@calimero-network/mero-js 25.3.3 → 26.0.1

package/dist/account/join-with-node.d.ts

@@ -21,18 +21,13 @@
  * `signer == credential.statement.sign_pk` before applying a join — so an
  * admitter can carry this and can never author it: it cannot admit a different
  * account, change the group, or grant a role. It can refuse, and that is all.
- * This is also why the fleet ingress leaves the route unauthenticated, and why
- * this posts with `fetch` rather than through `AdminApiClient`, which is built
- * around a node credential this caller does not have.
- *
- * ## Why it lives here and not in mero-js
- *
- * Two reasons. `mero-js` is read-only for this change by instruction, and the
- * shape that is actually useful to a caller is the one that hands back a
- * {@link DelegatedSession} — the node that admitted you is the node to connect
- * through — which is `mero-react`'s concern. The pieces that are pure SDK, the
- * borsh op layout and the request type, are used from `mero-js` unchanged and
- * are not reimplemented here.
+ * This is also why core serves the route without a credential (it sits on the
+ * public admin router, beside `/health` and the intent routes, on every node
+ * whatever its auth mode), why the fleet ingress exempts the one anchored path,
+ * and why this posts with `fetch` rather than through `AdminApiClient`, which is
+ * built around a node credential this caller does not have. A node that predates
+ * that change and runs embedded auth answers 401 here; the failure is reported at
+ * the `admit` step like any other refusal.
  *
  * ## Why the op has no parents
  *

package/dist/account/join-with-node.js

@@ -21,18 +21,13 @@
  * `signer == credential.statement.sign_pk` before applying a join — so an
  * admitter can carry this and can never author it: it cannot admit a different
  * account, change the group, or grant a role. It can refuse, and that is all.
- * This is also why the fleet ingress leaves the route unauthenticated, and why
- * this posts with `fetch` rather than through `AdminApiClient`, which is built
- * around a node credential this caller does not have.
- *
- * ## Why it lives here and not in mero-js
- *
- * Two reasons. `mero-js` is read-only for this change by instruction, and the
- * shape that is actually useful to a caller is the one that hands back a
- * {@link DelegatedSession} — the node that admitted you is the node to connect
- * through — which is `mero-react`'s concern. The pieces that are pure SDK, the
- * borsh op layout and the request type, are used from `mero-js` unchanged and
- * are not reimplemented here.
+ * This is also why core serves the route without a credential (it sits on the
+ * public admin router, beside `/health` and the intent routes, on every node
+ * whatever its auth mode), why the fleet ingress exempts the one anchored path,
+ * and why this posts with `fetch` rather than through `AdminApiClient`, which is
+ * built around a node credential this caller does not have. A node that predates
+ * that change and runs embedded auth answers 401 here; the failure is reported at
+ * the `admit` step like any other refusal.
  *
  * ## Why the op has no parents
  *

package/dist/account/session.d.ts

@@ -77,12 +77,9 @@ export declare function clearDelegatedCredential(): void;
  * replay a spent nonce and be refused. Keyed by relay and context because the
  * ledger the node keeps is per `(context, author device)`.
  *
- * This is the client-side half of core #4018. The node can answer "where does
- * my sequence stand" — `POST /contexts/{id}/warrant-nonce` with the caller's own
- * `authorProof` — but that route is mounted on the protected router, so a
- * delegated client on a relay cannot reach it. Until it moves, holding the
- * counter locally is the only option, and losing storage means burning refusals
- * until the counter catches up.
+ * No node serves a "where does my sequence stand" lookup (core #4018), so
+ * holding the counter locally is the only option, and losing storage means
+ * burning refusals until the counter catches up.
  */
 export declare function persistedNonces(relayUrl: string): {
     next: () => Promise<bigint>;

package/dist/account/session.js

@@ -116,12 +116,9 @@ export function clearDelegatedCredential() {
  * replay a spent nonce and be refused. Keyed by relay and context because the
  * ledger the node keeps is per `(context, author device)`.
  *
- * This is the client-side half of core #4018. The node can answer "where does
- * my sequence stand" — `POST /contexts/{id}/warrant-nonce` with the caller's own
- * `authorProof` — but that route is mounted on the protected router, so a
- * delegated client on a relay cannot reach it. Until it moves, holding the
- * counter locally is the only option, and losing storage means burning refusals
- * until the counter catches up.
+ * No node serves a "where does my sequence stand" lookup (core #4018), so
+ * holding the counter locally is the only option, and losing storage means
+ * burning refusals until the counter catches up.
  */
 export function persistedNonces(relayUrl) {
     // ONE sequence per relay, not one per context. A client is rebuilt whenever

