@calimero-network/mero-js 22.9.0 → 23.1.0

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export * from "./cloud/index.js";
 export * from "./sealed/index.js";
 export * from "./relay/index.js";
 export * from "./request-proof/index.js";
-export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
+export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, memberCapabilitySetOp, contextDetachedOp, subgroupVisibilitySetOp, groupMetadataSetOp, memberMetadataSetOp, contextMetadataSetOp, contextCapabilityGrantedOp, contextCapabilityRevokedOp, memberJoinedOpenOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
 export type { Signer } from "./signer/index.js";
 export { generateAccountRoot, accountRootFromPhrase, accountRootFromSecret, createAccountRootSigner, accountRootSignerFromPhrase, signAccountLink, signAccountLogin, resolveRoot, resolveRootPair, } from "./account/index.js";
@@ -34,7 +34,9 @@ export { signGroupInvitation, encodeGroupInvitation, groupInvitationHash, defaul
 export type { GroupInvitationInput } from "./invitation/index.js";
 export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from "./namespace-op/index.js";
 export type { SignMemberJoinInput } from "./namespace-op/index.js";
-export type { WarrantInput, CreationWarrantInput, CreationWarrantFields, SignedCreationWarrant, GovernanceWarrantInput, GovernanceWarrantFields, GovernanceOp, GovernanceOpKind, GovernanceMemberRole, GroupCreatedInput, NamespaceCreatedInput, } from "./warrant/index.js";
+export { OWNER_OP_KIND, transferOwnershipOp, groupDeleteOp, adminChangedOp, teeAuthoringPolicyOp, teeAdmissionPolicyOp, teeReleaseAdmissionPolicyOp, ownerOpDigest, ownerOpSigningPayload, signOwnerOpProof, rootGuardedOpBytes, } from "./owner-op/index.js";
+export type { OwnerOp, OwnerOpKind, OwnerOpPlane, OwnerOpProofInput, TeeAdmissionPolicyOpInput, TeeReleaseAdmissionPolicyOpInput, } from "./owner-op/index.js";
+export type { WarrantInput, CreationWarrantInput, CreationWarrantFields, SignedCreationWarrant, GovernanceWarrantInput, GovernanceWarrantFields, GovernanceOp, GovernanceOpKind, GovernanceMemberRole, GroupCreatedInput, SubgroupCreation, NamespaceCreatedInput, } from "./warrant/index.js";
 export { requestBodyHash, signRequest, callerProof, createProofSigner, } from "./request/index.js";
 export type { CallerProofInput, ProofRequest, ProofSignerOptions, } from "./request/index.js";
 export type { RequestSigInput } from "./request/index.js";

package/dist/index.js

@@ -34,7 +34,7 @@ export * from "./relay/index.js";
 // Request proofs — a caller's identity on the request itself, no session needed
 export * from "./request-proof/index.js";
 // Warrant signing — mint the author's consent for a relay to run one intent
-export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, groupReparentedOp, groupDeletedOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
+export { signWarrant, intentHash, signCreationWarrant, parseCreationWarrant, creationInitHash, signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, memberCapabilitySetOp, contextDetachedOp, subgroupVisibilitySetOp, groupMetadataSetOp, memberMetadataSetOp, contextMetadataSetOp, contextCapabilityGrantedOp, contextCapabilityRevokedOp, memberJoinedOpenOp, namespaceCreatedOp, defaultCapabilitiesSetOp, foundedNamespaceId, } from "./warrant/index.js";
 // Who signs — a key's capability, separated from its material, so a
 // non-extractable key can be used wherever a hex secret could.
 export { signerFromSecret, signerFromCryptoKey } from "./signer/index.js";
@@ -52,6 +52,7 @@ export { signDeviceScope, deviceScopePayload } from "./device-cert/index.js";
 // Invitations minted off-node, signed by a bound device key.
 export { signGroupInvitation, encodeGroupInvitation, groupInvitationHash, defaultAdmitters, MAX_INVITATION_VALIDITY_SECS, INVITED_ROLE, } from "./invitation/index.js";
 export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from "./namespace-op/index.js";
+export { OWNER_OP_KIND, transferOwnershipOp, groupDeleteOp, adminChangedOp, teeAuthoringPolicyOp, teeAdmissionPolicyOp, teeReleaseAdmissionPolicyOp, ownerOpDigest, ownerOpSigningPayload, signOwnerOpProof, rootGuardedOpBytes, } from "./owner-op/index.js";
 // Login-statement signing — the device's half of a password-free session
 export { requestBodyHash, signRequest, callerProof, createProofSigner, } from "./request/index.js";
 export { signLoginStatement } from "./login/index.js";

package/dist/index.mjs

@@ -2167,9 +2167,45 @@ var AdminApiClient = class {
    * and admitted TEEs stay members. The node applies the same op as
    * `setTeeAuthoringPolicy(groupId, { allowedMrtd: [] })`. `groupId` must be a
    * namespace root.
