@calimero-network/mero-js 24.1.2 → 24.2.0

package/dist/namespace-op/namespace-op.d.ts

@@ -59,8 +59,14 @@ import { type Signer } from '../signer/signer.js';
  * writer-set step (calimero-network/core#4263), and a capability revoke voids
  * the member's concurrent ops that needed a removed bit
  * (calimero-network/core#4453). No layout this module signs changes.
+ *
+ * 23: a TEE admission op carries the quote it was admitted on and a TEE
+ * authority evidence op the credential it was made for
+ * (calimero-network/core#4265). Neither is an op this module signs, so only
+ * the version byte moves. Core signs and checks at 23 from 0.11.0-rc.81, the
+ * first release with both 22 and 23.
  */
-export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 22;
+export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 23;
 /**
  * Borsh-encode a `SignedGroupOpenInvitation`.
  *

package/dist/namespace-op/namespace-op.js

@@ -45,8 +45,14 @@ import { resolveSigner } from '../signer/signer.js';
  * writer-set step (calimero-network/core#4263), and a capability revoke voids
  * the member's concurrent ops that needed a removed bit
  * (calimero-network/core#4453). No layout this module signs changes.
+ *
+ * 23: a TEE admission op carries the quote it was admitted on and a TEE
+ * authority evidence op the credential it was made for
+ * (calimero-network/core#4265). Neither is an op this module signs, so only
+ * the version byte moves. Core signs and checks at 23 from 0.11.0-rc.81, the
+ * first release with both 22 and 23.
  */
-export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 22;
+export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 23;
 /** Domain prefixed to the signable bytes; core's `NAMESPACE_GOVERNANCE_SIGN_DOMAIN`. */
 const NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode('calimero.namespace.v1');
 /** `NamespaceOp::Root` is the first variant. */

package/dist/relay/index.d.ts

@@ -1,4 +1,4 @@
 export { RelayClient, IntentRefusedError } from './relay-client.js';
-export type { RelayClientConfig, RelayDescription, IntentResult, CreationDescription, CreateContextInput, CreatedContext, GovernanceDescription, GovernInput, GovernResult, FoundNamespaceInput, FoundedNamespace, } from './relay-client.js';
+export type { RelayClientConfig, RelayExecutor, RelayDescription, IntentResult, CreationDescription, CreateContextInput, CreatedContext, GovernanceDescription, GovernInput, GovernResult, FoundNamespaceInput, FoundedNamespace, } from './relay-client.js';
 export { createMemoryNonceSource, createLocalStorageNonceSource, createRecoveringNonceSource, authorNonceLookup, WarrantNonceExhaustedError, } from './nonce-source.js';
 export type { NonceSource, WarrantNonceLookup, RecoveringNonceSourceOptions, } from './nonce-source.js';