package/dist/admin-api/admin-client.d.ts

@@ -1,37 +1,6 @@
-import { HttpClient, HTTPError } from '../http-client/index.js';
-import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, InviteSpecializedNodeRequest, InviteSpecializedNodeResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NamespaceIdentity, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, NamespaceRevokedDevices, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, TeeVerifyQuoteRequest, TeeVerifyQuoteResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData, WarrantNonceState } from './admin-types.js';
+import { HttpClient } from '../http-client/index.js';
+import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, NamespaceRevokedDevices, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData } from './admin-types.js';
 import { type RedeemOutcome } from './redeem-invitation.js';
-/**
- * Thrown when a node answers the warrant-nonce route with a 404.
- *
- * Its own type because the meaning is unambiguous and not "not found": the
- * handler never 404s — an unknown device is a `200` with `seen: false`, a
- * malformed id is a `400` — so a 404 says the route is not mounted on this
- * node. It is new on core and absent from `master` builds. A caller that sees
- * this should fall back to its own counter (or refuse to write) rather than
- * retry, because no amount of retrying adds a route to a running node.
- */
-export declare class WarrantNonceRouteUnavailableError extends Error {
-    /** The path that answered 404. */
-    readonly path: string;
-    /** The underlying HTTP failure, kept for logs. */
-    readonly cause: HTTPError;
-    name: string;
-    constructor(
-    /** The path that answered 404. */
-    path: string, 
-    /** The underlying HTTP failure, kept for logs. */
-    cause: HTTPError);
-}
-/**
- * Shape the node's answer into the union, which is where the exhausted case
- * stops being a missing field and starts being something the compiler asks
- * about.
- *
- * Exported for tests: it is the whole client-side contract of the route, and
- * testing it needs no transport.
- */
-export declare function parseWarrantNonce(body: string): WarrantNonceState;
 /**
  * Compare two version strings by SemVer 2.0 precedence, ascending: negative if
  * `a < b`, positive if `a > b`, `0` if equal. Build metadata (`+...`) is stripped
@@ -108,7 +77,6 @@ export declare class AdminApiClient {
      * context as stranded.
      */
     resyncContext(contextId: string, request?: ResyncContextRequest): Promise<ResyncContextResponseData>;
-    inviteSpecializedNode(request: InviteSpecializedNodeRequest): Promise<InviteSpecializedNodeResponseData>;
     updateContextApplication(contextId: string, request: UpdateContextApplicationRequest): Promise<void>;
     getContextsWithExecutorsForApplication(applicationId: string): Promise<ContextsWithExecutorsResponseData>;
     uploadBlob(request: UploadBlobRequest): Promise<UploadBlobResponseData>;
@@ -169,26 +137,6 @@ export declare class AdminApiClient {
      * namespace.
      */
     getNodeIdentity(): Promise<NodeIdentity>;
-    /**
-     * @deprecated Use {@link getNodeIdentity} instead. Every field this returns is
-     * node-level, so the namespace was only ever decoration — it now delegates to
-     * the node-level route and reshapes the answer.
-     *
-     * Three consequences of that delegation, all visible to a caller who relied on
-     * the old route's behaviour:
-     *
-     * - **No participation gate.** The namespace route answered 404 when this node
-     *   had never joined the namespace; this answers whatever the node's identity
-     *   is, regardless. If you were using it to ask "am I in this namespace?", ask
-     *   {@link listNamespaces} instead — that is the question you were really
-     *   asking.
-     * - **`namespaceId` is echoed verbatim.** The old route resolved a subgroup id
-     *   to its root namespace and returned that; passing a subgroup id here gives
-     *   the subgroup id back.
-     * - **404 means something else.** Previously "not my namespace", now "this node
-     *   holds no account root yet".
-     */
-    getNamespaceIdentity(namespaceId: string): Promise<NamespaceIdentity>;
     /**
      * Ask this node to run one method on a member's behalf, under a warrant that
      * member signed.
@@ -486,80 +434,6 @@ export declare class AdminApiClient {
      * same reason {@link listAccountDevices} unwraps `devices`.
      */
     listGroupMemberDevices(groupId: string, options?: ListMemberDevicesOptions): Promise<MemberDevicesEntry[]>;
-    /**
-     * Where `authorDeviceKey` stands in its warrant-nonce sequence in `contextId`.
-     *
-     * # What this is for
-     *
-     * The nonce is the one input to a warrant that is stateful on the *client*.