+   *
+   * `rootProof` is the signing admin's own root proof for that empty policy
+   * (`teeAuthoringPolicyOp([])`); omit it on a node that holds that root.
+   */
+  async disableTeeAuthoringPolicy(groupId, options = {}) {
+    const path = `/admin-api/groups/${groupId}/settings/tee-authoring-policy`;
+    if (options.rootProof === void 0) {
+      await this.httpClient.delete(path);
+      return;
+    }
+    await this.httpClient.request(path, {
+      method: "DELETE",
+      body: JSON.stringify({ rootProof: options.rootProof }),
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  // ---- Root-guarded owner ops (core schema 18) ----
+  /**
+   * Hand the group to `newOwner`, who must already be one of its admins.
+   * Owner-only, and it needs the owner account's root proof; see
+   * {@link RootGuardedOpRequest}.
+   */
+  async transferOwnership(groupId, request) {
+    await this.httpClient.post(`/admin-api/groups/${groupId}/transfer-ownership`, request);
+  }
+  /**
+   * Repoint the namespace's admin pin at `newAdmin`, a member of its root.
+   * Owner-only, with the owner account's root proof; see {@link RootGuardedOpRequest}.
+   */
+  async changeNamespaceAdmin(namespaceId, request) {
+    await this.httpClient.post(`/admin-api/namespaces/${namespaceId}/admin`, request);
+  }
+  /**
+   * Delete a group through the owner-only path: it must hold no contexts, and
+   * the op needs the owner account's root proof. {@link deleteGroup} is the
+   * admin-level cascading delete.
    */
-  async disableTeeAuthoringPolicy(groupId) {
-    await this.httpClient.delete(`/admin-api/groups/${groupId}/settings/tee-authoring-policy`);
+  async ownerDeleteGroup(groupId, request = {}) {
+    await this.httpClient.post(`/admin-api/groups/${groupId}/owner-delete`, request);
   }
   // ---- Group / member / context metadata ----
   async setGroupMetadata(groupId, request) {
@@ -7163,9 +7199,9 @@ function parseCreationWarrant(warrant) {
   const u32 = (what) => view.getUint32(take(4, what).byteOffset, true);
   const u64 = (what) => view.getBigUint64(take(8, what).byteOffset, true);
   const option = (what) => {
-    const tag2 = take(1, what)[0];
-    if (tag2 === 0) return null;
-    if (tag2 !== 1) throw new Error(`${what} has option tag ${tag2}, expected 0 or 1`);
+    const tag3 = take(1, what)[0];
+    if (tag3 === 0) return null;
+    if (tag3 !== 1) throw new Error(`${what} has option tag ${tag3}, expected 0 or 1`);
     const len = u32(what);
     if (len > MAX_LABEL_BYTES) {
       throw new Error(`${what} is ${len} bytes, over the ${MAX_LABEL_BYTES} a node accepts`);
@@ -7354,12 +7390,21 @@ var GROUP_OP = {
   MemberRemoved: 2,
   MemberLeft: 3,
   MemberRoleSet: 4,
-  DefaultCapabilitiesSet: 6
+  MemberCapabilitySet: 5,
+  DefaultCapabilitiesSet: 6,
+  ContextDetached: 9,
+  SubgroupVisibilitySet: 10,
+  GroupMetadataSet: 11,
+  MemberMetadataSet: 12,
+  ContextMetadataSet: 13,
+  ContextCapabilityGranted: 16,
+  ContextCapabilityRevoked: 17
 };
 var ROOT_OP = {
   GroupCreated: 0,
   GroupReparented: 1,
   GroupDeleted: 2,
+  MemberJoinedOpen: 7,
   NamespaceCreatedV2: 9
 };
 var NAMESPACE_ID_DOMAIN = new TextEncoder().encode("calimero.namespace.id.v1");
@@ -7409,6 +7454,17 @@ function memberRoleSetOp(member, memberRole) {
     bytes: concat(tag(GROUP_OP.MemberRoleSet), fromHex(member, "member", 32), role(memberRole))
   };
 }
+var SUBGROUP_ID_DOMAIN = new TextEncoder().encode("calimero.subgroup.id.v1");
+async function createdSubgroupId(admin, parentId, restricted, salt) {
+  return hex(
+    await domainHash(SUBGROUP_ID_DOMAIN, [
+      fromHex(admin, "admin", 32),
