@calimero-network/mero-js 25.3.3 → 26.0.0

package/dist/account/session.d.ts

@@ -77,12 +77,9 @@ export declare function clearDelegatedCredential(): void;
  * replay a spent nonce and be refused. Keyed by relay and context because the
  * ledger the node keeps is per `(context, author device)`.
  *
- * This is the client-side half of core #4018. The node can answer "where does
- * my sequence stand" — `POST /contexts/{id}/warrant-nonce` with the caller's own
- * `authorProof` — but that route is mounted on the protected router, so a
- * delegated client on a relay cannot reach it. Until it moves, holding the
- * counter locally is the only option, and losing storage means burning refusals
- * until the counter catches up.
+ * No node serves a "where does my sequence stand" lookup (core #4018), so
+ * holding the counter locally is the only option, and losing storage means
+ * burning refusals until the counter catches up.
  */
 export declare function persistedNonces(relayUrl: string): {
     next: () => Promise<bigint>;

package/dist/account/session.js

@@ -116,12 +116,9 @@ export function clearDelegatedCredential() {
  * replay a spent nonce and be refused. Keyed by relay and context because the
  * ledger the node keeps is per `(context, author device)`.
  *
- * This is the client-side half of core #4018. The node can answer "where does
- * my sequence stand" — `POST /contexts/{id}/warrant-nonce` with the caller's own
- * `authorProof` — but that route is mounted on the protected router, so a
- * delegated client on a relay cannot reach it. Until it moves, holding the
- * counter locally is the only option, and losing storage means burning refusals
- * until the counter catches up.
+ * No node serves a "where does my sequence stand" lookup (core #4018), so
+ * holding the counter locally is the only option, and losing storage means
+ * burning refusals until the counter catches up.
  */
 export function persistedNonces(relayUrl) {
     // ONE sequence per relay, not one per context. A client is rebuilt whenever

package/dist/admin-api/admin-client.d.ts

@@ -1,37 +1,6 @@
-import { HttpClient, HTTPError } from '../http-client/index.js';
-import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, NamespaceRevokedDevices, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData, WarrantNonceState } from './admin-types.js';
+import { HttpClient } from '../http-client/index.js';
+import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, NamespaceRevokedDevices, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData } from './admin-types.js';
 import { type RedeemOutcome } from './redeem-invitation.js';
-/**
- * Thrown when a node answers the warrant-nonce route with a 404.
- *
- * Its own type because the meaning is unambiguous and not "not found": the
- * handler never 404s — an unknown device is a `200` with `seen: false`, a
- * malformed id is a `400` — so a 404 says the route is not mounted on this
- * node. It is new on core and absent from `master` builds. A caller that sees
- * this should fall back to its own counter (or refuse to write) rather than
- * retry, because no amount of retrying adds a route to a running node.
- */
-export declare class WarrantNonceRouteUnavailableError extends Error {
-    /** The path that answered 404. */
-    readonly path: string;
-    /** The underlying HTTP failure, kept for logs. */
-    readonly cause: HTTPError;
-    name: string;
-    constructor(
-    /** The path that answered 404. */
-    path: string, 
-    /** The underlying HTTP failure, kept for logs. */
-    cause: HTTPError);
-}
-/**
- * Shape the node's answer into the union, which is where the exhausted case
- * stops being a missing field and starts being something the compiler asks
- * about.
- *
- * Exported for tests: it is the whole client-side contract of the route, and
- * testing it needs no transport.
- */
-export declare function parseWarrantNonce(body: string): WarrantNonceState;
 /**
  * Compare two version strings by SemVer 2.0 precedence, ascending: negative if
  * `a < b`, positive if `a > b`, `0` if equal. Build metadata (`+...`) is stripped
@@ -108,7 +77,6 @@ export declare class AdminApiClient {
      * context as stranded.
      */
     resyncContext(contextId: string, request?: ResyncContextRequest): Promise<ResyncContextResponseData>;
-    inviteSpecializedNode(request: InviteSpecializedNodeRequest): Promise<InviteSpecializedNodeResponseData>;
     updateContextApplication(contextId: string, request: UpdateContextApplicationRequest): Promise<void>;
     getContextsWithExecutorsForApplication(applicationId: string): Promise<ContextsWithExecutorsResponseData>;
     uploadBlob(request: UploadBlobRequest): Promise<UploadBlobResponseData>;
@@ -169,26 +137,6 @@ export declare class AdminApiClient {
      * namespace.