package/dist/relay/relay-client.d.ts

@@ -18,10 +18,10 @@
  * # The three preconditions, and why they are checked in this order
  *
  * `describe()` answers the first two in one call, before anything is signed:
- * the relay's executor account (which the warrant must name) and whether it
- * holds `CAN_AUTHOR_ON_BEHALF` on the owning group. The third — that the
- * author's account is a member — only the group knows, and it surfaces as a
- * refusal.
+ * the relay's executor account and signing key (which the warrant must name)
+ * and whether it holds `CAN_AUTHOR_ON_BEHALF` on the owning group. The third,
+ * that the author's account is a member, only the group knows, and it surfaces
+ * as a refusal.
  *
  * Checking before signing is not politeness. A warrant consumes a nonce from a
  * monotonic per-device sequence, and one minted against the wrong executor is
@@ -42,9 +42,8 @@ export interface RelayClientConfig {
     /**
      * The account the relay writes as, hex — a warrant's `executor`.
      *
-     * An account rather than a key, so one of the relay's processes rotating its
-     * signing key does not void warrants already issued to it. Left unset, the
-     * first `execute` learns it from {@link RelayClient.describe}.
+     * Only checked against what the relay answers: a warrant also names the
+     * relay's signing key, which only discovery reports, so the first call asks.
      */
     executorAccount?: string;
     /** The author's account, hex — whose consent the warrant carries. */
@@ -101,19 +100,22 @@ export interface RelayClientConfig {
      */
     rateLimitRetries?: number;
 }
-/** What a relay says about its ability to run intents in one context. */
-export interface RelayDescription {
+/** The relay a warrant names: its account, and the one key of it that may spend the warrant. */
+export interface RelayExecutor {
     /** The account a warrant must name as `executor`, hex. */
     executorAccount: string;
+    /** The signing key a warrant must name as `executor_key`, hex. */
+    executorKey: string;
+}
+/** What a relay says about its ability to run intents in one context. */
+export interface RelayDescription extends RelayExecutor {
     /** Whether the relay holds `CAN_AUTHOR_ON_BEHALF` on the owning group. */
     canAuthorOnBehalf: boolean;
     /** The group whose admin grants that capability, hex. */
     groupId: string;
 }
 /** What a relay says about its ability to create contexts in one group. */
-export interface CreationDescription {
-    /** The account a creation warrant must name as `executor`, hex. */
-    executorAccount: string;
+export interface CreationDescription extends RelayExecutor {
     /** The group, hex. */
     groupId: string;
     /**
@@ -156,9 +158,7 @@ export interface CreatedContext {
     memberPublicKey: string;
 }
 /** What a relay says about publishing governance ops for members of one group. */
-export interface GovernanceDescription {
-    /** The account a governance warrant must name as `executor`, hex. */
-    executorAccount: string;
+export interface GovernanceDescription extends RelayExecutor {
     /** The group asked about, hex. */
     groupId: string;
     /**
@@ -192,11 +192,10 @@ export interface FoundNamespaceInput {
      */
     salt?: string;
     /**
-     * The relay's account, hex: the warrant's `executor`. The namespace does not
-     * exist yet, so there is nothing to ask `describeGovernance` about. Falls back
-     * to the client's configured or already-learned `executorAccount`.
+     * The relay's account and node key (pinned, or from `resolveRelayNodeKey`). Never
+     * a discovery answer: that key is unauthenticated, and no namespace exists yet.
      */
-    executorAccount?: string;
+    executor: RelayExecutor;
     /**
      * The namespace root's default capability mask (`MemberCapabilities` bits),
      * set right after founding. A namespace is founded with core's minimal
@@ -292,7 +291,7 @@ export declare class IntentRefusedError extends Error {
 }
 export declare class RelayClient {
     private readonly baseUrl;
-    private executorAccount;
+    private executor;
     private readonly config;
     private readonly fetchImpl;
     private readonly timeoutMs;
@@ -389,7 +388,7 @@ export declare class RelayClient {
     createContext(input: CreateContextInput): Promise<CreatedContext>;
     /**
      * Ask the relay whether it may publish governance ops for members of
-     * `groupId`, and which account a warrant must name.
+     * `groupId`, and which account and key a warrant must name.
      */
     describeGovernance(groupId: string): Promise<GovernanceDescription>;
     /**
@@ -427,9 +426,7 @@ export declare class RelayClient {
      *
      * The executor cannot be learned from the relay first: the namespace does not
      * exist, so `describeGovernance` has nothing to answer about. It comes from
-     * `input.executorAccount`, the configured one, or one an earlier call learned
-     * (`describe`, `createContext`, `govern`), and without any of them this
-     * throws before taking a nonce.
+     * `input.executor` only, and without it this throws before taking a nonce.
      * The nonce is spent in the new namespace's ledger.
      *
      * With `defaultCapabilities`, the founder then sets the namespace's default
@@ -440,11 +437,11 @@ export declare class RelayClient {
      * Refusals (`400`/`403`) come back as {@link IntentRefusedError}; a salt
      * that names an existing namespace is a `409`, an `HTTPError`.
      */
-    foundNamespace(input?: FoundNamespaceInput): Promise<FoundedNamespace>;
+    foundNamespace(input: FoundNamespaceInput): Promise<FoundedNamespace>;
     private postGovernance;
     /**
-     * The executor a warrant must name: the one the relay answered with, which a
-     * configured account must agree with. Remembered for later calls.
+     * The relay's answer, checked against a configured account and remembered.
+     * Decoded here so a relay naming no key is refused before a nonce is taken.
      */
     private checkedExecutor;
     /**