+      fromHex(parentId, "parentId", 32),
+      new Uint8Array([restricted ? 1 : 0]),
+      fromHex(salt, "salt", 32)
+    ])
+  );
+}
 function defaultCapabilitiesSetOp(capabilities) {
   if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
     throw new Error(`capabilities must be a u32 bit mask, got ${String(capabilities)}`);
@@ -7431,10 +7487,16 @@ function groupCreatedOp(input) {
       fromHex(input.groupId, "groupId", 32),
       fromHex(input.parentId, "parentId", 32),
       tag(input.restricted ? 1 : 0),
-      fromHex(input.admin, "admin", 32)
+      fromHex(input.admin, "admin", 32),
+      fromHex(input.salt, "salt", 32)
     )
   };
 }
+async function subgroupCreation(input) {
+  const salt = input.salt ?? hex(crypto.getRandomValues(new Uint8Array(32)));
+  const groupId = await createdSubgroupId(input.admin, input.parentId, input.restricted, salt);
+  return { groupId, salt, op: groupCreatedOp({ ...input, groupId, salt }) };
+}
 function groupReparentedOp(childGroupId, newParentId) {
   return {
     kind: "root",
@@ -7474,6 +7536,87 @@ function namespaceCreatedOp(input) {
     )
   };
 }
+function str(value) {
+  const bytes = new TextEncoder().encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+function optionalStr(value) {
+  return value === void 0 ? tag(0) : concat(tag(1), str(value));
+}
+function stringMap(data = {}) {
+  const enc = new TextEncoder();
+  const entries = Object.entries(data).map(([k, v]) => [enc.encode(k), v, k]).sort(([a], [b]) => {
+    for (let i = 0; i < Math.min(a.length, b.length); i++) if (a[i] !== b[i]) return a[i] - b[i];
+    return a.length - b.length;
+  });
+  return concat(u32le(entries.length), ...entries.flatMap(([, v, k]) => [str(k), str(v)]));
+}
+function relayableMask(capabilities, what) {
+  if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
+    throw new Error(`${what} must be a u32 bit mask, got ${String(capabilities)}`);
+  }
+  if (hasCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
+    throw new Error(`${what} may not include CAN_AUTHOR_ON_BEHALF (512): a relay never carries a change to it`);
+  }
+  return capabilities;
+}
+function memberCapabilitySetOp(member, capabilities) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberCapabilitySet), fromHex(member, "member", 32), u32le(relayableMask(capabilities, "capabilities")))
+  };
+}
+function contextDetachedOp(contextId) {
+  return { kind: "group", bytes: concat(tag(GROUP_OP.ContextDetached), fromHex(contextId, "contextId", 32)) };
+}
+function subgroupVisibilitySetOp(mode) {
+  if (mode !== "open" && mode !== "restricted") throw new Error(`mode must be open or restricted, got ${String(mode)}`);
+  return { kind: "group", bytes: concat(tag(GROUP_OP.SubgroupVisibilitySet), tag(mode === "open" ? 0 : 1)) };
+}
+function groupMetadataSetOp(input = {}) {
+  return { kind: "group", bytes: concat(tag(GROUP_OP.GroupMetadataSet), optionalStr(input.name), stringMap(input.data)) };
+}
+function memberMetadataSetOp(member, input = {}) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.MemberMetadataSet), fromHex(member, "member", 32), optionalStr(input.name), stringMap(input.data))
+  };
+}
+function contextMetadataSetOp(contextId, input = {}) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextMetadataSet), fromHex(contextId, "contextId", 32), optionalStr(input.name), stringMap(input.data))
+  };
+}
+function contextCapability(capability) {
+  if (!Number.isInteger(capability) || capability < 1 || capability > 255) {
+    throw new Error(`capability must be a non-zero u8, got ${String(capability)}`);
+  }
+  return tag(capability);
+}