      */
     getNodeIdentity(): Promise<NodeIdentity>;
-    /**
-     * @deprecated Use {@link getNodeIdentity} instead. Every field this returns is
-     * node-level, so the namespace was only ever decoration — it now delegates to
-     * the node-level route and reshapes the answer.
-     *
-     * Three consequences of that delegation, all visible to a caller who relied on
-     * the old route's behaviour:
-     *
-     * - **No participation gate.** The namespace route answered 404 when this node
-     *   had never joined the namespace; this answers whatever the node's identity
-     *   is, regardless. If you were using it to ask "am I in this namespace?", ask
-     *   {@link listNamespaces} instead — that is the question you were really
-     *   asking.
-     * - **`namespaceId` is echoed verbatim.** The old route resolved a subgroup id
-     *   to its root namespace and returned that; passing a subgroup id here gives
-     *   the subgroup id back.
-     * - **404 means something else.** Previously "not my namespace", now "this node
-     *   holds no account root yet".
-     */
-    getNamespaceIdentity(namespaceId: string): Promise<NamespaceIdentity>;
     /**
      * Ask this node to run one method on a member's behalf, under a warrant that
      * member signed.
@@ -486,80 +434,6 @@ export declare class AdminApiClient {
      * same reason {@link listAccountDevices} unwraps `devices`.
      */
     listGroupMemberDevices(groupId: string, options?: ListMemberDevicesOptions): Promise<MemberDevicesEntry[]>;
-    /**
-     * Where `authorDeviceKey` stands in its warrant-nonce sequence in `contextId`.
-     *
-     * # What this is for
-     *
-     * The nonce is the one input to a warrant that is stateful on the *client*.
-     * Everything else an author needs it either holds (its keys, the method, the
-     * args) or can read from the relay ({@link RelayClient.describe} gives the
-     * executor account and the grant). So an author that has lost its counter —
-     * a browser keyholder in partitioned or periodically cleared storage, which
-     * is its normal lifecycle rather than a fault — otherwise has exactly one
-     * strategy: guess upward and burn a refused round trip per wrong guess, with
-     * each refusal indistinguishable at the API from a genuinely spent nonce.
-     *
-     * Read {@link WarrantNonceOpen.nextNonce} and mint there. If you still hold
-     * your own counter, mint at `max(ownNext, nextNonce)`: nonce state folds per
-     * peer, so a node can only be BEHIND a client whose warrants it has not
-     * applied — never ahead of the truth. An author spread across several relays
-     * asks each and takes the highest answer. {@link createRecoveringNonceSource}
-     * does all of that.
-     *
-     * Purely a read. It spends nothing and advances nothing, so it may be called
-     * as often as you like.
-     *
-     * # Forward compatibility — this route is NEW
-     *
-     * It is not on core `master` yet, so a current node answers **404**, which
-     * this method surfaces as {@link WarrantNonceRouteUnavailableError} rather
-     * than as an opaque {@link HTTPError}. That distinction matters because the
-     * handler itself never 404s: a device with no row is a `200` with
-     * `seen: false`, and a malformed id is a `400`. So a 404 here means the node
-     * does not serve the route at all — an older build, or a deployment that has
-     * not re-mounted it — and the answer is to fall back to a local counter, not
-     * to retry.
-     *
-     * # Authentication
-     *
-     * On the PROTECTED admin router, unlike the two delegated-execution routes it
-     * sits beside: it takes another principal's device key as input and reports
-     * that principal's activity. A `--public-intents` deployment does not serve
-     * this anonymously, so an admin credential is required.
-     *
-     * @param authorDeviceKey the device's signing key, base58 (43-44 chars) or
-     *        hex (exactly 64). The node accepts either; the two never collide.
-     */
-    getWarrantNonce(contextId: string, authorDeviceKey: string): Promise<WarrantNonceState>;
-    /**
-     * The same answer, asked for the way a delegated client has to ask.
