA_VERSION]),
     fromHex(input.namespaceId, "namespaceId", 32),
     u32le(parents.length),
     ...parents.map((p, i) => fromHex(p, `parentOpHashes[${i}]`, 32)),
-    signer,
+    signerPublicKey,
     u64le(input.nonce),
     op
   );
-  const signature = new Uint8Array(
-    await crypto.subtle.sign("Ed25519", key, concat(NAMESPACE_SIGN_DOMAIN, signable))
-  );
+  const signature = await signingKey.sign(concat(NAMESPACE_SIGN_DOMAIN, signable));
   const unendorsed = new Uint8Array([0]);
   return hex(concat(signable, signature, unendorsed));
 }
 
-// src/login/login.ts
-var SIGN_DOMAIN5 = new TextEncoder().encode("calimero.auth.login.v1");
-var AUDIENCE_TAG = {
-  webOrigin: 0,
-  codeSigningId: 1,
-  cli: 2
-};
-function audienceBody(audience) {
-  const encoder = new TextEncoder();
-  switch (audience.kind) {
-    case "webOrigin":
-      return encoder.encode(audience.origin);
-    case "codeSigningId":
-      return encoder.encode(audience.id);
-    case "cli":
-      return new Uint8Array(0);
-  }
-}
-function audienceSigningBytes(audience) {
-  return concat(
-    Uint8Array.from([AUDIENCE_TAG[audience.kind]]),
-    audienceBody(audience)
-  );
-}
-function audienceWire(audience) {
-  const tag2 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
-  if (audience.kind === "cli") {
-    return tag2;
-  }
-  const body = audienceBody(audience);
-  return concat(tag2, u32le(body.length), body);
-}
-async function signLoginStatement(input) {
-  const node = fromHex(input.node, "node", 32);
-  const challenge = fromHex(input.challenge, "challenge", 32);
-  const sessionKey = fromHex(input.sessionKey, "sessionKey", 32);
-  const key = await importSigningKey(input.deviceSecret);
-  const deviceKey = await derivePublicKey(input.deviceSecret);
-  const issuedAt = u64le(input.issuedAt);
-  const expiresAt = u64le(input.expiresAt);
-  const preimage = await domainHash(SIGN_DOMAIN5, [
-    node,
-    audienceSigningBytes(input.audience),
-    challenge,
-    sessionKey,
-    deviceKey,
-    issuedAt,
-    expiresAt
-  ]);
-  const signature = new Uint8Array(
-    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
-  );
-  return hex(
-    concat(
-      node,
-      audienceWire(input.audience),
-      challenge,
-      sessionKey,
-      deviceKey,
-      issuedAt,
-      expiresAt,
-      signature
-    )
-  );
-}
-
-// src/login/session.ts
-var DEFAULT_TTL_SECONDS2 = 300;
-async function generateSessionKey() {
-  const secret = hex(crypto.getRandomValues(new Uint8Array(32)));
-  return { publicKey: hex(await derivePublicKey(secret)), secret };
-}
-function audienceLabel(audience) {
-  switch (audience.kind) {
-    case "webOrigin":
-      return audience.origin;
-    case "codeSigningId":
-      return audience.id;
-    case "cli":
-      return "cli";
-  }
-}
-async function login(config) {
-  const baseUrl = config.nodeUrl.replace(/\/+$/, "");
-  const timeoutMs = config.timeoutMs ?? 1e4;
-  const request = async (path, init) => {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    let response;
-    try {
-      const requestInit = { ...init, signal: controller.signal };
-      response = config.fetch ? await config.fetch(`${baseUrl}${path}`, requestInit) : await globalThis.fetch(`${baseUrl}${path}`, requestInit);
-    } catch (err) {
-      throw new HTTPError(
-        0,
-        err instanceof Error ? err.name : "NetworkError",
-        `${baseUrl}${path}`,
-        new Headers(),
-        err instanceof Error ? err.message : String(err)
-      );
-    } finally {
-      clearTimeout(timer);
-    }
-    const text = await response.text().catch(() => "");
-    if (!response.ok) {
-      throw new HTTPError(
-        response.status,
-        response.statusText,
-        `${baseUrl}${path}`,
-        response.headers,
-        text
-      );
-    }
-    return text ? JSON.parse(text) : {};
-  };
-  const challengeBody = await request("/auth/challenge", {
-    method: "GET",
-    headers: { Accept: "application/json" }
-  });
-  const challenge = challengeBody.challenge ?? challengeBody.data?.challenge;
-  if (!challenge) {