+function contextCapabilityGrantedOp(contextId, member, capability) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextCapabilityGranted), fromHex(contextId, "contextId", 32), fromHex(member, "member", 32), contextCapability(capability))
+  };
+}
+function contextCapabilityRevokedOp(contextId, member, capability) {
+  return {
+    kind: "group",
+    bytes: concat(tag(GROUP_OP.ContextCapabilityRevoked), fromHex(contextId, "contextId", 32), fromHex(member, "member", 32), contextCapability(capability))
+  };
+}
+function memberJoinedOpenOp(input) {
+  return {
+    kind: "root",
+    bytes: concat(
+      tag(ROOT_OP.MemberJoinedOpen),
+      fromHex(input.member, "member", 32),
+      fromHex(input.groupId, "groupId", 32),
+      fromHexUnsized(input.credential, "credential")
+    )
+  };
+}
 
 // src/relay/relay-client.ts
 var DEFAULT_TTL_SECONDS = 300;
@@ -7992,12 +8135,12 @@ function audienceSigningBytes(audience) {
   );
 }
 function audienceWire(audience) {
-  const tag2 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
+  const tag3 = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
   if (audience.kind === "cli") {
-    return tag2;
+    return tag3;
   }
   const body = audienceBody(audience);
-  return concat(tag2, u32le(body.length), body);
+  return concat(tag3, u32le(body.length), body);
 }
 async function signLoginStatement(input) {
   const node = fromHex(input.node, "node", 32);
@@ -9682,8 +9825,8 @@ var SIGNATURE_HASHES = {
 };
 function read(bytes, offset, limit) {
   if (offset + 2 > limit) throw new Error("it is truncated");
-  const tag2 = bytes[offset];
-  if ((tag2 & 31) === 31) throw new Error("it uses a tag this parser does not read");
+  const tag3 = bytes[offset];
+  if ((tag3 & 31) === 31) throw new Error("it uses a tag this parser does not read");
   let length = bytes[offset + 1];
   let start = offset + 2;
   if (length & 128) {
@@ -9695,7 +9838,7 @@ function read(bytes, offset, limit) {
   }
   const end = start + length;
   if (end > limit) throw new Error("it is truncated");
-  return { tag: tag2, bytes, offset, start, end };
+  return { tag: tag3, bytes, offset, start, end };
 }
 function parseDer(bytes) {
   const element = read(bytes, 0, bytes.length);
@@ -9711,8 +9854,8 @@ function children(element) {
   }
   return out;
 }
-function expectTag(element, tag2, what) {
-  if (!element || element.tag !== tag2) throw new Error(`${what} is not where it should be`);
+function expectTag(element, tag3, what) {
+  if (!element || element.tag !== tag3) throw new Error(`${what} is not where it should be`);
   return element;
 }
 function contents(element) {
@@ -10270,7 +10413,7 @@ function bytes32(value, label2) {
 }
 
 // src/namespace-op/namespace-op.ts
-var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 16;
+var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 20;
 var NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode("calimero.namespace.v1");
 var NAMESPACE_OP_ROOT = 0;
 var ROOT_OP2 = {
@@ -10360,6 +10503,183 @@ async function signMemberJoinOp(input) {
   return hex(concat(signable, signature, unendorsed));
 }
 
+// src/owner-op/owner-op.ts
+var OWNER_OP_SIGN_DOMAIN = new TextEncoder().encode("calimero.account.owner-op.v1");
+var OWNER_OP_BODY_DOMAIN = new TextEncoder().encode("calimero.account.owner-op.body.v1");
+var ACCOUNT_ID_DOMAIN2 = new TextEncoder().encode("calimero.account.genesis.v1");
+var ACCOUNT_GENESIS_VERSION2 = 2;
+var OWNER_OP_KIND = {
+  transferOwnership: 0,
+  adminChanged: 1,
+  groupDelete: 2,
+  teeAdmissionPolicy: 3,
+  teeAuthoringPolicy: 4,
+  teeReleaseAdmissionPolicy: 5
+};
+var GROUP_OP2 = {
+  GroupDelete: 14,
+  TransferOwnership: 21,