package/dist/relay/relay-client.js

@@ -18,10 +18,10 @@
  * # The three preconditions, and why they are checked in this order
  *
  * `describe()` answers the first two in one call, before anything is signed:
- * the relay's executor account (which the warrant must name) and whether it
- * holds `CAN_AUTHOR_ON_BEHALF` on the owning group. The third — that the
- * author's account is a member — only the group knows, and it surfaces as a
- * refusal.
+ * the relay's executor account and signing key (which the warrant must name)
+ * and whether it holds `CAN_AUTHOR_ON_BEHALF` on the owning group. The third,
+ * that the author's account is a member, only the group knows, and it surfaces
+ * as a refusal.
  *
  * Checking before signing is not politeness. A warrant consumes a nonce from a
  * monotonic per-device sequence, and one minted against the wrong executor is
@@ -85,7 +85,6 @@ export class RelayClient {
     constructor(config) {
         this.config = config;
         this.baseUrl = config.relayUrl.replace(/\/+$/, '');
-        this.executorAccount = config.executorAccount;
         const injected = config.fetch;
         this.fetchImpl = injected
             ? (input, init) => injected(input, init)
@@ -139,8 +138,8 @@ export class RelayClient {
     async describe(contextId) {
         const body = await this.json('GET', `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`);
         // Learned, not merely returned: a client that called `describe` should not
-        // then have to pass the account back in to `execute`.
-        this.executorAccount = body.data.executorAccount;
+        // then have to pass the executor back in to `execute`.
+        this.checkedExecutor(body.data);
         return body.data;
     }
     /**
@@ -151,7 +150,7 @@ export class RelayClient {
      * apply. Nothing accumulates and nothing is reusable.
      */
     async execute(contextId, method, argsJson = {}) {
-        const executor = this.executorAccount ?? (await this.describe(contextId)).executorAccount;
+        const executor = this.executor ?? this.checkedExecutor(await this.describe(contextId));
         // Resolved before the nonce, so a misconfigured key burns none.
         const signer = await this.authorSigner();
         const nonce = await this.config.nonces.next();
@@ -159,14 +158,20 @@ export class RelayClient {
         const warrant = await signWarrant({
             context: contextId,
             authorAccount: this.config.authorAccount,
-            executor,
+            executor: executor.executorAccount,
+            executorKey: executor.executorKey,
             method,
             argsJson,
             nonce,
             notAfter: BigInt(Math.floor(Date.now() / 1000)) + BigInt(ttl),
             signer,
         });
-        const body = await this.json('POST', `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`, { method, argsJson, warrant, authorProof: this.config.authorProof });
+        const body = await this.json('POST', `/admin-api/contexts/${encodeURIComponent(contextId)}/intents`, { method, argsJson, warrant, authorProof: this.config.authorProof }).catch((err) => {
+            // A relay that re-keyed refuses every warrant naming its old key, so ask again next time.
+            if (err instanceof IntentRefusedError)
+                this.executor = undefined;
+            throw err;
+        });
         return { rootHash: body.data.rootHash, returns: body.data.returns ?? null };
     }
     /**
@@ -224,7 +229,7 @@ export class RelayClient {
                 `${described.groupId}; it needs CAN_CREATE_CONTEXT or admin ` +
                 '(checked before signing — no nonce was spent)', false, 403);
         }
-        const executor = this.checkedExecutor(described.executorAccount);
+        const executor = this.checkedExecutor(described);
         const initArgs = input.initArgs ?? {};
         // Resolved before the nonce, so a misconfigured key burns none.
         const signer = await this.authorSigner();
@@ -234,7 +239,8 @@ export class RelayClient {
             group: input.groupId,
             seed: input.seed,
             authorAccount: this.config.authorAccount,
-            executor,
+            executor: executor.executorAccount,
+            executorKey: executor.executorKey,
             applicationId: input.applicationId,
             serviceName: input.serviceName,
             name: input.name,
@@ -252,7 +258,7 @@ export class RelayClient {
     }
     /**
      * Ask the relay whether it may publish governance ops for members of
-     * `groupId`, and which account a warrant must name.