-    throw new Error("the node issued no challenge");
-  }
-  const session = await generateSessionKey();
-  const issuedAt = Math.floor(Date.now() / 1e3);
-  const statement = await signLoginStatement({
-    node: config.node,
-    audience: config.audience,
-    challenge,
-    sessionKey: session.publicKey,
-    issuedAt,
-    expiresAt: issuedAt + (config.ttlSeconds ?? DEFAULT_TTL_SECONDS2),
-    deviceSecret: config.deviceSecret
-  });
-  const tokenBody = await request("/auth/token", {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
-      auth_method: "account_proof",
-      public_key: session.publicKey,
-      client_name: config.clientName ?? audienceLabel(config.audience),
-      timestamp: issuedAt,
-      provider_data: {
-        challenge,
-        login_statement: statement,
-        account_proof: config.accountProof
-      }
-    })
-  });
-  const accessToken = tokenBody.access_token ?? tokenBody.data?.access_token;
-  const refreshToken = tokenBody.refresh_token ?? tokenBody.data?.refresh_token;
-  if (!accessToken) {
-    throw new Error("the node minted no session");
-  }
-  return {
-    accessToken,
-    refreshToken: refreshToken ?? "",
-    sessionKey: session.publicKey,
-    sessionSecret: session.secret
-  };
-}
-
 // src/nodeDiscovery.ts
 var DEFAULT_LOCAL_NODE_PORTS = [2428, 2429, 2528, 2529];
 var LOCAL_HOST = "localhost";
@@ -9091,6 +10412,102 @@ async function discoverLocalNodes(options = {}) {
   );
   return results.filter((url) => url !== null);
 }
+
+// src/relay-attestation/attest-node-key.ts
+var KEY_BINDING_DOMAIN = new TextEncoder().encode("calimero.tee-attest.key-binding.v1");
+var MOCK_QUOTE_HEADER = new TextEncoder().encode("MOCK_TDX_QUOTE_V1");
+var TDX_REPORT_DATA_OFFSET = 48 + 520;
+function concat2(...parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+function equal2(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function fromBase643(b64) {
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function fromHex32(value, label2) {
+  if (typeof value !== "string" || !/^[0-9a-fA-F]{64}$/.test(value)) {
+    throw new Error(`${label2} must be 64 hex characters`);
+  }
+  const out = new Uint8Array(32);
+  for (let i = 0; i < 32; i += 1) out[i] = Number.parseInt(value.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+async function attestKeyBinding(nodeKey) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    concat2(KEY_BINDING_DOMAIN, new Uint8Array(32), nodeKey)
+  );
+  return new Uint8Array(digest);
+}
+function reportDataOf(quote) {
+  const mock = quote.length >= MOCK_QUOTE_HEADER.length && equal2(quote.subarray(0, MOCK_QUOTE_HEADER.length), MOCK_QUOTE_HEADER);
+  const at = mock ? MOCK_QUOTE_HEADER.length : TDX_REPORT_DATA_OFFSET;
+  if (quote.length < at + 64) {
+    throw new Error(`the quote is too short to carry report data (${quote.length} bytes)`);
+  }
+  return { reportData: quote.slice(at, at + 64), mock };
+}
+async function attestRelayNodeKey(opts) {
+  const nonce2 = crypto.getRandomValues(new Uint8Array(32));
+  const url = `${opts.relayUrl.replace(/\/+$/, "")}/admin-api/tee/attest`;
+  const body = JSON.stringify({
+    nonce: hex(nonce2),
+    bindNodeKey: true,
+    ...opts.verify?.includeCollateral ? { includeCollateral: true } : {}
+  });
+  const init = { method: "POST", headers: { "Content-Type": "application/json" }, body };
+  const response = opts.fetch ? await opts.fetch(url, init) : await globalThis.fetch(url, init);
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(`the relay would not attest (HTTP ${response.status})${text ? `: ${text}` : ""}`);
+  }
+  const parsed = await response.json();
+  const data = parsed.data ?? parsed;
+  if (typeof data.quoteB64 !== "string") throw new Error("the relay returned no quote");
+  const nodeKey = fromHex32(data.boundPublicKey, "boundPublicKey");
+  const quote = fromBase643(data.quoteB64);
+  const { reportData, mock } = reportDataOf(quote);
+  if (mock) {
+    if (!opts.allowMock) {
+      throw new Error("the relay answered with a MOCK quote, which proves nothing about the hardware");
+    }
+  } else if (opts.verify) {