+  TeeAuthoringPolicySet: 33,
+  TeeAdmissionPolicySetV2: 37,
+  TeeReleaseAdmissionPolicySetV2: 38,
+  RootGuarded: 42
+};
+var ROOT_OP3 = {
+  AdminChanged: 3,
+  RootGuarded: 12
+};
+var TEE_MODE = { replica: 0, relay: 1 };
+var te = new TextEncoder();
+function tag2(byte) {
+  return new Uint8Array([byte]);
+}
+function borshString3(value) {
+  const bytes = te.encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+function borshStrings(values) {
+  return concat(u32le(values.length), ...values.map(borshString3));
+}
+function borshBool(value) {
+  return tag2(value ? 1 : 0);
+}
+function teeMode(mode) {
+  const byte = TEE_MODE[mode ?? "replica"];
+  if (byte === void 0) {
+    throw new Error(`mode must be replica or relay, got ${String(mode)}`);
+  }
+  return tag2(byte);
+}
+function transferOwnershipOp(newOwner) {
+  return {
+    kind: "transferOwnership",
+    plane: "group",
+    bytes: concat(tag2(GROUP_OP2.TransferOwnership), fromHex(newOwner, "newOwner", 32))
+  };
+}
+function groupDeleteOp() {
+  return { kind: "groupDelete", plane: "group", bytes: tag2(GROUP_OP2.GroupDelete) };
+}
+function adminChangedOp(newAdmin) {
+  return {
+    kind: "adminChanged",
+    plane: "root",
+    bytes: concat(tag2(ROOT_OP3.AdminChanged), fromHex(newAdmin, "newAdmin", 32))
+  };
+}
+function teeAuthoringPolicyOp(allowedMrtd) {
+  return {
+    kind: "teeAuthoringPolicy",
+    plane: "group",
+    bytes: concat(tag2(GROUP_OP2.TeeAuthoringPolicySet), borshStrings(allowedMrtd))
+  };
+}
+function teeAdmissionPolicyOp(input) {
+  return {
+    kind: "teeAdmissionPolicy",
+    plane: "group",
+    bytes: concat(
+      tag2(GROUP_OP2.TeeAdmissionPolicySetV2),
+      borshStrings(input.allowedMrtd),
+      borshStrings(input.allowedRtmr0),
+      borshStrings(input.allowedRtmr1),
+      borshStrings(input.allowedRtmr2),
+      borshStrings(input.allowedRtmr3),
+      borshStrings(input.allowedTcbStatuses),
+      borshBool(input.acceptMock),
+      teeMode(input.mode)
+    )
+  };
+}
+function teeReleaseAdmissionPolicyOp(input) {
+  const minRelease = input.minReleaseVersion === void 0 ? tag2(0) : concat(tag2(1), borshString3(input.minReleaseVersion));
+  return {
+    kind: "teeReleaseAdmissionPolicy",
+    plane: "group",
+    bytes: concat(
+      tag2(GROUP_OP2.TeeReleaseAdmissionPolicySetV2),
+      borshStrings(input.allowedProfiles),
+      minRelease,
+      borshStrings(input.allowedTcbStatuses),
+      borshBool(input.acceptMock),
+      teeMode(input.mode)
+    )
+  };
+}
+async function ownerOpDigest(opBytes) {
+  return domainHash(OWNER_OP_BODY_DOMAIN, [opBytes]);
+}
+async function ownerOpSigningPayload(input) {
+  return domainHash(OWNER_OP_SIGN_DOMAIN, [
+    fromHex(input.account, "account", 32),
+    fromHex(input.namespaceId, "namespaceId", 32),
+    fromHex(input.groupId, "groupId", 32),
+    tag2(kindByte2(input.kind)),
+    input.opDigest,
+    u64le(input.counter),
+    u32le(input.keyEpoch)
+  ]);
+}
+function kindByte2(kind) {
+  const byte = OWNER_OP_KIND[kind];
+  if (byte === void 0) {
+    throw new Error(`unknown owner-op kind ${String(kind)}`);
+  }
+  return byte;
+}
+var HANDOFF_BYTES = 32 + 4 + 32 + 64;
+async function signOwnerOpProof(input) {
+  const rootPublicKey = await derivePublicKey(input.rootSecret);
+  const genesis = concat(tag2(ACCOUNT_GENESIS_VERSION2), rootPublicKey);
+  const account = hex(await domainHash(ACCOUNT_ID_DOMAIN2, [genesis]));
+  const keyEpoch = input.keyEpoch ?? 0;
+  const chain = (input.chain ?? []).map((handoff, index) => {
+    const bytes = fromHexUnsized(handoff, `chain[${index}]`);
+    if (bytes.length !== HANDOFF_BYTES) {