+     * `groupId`, and which account and key a warrant must name.
      */
     async describeGovernance(groupId) {
         const body = await this.json('GET', `/admin-api/groups/${encodeURIComponent(groupId)}/governance-intents`);
@@ -281,7 +287,7 @@ export class RelayClient {
                 `${described.groupId}; an admin must admit it as a relay or grant it CAN_AUTHOR_ON_BEHALF ` +
                 '(checked before signing, no nonce was spent)', false, 403);
         }
-        const executor = this.checkedExecutor(described.executorAccount);
+        const executor = this.checkedExecutor(described);
         // Resolved before the nonce, so a misconfigured key burns none.
         const signer = await this.authorSigner();
         const nonce = await this.config.nonces.next();
@@ -290,7 +296,8 @@ export class RelayClient {
             scope: input.groupId,
             op: input.op,
             authorAccount: this.config.authorAccount,
-            executor,
+            executor: executor.executorAccount,
+            executorKey: executor.executorKey,
             nonce,
             notAfter: BigInt(Math.floor(Date.now() / 1000)) + BigInt(ttl),
             signer,
@@ -316,9 +323,7 @@ export class RelayClient {
      *
      * The executor cannot be learned from the relay first: the namespace does not
      * exist, so `describeGovernance` has nothing to answer about. It comes from
-     * `input.executorAccount`, the configured one, or one an earlier call learned
-     * (`describe`, `createContext`, `govern`), and without any of them this
-     * throws before taking a nonce.
+     * `input.executor` only, and without it this throws before taking a nonce.
      * The nonce is spent in the new namespace's ledger.
      *
      * With `defaultCapabilities`, the founder then sets the namespace's default
@@ -329,14 +334,12 @@ export class RelayClient {
      * Refusals (`400`/`403`) come back as {@link IntentRefusedError}; a salt
      * that names an existing namespace is a `409`, an `HTTPError`.
      */
-    async foundNamespace(input = {}) {
-        const executor = input.executorAccount
-            ? this.checkedExecutor(input.executorAccount)
-            : this.executorAccount;
-        if (!executor) {
-            throw new Error("foundNamespace needs the relay's account: pass executorAccount or configure it " +
+    async foundNamespace(input) {
+        if (!input?.executor) {
+            throw new Error("foundNamespace needs the relay's account and signing key: pass executor " +
                 '(checked before signing, no nonce was spent)');
         }
+        const executor = this.checkedExecutor(input.executor);
         const salt = input.salt
             ? hex(fromHex(input.salt, 'salt', 32))
             : hex(crypto.getRandomValues(new Uint8Array(32)));
@@ -360,7 +363,8 @@ export class RelayClient {
             scope: namespaceId,
             op,
             authorAccount: this.config.authorAccount,
-            executor,
+            executor: executor.executorAccount,
+            executorKey: executor.executorKey,
             nonce,
             notAfter: BigInt(Math.floor(Date.now() / 1000)) + BigInt(ttl),
             signer,
@@ -408,17 +412,21 @@ export class RelayClient {
         return body.data;
     }
     /**
-     * The executor a warrant must name: the one the relay answered with, which a
-     * configured account must agree with. Remembered for later calls.
+     * The relay's answer, checked against a configured account and remembered.
+     * Decoded here so a relay naming no key is refused before a nonce is taken.
      */
     checkedExecutor(answered) {
+        const executor = {
+            executorAccount: hex(fromHex(answered.executorAccount ?? '', "the relay's executorAccount", 32)),
+            executorKey: hex(fromHex(answered.executorKey ?? '', "the relay's executorKey", 32)),
+        };
         const configured = this.config.executorAccount;
-        if (configured && configured.toLowerCase() !== answered.toLowerCase()) {
+        if (configured && configured.toLowerCase() !== executor.executorAccount) {
             throw new Error(`configured executorAccount ${configured} is not the relay's account ` +
-                `${answered}; a warrant naming it would be unspendable`);
+                `${executor.executorAccount}; a warrant naming it would be unspendable`);
         }
-        this.executorAccount = answered;
-        return answered;
+        this.executor = executor;
+        return executor;
     }
     /**
      * One request, waiting out a rate limit rather than failing the caller.