-     *
-     * {@link getWarrantNonce} is on the protected admin router, so a keyholder
-     * writing through a relay — the client this whole facility exists for — is
-     * refused it: measured `403` for a session carrying exactly
-     * `context:intent`, `context:query`, `context:subscribe`. That client has no
-     * admin credential and cannot be given one without defeating the point of the
-     * delegated surface.
-     *
-     * What it does have is the credential proving the device is its own, which it
-     * already sends on every write. Presenting it here makes the request
-     * self-scoped: you learn a device's position only by proving, at call time,
-     * that the device is yours. So there is no oracle to protect against, and no
-     * reason for an admin gate.
-     *
-     * The device key is NOT a parameter. It is read from the verified
-     * certificate server-side, which is the only reading that cannot disagree
-     * with the signature — a key supplied alongside would be a second spelling of
-     * the same fact, and two spellings can differ.
-     *
-     * Returns the identical shape {@link getWarrantNonce} returns, so a caller can
-     * swap one for the other without touching what it does with the answer.
-     *
-     * @param authorProof hex-encoded borsh `AccountProof<DeviceCert>` — the same
-     *        value passed as `authorProof` to the relay client.
-     */
-    getWarrantNonceAsAuthor(contextId: string, authorProof: string): Promise<WarrantNonceState>;
     /**
      * Member accounts in the group and the devices bound to each. An admin node
      * sees every account; a plain member only its own. `403` if this node is not a
@@ -734,11 +608,6 @@ export declare class AdminApiClient {
     joinSubgroupInheritance(groupId: string): Promise<JoinSubgroupInheritanceResponseData>;
     getTeeInfo(): Promise<TeeInfoResponseData>;
     teeAttest(request: TeeAttestRequest): Promise<TeeAttestResponseData>;
-    /**
-     * @deprecated Nodes no longer serve `/admin-api/tee/verify-quote` (removed in
-     * core#3262), so this fails. Verify quotes with `createQuoteVerifier`.
-     */
-    teeVerifyQuote(request: TeeVerifyQuoteRequest): Promise<TeeVerifyQuoteResponseData>;
     getPeersCount(): Promise<{
         count: number;
     }>;

package/dist/admin-api/admin-client.js

@@ -1,92 +1,7 @@
-import { HTTPError, withRetry } from '../http-client/index.js';
+import { withRetry } from '../http-client/index.js';
 import { pathSegment } from '../http-client/path-segment.js';
 import { CAPABILITIES, hasCap, withCap } from '../capabilities.js';
 import { redeemInvitation } from './redeem-invitation.js';
-/**
- * Thrown when a node answers the warrant-nonce route with a 404.
- *
- * Its own type because the meaning is unambiguous and not "not found": the
- * handler never 404s — an unknown device is a `200` with `seen: false`, a
- * malformed id is a `400` — so a 404 says the route is not mounted on this
- * node. It is new on core and absent from `master` builds. A caller that sees
- * this should fall back to its own counter (or refuse to write) rather than
- * retry, because no amount of retrying adds a route to a running node.
- */
-export class WarrantNonceRouteUnavailableError extends Error {
-    constructor(
-    /** The path that answered 404. */
-    path, 
-    /** The underlying HTTP failure, kept for logs. */
-    cause) {
-        super(`this node does not serve warrant-nonce discovery (404 on ${path}); it predates the route, so a client must fall back to its own nonce counter`);
-        this.path = path;
-        this.cause = cause;
-        this.name = 'WarrantNonceRouteUnavailableError';
-    }
-}
-/**
- * Recover a `u64` from the response bytes rather than from a parsed `number`.
- *
- * `JSON.parse` has already rounded anything past 2^53 by the time a value is
- * handed over, and it rounds without complaint — so the digits are read back
- * out of the source text and turned straight into a `bigint`.
- *
- * Matching on the quoted key is safe for exactly this response: its only two
- * string fields are a context id and a device key, both of which are hex or
- * base58 and so cannot contain a quote, a colon, or these field names. The
- * parsed object still decides whether a field is *present*; the text is
- * consulted only for its digits.
- */
-function u64FromBody(body, parsed, field) {
-    const value = parsed[field];
-    if (value === undefined || value === null)
-        return undefined;
-    const digits = new RegExp(`"${field}"\\s*:\\s*(\\d+)`).exec(body);
-    if (digits)
-        return BigInt(digits[1]);
-    // The field is present but not a bare integer literal in the body — a node
-    // that started sending it as a string, say. Accept a decimal string, and
-    // refuse anything else loudly instead of coercing a nonce into existence.
