@calimero-network/mero-js 26.11.0 → 27.0.0

package/dist/admin-api/admin-client.js

@@ -1,1230 +0,0 @@
-import { withRetry } from '../http-client/index.js';
-import { pathSegment } from '../http-client/path-segment.js';
-import { CAPABILITIES, hasCap, withCap } from '../capabilities.js';
-import { redeemInvitation } from './redeem-invitation.js';
-/**
- * Helper: server wraps most responses in `{ data: T }`.
- * This extracts `.data` so callers get the inner payload directly. Null-safe so an
- * empty 2xx body (parsed as null) yields undefined instead of throwing.
- */
-function unwrap(response) {
-    return response?.data;
-}
-/**
- * Compare two version strings by SemVer 2.0 precedence, ascending: negative if
- * `a < b`, positive if `a > b`, `0` if equal. Build metadata (`+...`) is stripped
- * and ignored. The numeric `major.minor.patch` core is compared field-by-field
- * (numerically when both parse, so `1.10.0 > 1.9.0`; a missing field is `0`). A
- * version WITH a pre-release ranks below the same core without one, and
- * pre-release identifiers compare per spec: dot-separated, numeric identifiers
- * numerically, alphanumeric lexically by ASCII, numeric below alphanumeric, and a
- * shorter set of identifiers loses when all preceding fields are equal.
- */
-export function compareSemver(a, b) {
-    const [coreA, preA] = splitVersion(a);
-    const [coreB, preB] = splitVersion(b);
-    const na = coreA.split('.');
-    const nb = coreB.split('.');
-    const n = Math.max(na.length, nb.length);
-    for (let i = 0; i < n; i++) {
-        const c = compareSemverId(na[i] ?? '0', nb[i] ?? '0');
-        if (c !== 0)
-            return c;
-    }
-    // A pre-release ranks below the same core version with no pre-release.
-    if (preA === undefined && preB === undefined)
-        return 0;
-    if (preA === undefined)
-        return 1;
-    if (preB === undefined)
-        return -1;
-    const pa = preA.split('.');
-    const pb = preB.split('.');
-    const m = Math.max(pa.length, pb.length);
-    for (let i = 0; i < m; i++) {
-        if (i >= pa.length)
-            return -1; // shorter set loses when all preceding equal
-        if (i >= pb.length)
-            return 1;
-        const c = compareSemverId(pa[i], pb[i]);
-        if (c !== 0)
-            return c;
-    }
-    return 0;
-}
-/** Drop build metadata and split the pre-release tail: `1.2.3-rc.1+b` -> `['1.2.3', 'rc.1']`. */
-function splitVersion(v) {
-    const core = v.split('+', 1)[0];
-    const dash = core.indexOf('-');
-    return dash === -1 ? [core, undefined] : [core.slice(0, dash), core.slice(dash + 1)];
-}
-/**
- * Compare one identifier: numerically when both are all-digits, else lexically by
- * ASCII with a numeric identifier ranking below an alphanumeric one. Fallback: a
- * non-numeric core component (loose/malformed input) is treated as a string, so
- * comparison never throws.
- */
-function compareSemverId(a, b) {
-    const na = /^\d+$/.test(a);
-    const nb = /^\d+$/.test(b);
-    if (na && nb) {
-        const d = Number(a) - Number(b);
-        return d < 0 ? -1 : d > 0 ? 1 : 0;
-    }
-    if (na)
-        return -1;
-    if (nb)
-        return 1;
-    return a < b ? -1 : a > b ? 1 : 0;
-}
-/**
- * Fetch a URL from the (foreign-origin) registry with a per-attempt timeout and
- * retry on transient failures. Deliberately NOT routed through the node
- * `HttpClient`: that client attaches the node's bearer token to every request,
- * which must never leak to the registry's origin. Each attempt times out after
- * ~10s; network errors and 5xx are retried (2 retries, short backoff via the
- * shared `withRetry`), while a 4xx is a definitive answer and is not retried.
- * `kind`/`context` shape the error message so failures stay debuggable in logs.
- */
-async function fetchRegistry(url, kind, context) {
-    return withRetry(async () => {
-        const resp = await fetch(url, { signal: AbortSignal.timeout(10000) });
-        if (!resp.ok) {
-            // Carry `status` so withRetry retries 5xx but leaves 4xx to throw.
-            const err = new Error(`registry ${kind} fetch failed (${resp.status}) for ${context}`);
-            err.status = resp.status;
-            throw err;
-        }
-        return resp;
-    }, { attempts: 3 });
-}
-export class AdminApiClient {
-    constructor(httpClient) {
-        this.httpClient = httpClient;
-    }
-    // ---- Health and Status (public, no auth) ----
-    async healthCheck() {
-        return unwrap(await this.httpClient.get('/admin-api/health'));
-    }
-    /**
-     * Whether the node has finished starting and its store answers. Public, like
-     * {@link healthCheck}; unlike it, a node that is up but not ready answers
-     * `503`, which this surfaces as an `HTTPError` whose body names the stage.
-     */
-    async readinessCheck() {
-        return unwrap(await this.httpClient.get('/admin-api/ready'));
-    }
-    async isAuthed() {
-        return this.httpClient.get('/admin-api/is-authed');
-    }
-    // ---- Application Management ----
-    /**
-     * Install a published application by its `package@version` coordinates. The
-     * node resolves and fetches them from its own configured `[registry]`, so no
-     * URL is passed and none is accepted. A 502 means the node's source has
-     * nothing published at those coordinates. This is the discrete "download"
-     * step an Updates flow pairs with a subsequent `upgradeGroup`.
-     */
-    async installApplication(request) {
-        return unwrap(await this.httpClient.post('/admin-api/install-application', request));
-    }
-    /**
-     * List a package's published versions from the registry, newest-first by
-     * semver. Reads the registry's V2 bundle listing
-     * (`GET {registry}/api/v2/bundles?package={package}`), taking each bundle's
-     * `appVersion`. Registry-side data — distinct from the node's
-     * installed-version list — and the source an Updates view compares against
-     * the running `Context.applicationVersion` to detect "a new version exists".
-     */
-    async getRegistryVersions(registryUrl, packageName) {
-        const url = new URL('/api/v2/bundles', new URL(registryUrl).origin);
-        url.searchParams.set('package', packageName);
-        const resp = await fetchRegistry(url.toString(), 'versions', packageName);
-        const bundles = (await resp.json());
-        return (Array.isArray(bundles) ? bundles : [])
-            .map((b) => b.appVersion)
-            .filter((v) => typeof v === 'string')
-            .sort((a, b) => compareSemver(b, a));
-    }
-    async installDevApplication(request) {
-        return unwrap(await this.httpClient.post('/admin-api/install-dev-application', request));
-    }
-    async uninstallApplication(appId) {
-        return unwrap(await this.httpClient.delete(`/admin-api/applications/${pathSegment(appId)}`));
-    }
-    async listApplications() {
-        return unwrap(await this.httpClient.get('/admin-api/applications'));
-    }
-    async getApplication(appId) {
-        return unwrap(await this.httpClient.get(`/admin-api/applications/${pathSegment(appId)}`));
-    }
-    /**
-     * Installed-blob inventory for an application — one entry per locally installed
-     * version. This is the *installed* inventory (source for a "pick a version to
-     * pin" UI); the registry equivalent is `listPackageVersions`.
-     */
-    async listApplicationVersions(applicationId) {
-        return unwrap(await this.httpClient.get(`/admin-api/applications/${pathSegment(applicationId)}/versions`));
-    }
-    /**
-     * The application's embedded `wasm-abi/1` manifest. Omit `serviceName` for
-     * single-service apps; core 400s if the ABI is absent or the name is ambiguous.
-     */
-    async getApplicationAbi(applicationId, serviceName) {
-        const query = serviceName ? `?service_name=${encodeURIComponent(serviceName)}` : '';
-        return unwrap(await this.httpClient.get(`/admin-api/applications/${pathSegment(applicationId)}/abi${query}`));
-    }
-    // ---- Package Management ----
-    async listPackages() {
-        // Core returns this flat ({ packages: [...] }), not under `data`; tolerate both.
-        const r = await this.httpClient.get('/admin-api/packages');
-        return (r?.data ?? r);
-    }
-    async listPackageVersions(packageName) {
-        // Core returns this flat ({ versions: [...] }), not under `data`; tolerate both.
-        const r = await this.httpClient.get(`/admin-api/packages/${pathSegment(packageName)}/versions`);
-        return (r?.data ?? r);
-    }
-    async getLatestPackageVersion(packageName) {
-        return this.httpClient.get(`/admin-api/packages/${pathSegment(packageName)}/latest`);
-    }
-    // ---- Context Management ----
-    async createContext(request) {
-        // Core requires `initializationParams` (no default); default it to an empty
-        // byte array so callers that pass none don't get a 400.
-        const body = { ...request, initializationParams: request.initializationParams ?? [] };
-        return unwrap(await this.httpClient.post('/admin-api/contexts', body));
-    }
-    async deleteContext(contextId) {
-        return unwrap(await this.httpClient.delete(`/admin-api/contexts/${pathSegment(contextId)}`));
-    }
-    async getContexts() {
-        return unwrap(await this.httpClient.get('/admin-api/contexts'));
-    }
-    async getContext(contextId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/${pathSegment(contextId)}`));
-    }
-    async getContextsForApplication(applicationId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/for-application/${pathSegment(applicationId)}`));
-    }
-    // ---- Context Identity ----
-    async generateContextIdentity() {
-        return unwrap(await this.httpClient.post('/admin-api/identity/context', {}));
-    }
-    async getContextIdentities(contextId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/${pathSegment(contextId)}/identities`));
-    }
-    async getContextIdentitiesOwned(contextId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/${pathSegment(contextId)}/identities-owned`));
-    }
-    // ---- Context join (group membership) ----
-    async joinContext(contextId) {
-        return unwrap(await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/join`, {}));
-    }
-    // ---- Context group / storage / sync ----
-    async getContextGroup(contextId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/${pathSegment(contextId)}/group`));
-    }
-    async getContextStorage(contextId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/${pathSegment(contextId)}/storage`));
-    }
-    /** Sync one context, or every context when `contextId` is omitted. */
-    async syncContext(contextId) {
-        // Sync-all is `/contexts/sync` with no trailing slash - core routes the two
-        // spellings separately and 404s the trailing one.
-        const path = contextId ? `/admin-api/contexts/sync/${pathSegment(contextId)}` : '/admin-api/contexts/sync';
-        await this.httpClient.post(path, {});
-    }
-    /**
-     * Kick off a full state re-pull for a context (operator recovery for a
-     * stranded context). `force` re-pulls even when the node does not flag the
-     * context as stranded.
-     */
-    async resyncContext(contextId, request = {}) {
-        // Core's `ResyncContextApiResponse` is a flat payload (no inner `data`
-        // field), so parse the body directly — do NOT `unwrap`, or `resyncStarted`
-        // reads as undefined and the resync silently appears to never start.
-        const r = await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/resync`, request);
-        // An empty 2xx body means the resync was accepted; synthesize the result so
-        // callers always get a typed value instead of null.
-        return r ?? { contextId, resyncStarted: true };
-    }
-    async updateContextApplication(contextId, request) {
-        await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/application`, request);
-    }
-    async getContextsWithExecutorsForApplication(applicationId) {
-        // Core returns this flat as { contexts: [...] } (not a bare array under `data`).
-        const r = await this.httpClient.get(`/admin-api/contexts/with-executors/for-application/${pathSegment(applicationId)}`);
-        if (Array.isArray(r))
-            return r;
-        return (r?.contexts ??
-            r?.data ??
-            []);
-    }
-    // ---- Blob Management ----
-    async uploadBlob(request) {
-        // Core streams the raw request body into blob storage (no JSON) and takes
-        // its params from the query string (`hash`, `context_id` — snake_case).
-        const params = new URLSearchParams();
-        if (request.hash)
-            params.set('hash', request.hash);
-        if (request.contextId)
-            params.set('context_id', request.contextId);
-        const query = params.toString();
-        const path = query ? `/admin-api/blobs?${query}` : '/admin-api/blobs';
-        // request.data (Uint8Array view | ArrayBuffer | Blob) is a valid BodyInit and
-        // is streamed verbatim — no JSON, no cast. fetch honors a Uint8Array view's
-        // byteOffset/byteLength, so subarrays upload the correct region.
-        // Core's BlobInfo is snake_case (`blob_id`); map to camelCase like deleteBlob.
-        const res = unwrap(await this.httpClient.request(path, {
-            method: 'PUT',
-            body: request.data,
-            headers: { 'Content-Type': 'application/octet-stream' },
-        }));
-        return { blobId: res.blob_id, size: res.size };
-    }
-    async deleteBlob(blobId) {
-        // Core's `BlobDeleteResponse` is a flat, snake_case payload (`{ blob_id,
-        // deleted }`) — the lone admin DTO without a camelCase rename and without an
-        // inner `data` field. Parse directly (no `unwrap`) and map to camelCase.
-        const body = await this.httpClient.delete(`/admin-api/blobs/${pathSegment(blobId)}`);
-        return { blobId: body.blob_id, deleted: body.deleted };
-    }
-    async listBlobs() {
-        // Core's BlobInfo is snake_case (`blob_id`); map to camelCase.
-        const res = unwrap(await this.httpClient.get('/admin-api/blobs'));
-        return { blobs: res.blobs.map((b) => ({ blobId: b.blob_id, size: b.size })) };
-    }
-    /**
-     * Blob-read query params. `context_id` is the same snake_case param
-     * {@link uploadBlob} announces with; building it in one place keeps the read
-     * side from drifting from the write side.
-     */
-    blobPath(blobId, options) {
-        if (!options?.contextId)
-            return `/admin-api/blobs/${pathSegment(blobId)}`;
-        const params = new URLSearchParams({ context_id: options.contextId });
-        return `/admin-api/blobs/${pathSegment(blobId)}?${params.toString()}`;
-    }
-    /**
-     * Download a blob's raw bytes. `GET /admin-api/blobs/:id` streams the blob
-     * content (e.g. `application/gzip`), NOT JSON — so fetch it as an ArrayBuffer.
-     * Use {@link listBlobs} for `{ blobId, size }` metadata.
-     *
-     * Without `contextId` the read is local-only: the node answers from its own
-     * blob store and returns immediately, or 404s. Passing `contextId` opts into
-     * network discovery — the node probes that context's peers (availability
-     * nodes first) for a holder, then transfers the bytes. Budget for it: core
-     * bounds discovery by a ~30s deadline, and the transfer is on top of that, so
-     * the worst case is well past what a UI should block on unhinted.
-     */
-    async getBlob(blobId, options) {
-        return this.httpClient.get(this.blobPath(blobId, options), {
-            parse: 'arrayBuffer',
-        });
-    }
-    /**
-     * Fetch a blob's metadata without downloading it. `HEAD /admin-api/blobs/:id`
-     * returns the info in response headers (size via `content-length`, plus
-     * `x-blob-id`/`x-blob-hash`/`x-blob-mime-type`).
-     *
-     * Without `contextId` this is a local-only presence check that returns
-     * immediately. Passing `contextId` opts into the same network discovery
-     * {@link getBlob} uses — presence and size answered by probing the context's
-     * peers, with no transfer — so it inherits core's ~30s discovery deadline as
-     * its worst case. A probe only carries `found` and `size`, so a peer-sourced
-     * answer has no `hash`/`mimeType`; read `source` to tell the two apart.
-     */
-    async getBlobInfo(blobId, options) {
-        // HEAD throws (HttpError) on a non-2xx status, so we only reach here on success
-        // — the x-blob-* headers are present. Guard size against a missing/non-numeric
-        // content-length anyway (defaults to 0 rather than NaN).
-        const { headers } = await this.httpClient.head(this.blobPath(blobId, options));
-        const size = Number(headers['content-length']);
-        return {
-            blobId: headers['x-blob-id'] ?? blobId,
-            size: Number.isFinite(size) ? size : 0,
-            hash: headers['x-blob-hash'],
-            mimeType: headers['x-blob-mime-type'],
-            // Nodes that predate the context-aware HEAD omit this header entirely, so
-            // it stays undefined rather than being defaulted to 'local' — absent means
-            // "the node didn't say", which is not the same claim as "served locally".
-            source: headers['x-blob-source'],
-        };
-    }
-    // ---- Alias Management ----
-    async createContextAlias(request) {
-        return unwrap(await this.httpClient.post('/admin-api/alias/create/context', { alias: request.alias, contextId: request.contextId }));
-    }
-    async createApplicationAlias(request) {
-        return unwrap(await this.httpClient.post('/admin-api/alias/create/application', { alias: request.alias, applicationId: request.applicationId }));
-    }
-    async lookupContextAlias(name) {
-        return unwrap(await this.httpClient.post(`/admin-api/alias/lookup/context/${pathSegment(name)}`, {}));
-    }
-    async lookupApplicationAlias(name) {
-        return unwrap(await this.httpClient.post(`/admin-api/alias/lookup/application/${pathSegment(name)}`, {}));
-    }
-    async deleteContextAlias(name) {
-        return unwrap(await this.httpClient.post(`/admin-api/alias/delete/context/${pathSegment(name)}`, {}));
-    }
-    async deleteApplicationAlias(name) {
-        return unwrap(await this.httpClient.post(`/admin-api/alias/delete/application/${pathSegment(name)}`, {}));
-    }
-    async listContextAliases() {
-        return unwrap(await this.httpClient.get('/admin-api/alias/list/context'));
-    }
-    async listApplicationAliases() {
-        return unwrap(await this.httpClient.get('/admin-api/alias/list/application'));
-    }
-    async createDeviceAlias(request) {
-        return unwrap(await this.httpClient.post('/admin-api/alias/create/device', { alias: request.alias, deviceId: request.deviceId }));
-    }
-    async lookupDeviceAlias(name) {
-        return unwrap(await this.httpClient.post(`/admin-api/alias/lookup/device/${pathSegment(name)}`, {}));
-    }
-    async deleteDeviceAlias(name) {
-        return unwrap(await this.httpClient.post(`/admin-api/alias/delete/device/${pathSegment(name)}`, {}));
-    }
-    async listDeviceAliases() {
-        return unwrap(await this.httpClient.get('/admin-api/alias/list/device'));
-    }
-    // ---- Namespace Management ----
-    async listNamespaces() {
-        return unwrap(await this.httpClient.get('/admin-api/namespaces'));
-    }
-    async getNamespace(namespaceId) {
-        return unwrap(await this.httpClient.get(`/admin-api/namespaces/${pathSegment(namespaceId)}`));
-    }
-    /**
-     * Who this node is — the account it writes as, the device it is, the key it
-     * signs with, and the account root a second device pairs against.
-     *
-     * Takes no namespace, and that is the point: one root key is one account
-     * everywhere, and a node signs with one key, so none of it varies by
-     * namespace.
-     */
-    async getNodeIdentity() {
-        return unwrap(await this.httpClient.get('/admin-api/identity'));
-    }
-    /**
-     * Ask this node to run one method on a member's behalf, under a warrant that
-     * member signed.
-     *
-     * The node executes and signs the envelope with its own key; the change is
-     * attributed to the **author**. Both halves travel together, so every peer
-     * re-checks that the member consented instead of trusting the relay.
-     *
-     * Three things have to be true first, and none is implied by the others:
-     *
-     * - the author's **account** is a member of the group owning the context —
-     *   their device joins nothing and is in no group's binding rows, which is
-     *   exactly the case a device certificate covers;
-     * - this node holds `CAN_AUTHOR_ON_BEHALF` on that group, which is implied by
-     *   neither membership nor admin;
-     * - the warrant has not been spent. It is single-use: presenting a valid one
-     *   twice is refused, because the signature stays valid forever and replay is
-     *   not forgery.
-     *
-     * A refusal comes back as a `403` carrying the reason — "an admin must grant
-     * CAN_AUTHOR_ON_BEHALF to …", or that the nonce is already spent — so a caller
-     * can tell which precondition failed rather than only that one did.
-     *
-     * Mint the warrant with {@link signWarrant}; see
-     * {@link PerformIntentRequest.warrant}.
-     */
-    async performIntent(contextId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/intents`, request));
-    }
-    /**
-     * Read a context as the session's ACCOUNT, without minting a warrant.
-     *
-     * Needs an account-authenticated session — one from {@link login}, not the
-     * admin password login — and refuses otherwise with a `401`. The account must
-     * be a member of the group owning the context (`403` if not), and the method
-     * must be declared read-only in the app's ABI (`409` if not; a write needs
-     * {@link performIntent}).
-     */
-    async queryContext(contextId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/query`, request));
-    }
-    /**
-     * Issue an access grant: a token whose holder may call `request.methods` in
-     * `contextId`, as this node, with no session of its own.
-     *
-     * A grant only narrows: each method must be one this session's own token may
-     * execute in the context (`403` otherwise), and an account session is refused
-     * (`403`), since a granted call runs as the node. The token is in the answer
-     * once and never again; the node keeps only its hash.
-     */
-    async createAccessGrant(contextId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/grants`, { methods: request.methods, label: request.label ?? '', notAfter: request.notAfter ?? null }));
-    }
-    /** The access grants of `contextId` this session could have issued. */
-    async listAccessGrants(contextId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/${pathSegment(contextId)}/grants`));
-    }
-    /** Revoke an access grant. A grant this session cannot see is a `404`. */
-    async revokeAccessGrant(contextId, grantId) {
-        return unwrap(await this.httpClient.delete(`/admin-api/contexts/${pathSegment(contextId)}/grants/${pathSegment(grantId)}`));
-    }
-    /**
-     * Call one method under an access grant. The token is the whole credential:
-     * the route is public on every node, so this works from a client holding no
-     * session at all. A method the grant does not name, an unknown or revoked
-     * token, and an expired grant are each a `403`.
-     */
-    async callWithAccessGrant(contextId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/grant-calls`, request));
-    }
-    /**
-     * Ask what this node can do for a member in `contextId`, before they sign
-     * anything.
-     *
-     * The facts {@link performIntent} needs and a client cannot derive: whose
-     * account and key go in the warrant's `executor` and `executor_key`, which
-     * release it pins, and whether this node holds `CAN_AUTHOR_ON_BEHALF` on the
-     * owning group.
-     * `canAuthorOnBehalf: false` comes back as an answer rather than an error, as
-     * it is the default state of every context, so a caller can say "an admin of
-     * `groupId` must grant it to `executorAccount`" instead of presenting a
-     * warrant that will be refused after the author has spent a nonce on it.
-     *
-     * `404` means the context belongs to no group, this node holds no account or
-     * identity in it yet, or its group names no release yet; no warrant can be
-     * spent here until that changes.
-     *
-     * For a caller with no credential on the node at all — a browser tab holding
-     * one signing key — use `RelayClient`, which reads this same route on a node
-     * run as a relay.
-     */
-    async getIntentRelay(contextId) {
-        return unwrap(await this.httpClient.get(`/admin-api/contexts/${pathSegment(contextId)}/intents`));
-    }
-    async listNamespacesForApplication(applicationId) {
-        return unwrap(await this.httpClient.get(`/admin-api/namespaces/for-application/${pathSegment(applicationId)}`));
-    }
-    async createNamespace(request) {
-        return unwrap(await this.httpClient.post('/admin-api/namespaces', request));
-    }
-    /** What `namespaceId` approves for outbound requests, one entry per publisher. */
-    async listOutboundApprovals(namespaceId) {
-        return unwrap(await this.httpClient.get(`/admin-api/namespaces/${pathSegment(namespaceId)}/outbound-approvals`));
-    }
-    /**
-     * Set what `namespaceId` approves for the publisher of `request.applicationId`
-     * to exactly `request.approve`: `'manifest'` or a list of URL prefixes, and
-     * `[]` revokes everything. Takes effect at the app's next run.
-     */
-    async setOutboundApproval(namespaceId, request) {
-        return unwrap(await this.httpClient.put(`/admin-api/namespaces/${pathSegment(namespaceId)}/outbound-approvals`, 
-        // Core declares this body `deny_unknown_fields`, so send exactly these.
-        { applicationId: request.applicationId, approve: request.approve }));
-    }
-    async deleteNamespace(namespaceId) {
-        // Core requires `Content-Type: application/json` on this DELETE even though
-        // the body is always empty, so send the header and an empty JSON object.
-        return unwrap(await this.httpClient.request(`/admin-api/namespaces/${pathSegment(namespaceId)}`, {
-            method: 'DELETE',
-            body: '{}',
-            headers: { 'Content-Type': 'application/json' },
-        }));
-    }
-    async createNamespaceInvitation(namespaceId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/invite`, request ?? {}));
-    }
-    /**
-     * Present a join this caller signed to a node the inviter named as an
-     * admitter.
-     *
-     * For a member with no node. `joinNamespace` publishes the membership op from
-     * the node making the call; this hands an already-signed op to somebody else's
-     * node to publish. The distinction matters because a keyholder has nowhere to
-     * publish from.
-     *
-     * The op must be signed by the **device key** in the credential it carries —
-     * every peer checks that when applying a join. So the admitter cannot author
-     * this, only carry it: a hostile one can refuse, and nothing else. It cannot
-     * admit a different account, change the group, or grant a role.
-     *
-     * @param namespaceId the namespace being joined, 64 hex
-     * @param request the invitation and the hex-encoded signed op
-     */
-    async admitJoin(namespaceId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/admit`, request, { timeoutMs: 65000 }));
-    }
-    async joinNamespace(namespaceId, request) {
-        const data = unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/join`, request, { timeoutMs: 65000 }));
-        // core 0.11.0-rc.25 renamed this response's `groupId` to `namespaceId`
-        // (core#3598). Bind whichever spelling the node actually sent rather than
-        // picking one: the rename lands as `undefined` on the field the client
-        // reads, and nothing errors — no 4xx, no thrown parse — so a client that
-        // knows only one spelling fails much later and somewhere else. Normalising
-        // here means one mero-js works against nodes either side of that release.
-        if (data && data.namespaceId === undefined && data.groupId !== undefined) {
-            return { ...data, namespaceId: data.groupId };
-        }
-        return data;
-    }
-    /**
-     * Bring back a namespace the user removed from this node while the account
-     * stayed a member (POST /admin-api/namespaces/:namespace_id/join, no
-     * invitation). Such namespaces are the `forgotten` ones in
-     * {@link listNamespacesForApplication}.
-     */
-    async restoreNamespace(namespaceId) {
-        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/join`, {}, { timeoutMs: 65000 }));
-    }
-    /**
-     * Join the namespace an invitation grants, and say what happened — including
-     * when the request failed but the join landed anyway.
-     *
-     * Use this rather than {@link joinNamespace} whenever someone is following an
-     * invitation. A join waits for a member to come online and can outlast any
-     * proxy in front of the node; the request then fails while the join
-     * succeeds. This sends the join once, then checks {@link listNamespaces}:
-     * a failed request whose namespace is listed is `already-member`, a success.
-     *
-     * Never throws for an ordinary failure. A failed outcome carries a `reason`
-     * read off the node's status (core rc.56+), and `retryable`, which says
-     * whether to keep the invitation for another attempt.
-     *
-     * @param namespaceId the namespace the invitation names, 64 hex
-     * @param invitation the signed invitation, as the inviter's node minted it
-     * @param options `groupName` is sent with the join; `teamName` is echoed back
-     *   on a successful outcome for the caller's UI
-     */
-    async redeemInvitation(namespaceId, invitation, options = {}) {
-        const { groupName, teamName } = options;
-        return redeemInvitation({ namespaceId, invitation, teamName }, {
-            join: async () => {
-                await this.joinNamespace(namespaceId, groupName === undefined ? { invitation } : { invitation, groupName });
-            },
-            memberships: async () => ((await this.listNamespaces()) ?? []).map((n) => n.namespaceId),
-        });
-    }
-    async createGroupInNamespace(namespaceId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/groups`, request ?? {}));
-    }
-    async listNamespaceGroups(namespaceId) {
-        return unwrap(await this.httpClient.get(`/admin-api/namespaces/${pathSegment(namespaceId)}/groups`));
-    }
-    // ---- Account Devices & Pairing ----
-    /**
-     * Mint this node a device for an account that already lives somewhere else -
-     * the first half of pairing, run on the joining node.
-     *
-     * Publishes nothing and needs no key: it produces the device id, the two
-     * public keys and the signature that the account holder's
-     * {@link completeAccountPairing} certifies, plus a code to read out to them
-     * over a channel the payload does not travel on. Until that second half runs,
-     * the device this mints is inert.
-     *
-     * Takes a set of namespaces rather than one, and takes it from the caller
-     * because this node cannot discover it: a node that is a member of nothing can
-     * neither read the account's namespace set off a DAG nor derive it. One device
-     * covers however many are named - the certificate is over the account, not a
-     * scope - so there is one id and one code to hand over regardless.
-     */
-    async initAccountPairing(request) {
-        return unwrap(await this.httpClient.post('/admin-api/account/pair-init', request));
-    }
-    /**
-     * Certify a device another node minted, link it, and deliver its scope keys -
-     * the second half of pairing, run on the node that holds the account root.
-     *
-     * Every field but `applications` is copied verbatim out of that node's
-     * {@link initAccountPairing} answer. Only this side can complete it: the
-     * certificate is signed by the account root, which never leaves the node that
-     * holds it.
-     *
-     * The scope is named in applications, not namespaces, because that is the
-     * question a person can answer - a namespace is an implementation unit they
-     * never chose. Leave it out to grant every application.
-     */
-    async completeAccountPairing(request) {
-        return unwrap(await this.httpClient.post('/admin-api/account/pair-complete', request));
-    }
-    /**
-     * Re-run the pairing fan-out for a device this account already certified,
-     * against the namespaces this node takes part in now.
-     *
-     * Pairing is a snapshot, and this is how it is repeated. A namespace created
-     * or joined afterwards holds no binding for a device paired before it, and the
-     * symptom is silence - the device simply never sees that namespace. Nothing
-     * but the id is needed to repair it: the certificate is already held here,
-     * root-signed and naming no namespace, so a fresh endorsement and a key wrap
-     * are all a later namespace is missing. The device does not have to be online.
-     *
-     * Passing `applications` widens the device's stored scope as well as
-     * repairing. Passing none - or an empty list - repairs against the scope
-     * already stored, which is deliberately NOT the "every application" that an
-     * empty list means on {@link completeAccountPairing}: overloading it here
-     * would make the accidental request the widest one.
-     */
-    async relinkAccountDevice(deviceId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/account/devices/${pathSegment(deviceId)}/relink`, request ?? {}));
-    }
-    /**
-     * Replace a device's scope outright, in one root-signed op.
-     *
-     * {@link relinkAccountDevice} only ever adds applications; this is how a
-     * scope is narrowed - or an `all` device is given a fixed list instead. The
-     * device need not be online.
-     */
-    async rescopeAccountDevice(deviceId, request) {
-        return unwrap(await this.httpClient.put(`/admin-api/account/devices/${pathSegment(deviceId)}/scope`, request));
-    }
-    /**
-     * Sign a payload an outside verifier specified, with this account's root.
-     *
-     * The counterpart to a verifier that issued a challenge and will check the
-     * signature against the account id it derives — the cloud's account link and
-     * login exchanges being the ones this exists for. The root never leaves the
-     * node, so this is the only way a client can produce that signature.
-     *
-     * `domain` is a NAME from a closed set the node knows, never the domain bytes.
-     * That is the security property rather than an encoding preference: signing
-     * caller-supplied bytes under a caller-supplied prefix would be an oracle over
-     * the one key that can certify a device. A node refuses a name it does not
-     * know, and refuses one whose bytes could be extended into a credential of its
-     * own.
-     *
-     * What comes back proves possession of the root and nothing else. Whether the
-     * payload is a challenge anyone issued, whether it is fresh, and whether the
-     * holder may link this account are the verifier's to decide — it issued the
-     * challenge and knows who to.
-     *
-     * ```ts
-     * const { nonce } = await cloud.getAccountLoginChallenge();
-     * const { rootPublicKey, signature } = await admin.signWithAccountRoot({
-     *   domain: 'mdma.account-login',
-     *   payload: hexEncodeUtf8(nonce),
-     * });
-     * await cloud.submitAccountLogin({ rootPublicKey, nonce, signature });
-     * ```
-     */
-    async signWithAccountRoot(request) {
-        return unwrap(await this.httpClient.post('/admin-api/account/sign-with-root', request));
-    }
-    /**
-     * Name a device of this account, for a listing to render.
-     *
-     * Run on the node holding the account root to name any device; a paired
-     * node is accepted only for that device's own id.
-     */
-    async labelAccountDevice(deviceId, request) {
-        return unwrap(await this.httpClient.put(`/admin-api/account/devices/${pathSegment(deviceId)}/label`, request));
-    }
-    /**
-     * Every device of this account, as this node sees them - its own included.
-     *
-     * Joined from the node-local certificate cache and the live bindings of every
-     * namespace this node takes part in, so it is this node's view rather than a
-     * global one: a device certified by another holder appears with an empty
-     * `applications`, because the certificate that would name its scope is not
-     * cached here.
-     *
-     * The wire wraps this in `devices` rather than the usual `data`; the array is
-     * what a caller wants, so that wrapper is not passed on.
-     */
-    async listAccountDevices() {
-        const response = await this.httpClient.get('/admin-api/account/devices');
-        return response.devices;
-    }
-    /**
-     * Every application this account speaks in, with the namespaces targeting each.
-     *
-     * What a device-scoping UI lists: {@link completeAccountPairing} and
-     * {@link relinkAccountDevice} both take applications, and this is where the
-     * ids they take come from. Derived from the namespaces this node takes part
-     * in, so an application installed with no namespace yet is absent - it has
-     * nothing to scope a device to until one exists.
-     *
-     * Wrapped in `applications` on the wire rather than `data`, unwrapped here for
-     * the same reason {@link listAccountDevices} unwraps `devices`.
-     */
-    async listAccountApplications() {
-        const response = await this.httpClient.get('/admin-api/account/applications');
-        return response.applications;
-    }
-    /**
-     * Withdraw a device from this account, terminally.
-     *
-     * Two authorities reach the same endpoint. An admin may revoke any device and
-     * rotates the scope key as it goes. The account holder may revoke its own with
-     * a root-signed `proof`, which does not rotate - so read
-     * {@link RevokeAccountDeviceResponseData.revokedIn} rather than assuming the
-     * device lost its access: a namespace reporting `keyRotated: false` has
-     * stopped the device writing but leaves it able to read until an admin
-     * rotates.
-     *
-     * `namespaceId` names where to publish from, not the extent of the revocation:
-     * a device belongs to the account, so every namespace holding a binding for it
-     * is withdrawn from and reported back.
-     *
-     * **Revocation is forward-only.** It withdraws the device's authority from
-     * here on and does NOT retract past authorship: ops the device already signed
-     * keep verifying and stay in the DAG, because the certificate that authorised
-     * them was valid when the signature was made. Nothing in this system can
-     * un-author what a device wrote, so a UI built on this call must not offer
-     * that - "this device can no longer act" is the only claim it supports.
-     */
-    async revokeAccountDevice(namespaceId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/account/revoke`, request));
-    }
-    /**
-     * Carry the device link of an account **this node does not hold**, so the
-     * namespace binds that device's key to the account.
-     *
-     * The relay half of a nodeless account minting invitations. An account added
-     * to a group by account holds its grants but has no device bound, so peers
-     * refuse whatever its device signs as "bound to no account". The credential
-     * and scope are root-signed and self-certifying; this node adds its own
-     * member endorsement and publishes the `AccountDeviceLinked`. After that the
-     * device signs invitations itself — see `signGroupInvitation`.
-     *
-     * Refusals: `400` when a proof does not verify or the scope does not reach
-     * this namespace (re-sign it), `403` when the device was revoked here or the
-     * account is a member of nothing in the namespace (add it first).
-     */
-    async linkAccountDevice(namespaceId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/account/link-device`, request));
-    }
-    // ---- Group Management ----
-    async getGroupInfo(groupId) {
-        return unwrap(await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}`));
-    }
-    /** Thin wrapper over {@link getGroupInfo}: returns the group's `defaultCapabilities` bitmask. */
-    async getDefaultCapabilities(groupId) {
-        return (await this.getGroupInfo(groupId)).defaultCapabilities;
-    }
-    /** Thin wrapper over {@link getGroupInfo}: returns the group's `subgroupVisibility`. */
-    async getSubgroupVisibility(groupId) {
-        return (await this.getGroupInfo(groupId)).subgroupVisibility;
-    }
-    async deleteGroup(groupId) {
-        // Core requires `Content-Type: application/json` on this DELETE even though
-        // the body is always empty, so send the header and an empty JSON object.
-        return unwrap(await this.httpClient.request(`/admin-api/groups/${pathSegment(groupId)}`, {
-            method: 'DELETE',
-            body: '{}',
-            headers: { 'Content-Type': 'application/json' },
-        }));
-    }
-    async listGroupMembers(groupId) {
-        const response = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/members`);
-        // Validate the field we declare as non-optional in the type so a
-        // contract-violating response (proxy error body, future API drift,
-        // etc.) surfaces as a clear error rather than silently producing an
-        // empty list. Empty groups still satisfy this — merod returns
-        // `members: []`, not an omitted field.
-        if (!Array.isArray(response?.members)) {
-            // Sanitize before interpolation: groupId reaches us from caller code,
-            // not parsed input, but defending the message keeps untrusted bytes
-            // out of error logs and downstream UIs.
-            const safeId = String(groupId).replace(/[\r\n\t\s]/g, '').slice(0, 64);
-            throw new Error(`Invalid listGroupMembers response for group ${safeId}: missing or non-array \`members\` field`);
-        }
-        return response;
-    }
-    /**
-     * Account -> devices for the members of a group, as its live bindings record
-     * them.
-     *
-     * The join between a group member listing, which names accounts, and a
-     * context's identities, which name bare signing keys - both 64 hex, and
-     * nothing but the source tells them apart. Batch rather than per-account
-     * because the key -> account direction gets asked about arbitrary authors,
-     * which a per-account route would answer in N calls.
-     *
-     * What comes back is **caller-scoped by the node**: an admin of the group sees
-     * every member's devices, a plain member only its own entry. A single-entry
-     * answer is therefore a statement about this caller's role, not about the
-     * group's size.
-     *
-     * Only live bindings appear, so a revoked device is absent here - use
-     * {@link listAccountDevices} for the account's own devices, which keeps a
-     * revoked one with `revoked: true`. Absence here never means the device never
-     * acted: revocation is forward-only and its past ops remain in the DAG.
-     *
-     * Wrapped in `members` on the wire rather than `data`, unwrapped here for the
-     * same reason {@link listAccountDevices} unwraps `devices`.
-     */
-    async listGroupMemberDevices(groupId, options) {
-        // Both params are optional on the node, which clamps `limit` to its own
-        // maximum; sending them only when asked keeps the node's defaults authoritative
-        // rather than freezing today's values into this client.
-        const params = new URLSearchParams();
-        if (options?.offset !== undefined)
-            params.set('offset', String(options.offset));
-        if (options?.limit !== undefined)
-            params.set('limit', String(options.limit));
-        const query = params.toString();
-        const base = `/admin-api/groups/${pathSegment(groupId)}/member-devices`;
-        const response = await this.httpClient.get(query ? `${base}?${query}` : base);
-        return response.members;
-    }
-    /**
-     * Member accounts in the group and the devices bound to each. An admin node
-     * sees every account; a plain member only its own. `403` if this node is not a
-     * member of the group.
-     */
-    async listMemberDevices(groupId, options = {}) {
-        const params = new URLSearchParams();
-        if (options.offset !== undefined)
-            params.set('offset', String(options.offset));
-        if (options.limit !== undefined)
-            params.set('limit', String(options.limit));
-        const query = params.toString();
-        const path = `/admin-api/groups/${pathSegment(groupId)}/member-devices${query ? `?${query}` : ''}`;
-        return this.httpClient.get(path);
-    }
-    /**
-     * Seal a small payload to a member account's root key. This node must be a
-     * member of the group, and `account` must be an account the group knows, so
-     * the route reaches no further than the caller already does.
-     */
-    async sealToAccount(groupId, account, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/accounts/${pathSegment(account)}/seal`, request));
-    }
-    async listGroupContexts(groupId) {
-        return unwrap(await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/contexts`));
-    }
-    async addGroupMembers(groupId, request) {
-        await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/members`, request);
-    }
-    async removeGroupMembers(groupId, request) {
-        await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/members/remove`, request);
-    }
-    /**
-     * `identity` is the member's ACCOUNT (64 hex), as returned by
-     * {@link listGroupMembers} — not the signing key that added them. Both are
-     * 64 hex, so nothing but the source tells them apart.
-     */
-    async updateMemberRole(groupId, identity, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/members/${pathSegment(identity)}/role`, request);
-    }
-    /**
-     * `identity` is the member's ACCOUNT (64 hex), as returned by
-     * {@link listGroupMembers} — not the signing key that added them. Both are
-     * 64 hex, so nothing but the source tells them apart.
-     */
-    async getMemberCapabilities(groupId, identity) {
-        return unwrap(await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/members/${pathSegment(identity)}/capabilities`));
-    }
-    /**
-     * `identity` is the member's ACCOUNT (64 hex), as returned by
-     * {@link listGroupMembers} — not the signing key that added them. Both are
-     * 64 hex, so nothing but the source tells them apart.
-     */
-    async setMemberCapabilities(groupId, identity, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/members/${pathSegment(identity)}/capabilities`, request);
-    }
-    async setDefaultCapabilities(groupId, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/settings/default-capabilities`, request);
-    }
-    /**
-     * Make every member admitted to `groupId` from now on able to relay a
-     * delegated write, without a per-node governance op each time.
-     *
-     * `CAN_AUTHOR_ON_BEHALF` is implied by nothing — not membership, not admin —
-     * so every group is authorship-closed and each fleet relay otherwise needs an
-     * admin to grant it individually, at the moment the relay is assigned and the
-     * admin is not watching. Setting it in the group's DEFAULT mask is core's own
-     * answer to that: `add_member` seeds a non-admin's capability row from the
-     * default, so an attested node admitted afterwards lands open.
-     *
-     * Call it on the NAMESPACE (the root group). A grant resolves through the
-     * membership anchor, so one at the root reaches every Open subgroup beneath
-     * it, which is where contexts actually live; a `Restricted` subgroup is a
-     * membership boundary and needs its own call.
-     *
-     * ### Two things this does not do
-     *
-     * **It is not retroactive.** The default is copied into a member's row when
-     * that member is admitted, so nodes already admitted keep the row they got.
-     * Use {@link grantAuthorship} for those — or call this at namespace creation,
-     * which is the only point that needs no backfill at all.
-     *
-     * **It does not reach admins.** Core seeds the default only for non-admin
-     * roles, and `CAN_AUTHOR_ON_BEHALF` is deliberately not implied by admin. An
-     * admin's own node therefore stays closed and needs {@link grantAuthorship}.
-     *
-     * ### What it widens
-     *
-     * Every future non-admin member of the group, not only attested TEE nodes, so
-     * any of them may be named as a warrant's `executor`. The bound worth knowing
-     * before deciding: an executor cannot FORGE. A delegated write is authorized
-     * by the author's own warrant — signed by their device key, committed to one
-     * context, method and exact arguments, with its nonce checked unspent — so a
-     * holder can only spend a warrant it was deliberately handed. What it does
-     * gain is the arguments in cleartext and the choice of when, or whether, to
-     * publish.
-     *
-     * Read-modify-write rather than a blind set: core seeds a new group's default
-     * with `CAN_JOIN_OPEN_SUBGROUPS`, and overwriting that would quietly stop
-     * every later member inheriting into Open subgroups.
-     *
-     * Returns the resulting mask and whether an op was published — it is a no-op
-     * when the bit is already set, so it is safe to call on every startup.
-     */
-    async openToDelegatedExecution(groupId) {
-        const current = await this.getDefaultCapabilities(groupId);
-        if (hasCap(current, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
-            return { changed: false, defaultCapabilities: current };
-        }
-        const next = withCap(current, CAPABILITIES.CAN_AUTHOR_ON_BEHALF);
-        await this.setDefaultCapabilities(groupId, { defaultCapabilities: next });
-        return { changed: true, defaultCapabilities: next };
-    }
-    /**
-     * Grant `account` the authorship bit on `groupId`, leaving its other
-     * capabilities alone.
-     *
-     * The per-member counterpart to {@link openToDelegatedExecution}, and what
-     * closes the gap that method cannot: a relay admitted BEFORE the default was
-     * set, and an admin's own node, which never receives the default at all.
-     *
-     * `account` is the member's ACCOUNT id (64 hex) as `listGroupMembers` returns
-     * it — for a fleet relay, the `account` the cloud reports for that node. Not
-     * the signing key that added them; both are 64 hex, so nothing but the source
-     * tells them apart.
-     *
-     * Read-modify-write, so it adds the bit rather than replacing the member's
-     * mask. A no-op when the member already holds it.
-     */
-    async grantAuthorship(groupId, account) {
-        const { capabilities } = await this.getMemberCapabilities(groupId, account);
-        if (hasCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
-            return { changed: false, capabilities };
-        }
-        const next = withCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF);
-        await this.setMemberCapabilities(groupId, account, { capabilities: next });
-        return { changed: true, capabilities: next };
-    }
-    async setSubgroupVisibility(groupId, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/settings/subgroup-visibility`, request);
-    }
-    async setTeeAdmissionPolicy(groupId, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/settings/tee-admission-policy`, request);
-    }
-    async getTeeAdmissionPolicy(groupId) {
-        // Intersection (not union) so the type is unambiguous: `data` is optional, so
-        // `?? response` cleanly falls back to a flat (un-enveloped) response.
-        const response = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/settings/tee-admission-policy`);
-        return response.data ?? response;
-    }
-    /**
-     * Sets which admitted TEEs may author as the TEE authority. Pass
-     * `{ allowedMrtd: [] }` to turn TEE authorship off. `groupId` must be a
-     * namespace root; the node refuses a subgroup. The node exposes no read-back
-     * route for this policy.
-     */
-    async setTeeAuthoringPolicy(groupId, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/settings/tee-authoring-policy`, request);
-    }
-    /**
-     * Turns TEE authorship off in the namespace: every TEE loses its authority,
-     * and admitted TEEs stay members. The node applies the same op as
-     * `setTeeAuthoringPolicy(groupId, { allowedMrtd: [] })`. `groupId` must be a
-     * namespace root.
-     *
-     * `rootProof` is the signing admin's own root proof for that empty policy
-     * (`teeAuthoringPolicyOp([])`); omit it on a node that holds that root.
-     */
-    async disableTeeAuthoringPolicy(groupId, options = {}) {
-        const path = `/admin-api/groups/${pathSegment(groupId)}/settings/tee-authoring-policy`;
-        if (options.rootProof === undefined) {
-            await this.httpClient.delete(path);
-            return;
-        }
-        await this.httpClient.request(path, {
-            method: 'DELETE',
-            body: JSON.stringify({ rootProof: options.rootProof }),
-            headers: { 'Content-Type': 'application/json' },
-        });
-    }
-    // ---- Root-guarded owner ops (core schema 18) ----
-    /**
-     * Hand the group to `newOwner`, who must already be one of its admins.
-     * Owner-only, and it needs the owner account's root proof; see
-     * {@link RootGuardedOpRequest}.
-     */
-    async transferOwnership(groupId, request) {
-        await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/transfer-ownership`, request);
-    }
-    /**
-     * Repoint the namespace's admin pin at `newAdmin`, a member of its root.
-     * Owner-only, with the owner account's root proof; see {@link RootGuardedOpRequest}.
-     */
-    async changeNamespaceAdmin(namespaceId, request) {
-        await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/admin`, request);
-    }
-    /**
-     * Delete a group through the owner-only path: it must hold no contexts, and
-     * the op needs the owner account's root proof. {@link deleteGroup} is the
-     * admin-level cascading delete.
-     */
-    async ownerDeleteGroup(groupId, request = {}) {
-        await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/owner-delete`, request);
-    }
-    // ---- Group / member / context metadata ----
-    async setGroupMetadata(groupId, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/metadata`, request);
-    }
-    async getGroupMetadata(groupId) {
-        // Core single-envelopes the record: `{ data: MetadataRecord | null }`.
-        // "No record yet" is `{ data: null }` (or a bare null body on older nodes),
-        // so optional-chain to a clean null. Returns the full record (name + data +
-        // updatedAt/updatedBy), not just the data map.
-        const response = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/metadata`);
-        return response?.data ?? null;
-    }
-    async setMemberMetadata(groupId, identity, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/members/${pathSegment(identity)}/metadata`, request);
-    }
-    /**
-     * `identity` is the member's ACCOUNT (64 hex), as returned by
-     * {@link listGroupMembers} — not the signing key that added them. Both are
-     * 64 hex, so nothing but the source tells them apart.
-     */
-    async getMemberMetadata(groupId, identity) {
-        // Single-enveloped record; see getGroupMetadata.
-        const response = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/members/${pathSegment(identity)}/metadata`);
-        return response?.data ?? null;
-    }
-    async setContextMetadata(groupId, contextId, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/contexts/${pathSegment(contextId)}/metadata`, request);
-    }
-    async getContextMetadata(groupId, contextId) {
-        // Single-enveloped record; see getGroupMetadata.
-        const response = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/contexts/${pathSegment(contextId)}/metadata`);
-        return response?.data ?? null;
-    }
-    async syncGroup(groupId) {
-        return unwrap(await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/sync`, {}));
-    }
-    async upgradeGroup(groupId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/upgrade`, request));
-    }
-    async getGroupUpgradeStatus(groupId) {
-        return unwrap(await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/upgrade/status`));
-    }
-    /** Releases to install before activating the upgrade, in list order (oldest first). An older server returns []. */
-    async getGroupMissingReleases(groupId) {
-        const res = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/upgrade/status`);
-        return res.missingReleases ?? [];
-    }
-    /**
-     * The operator-facing "have all peers migrated?" rollup for a namespace.
-     * The handler serializes the payload directly, so there is no `{ data }`
-     * envelope to unwrap here (unlike most admin reads).
-     */
-    async getMigrationStatus(namespaceId) {
-        return this.httpClient.get(`/admin-api/groups/${pathSegment(namespaceId)}/migration-status`);
-    }
-    /** Revoked devices and withdrawn slots of a namespace; 403 unless this node is a bound member. */
-    async listNamespaceRevokedDevices(namespaceId) {
-        return this.httpClient.get(`/admin-api/namespaces/${pathSegment(namespaceId)}/revoked-devices`);
-    }
-    /** Per-group cascade-migration snapshots for a namespace. */
-    async getCascadeStatus(namespaceId) {
-        return unwrap(await this.httpClient.get(`/admin-api/groups/${pathSegment(namespaceId)}/cascade-status`));
-    }
-    /** Switch this node's contexts in a namespace onto its stored upgrade target; 409 if an `expected*` guard differs. */
-    async activateGroupUpgrade(namespaceId, request = {}) {
-        return unwrap(await this.httpClient.post(`/admin-api/groups/${pathSegment(namespaceId)}/upgrade/activate`, request));
-    }
-    async retryGroupUpgrade(groupId) {
-        return unwrap(await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/upgrade/retry`, {}));
-    }
-    /** Move `childGroupId` under `request.newParentId`. */
-    async reparentGroup(childGroupId, request) {
-        // Core returns this flat ({ reparented }); tolerate the { data } envelope too.
-        const r = await this.httpClient.post(`/admin-api/groups/${pathSegment(childGroupId)}/reparent`, request);
-        return (r?.data ?? r);
-    }
-    async listSubgroups(groupId) {
-        const response = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/subgroups`);
-        return response.subgroups ?? response.data ?? [];
-    }
-    async detachContextFromGroup(groupId, contextId) {
-        await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/contexts/${pathSegment(contextId)}/remove`, {});
-    }
-    // ---- Group Invitation & Join ----
-    async createGroupInvitation(groupId, request) {
-        return unwrap(await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/invite`, request ?? {}));
-    }
-    async joinGroup(request) {
-        return unwrap(await this.httpClient.post('/admin-api/groups/join', request));
-    }
-    async joinSubgroupInheritance(groupId) {
-        return unwrap(await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/join-via-inheritance`, {}));
-    }
-    // ---- TEE ----
-    async getTeeInfo() {
-        return unwrap(await this.httpClient.get('/admin-api/tee/info'));
-    }
-    async teeAttest(request) {
-        return unwrap(await this.httpClient.post('/admin-api/tee/attest', request));
-    }
-    // ---- Network ----
-    async getPeersCount() {
-        return this.httpClient.get('/admin-api/peers');
-    }
-    /** Node network status (GET /admin-api/network/status). */
-    async getNetworkStatus() {
-        return this.httpClient.get('/admin-api/network/status');
-    }
-    /** Node storage/usage stats (GET /admin-api/usage). */
-    async getUsage() {
-        return this.httpClient.get('/admin-api/usage');
-    }
-    // ---- Group / context / namespace membership ----
-    /** Create a standalone group (POST /admin-api/groups). */
-    async createGroup(request) {
-        return unwrap(await this.httpClient.post('/admin-api/groups', request));
-    }
-    /** Leave a group (POST /admin-api/groups/:group_id/leave). */
-    async leaveGroup(groupId) {
-        await this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/leave`, {});
-    }
-    /** Leave a context (POST /admin-api/contexts/:context_id/leave). */
-    async leaveContext(contextId) {
-        await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/leave`, {});
-    }
-    /**
-     * Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave).
-     *
-     * With `purge`, every device of the account also takes the namespace off its
-     * disk. Core reads `purge` from the query string, so it is not in the body.
-     */
-    async leaveNamespace(namespaceId, options = {}) {
-        const query = options.purge ? '?purge=true' : '';
-        await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/leave${query}`, {});
-    }
-    /** Issue a group ownership proof (POST /admin-api/groups/:group_id/issue-ownership-proof). */
-    async issueOwnershipProof(groupId, request) {
-        return this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/issue-ownership-proof`, request);
-    }
-    /** Issue a namespace ownership proof (POST /admin-api/groups/:group_id/issue-namespace-ownership-proof). */
-    async issueNamespaceOwnershipProof(groupId, request) {
-        return this.httpClient.post(`/admin-api/groups/${pathSegment(groupId)}/issue-namespace-ownership-proof`, request);
-    }
-    /**
-     * Set a member's auto-follow flag (PUT
-     * /admin-api/groups/:group_id/members/:identity/auto-follow).
-     *
-     * `identity` is the member's ACCOUNT (64 hex), as returned by
-     * {@link listGroupMembers} — not the signing key that added them. Both are
-     * 64 hex, so nothing but the source tells them apart.
-     */
-    async setMemberAutoFollow(groupId, identity, request) {
-        await this.httpClient.put(`/admin-api/groups/${pathSegment(groupId)}/members/${pathSegment(identity)}/auto-follow`, request);
-    }
-    /** Abort a namespace migration (POST /admin-api/groups/:namespace_id/migration/abort). */
-    async abortMigration(namespaceId) {
-        return this.httpClient.post(`/admin-api/groups/${pathSegment(namespaceId)}/migration/abort`, {});
-    }
-}