+    const accepted = await opts.verify({
+      quoteB64: data.quoteB64,
+      nonce: hex(nonce2),
+      reportDataSuffix: hex(await attestKeyBinding(nodeKey)),
+      ...data.collateral ? { collateral: data.collateral } : {}
+    });
+    if (!accepted) {
+      throw new Error("the relay's quote did not verify: not a trusted image, or not bound to this request");
+    }
+  } else if (opts.verifyQuote) {
+    await opts.verifyQuote(quote);
+  } else {
+    throw new Error("a real TDX quote needs a verify (or verifyQuote) to check its signature and measurements");
+  }
+  if (!equal2(reportData.subarray(0, 32), nonce2)) {
+    throw new Error("the quote does not carry our nonce: it was not made for this request");
+  }
+  if (!equal2(reportData.subarray(32, 64), await attestKeyBinding(nodeKey))) {
+    throw new Error("the quote does not bind the key the relay named: refusing it");
+  }
+  return { nodeKey: hex(nodeKey), mock };
+}
 export {
   AdminApiClient,
   AuthApiClient,
@@ -9103,12 +10520,18 @@ export {
   EphemeralClient,
   HANDSHAKE_PATH,
   HTTPError,
+  INVITED_ROLE,
   IntentRefusedError,
   LocalStorageTokenStore,
+  MAX_INVITATION_VALIDITY_SECS,
   MemoryTokenStore,
+  MeroClient,
   MeroJs,
   NODE_RELEASE_SIGNER,
+  REQUEST_PROOF_HEADER,
   RelayClient,
+  RelayObserver,
+  RelayTransport,
   RpcClient,
   RpcError,
   SEALED_CONTENT_TYPE,
@@ -9117,21 +10540,36 @@ export {
   SealedTransportError,
   SseClient,
   StaleTransportKeyError,
+  WarrantNonceExhaustedError,
+  WarrantNonceRouteUnavailableError,
   WebHttpClient,
   WsClient,
   accountForRoot,
+  accountForRootPublicKey,
   accountRootFromPhrase,
   accountRootFromSecret,
+  accountRootSignerFromPhrase,
   admitterAddrsFromNetworkStatus,
+  attestKeyBinding,
+  attestRelayNodeKey,
+  authorNonceLookup,
+  beginCloudLink,
+  beginDeviceEnrolment,
   buildAuthLoginUrl,
+  callbackIsForeign,
   callerProof,
   capMask,
   capNames,
   classifyError,
+  cloudLinkUrl,
   cloudNodeReleaseUrl,
   combineSignals,
   compareSemver,
+  completeCloudLink,
+  completeDeviceEnrolment,
   connectCloud,
+  connectCloudWithAccount,
+  createAccountRootSigner,
   createAdminApiClient,
   createAdminApiClientFromHttpClient,
   createAttestedSealedFetch,
@@ -9143,12 +10581,15 @@ export {
   createHttpClient,
   createLocalStorageNonceSource,
   createMemoryNonceSource,
+  createMeroClient,
   createMeroJs,
   createNodeAdminApiClient,
   createNodeAuthApiClient,
   createNodeHttpClient,
+  createProofAuthorizer,
   createProofSigner,
   createQuoteVerifier,
+  createRecoveringNonceSource,
   createRetryableMethod,
   createSealedFetch,
   createSignedReleaseSealedFetch,
@@ -9156,9 +10597,14 @@ export {
   createTimeoutSignal,
   createUniversalHttpClient,
   creationInitHash,
+  defaultAdmitters,
+  defaultAudience,
   defaultCapabilitiesSetOp,
   deviceCertPayload,
+  deviceEnrolmentUrl,
+  deviceScopePayload,
   discoverLocalNodes,
+  encodeGroupInvitation,
   encodeSignedInvitation,
   fetchAttestedTransportKey,
   fetchNodeRelease,
@@ -9169,6 +10615,7 @@ export {
   governanceOpHash,
   groupCreatedOp,
   groupDeletedOp,
+  groupInvitationHash,
   groupReparentedOp,
   hasCap,
   hexEncodeUtf8,
@@ -9187,27 +10634,39 @@ export {
   nodeReleaseVersionFromImage,
   parseAuthCallback,
   parseCreationWarrant,
+  parseDeviceCredential,
   parseGovernanceWarrant,
+  parseWarrantNonce,
   probeNodeHealth,
+  readCloudLinkCallback,
+  readEnrolmentCallback,
   redeemInvitation,
+  reportDataOf,
   requestBodyHash,
+  resolveRoot,
+  resolveRootPair,
   routingProofHeaders,
   shouldRetain,
   signAccountLink,
   signAccountLogin,
   signCreationWarrant,
   signDeviceCert,
+  signDeviceScope,
   signGovernanceWarrant,
+  signGroupInvitation,
   signLoginStatement,
   signMemberJoinOp,
   signRequest,
+  signRequestProof,
   signRoutingChallenge,
   signWarrant,
+  signedPath,
   signerFromCryptoKey,
   signerFromSecret,
   transportKeyBinding,
   trustSignedRelease,
   trustedMeasurementsFromReleases,
+  verifyDeviceCredential,
   verifySignedNodeRelease,
   withCap,
   withRetry,