-    if (typeof value === 'string' && /^\d+$/.test(value))
-        return BigInt(value);
-    throw new Error(`warrant-nonce response field \`${field}\` is not a u64: ${JSON.stringify(value)}`);
-}
-/**
- * Shape the node's answer into the union, which is where the exhausted case
- * stops being a missing field and starts being something the compiler asks
- * about.
- *
- * Exported for tests: it is the whole client-side contract of the route, and
- * testing it needs no transport.
- */
-export function parseWarrantNonce(body) {
-    const parsed = JSON.parse(body);
-    const data = parsed?.data;
-    if (!data || typeof data !== 'object') {
-        throw new Error(`warrant-nonce response had no \`data\`: ${body.slice(0, 200)}`);
-    }
-    const common = {
-        contextId: String(data.contextId ?? ''),
-        authorDeviceKey: String(data.authorDeviceKey ?? ''),
-        seen: data.seen === true,
-        highWaterNonce: u64FromBody(body, data, 'highWaterNonce'),
-        // Not defaulted: a node that stopped sending it is a node whose window this
-        // client would be guessing at, and the window is not a nonce input anyway.
-        windowWidth: u64FromBody(body, data, 'windowWidth') ?? 0n,
-    };
-    const nextNonce = u64FromBody(body, data, 'nextNonce');
-    if (nextNonce === undefined) {
-        // The one absence with a meaning: `u64::MAX` is spent. The node omits the
-        // field rather than wrapping to `0`, and a client must not fill the gap.
-        return {
-            ...common,
-            kind: 'exhausted',
-            seen: true,
-            highWaterNonce: common.highWaterNonce ?? 0xffffffffffffffffn,
-        };
-    }
-    return { ...common, kind: 'open', nextNonce };
-}
 /**
  * Helper: server wraps most responses in `{ data: T }`.
  * This extracts `.data` so callers get the inner payload directly. Null-safe so an
@@ -334,9 +249,6 @@ export class AdminApiClient {
         // callers always get a typed value instead of null.
         return r ?? { contextId, resyncStarted: true };
     }
-    async inviteSpecializedNode(request) {
-        return unwrap(await this.httpClient.post('/admin-api/contexts/invite-specialized-node', request));
-    }
     async updateContextApplication(contextId, request) {
         await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/application`, request);
     }
@@ -495,29 +407,6 @@ export class AdminApiClient {
     async getNodeIdentity() {
         return unwrap(await this.httpClient.get('/admin-api/identity'));
     }
-    /**
-     * @deprecated Use {@link getNodeIdentity} instead. Every field this returns is
-     * node-level, so the namespace was only ever decoration — it now delegates to
-     * the node-level route and reshapes the answer.
-     *
-     * Three consequences of that delegation, all visible to a caller who relied on
-     * the old route's behaviour:
-     *
-     * - **No participation gate.** The namespace route answered 404 when this node
-     *   had never joined the namespace; this answers whatever the node's identity
-     *   is, regardless. If you were using it to ask "am I in this namespace?", ask
-     *   {@link listNamespaces} instead — that is the question you were really
-     *   asking.
-     * - **`namespaceId` is echoed verbatim.** The old route resolved a subgroup id
-     *   to its root namespace and returned that; passing a subgroup id here gives
-     *   the subgroup id back.
-     * - **404 means something else.** Previously "not my namespace", now "this node
-     *   holds no account root yet".
-     */
-    async getNamespaceIdentity(namespaceId) {
-        const node = await this.getNodeIdentity();
-        return { namespaceId, publicKey: node.publicKey, account: node.accountId };
-    }
     /**
      * Ask this node to run one method on a member's behalf, under a warrant that
      * member signed.
@@ -924,113 +813,6 @@ export class AdminApiClient {
         const response = await this.httpClient.get(query ? `${base}?${query}` : base);
         return response.members;
     }
-    /**
-     * Where `authorDeviceKey` stands in its warrant-nonce sequence in `contextId`.
-     *
-     * # What this is for
-     *
-     * The nonce is the one input to a warrant that is stateful on the *client*.