-     * Everything else an author needs it either holds (its keys, the method, the
-     * args) or can read from the relay ({@link RelayClient.describe} gives the
-     * executor account and the grant). So an author that has lost its counter —
-     * a browser keyholder in partitioned or periodically cleared storage, which
-     * is its normal lifecycle rather than a fault — otherwise has exactly one
-     * strategy: guess upward and burn a refused round trip per wrong guess, with
-     * each refusal indistinguishable at the API from a genuinely spent nonce.
-     *
-     * Read {@link WarrantNonceOpen.nextNonce} and mint there. If you still hold
-     * your own counter, mint at `max(ownNext, nextNonce)`: nonce state folds per
-     * peer, so a node can only be BEHIND a client whose warrants it has not
-     * applied — never ahead of the truth. An author spread across several relays
-     * asks each and takes the highest answer. {@link createRecoveringNonceSource}
-     * does all of that.
-     *
-     * Purely a read. It spends nothing and advances nothing, so it may be called
-     * as often as you like.
-     *
-     * # Forward compatibility — this route is NEW
-     *
-     * It is not on core `master` yet, so a current node answers **404**, which
-     * this method surfaces as {@link WarrantNonceRouteUnavailableError} rather
-     * than as an opaque {@link HTTPError}. That distinction matters because the
-     * handler itself never 404s: a device with no row is a `200` with
-     * `seen: false`, and a malformed id is a `400`. So a 404 here means the node
-     * does not serve the route at all — an older build, or a deployment that has
-     * not re-mounted it — and the answer is to fall back to a local counter, not
-     * to retry.
-     *
-     * # Authentication
-     *
-     * On the PROTECTED admin router, unlike the two delegated-execution routes it
-     * sits beside: it takes another principal's device key as input and reports
-     * that principal's activity. A `--public-intents` deployment does not serve
-     * this anonymously, so an admin credential is required.
-     *
-     * @param authorDeviceKey the device's signing key, base58 (43-44 chars) or
-     *        hex (exactly 64). The node accepts either; the two never collide.
-     */
-    getWarrantNonce(contextId: string, authorDeviceKey: string): Promise<WarrantNonceState>;
-    /**
-     * The same answer, asked for the way a delegated client has to ask.
-     *
-     * {@link getWarrantNonce} is on the protected admin router, so a keyholder
-     * writing through a relay — the client this whole facility exists for — is
-     * refused it: measured `403` for a session carrying exactly
-     * `context:intent`, `context:query`, `context:subscribe`. That client has no
-     * admin credential and cannot be given one without defeating the point of the
-     * delegated surface.
-     *
-     * What it does have is the credential proving the device is its own, which it
-     * already sends on every write. Presenting it here makes the request
-     * self-scoped: you learn a device's position only by proving, at call time,
-     * that the device is yours. So there is no oracle to protect against, and no
-     * reason for an admin gate.
-     *
-     * The device key is NOT a parameter. It is read from the verified
-     * certificate server-side, which is the only reading that cannot disagree
-     * with the signature — a key supplied alongside would be a second spelling of
-     * the same fact, and two spellings can differ.
-     *
-     * Returns the identical shape {@link getWarrantNonce} returns, so a caller can
-     * swap one for the other without touching what it does with the answer.
-     *
-     * @param authorProof hex-encoded borsh `AccountProof<DeviceCert>` — the same
-     *        value passed as `authorProof` to the relay client.
-     */
-    getWarrantNonceAsAuthor(contextId: string, authorProof: string): Promise<WarrantNonceState>;
     /**
      * Member accounts in the group and the devices bound to each. An admin node
      * sees every account; a plain member only its own. `403` if this node is not a
@@ -734,11 +608,6 @@ export declare class AdminApiClient {
     joinSubgroupInheritance(groupId: string): Promise<JoinSubgroupInheritanceResponseData>;
     getTeeInfo(): Promise<TeeInfoResponseData>;
     teeAttest(request: TeeAttestRequest): Promise<TeeAttestResponseData>;
-    /**
-     * @deprecated Nodes no longer serve `/admin-api/tee/verify-quote` (removed in
-     * core#3262), so this fails. Verify quotes with `createQuoteVerifier`.
-     */
-    teeVerifyQuote(request: TeeVerifyQuoteRequest): Promise<TeeVerifyQuoteResponseData>;
     getPeersCount(): Promise<{
         count: number;
     }>;