package/dist/warrant/creation-warrant.d.ts

@@ -36,8 +36,10 @@ export interface CreationWarrantInput {
     seed?: string;
     /** The author's account, hex — whose consent this is, and who runs `init`. */
     authorAccount: string;
-    /** The relay authorised to act, hex. An account, not a key. */
+    /** The relay's account, hex: the subject its authorship grant is held by. */
     executor: string;
+    /** The one signing key of `executor` that may carry it out, hex: discovery's `executorKey`. */
+    executorKey: string;
     /** The application the context is created with, hex (32 bytes). */
     applicationId: string;
     /**
@@ -103,6 +105,7 @@ export interface CreationWarrantFields {
     /** The author device key: the signer's public key. */
     deviceKey: string;
     executor: string;
+    executorKey: string;
     applicationId: string;
     /** `null` when absent — distinct from `""`. */
     serviceName: string | null;
@@ -129,6 +132,7 @@ export interface CreationPreimageParts {
     authorAccount: Uint8Array;
     deviceKey: Uint8Array;
     executor: Uint8Array;
+    executorKey: Uint8Array;
     applicationId: Uint8Array;
     serviceName: Uint8Array | null;
     name: Uint8Array | null;

package/dist/warrant/creation-warrant.js

@@ -51,6 +51,7 @@ export async function creationWarrantPreimage(p) {
         p.authorAccount,
         p.deviceKey,
         p.executor,
+        p.executorKey,
         p.applicationId,
         new Uint8Array([p.serviceName === null ? 0 : 1]),
         p.serviceName ?? new Uint8Array(0),
@@ -78,6 +79,7 @@ export async function signCreationWarrant(input) {
         : fromHex(input.seed, 'seed', 32);
     const authorAccount = fromHex(input.authorAccount, 'authorAccount', 32);
     const executor = fromHex(input.executor, 'executor', 32);
+    const executorKey = fromHex(input.executorKey, 'executorKey', 32);
     const applicationId = fromHex(input.applicationId, 'applicationId', 32);
     const serviceName = label(input.serviceName, 'serviceName');
     const name = label(input.name, 'name');
@@ -92,6 +94,7 @@ export async function signCreationWarrant(input) {
         authorAccount,
         deviceKey,
         executor,
+        executorKey,
         applicationId,
         serviceName,
         name,
@@ -102,7 +105,7 @@ export async function signCreationWarrant(input) {
         notAfter: input.notAfter,
     });
     const signature = checkedSignature(await signer.sign(preimage));
-    const warrant = hex(concat(group, seed, authorAccount, deviceKey, executor, applicationId, borshOption(serviceName), borshOption(name), initHash, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, u64le(input.nonce), u64le(input.notAfter), signature));
+    const warrant = hex(concat(group, seed, authorAccount, deviceKey, executor, executorKey, applicationId, borshOption(serviceName), borshOption(name), initHash, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, u64le(input.nonce), u64le(input.notAfter), signature));
     return { warrant, seed: hex(seed) };
 }
 /**
@@ -157,6 +160,7 @@ export function parseCreationWarrant(warrant) {
         authorAccount: hex(take(32, 'authorAccount')),
         deviceKey: hex(take(32, 'deviceKey')),
         executor: hex(take(32, 'executor')),
+        executorKey: hex(take(32, 'executorKey')),
         applicationId: hex(take(32, 'applicationId')),
         serviceName: option('serviceName'),
         name: option('name'),

package/dist/warrant/governance-warrant.d.ts

@@ -39,8 +39,10 @@ export interface GovernanceWarrantInput {
     op: GovernanceOp;
     /** The author's account, hex: whose authority the op is applied under. */
     authorAccount: string;
-    /** The relay authorised to publish it, hex. An account, not a key. */
+    /** The relay's account, hex: the subject its authorship grant is held by. */
     executor: string;
+    /** The one signing key of `executor` that may publish it, hex: discovery's `executorKey`. */
+    executorKey: string;
     /**
      * Monotonic per author **device**, spent in a per-group ledger. The same
      * nonce source `RelayClient` uses for every other warrant is correct.
@@ -76,6 +78,7 @@ export interface GovernanceWarrantFields {
     /** The author device key: the signer's public key. */
     deviceKey: string;
     executor: string;
+    executorKey: string;
     opHash: string;
     accountHeads: string[];
     governanceFloor: string[];
@@ -95,6 +98,7 @@ export interface GovernancePreimageParts {
     authorAccount: Uint8Array;
     deviceKey: Uint8Array;
     executor: Uint8Array;
+    executorKey: Uint8Array;
     opHash: Uint8Array;
     accountHeads: Uint8Array[];
     governanceFloor: Uint8Array[];