-     * Everything else an author needs it either holds (its keys, the method, the
-     * args) or can read from the relay ({@link RelayClient.describe} gives the
-     * executor account and the grant). So an author that has lost its counter —
-     * a browser keyholder in partitioned or periodically cleared storage, which
-     * is its normal lifecycle rather than a fault — otherwise has exactly one
-     * strategy: guess upward and burn a refused round trip per wrong guess, with
-     * each refusal indistinguishable at the API from a genuinely spent nonce.
-     *
-     * Read {@link WarrantNonceOpen.nextNonce} and mint there. If you still hold
-     * your own counter, mint at `max(ownNext, nextNonce)`: nonce state folds per
-     * peer, so a node can only be BEHIND a client whose warrants it has not
-     * applied — never ahead of the truth. An author spread across several relays
-     * asks each and takes the highest answer. {@link createRecoveringNonceSource}
-     * does all of that.
-     *
-     * Purely a read. It spends nothing and advances nothing, so it may be called
-     * as often as you like.
-     *
-     * # Forward compatibility — this route is NEW
-     *
-     * It is not on core `master` yet, so a current node answers **404**, which
-     * this method surfaces as {@link WarrantNonceRouteUnavailableError} rather
-     * than as an opaque {@link HTTPError}. That distinction matters because the
-     * handler itself never 404s: a device with no row is a `200` with
-     * `seen: false`, and a malformed id is a `400`. So a 404 here means the node
-     * does not serve the route at all — an older build, or a deployment that has
-     * not re-mounted it — and the answer is to fall back to a local counter, not
-     * to retry.
-     *
-     * # Authentication
-     *
-     * On the PROTECTED admin router, unlike the two delegated-execution routes it
-     * sits beside: it takes another principal's device key as input and reports
-     * that principal's activity. A `--public-intents` deployment does not serve
-     * this anonymously, so an admin credential is required.
-     *
-     * @param authorDeviceKey the device's signing key, base58 (43-44 chars) or
-     *        hex (exactly 64). The node accepts either; the two never collide.
-     */
-    async getWarrantNonce(contextId, authorDeviceKey) {
-        const path = `/admin-api/contexts/${pathSegment(contextId)}/warrant-nonce/${pathSegment(authorDeviceKey)}`;
-        // Read as TEXT, not JSON. `JSON.parse` would turn the `u64` nonces into
-        // doubles before this code ever sees them, rounding anything past 2^53 into
-        // a value that looks ordinary and is refused forever. The digits have to be
-        // taken from the bytes.
-        let raw;
-        try {
-            raw = await this.httpClient.get(path, { parse: 'text' });
-        }
-        catch (error) {
-            if (error instanceof HTTPError && error.status === 404) {
-                throw new WarrantNonceRouteUnavailableError(path, error);
-            }
-            throw error;
-        }
-        return parseWarrantNonce(raw);
-    }
-    /**
-     * The same answer, asked for the way a delegated client has to ask.
-     *
-     * {@link getWarrantNonce} is on the protected admin router, so a keyholder
-     * writing through a relay — the client this whole facility exists for — is
-     * refused it: measured `403` for a session carrying exactly
-     * `context:intent`, `context:query`, `context:subscribe`. That client has no
-     * admin credential and cannot be given one without defeating the point of the
-     * delegated surface.
-     *
-     * What it does have is the credential proving the device is its own, which it
-     * already sends on every write. Presenting it here makes the request
-     * self-scoped: you learn a device's position only by proving, at call time,
-     * that the device is yours. So there is no oracle to protect against, and no
-     * reason for an admin gate.
-     *
-     * The device key is NOT a parameter. It is read from the verified
-     * certificate server-side, which is the only reading that cannot disagree
-     * with the signature — a key supplied alongside would be a second spelling of
-     * the same fact, and two spellings can differ.
-     *
-     * Returns the identical shape {@link getWarrantNonce} returns, so a caller can
-     * swap one for the other without touching what it does with the answer.
-     *
-     * @param authorProof hex-encoded borsh `AccountProof<DeviceCert>` — the same
-     *        value passed as `authorProof` to the relay client.