package/dist/admin-api/admin-client.js

@@ -1,92 +1,7 @@
-import { HTTPError, withRetry } from '../http-client/index.js';
+import { withRetry } from '../http-client/index.js';
 import { pathSegment } from '../http-client/path-segment.js';
 import { CAPABILITIES, hasCap, withCap } from '../capabilities.js';
 import { redeemInvitation } from './redeem-invitation.js';
-/**
- * Thrown when a node answers the warrant-nonce route with a 404.
- *
- * Its own type because the meaning is unambiguous and not "not found": the
- * handler never 404s — an unknown device is a `200` with `seen: false`, a
- * malformed id is a `400` — so a 404 says the route is not mounted on this
- * node. It is new on core and absent from `master` builds. A caller that sees
- * this should fall back to its own counter (or refuse to write) rather than
- * retry, because no amount of retrying adds a route to a running node.
- */
-export class WarrantNonceRouteUnavailableError extends Error {
-    constructor(
-    /** The path that answered 404. */
-    path, 
-    /** The underlying HTTP failure, kept for logs. */
-    cause) {
-        super(`this node does not serve warrant-nonce discovery (404 on ${path}); it predates the route, so a client must fall back to its own nonce counter`);
-        this.path = path;
-        this.cause = cause;
-        this.name = 'WarrantNonceRouteUnavailableError';
-    }
-}
-/**
- * Recover a `u64` from the response bytes rather than from a parsed `number`.
- *
- * `JSON.parse` has already rounded anything past 2^53 by the time a value is
- * handed over, and it rounds without complaint — so the digits are read back
- * out of the source text and turned straight into a `bigint`.
- *
- * Matching on the quoted key is safe for exactly this response: its only two
- * string fields are a context id and a device key, both of which are hex or
- * base58 and so cannot contain a quote, a colon, or these field names. The
- * parsed object still decides whether a field is *present*; the text is
- * consulted only for its digits.
- */
-function u64FromBody(body, parsed, field) {
-    const value = parsed[field];
-    if (value === undefined || value === null)
-        return undefined;
-    const digits = new RegExp(`"${field}"\\s*:\\s*(\\d+)`).exec(body);
-    if (digits)
-        return BigInt(digits[1]);
-    // The field is present but not a bare integer literal in the body — a node
-    // that started sending it as a string, say. Accept a decimal string, and
-    // refuse anything else loudly instead of coercing a nonce into existence.
-    if (typeof value === 'string' && /^\d+$/.test(value))
-        return BigInt(value);
-    throw new Error(`warrant-nonce response field \`${field}\` is not a u64: ${JSON.stringify(value)}`);
-}
-/**
- * Shape the node's answer into the union, which is where the exhausted case
- * stops being a missing field and starts being something the compiler asks
- * about.
- *
- * Exported for tests: it is the whole client-side contract of the route, and
- * testing it needs no transport.
- */
-export function parseWarrantNonce(body) {
-    const parsed = JSON.parse(body);
-    const data = parsed?.data;
-    if (!data || typeof data !== 'object') {
-        throw new Error(`warrant-nonce response had no \`data\`: ${body.slice(0, 200)}`);
-    }
-    const common = {
-        contextId: String(data.contextId ?? ''),
-        authorDeviceKey: String(data.authorDeviceKey ?? ''),
-        seen: data.seen === true,
-        highWaterNonce: u64FromBody(body, data, 'highWaterNonce'),
-        // Not defaulted: a node that stopped sending it is a node whose window this
-        // client would be guessing at, and the window is not a nonce input anyway.
-        windowWidth: u64FromBody(body, data, 'windowWidth') ?? 0n,
-    };
-    const nextNonce = u64FromBody(body, data, 'nextNonce');
-    if (nextNonce === undefined) {
-        // The one absence with a meaning: `u64::MAX` is spent. The node omits the
-        // field rather than wrapping to `0`, and a client must not fill the gap.
-        return {
-            ...common,
-            kind: 'exhausted',
-            seen: true,
-            highWaterNonce: common.highWaterNonce ?? 0xffffffffffffffffn,
-        };
-    }
-    return { ...common, kind: 'open', nextNonce };
-}
 /**
  * Helper: server wraps most responses in `{ data: T }`.