+      throw new Error(
+        `chain[${index}] must be a ${HANDOFF_BYTES}-byte RootKeyHandoff, got ${bytes.length}`
+      );
+    }
+    return bytes;
+  });
+  if (keyEpoch > chain.length) {
+    throw new Error(
+      `keyEpoch ${keyEpoch} needs ${keyEpoch} handoffs in chain, got ${chain.length}`
+    );
+  }
+  const opDigest = await ownerOpDigest(input.op.bytes);
+  const payload = await ownerOpSigningPayload({
+    account,
+    namespaceId: input.namespaceId,
+    groupId: input.groupId,
+    kind: input.op.kind,
+    opDigest,
+    counter: input.counter,
+    keyEpoch
+  });
+  const key = await importSigningKey(input.rootSecret);
+  const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", key, payload));
+  return hex(
+    concat(
+      genesis,
+      u32le(chain.length),
+      ...chain,
+      fromHex(account, "account", 32),
+      fromHex(input.namespaceId, "namespaceId", 32),
+      fromHex(input.groupId, "groupId", 32),
+      tag2(kindByte2(input.op.kind)),
+      opDigest,
+      u64le(input.counter),
+      u32le(keyEpoch),
+      signature
+    )
+  );
+}
+function rootGuardedOpBytes(op, rootProof) {
+  const wrapper = op.plane === "group" ? GROUP_OP2.RootGuarded : ROOT_OP3.RootGuarded;
+  return concat(tag2(wrapper), op.bytes, fromHexUnsized(rootProof, "rootProof"));
+}
+
 // src/nodeDiscovery.ts
 var DEFAULT_LOCAL_NODE_PORTS = [2428, 2429, 2528, 2529];
 var LOCAL_HOST = "localhost";
@@ -10528,6 +10848,7 @@ export {
   MeroClient,
   MeroJs,
   NODE_RELEASE_SIGNER,
+  OWNER_OP_KIND,
   REQUEST_PROOF_HEADER,
   RelayClient,
   RelayObserver,
@@ -10549,6 +10870,7 @@ export {
   accountRootFromPhrase,
   accountRootFromSecret,
   accountRootSignerFromPhrase,
+  adminChangedOp,
   admitterAddrsFromNetworkStatus,
   attestKeyBinding,
   attestRelayNodeKey,
@@ -10569,6 +10891,10 @@ export {
   completeDeviceEnrolment,
   connectCloud,
   connectCloudWithAccount,
+  contextCapabilityGrantedOp,
+  contextCapabilityRevokedOp,
+  contextDetachedOp,
+  contextMetadataSetOp,
   createAccountRootSigner,
   createAdminApiClient,
   createAdminApiClientFromHttpClient,
@@ -10596,6 +10922,7 @@ export {
   createSignedReleaseVerifier,
   createTimeoutSignal,
   createUniversalHttpClient,
+  createdSubgroupId,
   creationInitHash,
   defaultAdmitters,
   defaultAudience,
@@ -10614,8 +10941,10 @@ export {
   generateSessionKey,
   governanceOpHash,
   groupCreatedOp,
+  groupDeleteOp,
   groupDeletedOp,
   groupInvitationHash,
+  groupMetadataSetOp,
   groupReparentedOp,
   hasCap,
   hexEncodeUtf8,
@@ -10625,13 +10954,18 @@ export {
   localNodeUrl,
   login,
   memberAddedOp,
+  memberCapabilitySetOp,
+  memberJoinedOpenOp,
   memberLeftOp,
+  memberMetadataSetOp,
   memberRemovedOp,
   memberRoleSetOp,
   mintDeviceId,
   namespaceCreatedOp,
   nodeEndpoint,
   nodeReleaseVersionFromImage,
+  ownerOpDigest,
+  ownerOpSigningPayload,
   parseAuthCallback,
   parseCreationWarrant,
   parseDeviceCredential,
@@ -10645,6 +10979,7 @@ export {
   requestBodyHash,
   resolveRoot,
   resolveRootPair,
+  rootGuardedOpBytes,
   routingProofHeaders,
   shouldRetain,
   signAccountLink,
@@ -10656,6 +10991,7 @@ export {
   signGroupInvitation,
   signLoginStatement,
   signMemberJoinOp,
+  signOwnerOpProof,
   signRequest,
   signRequestProof,
   signRoutingChallenge,
@@ -10663,6 +10999,12 @@ export {
   signedPath,
   signerFromCryptoKey,
   signerFromSecret,
+  subgroupCreation,
+  subgroupVisibilitySetOp,
+  teeAdmissionPolicyOp,
+  teeAuthoringPolicyOp,
+  teeReleaseAdmissionPolicyOp,
+  transferOwnershipOp,
   transportKeyBinding,
   trustSignedRelease,
   trustedMeasurementsFromReleases,