-     */
-    async getWarrantNonceAsAuthor(contextId, authorProof) {
-        const path = `/admin-api/contexts/${pathSegment(contextId)}/warrant-nonce`;
-        // Text, not JSON, for the reason given in `getWarrantNonce`: `JSON.parse`
-        // rounds a u64 past 2^53 into a nonce that looks ordinary and is refused
-        // for ever.
-        let raw;
-        try {
-            raw = await this.httpClient.post(path, { authorProof }, { parse: 'text' });
-        }
-        catch (error) {
-            if (error instanceof HTTPError && error.status === 404) {
-                throw new WarrantNonceRouteUnavailableError(path, error);
-            }
-            throw error;
-        }
-        return parseWarrantNonce(raw);
-    }
     /**
      * Member accounts in the group and the devices bound to each. An admin node
      * sees every account; a plain member only its own. `403` if this node is not a
@@ -1326,13 +1108,6 @@ export class AdminApiClient {
     async teeAttest(request) {
         return unwrap(await this.httpClient.post('/admin-api/tee/attest', request));
     }
-    /**
-     * @deprecated Nodes no longer serve `/admin-api/tee/verify-quote` (removed in
-     * core#3262), so this fails. Verify quotes with `createQuoteVerifier`.
-     */
-    async teeVerifyQuote(request) {
-        return unwrap(await this.httpClient.post('/admin-api/tee/verify-quote', request));
-    }
     // ---- Network ----
     async getPeersCount() {
         return this.httpClient.get('/admin-api/peers');

package/dist/admin-api/admin-types.d.ts

@@ -164,13 +164,6 @@ export interface ContextStorageResponseData {
     sizeInBytes: number;
 }
 export type SyncContextResponseData = null;
-export interface InviteSpecializedNodeRequest {
-    contextId: string;
-    inviterId?: string;
-}
-export interface InviteSpecializedNodeResponseData {
-    nonce: string;
-}
 export interface UpdateContextApplicationRequest {
     applicationId: string;
     executorPublicKey: string;
@@ -617,23 +610,6 @@ export interface RevokedFromEntry {
     /** The device that was withdrawn, 64 hex characters. */
     deviceId: string;
 }
-/**
- * @deprecated Use {@link AdminApiClient.getNodeIdentity} instead. Nothing here
- * varies by namespace, so the parameter could only ever be decoration.
- */
-export interface NamespaceIdentity {
-    /** Echoed back from the argument; it does not describe the identity. */
-    namespaceId: string;
-    /** The key this node signs with, 64 hex. */
-    publicKey: string;
-    /**
-     * The account this node writes as, 64 hex characters. This — not
-     * `publicKey` — is what member-addressing endpoints take, and what
-     * `listGroupMembers` entries are keyed by, so it is how a caller locates
-     * itself in a member list.
-     */
-    account: string;
-}
 export interface CreateNamespaceRequest {
     applicationId: string;
     name?: string;
@@ -1889,23 +1865,6 @@ export interface TeeAttestResponseData {
      */
     collateral?: DcapCollateral;
 }
-/**
- * @deprecated Nodes no longer serve `/admin-api/tee/verify-quote` (removed in
- * core#3262), so a request for it fails. Verify quotes with
- * `createQuoteVerifier`.
- */
-export interface TeeVerifyQuoteRequest {
-    quoteB64: string;
-    nonce: string;
-    expectedApplicationHash?: string;
-}
-/** @deprecated See {@link TeeVerifyQuoteRequest}. */
-export interface TeeVerifyQuoteResponseData {
-    quoteVerified: boolean;
-    nonceVerified: boolean;
-    applicationHashVerified?: boolean;
-    quote: Quote;
-}
 export interface AdminApiClientConfig {
     baseUrl: string;
     getAuthToken?: () => Promise<string | undefined>;
@@ -1936,108 +1895,3 @@ export interface AdmitJoinResponseData {
      */
     readonly published: boolean;
 }
-/**
- * Where one author device stands in its warrant-nonce sequence on one node.
- *
- * # Why `bigint` and not `number`
- *
- * A nonce is a `u64` on the node. `JSON.parse` turns every number into an IEEE
- * double, so any value past 2^53 arrives already rounded - and it rounds
- * silently, producing a nonce that looks ordinary and is refused forever. The
- * exhaustion rule this endpoint exists to report (`u64::MAX` spent -> no next
- * nonce) lives precisely in the range a `number` cannot hold, so representing it
- * as one would lose the very case the type is meant to make visible.
- *
- * `bigint` over a decimal `string` because callers do arithmetic with these:
- * the documented recovery rule is `max(ownNext, nextNonce)`, and
- * {@link NonceSource} already emits `bigint`. A string would make every caller
- * convert first, and the ones that forget would compare `"10" < "9"`.
- *
- * The digits are recovered from the raw response text rather than from a parsed
- * `number`, so nothing is routed through a double on the way in.
- *
- * # Why a union on `kind`
- *
- * `nextNonce` is absent in exactly one case, and a client that reads it as
- * `undefined` and falls back to a guess burns nonces for real. Splitting the two
- * cases makes the compiler ask which one this is before `nextNonce` can be read
- * at all.
- *
- * The discriminant is a string rather than an `exhausted: boolean` because this
- * package compiles with `strictNullChecks` off, and TypeScript declines to
- * narrow a union on a boolean-literal discriminant in that mode. A flag that
- * silently fails to narrow would be worse than no flag: it would read as a
- * guard and admit `nextNonce` on both arms.
- */
-export type WarrantNonceState = WarrantNonceOpen | WarrantNonceExhausted;
-/** Fields both arms carry, whatever the sequence's state. */
-interface WarrantNonceCommon {
-    /** The context asked about, echoed - read it to reject a cached answer. */
-    readonly contextId: string;
-    /**
-     * The author device asked about, echoed. This is the device's SIGNING KEY,
-     * not its `deviceId` and not the account: two devices of one account hold two
-     * independent sequences, and a re-keyed device starts a fresh one.
-     *
-     * Echoed as the node spelled it, which is the spelling that was asked for -
-     * the route accepts base58 or hex and does not normalise between them.
-     */
-    readonly authorDeviceKey: string;
-    /**
-     * Whether this node has admitted any warrant from this device here.
-     *
-     * `false` is the ordinary state of a device that has not written yet - a fresh
-     * sequence, not an error and not a row worth retrying for.
-     */
-    readonly seen: boolean;
-    /**
-     * The highest nonce this node has accepted from this device here, absent when
-     * `seen` is `false`.
-     *
-     * Reported for auditability. Do NOT compute a nonce from it: the `+ 1` is the
-     * node's arithmetic, already done in {@link WarrantNonceOpen.nextNonce}, and
-     * doing it again here is how a client reintroduces the overflow this endpoint
-     * avoids.
-     */
-    readonly highWaterNonce?: bigint;
-    /**
-     * How far below `highWaterNonce` a late warrant may still be accepted.
-     *
-     * Constant (64 today), and useful for sizing an in-flight window: a warrant
-     * minted but not yet executed is refused once this many later ones have landed
-     * ahead of it. It is NOT an input to a nonce - which parts of the window below
-     * the mark are already spent is deliberately not reported.
-     */
-    readonly windowWidth: bigint;
-}
-/** The sequence has room: {@link nextNonce} is the number to mint at. */
-export interface WarrantNonceOpen extends WarrantNonceCommon {
-    readonly kind: 'open';
-    /**
-     * The smallest nonce this node is guaranteed to accept. **The only actionable
-     * value here.**
-     *
-     * `0` on a fresh sequence (`seen: false`), which is a real answer, not a
-     * missing one.
-     *
-     * A client that still holds its own counter must mint at
-     * `max(ownNext, nextNonce)`, never at `nextNonce` alone: nonce state folds per
-     * peer, so this node can be BEHIND a client whose warrants it has not applied
-     * yet, and never ahead of the truth. An author spread across relays asks each
-     * and takes the highest answer.
-     */
-    readonly nextNonce: bigint;
-}
-/**
- * `u64::MAX` is spent here: there is no next nonce and this device cannot write
- * to this context again. It must re-key - a new signing key starts a fresh
- * sequence.
- *
- * The node reports this by omitting `nextNonce` rather than by wrapping to `0`,
- * because a wrapped `0` would look like a valid answer and be refused forever.
- */
-export interface WarrantNonceExhausted extends WarrantNonceCommon {
-    readonly kind: 'exhausted';
-    readonly seen: true;
-    readonly highWaterNonce: bigint;
-}