  * This extracts `.data` so callers get the inner payload directly. Null-safe so an
@@ -334,9 +249,6 @@ export class AdminApiClient {
         // callers always get a typed value instead of null.
         return r ?? { contextId, resyncStarted: true };
     }
-    async inviteSpecializedNode(request) {
-        return unwrap(await this.httpClient.post('/admin-api/contexts/invite-specialized-node', request));
-    }
     async updateContextApplication(contextId, request) {
         await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/application`, request);
     }
@@ -495,29 +407,6 @@ export class AdminApiClient {
     async getNodeIdentity() {
         return unwrap(await this.httpClient.get('/admin-api/identity'));
     }
-    /**
-     * @deprecated Use {@link getNodeIdentity} instead. Every field this returns is
-     * node-level, so the namespace was only ever decoration — it now delegates to
-     * the node-level route and reshapes the answer.
-     *
-     * Three consequences of that delegation, all visible to a caller who relied on
-     * the old route's behaviour:
-     *
-     * - **No participation gate.** The namespace route answered 404 when this node
-     *   had never joined the namespace; this answers whatever the node's identity
-     *   is, regardless. If you were using it to ask "am I in this namespace?", ask
-     *   {@link listNamespaces} instead — that is the question you were really
-     *   asking.
-     * - **`namespaceId` is echoed verbatim.** The old route resolved a subgroup id
-     *   to its root namespace and returned that; passing a subgroup id here gives
-     *   the subgroup id back.
-     * - **404 means something else.** Previously "not my namespace", now "this node
-     *   holds no account root yet".
-     */
-    async getNamespaceIdentity(namespaceId) {
-        const node = await this.getNodeIdentity();
-        return { namespaceId, publicKey: node.publicKey, account: node.accountId };
-    }
     /**
      * Ask this node to run one method on a member's behalf, under a warrant that
      * member signed.
@@ -924,113 +813,6 @@ export class AdminApiClient {
         const response = await this.httpClient.get(query ? `${base}?${query}` : base);
         return response.members;
     }
-    /**
-     * Where `authorDeviceKey` stands in its warrant-nonce sequence in `contextId`.
-     *
-     * # What this is for
-     *
-     * The nonce is the one input to a warrant that is stateful on the *client*.
-     * Everything else an author needs it either holds (its keys, the method, the
-     * args) or can read from the relay ({@link RelayClient.describe} gives the
-     * executor account and the grant). So an author that has lost its counter —
-     * a browser keyholder in partitioned or periodically cleared storage, which
-     * is its normal lifecycle rather than a fault — otherwise has exactly one
-     * strategy: guess upward and burn a refused round trip per wrong guess, with
-     * each refusal indistinguishable at the API from a genuinely spent nonce.
-     *
-     * Read {@link WarrantNonceOpen.nextNonce} and mint there. If you still hold
-     * your own counter, mint at `max(ownNext, nextNonce)`: nonce state folds per
-     * peer, so a node can only be BEHIND a client whose warrants it has not
-     * applied — never ahead of the truth. An author spread across several relays
-     * asks each and takes the highest answer. {@link createRecoveringNonceSource}
-     * does all of that.
-     *
-     * Purely a read. It spends nothing and advances nothing, so it may be called
-     * as often as you like.
-     *
-     * # Forward compatibility — this route is NEW
-     *
-     * It is not on core `master` yet, so a current node answers **404**, which
-     * this method surfaces as {@link WarrantNonceRouteUnavailableError} rather
-     * than as an opaque {@link HTTPError}. That distinction matters because the
-     * handler itself never 404s: a device with no row is a `200` with
-     * `seen: false`, and a malformed id is a `400`. So a 404 here means the node
-     * does not serve the route at all — an older build, or a deployment that has
-     * not re-mounted it — and the answer is to fall back to a local counter, not
-     * to retry.
-     *
-     * # Authentication
-     *
-     * On the PROTECTED admin router, unlike the two delegated-execution routes it
-     * sits beside: it takes another principal's device key as input and reports
-     * that principal's activity. A `--public-intents` deployment does not serve
-     * this anonymously, so an admin credential is required.
-     *
-     * @param authorDeviceKey the device's signing key, base58 (43-44 chars) or
-     *        hex (exactly 64). The node accepts either; the two never collide.
-     */
-    async getWarrantNonce(contextId, authorDeviceKey) {
-        const path = `/admin-api/contexts/${pathSegment(contextId)}/warrant-nonce/${pathSegment(authorDeviceKey)}`;
-        // Read as TEXT, not JSON. `JSON.parse` would turn the `u64` nonces into
-        // doubles before this code ever sees them, rounding anything past 2^53 into
-        // a value that looks ordinary and is refused forever. The digits have to be
-        // taken from the bytes.
-        let raw;
-        try {
-            raw = await this.httpClient.get(path, { parse: 'text' });
-        }
-        catch (error) {
-            if (error instanceof HTTPError && error.status === 404) {
-                throw new WarrantNonceRouteUnavailableError(path, error);
-            }
-            throw error;
-        }
-        return parseWarrantNonce(raw);
-    }
-    /**
-     * The same answer, asked for the way a delegated client has to ask.
-     *
-     * {@link getWarrantNonce} is on the protected admin router, so a keyholder
-     * writing through a relay — the client this whole facility exists for — is
-     * refused it: measured `403` for a session carrying exactly
-     * `context:intent`, `context:query`, `context:subscribe`. That client has no
-     * admin credential and cannot be given one without defeating the point of the
-     * delegated surface.
-     *
-     * What it does have is the credential proving the device is its own, which it
-     * already sends on every write. Presenting it here makes the request
-     * self-scoped: you learn a device's position only by proving, at call time,
-     * that the device is yours. So there is no oracle to protect against, and no
-     * reason for an admin gate.
-     *
-     * The device key is NOT a parameter. It is read from the verified
-     * certificate server-side, which is the only reading that cannot disagree
-     * with the signature — a key supplied alongside would be a second spelling of
-     * the same fact, and two spellings can differ.
-     *
-     * Returns the identical shape {@link getWarrantNonce} returns, so a caller can
-     * swap one for the other without touching what it does with the answer.
-     *
-     * @param authorProof hex-encoded borsh `AccountProof<DeviceCert>` — the same
-     *        value passed as `authorProof` to the relay client.
-     */
-    async getWarrantNonceAsAuthor(contextId, authorProof) {
-        const path = `/admin-api/contexts/${pathSegment(contextId)}/warrant-nonce`;
-        // Text, not JSON, for the reason given in `getWarrantNonce`: `JSON.parse`
-        // rounds a u64 past 2^53 into a nonce that looks ordinary and is refused
-        // for ever.
-        let raw;
-        try {
-            raw = await this.httpClient.post(path, { authorProof }, { parse: 'text' });
-        }
-        catch (error) {
-            if (error instanceof HTTPError && error.status === 404) {
-                throw new WarrantNonceRouteUnavailableError(path, error);
-            }
-            throw error;
-        }
-        return parseWarrantNonce(raw);
-    }
     /**
      * Member accounts in the group and the devices bound to each. An admin node
      * sees every account; a plain member only its own. `403` if this node is not a
@@ -1326,13 +1108,6 @@ export class AdminApiClient {
     async teeAttest(request) {
         return unwrap(await this.httpClient.post('/admin-api/tee/attest', request));
     }
-    /**
-     * @deprecated Nodes no longer serve `/admin-api/tee/verify-quote` (removed in
-     * core#3262), so this fails. Verify quotes with `createQuoteVerifier`.
-     */
-    async teeVerifyQuote(request) {
-        return unwrap(await this.httpClient.post('/admin-api/tee/verify-quote', request));
-    }
     // ---- Network ----
     async getPeersCount() {
         return this.httpClient.get('/admin-api/peers');