package/dist/warrant/governance-warrant.js

@@ -53,6 +53,7 @@ export async function governanceWarrantPreimage(p) {
         p.authorAccount,
         p.deviceKey,
         p.executor,
+        p.executorKey,
         p.opHash,
         u64le(p.accountHeads.length),
         ...p.accountHeads,
@@ -70,6 +71,7 @@ export async function signGovernanceWarrant(input) {
     const scope = fromHex(input.scope, 'scope', 32);
     const authorAccount = fromHex(input.authorAccount, 'authorAccount', 32);
     const executor = fromHex(input.executor, 'executor', 32);
+    const executorKey = fromHex(input.executorKey, 'executorKey', 32);
     const accountHeads = citedHeads(input.accountHeads, 'accountHeads');
     const governanceFloor = citedHeads(input.governanceFloor, 'governanceFloor');
     const kind = kindByte(input.op.kind);
@@ -82,6 +84,7 @@ export async function signGovernanceWarrant(input) {
         authorAccount,
         deviceKey,
         executor,
+        executorKey,
         opHash,
         accountHeads,
         governanceFloor,
@@ -89,7 +92,7 @@ export async function signGovernanceWarrant(input) {
         notAfter: input.notAfter,
     });
     const signature = checkedSignature(await signer.sign(preimage));
-    return hex(concat(scope, new Uint8Array([kind]), authorAccount, deviceKey, executor, opHash, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, u64le(input.nonce), u64le(input.notAfter), signature));
+    return hex(concat(scope, new Uint8Array([kind]), authorAccount, deviceKey, executor, executorKey, opHash, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, u64le(input.nonce), u64le(input.notAfter), signature));
 }
 /**
  * Decode a hex governance warrant back into its fields.
@@ -139,6 +142,7 @@ export function parseGovernanceWarrant(warrant) {
         authorAccount: hex(take(32, 'authorAccount')),
         deviceKey: hex(take(32, 'deviceKey')),
         executor: hex(take(32, 'executor')),
+        executorKey: hex(take(32, 'executorKey')),
         opHash: hex(take(32, 'opHash')),
         accountHeads: heads('accountHeads'),
         governanceFloor: heads('governanceFloor'),

package/dist/warrant/warrant.d.ts

@@ -42,8 +42,13 @@ export interface WarrantInput {
     context: string;
     /** The author's account, hex — whose consent this is. */
     authorAccount: string;
-    /** The relay authorised to act, hex. An account, not a key. */
+    /** The relay's account, hex: the subject its authorship grant is held by. */
     executor: string;
+    /**
+     * The one signing key of `executor` that may spend this warrant, hex: the
+     * relay's `executorKey` from discovery. Any other key of the account is refused.
+     */
+    executorKey: string;
     /**
      * The application build this warrant is signed against, hex (32 bytes).
      *
@@ -152,6 +157,7 @@ export interface WarrantFields {
     /** The author device key `signWarrant` derived from the secret. */
     deviceKey: string;
     executor: string;
+    executorKey: string;
     appVersion: string;
     method: string;
     intentHash: string;

package/dist/warrant/warrant.js

@@ -59,6 +59,7 @@ export async function signWarrant(input) {
     const context = fromHex(input.context, 'context', 32);
     const authorAccount = fromHex(input.authorAccount, 'authorAccount', 32);
     const executor = fromHex(input.executor, 'executor', 32);
+    const executorKey = fromHex(input.executorKey, 'executorKey', 32);
     const appVersion = fromHex(input.appVersion ?? UNPINNED_APP, 'appVersion', 32);
     const accountHeads = citedHeads(input.accountHeads, 'accountHeads');
     const governanceFloor = citedHeads(input.governanceFloor, 'governanceFloor');
@@ -78,6 +79,7 @@ export async function signWarrant(input) {
         authorAccount,
         publicKey,
         executor,
+        executorKey,
         appVersion,
         method,
         commitment,
@@ -91,7 +93,7 @@ export async function signWarrant(input) {
     const signature = checkedSignature(await signer.sign(preimage));
     // Borsh: a `String` is a u32 length then its UTF-8 bytes; a `Vec<[u8; 32]>` is
     // a u32 count then the elements. u32 HERE; u64 in the preimage above.
-    return hex(concat(context, authorAccount, publicKey, executor, appVersion, u32le(method.length), method, commitment, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, nonce, notAfter, signature));
+    return hex(concat(context, authorAccount, publicKey, executor, executorKey, appVersion, u32le(method.length), method, commitment, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, nonce, notAfter, signature));
 }
 /**
  * Decode a cited-head list, refusing one longer than a node will accept.
@@ -146,6 +148,7 @@ export function parseWarrant(warrant) {
     const authorAccount = take(32);
     const deviceKey = take(32);
     const executor = take(32);
+    const executorKey = take(32);
     const appVersion = take(32);
     const methodLen = u32At(o);
     o += 4;
@@ -168,6 +171,7 @@ export function parseWarrant(warrant) {
         authorAccount,
         deviceKey,
         executor,
+        executorKey,
         appVersion,
         method,
         intentHash: intentHashField,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "24.1.2",
+  "version": "24.2.0",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {