@calimero-network/mero-js 26.11.0 → 27.0.0

package/dist/cloud/routing-proof.d.ts

@@ -1,113 +0,0 @@
-/**
- * Proving an account to the cloud for the one read a joiner cannot avoid.
- *
- * `GET /api/cloud/namespaces/{ns}/admitters` answers where to send a signed
- * membership op. A joiner needs it and *cannot* hold a cloud login: it is by
- * construction not the namespace owner, and not needing an account on the cloud
- * is the entire point of the path — a keyholder mints a root, certifies a
- * device and signs its own join offline, and this read is the only thing that
- * tells it where to post the result.
- *
- * So the caller proves possession of the credential it already holds. The cloud
- * mints a sealed, namespace-bound nonce; the device signs it; the read carries
- * the certificate and that signature.
- *
- * ## What this establishes, and what it does not
- *
- * It establishes that the caller holds a device key certified by some account
- * root, and *which* account that is. It does **not** establish that the account
- * was invited to the namespace, nor that it is a member — the cloud cannot
- * check either, because membership is governance state held by the nodes.
- * Anyone can mint an account root offline, so this is not a wall. It buys
- * attribution (every read names an account and can be rate-limited) and it ends
- * anonymous bulk discovery. Authorization stays where it always was: at the
- * node, on the signed op.
- *
- * ## Why the DEVICE signs, not the root
- *
- * The opposite choice from {@link signAccountLink}, deliberately. That one
- * exists for the device-loss case, so only the root will do. This one runs on
- * every routing read from a browser that discards the root immediately after
- * certifying its device — requiring the root would mean re-entering a 24-word
- * phrase to look up a URL.
- *
- * The certificate alone is not enough and the signature is not redundant with
- * it: a certificate travels in the clear inside every device-link op, so anyone
- * who has seen one can replay it. Only the nonce signature binds the presenter
- * to the device.
- */
-/**
- * The credential a routing read presents: a certificate, and the key to sign
- * the challenge with.
- *
- * `credential` is the 237-byte `AccountProof<DeviceCert>` as hex — exactly what
- * {@link signDeviceCert} returns, and the same string a login statement and a
- * warrant carry. It is public by construction.
- *
- * `deviceSecret` never leaves the process. It signs the challenge locally and
- * only the signature travels.
- */
-export interface RoutingCredential {
-    /** The `AccountProof<DeviceCert>`, hex borsh, as `signDeviceCert` returns it. */
-    credential: string;
-    /** The certified device's ed25519 signing secret, hex (32 bytes). */
-    deviceSecret: string;
-}
-/** A challenge to sign, as the cloud minted it. */
-export interface RoutingChallenge {
-    namespaceId: string;
-    /** Opaque and sealed — the client neither parses nor constructs this. */
-    nonce: string;
-    /** Epoch **milliseconds**, as MDMA reports it. Nonces live about two minutes. */
-    expiresAtMs: number;
-}
-/**
- * A challenge bound to an ACCOUNT rather than a namespace, for asking which
- * relays serve that account.
- *
- * Separate from {@link RoutingChallenge} because the binding is the security
- * property, not a field name: MDMA seals the account into this one and the
- * namespace into that one, and refuses each at the other's route. Keeping the
- * TypeScript types distinct is what stops a caller passing the wrong one and
- * learning about it as a 403.
- */
-export interface DiscoveryChallenge {
-    accountId: string;
-    /** Opaque and sealed — the client neither parses nor constructs this. */
-    nonce: string;
-    /** Epoch **milliseconds**, as MDMA reports it. Nonces live about two minutes. */
-    expiresAtMs: number;
-}
-/**
- * The three header values a proven routing read carries.
- *
- * Intersected with `Record<string, string>` rather than declared as a plain
- * interface so it drops straight into a headers bag: an interface has no index
- * signature, so TypeScript refuses it where `Record<string, string>` is wanted
- * even though every field is a string.
- */
-export type RoutingProofHeaders = Record<string, string> & {
-    'X-Calimero-Credential': string;
-    'X-Calimero-Nonce': string;
-    'X-Calimero-Signature': string;
-};
-/**
- * Sign a routing challenge with the device key.
- *
- * Returns base64, which is what the header carries and what MDMA's verifier
- * decodes — the one place this SDK does not spell a signature as hex, because
- * the wire format is not ours to choose.
- */
-export declare function signRoutingChallenge(nonce: string, deviceSecret: string): Promise<string>;
-/**
- * Build the headers for one routing read, from a challenge the cloud minted.
- *
- * Separated from the request so a caller that fetches its own challenge — a
- * test, or a client batching several reads against one nonce — can use the same
- * encoding rather than a second spelling of it.
- *
- * Takes either challenge kind: only the nonce is signed and both are signed
- * over the same domain, so one encoder serves both. What separates them is what
- * MDMA sealed inside, which is checked server-side.
- */
-export declare function routingProofHeaders(challenge: RoutingChallenge | DiscoveryChallenge, credential: RoutingCredential): Promise<RoutingProofHeaders>;

package/dist/cloud/routing-proof.js

@@ -1,96 +0,0 @@
-/**
- * Proving an account to the cloud for the one read a joiner cannot avoid.
- *
- * `GET /api/cloud/namespaces/{ns}/admitters` answers where to send a signed
- * membership op. A joiner needs it and *cannot* hold a cloud login: it is by
- * construction not the namespace owner, and not needing an account on the cloud
- * is the entire point of the path — a keyholder mints a root, certifies a
- * device and signs its own join offline, and this read is the only thing that
- * tells it where to post the result.
- *
- * So the caller proves possession of the credential it already holds. The cloud
- * mints a sealed, namespace-bound nonce; the device signs it; the read carries
- * the certificate and that signature.
- *
- * ## What this establishes, and what it does not
- *
- * It establishes that the caller holds a device key certified by some account
- * root, and *which* account that is. It does **not** establish that the account
- * was invited to the namespace, nor that it is a member — the cloud cannot
- * check either, because membership is governance state held by the nodes.
- * Anyone can mint an account root offline, so this is not a wall. It buys
- * attribution (every read names an account and can be rate-limited) and it ends
- * anonymous bulk discovery. Authorization stays where it always was: at the
- * node, on the signed op.
- *
- * ## Why the DEVICE signs, not the root
- *
- * The opposite choice from {@link signAccountLink}, deliberately. That one
- * exists for the device-loss case, so only the root will do. This one runs on
- * every routing read from a browser that discards the root immediately after
- * certifying its device — requiring the root would mean re-entering a 24-word
- * phrase to look up a URL.
- *
- * The certificate alone is not enough and the signature is not redundant with
- * it: a certificate travels in the clear inside every device-link op, so anyone
- * who has seen one can replay it. Only the nonce signature binds the presenter
- * to the device.
- */
-import { concat, fromHex, importSigningKey } from '../crypto/internal.js';
-/**
- * The signing domain, followed immediately by the nonce as UTF-8.
- *
- * A flat prefix rather than this SDK's usual length-prefixed `domainHash`,
- * because the verifier is MDMA's `verify_routing_proof` and it checks
- * `DOMAIN ‖ nonce` against the raw message. The trailing NUL is part of the
- * domain string on both sides; it is what stops a domain that is a prefix of
- * some future one from colliding with it.
- */
-const ROUTING_PROOF_DOMAIN = new TextEncoder().encode('calimero.mdma.routing-read.v1\0');
-/**
- * Sign a routing challenge with the device key.
- *
- * Returns base64, which is what the header carries and what MDMA's verifier
- * decodes — the one place this SDK does not spell a signature as hex, because
- * the wire format is not ours to choose.
- */
-export async function signRoutingChallenge(nonce, deviceSecret) {
-    // Validate the secret the same way every other signing path does, so a
-    // truncated or mis-cased key fails here rather than as a 403 from the cloud.
-    fromHex(deviceSecret, 'deviceSecret', 32);
-    const key = await importSigningKey(deviceSecret);
-    const message = concat(ROUTING_PROOF_DOMAIN, new TextEncoder().encode(nonce));
-    const signature = new Uint8Array(await crypto.subtle.sign({ name: 'Ed25519' }, key, message));
-    return base64(signature);
-}
-/**
- * Build the headers for one routing read, from a challenge the cloud minted.
- *
- * Separated from the request so a caller that fetches its own challenge — a
- * test, or a client batching several reads against one nonce — can use the same
- * encoding rather than a second spelling of it.
- *
- * Takes either challenge kind: only the nonce is signed and both are signed
- * over the same domain, so one encoder serves both. What separates them is what
- * MDMA sealed inside, which is checked server-side.
- */
-export async function routingProofHeaders(challenge, credential) {
-    return {
-        'X-Calimero-Credential': credential.credential,
-        'X-Calimero-Nonce': challenge.nonce,
-        'X-Calimero-Signature': await signRoutingChallenge(challenge.nonce, credential.deviceSecret),
-    };
-}
-/**
- * base64, the encoding the header carries.
- *
- * `btoa` is global in every browser and in Node since 16, and this package
- * requires Node 18 — so there is no runtime here that needs a `Buffer`
- * fallback, and adding one would pull a Node-only global into browser code.
- */
-function base64(bytes) {
-    let binary = '';
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary);
-}

package/dist/device-cert/device-cert.d.ts

@@ -1,189 +0,0 @@
-import { type Signer } from '../signer/signer.js';
-/**
- * Core's `ACCOUNT_GENESIS_VERSION`. It is part of the `AccountId` preimage, so
- * this value decides which account a root key names — a mismatch does not fail
- * as a version error at the edge, it silently derives a different account and
- * core refuses the credential as unverifiable.
- *
- * `2` since the genesis dropped its per-namespace nonce. This was `1`, which
- * produced credentials current core rejects outright; the shape was already v2,
- * only the tag was stale.
- */
-export declare const ACCOUNT_GENESIS_VERSION = 2;
-/** What a root certifies about one device. */
-export interface DeviceCertInput {
-    /**
-     * The account root's signing secret, 64 hex. Signs the certificate.
-     *
-     * Mutually exclusive with {@link DeviceCertInput.signer}, and the weaker of
-     * the two in a browser: this is the one key in the system with nothing above
-     * it to revoke it, so a page that can read it can take the account for good.
-     * Prefer `signer` anywhere the root is held rather than loaded.
-     */
-    rootSecret?: string;
-    /**
-     * The account root's signer — use instead of {@link DeviceCertInput.rootSecret}
-     * when the root is a key this page may use and cannot read.
-     *
-     * This is what lets the certifying page keep its root as a non-extractable
-     * `CryptoKey`: {@link accountRootSignerFromPhrase} hands one back, and script
-     * injected into the page can then mint certificates only while the page is
-     * open, rather than walking off with the account.
-     */
-    signer?: Signer;
-    /** The device being certified, 64 hex — see {@link mintDeviceId}. */
-    device: string;
-    /** The key that device signs with, 64 hex. */
-    signPublicKey: string;
-    /** The key the group key is delivered to, 64 hex (X25519). */
-    kemPublicKey: string;
-    /**
-     * Must strictly exceed any epoch already folded for this device.
-     *
-     * The projection refuses a link that does not advance it, so a re-issued
-     * certificate reusing an epoch is inert rather than a rollback.
-     */
-    deviceEpoch: number;
-}
-/**
- * Mint a device id: `nonce ‖ H(DEVICE_ID_DOMAIN, account ‖ nonce)[..16]`.
- *
- * Derived from the account and a fresh nonce rather than from the device's keys,
- * so rotating a keypair keeps the replica identity - and with it the counter
- * slots and HLC lineage - intact. The hash half binds the id to its account:
- * core refuses a certificate naming an id minted for another account.
- */
-export declare function mintDeviceId(account: string, nonce: Uint8Array): Promise<string>;
-/**
- * The 32 bytes a root signs to certify a device.
- *
- * Both keys are covered, so neither the signing key nor the delivery key can be
- * substituted into a certificate that otherwise verifies — which is what stops a
- * relay carrying someone's credential from making itself the reader.
- */
-export declare function deviceCertPayload(input: {
-    account: string;
-    device: string;
-    signPublicKey: string;
-    kemPublicKey: string;
-    keyEpoch: number;
-    deviceEpoch: number;
-}): Promise<Uint8Array>;
-/**
- * Borsh-encode an `AccountProof<DeviceCert>` — what core calls a
- * `JoinAccountCredential`.
- *
- * Extracted so the device-cert path and the namespace-op signer encode this from
- * one implementation. Two copies of a borsh layout drift silently: the encoding
- * is only checked by a peer rejecting a signature, which points at the signature
- * rather than at whichever copy went stale.
- *
- * Layout is `AccountProof { genesis, chain, statement }`:
- * `AccountGenesis` (version u8 + root pk 32) + `chain` (empty Vec, u32 len) +
- * `DeviceCert` (account 32 + device 32 + sign pk 32 + kem pk 32 + key_epoch u32
- * + device_epoch u32 + signature 64) = 237 bytes with an empty chain.
- */
-export declare function accountProofBytes(input: {
-    rootPublicKey: Uint8Array;
-    account: string;
-    device: string;
-    signPublicKey: string;
-    kemPublicKey: string;
-    keyEpoch: number;
-    deviceEpoch: number;
-    signature: Uint8Array;
-}): Uint8Array;
-/**
- * Certify a device, returning the hex credential `merod account sign-cert`
- * prints — a borsh-encoded `AccountProof<DeviceCert>`.
- *
- * The layout, field for field, is core's:
- *
- * ```
- * AccountProof { genesis: AccountGenesis, chain: Vec<RootKeyHandoff>, statement: DeviceCert }
- *   AccountGenesis { version: u8, root_sign_pk: [u8; 32] }
- *   chain          → u32-LE count, then that many handoffs
- *   DeviceCert     { account, device, sign_pk, kem_pk: [u8; 32] x4,
- *                    key_epoch: u32, device_epoch: u32, signature: [u8; 64] }
- * ```
- *
- * Borsh for plain fixed-width data is concatenation; the only variable part is
- * the chain's length prefix. `chain` is empty here for the same reason it is in
- * `sign-cert`: a root that has never been handed off signs directly, and a
- * handoff chain is only needed once it has.
- *
- * `keyEpoch` is 0 for the same reason — it names the root epoch that signed, and
- * an un-rotated root is at 0. Re-signing after a handoff is a separate flow that
- * needs the chain, so this deliberately does not take it as an argument rather
- * than accepting a value it would then have to ignore.
- */
-export declare function signDeviceCert(input: DeviceCertInput): Promise<string>;
-/** A credential read back apart, field for field. */
-export interface DeviceCredential {
-    /** The account root that signed, 64 hex — `AccountGenesis::root_sign_pk`. */
-    rootPublicKey: string;
-    /** The account the certificate names, 64 hex. */
-    account: string;
-    /** The device it certifies, 64 hex. */
-    device: string;
-    /** That device's ed25519 signing key, 64 hex. */
-    signPublicKey: string;
-    /** That device's X25519 key-delivery key, 64 hex. */
-    kemPublicKey: string;
-    keyEpoch: number;
-    deviceEpoch: number;
-    /** The root's signature over {@link deviceCertPayload}, 128 hex. */
-    signature: string;
-}
-/**
- * Read an `AccountProof<DeviceCert>` back apart — the inverse of
- * {@link accountProofBytes}, and deliberately in the same file as it.
- *
- * A decoder that lives away from its encoder drifts: the layout is only checked
- * by a peer rejecting a signature, which points at the signature rather than at
- * whichever copy went stale.
- *
- * This checks the *shape* and nothing else — it says what the bytes claim, not
- * whether the claim is true. {@link verifyDeviceCredential} is the one that
- * answers that, and it is the one a caller acting on a credential from another
- * origin wants.
- *
- * @throws on a wrong genesis version, a non-empty handoff chain, or trailing
- * bytes. A non-empty chain is refused rather than skipped: verifying a handed-off
- * root means walking the chain, and a decoder that returned the statement while
- * ignoring who was entitled to sign it would hand a verifier the wrong root.
- */
-export declare function parseDeviceCredential(credential: string): DeviceCredential;
-/**
- * Check that a credential says what it claims: the root signed it, the
- * account it names is the one that root derives, and the device id was minted
- * for that account.
- *
- * The first two matter and neither implies the other. The signature says the
- * genesis root consented to these exact keys; the account derivation says the
- * certificate cannot have been re-pointed at a different account while keeping a
- * signature that verifies. A caller that checked only the first would accept a
- * certificate naming an account whose root never signed anything. The third
- * stops a root claiming a device id minted for another account.
- *
- * What it does **not** establish is that the account is one the caller wanted.
- * Anyone can mint a root offline and certify any public key with it, so a
- * credential arriving from elsewhere proves a *consistent* account, not *your*
- * account — see `cloud/enrol-redirect.ts` for the binding that closes that.
- *
- * @throws with which check failed, rather than returning false — every failure
- * here is a credential that must not be stored, and a boolean gets ignored.
- */
-export declare function verifyDeviceCredential(credential: string): Promise<DeviceCredential>;
-/** The account this root owns — the content address of its genesis. */
-export declare function accountForRoot(rootSecret: string): Promise<string>;
-/**
- * The same account id, from the root's **public** half.
- *
- * The form a root that cannot be exported needs. It is also the honest shape of
- * the derivation: an account id is a function of the public key, and asking for
- * the secret only ever meant "let me derive the public key first".
- *
- * @param rootPublicKey the root's ed25519 public key, 64 hex
- */
-export declare function accountForRootPublicKey(rootPublicKey: string): Promise<string>;

package/dist/device-cert/device-cert.js

@@ -1,239 +0,0 @@
-/**
- * Minting and certifying a device offline, with a key that never reaches a node.
- *
- * This is the second half of the keyholder story. `signWarrant` lets an account
- * with no node *write*; this lets one exist in the first place — an account root
- * certifies a device, and the resulting credential is what a joiner presents.
- *
- * As with the warrant signer, the risk is that this reproduces core's encoding
- * and has to keep doing so. The answer is the same: a golden vector here, and an
- * e2e that diffs this output against `merod account sign-cert` byte for byte.
- *
- * Everything below is derived from core:
- *
- * - `DeviceCert::signing_payload` — `crates/account/src/device.rs`
- * - `DeviceId::mint`              — `crates/primitives/src/identity.rs`
- * - `AccountProof` / `AccountGenesis` borsh layout — `crates/account/src/{signed,account}.rs`
- */
-import { concat, derivePublicKey, domainHash, fromHex, hex, u32le, verifySignature, } from '../crypto/internal.js';
-import { resolveSigner } from '../signer/signer.js';
-const CERT_DOMAIN = new TextEncoder().encode('calimero.device.cert.v1');
-const ACCOUNT_ID_DOMAIN = new TextEncoder().encode('calimero.account.genesis.v1');
-const DEVICE_ID_DOMAIN = new TextEncoder().encode('calimero.device.id.v1');
-/**
- * Core's `ACCOUNT_GENESIS_VERSION`. It is part of the `AccountId` preimage, so
- * this value decides which account a root key names — a mismatch does not fail
- * as a version error at the edge, it silently derives a different account and
- * core refuses the credential as unverifiable.
- *
- * `2` since the genesis dropped its per-namespace nonce. This was `1`, which
- * produced credentials current core rejects outright; the shape was already v2,
- * only the tag was stale.
- */
-export const ACCOUNT_GENESIS_VERSION = 2;
-/** Byte length of an `AccountProof<DeviceCert>` with an empty handoff chain. */
-const ACCOUNT_PROOF_BYTES = 237;
-/**
- * Mint a device id: `nonce ‖ H(DEVICE_ID_DOMAIN, account ‖ nonce)[..16]`.
- *
- * Derived from the account and a fresh nonce rather than from the device's keys,
- * so rotating a keypair keeps the replica identity - and with it the counter
- * slots and HLC lineage - intact. The hash half binds the id to its account:
- * core refuses a certificate naming an id minted for another account.
- */
-export async function mintDeviceId(account, nonce) {
-    if (nonce.length !== 16) {
-        throw new Error(`nonce must be 16 bytes, got ${nonce.length}`);
-    }
-    const accountBytes = fromHex(account, 'account', 32);
-    const binding = await domainHash(DEVICE_ID_DOMAIN, [accountBytes, nonce]);
-    return hex(concat(nonce, binding.subarray(0, 16)));
-}
-/**
- * The 32 bytes a root signs to certify a device.
- *
- * Both keys are covered, so neither the signing key nor the delivery key can be
- * substituted into a certificate that otherwise verifies — which is what stops a
- * relay carrying someone's credential from making itself the reader.
- */
-export async function deviceCertPayload(input) {
-    return domainHash(CERT_DOMAIN, [
-        fromHex(input.account, 'account', 32),
-        fromHex(input.device, 'device', 32),
-        fromHex(input.signPublicKey, 'signPublicKey', 32),
-        fromHex(input.kemPublicKey, 'kemPublicKey', 32),
-        u32le(input.keyEpoch),
-        u32le(input.deviceEpoch),
-    ]);
-}
-/**
- * Borsh-encode an `AccountProof<DeviceCert>` — what core calls a
- * `JoinAccountCredential`.
- *
- * Extracted so the device-cert path and the namespace-op signer encode this from
- * one implementation. Two copies of a borsh layout drift silently: the encoding
- * is only checked by a peer rejecting a signature, which points at the signature
- * rather than at whichever copy went stale.
- *
- * Layout is `AccountProof { genesis, chain, statement }`:
- * `AccountGenesis` (version u8 + root pk 32) + `chain` (empty Vec, u32 len) +
- * `DeviceCert` (account 32 + device 32 + sign pk 32 + kem pk 32 + key_epoch u32
- * + device_epoch u32 + signature 64) = 237 bytes with an empty chain.
- */
-export function accountProofBytes(input) {
-    return concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), input.rootPublicKey, u32le(0), fromHex(input.account, 'account', 32), fromHex(input.device, 'device', 32), fromHex(input.signPublicKey, 'signPublicKey', 32), fromHex(input.kemPublicKey, 'kemPublicKey', 32), u32le(input.keyEpoch), u32le(input.deviceEpoch), input.signature);
-}
-/**
- * Certify a device, returning the hex credential `merod account sign-cert`
- * prints — a borsh-encoded `AccountProof<DeviceCert>`.
- *
- * The layout, field for field, is core's:
- *
- * ```
- * AccountProof { genesis: AccountGenesis, chain: Vec<RootKeyHandoff>, statement: DeviceCert }
- *   AccountGenesis { version: u8, root_sign_pk: [u8; 32] }
- *   chain          → u32-LE count, then that many handoffs
- *   DeviceCert     { account, device, sign_pk, kem_pk: [u8; 32] x4,
- *                    key_epoch: u32, device_epoch: u32, signature: [u8; 64] }
- * ```
- *
- * Borsh for plain fixed-width data is concatenation; the only variable part is
- * the chain's length prefix. `chain` is empty here for the same reason it is in
- * `sign-cert`: a root that has never been handed off signs directly, and a
- * handoff chain is only needed once it has.
- *
- * `keyEpoch` is 0 for the same reason — it names the root epoch that signed, and
- * an un-rotated root is at 0. Re-signing after a handoff is a separate flow that
- * needs the chain, so this deliberately does not take it as an argument rather
- * than accepting a value it would then have to ignore.
- */
-export async function signDeviceCert(input) {
-    const signer = await resolveSigner(input.rootSecret, input.signer, 'rootSecret');
-    // The signer names its own key, so the account is read off it rather than
-    // derived from material this function may not have.
-    const rootPublicKey = fromHex(signer.publicKey, 'signer.publicKey', 32);
-    const account = await accountForRootPublicKey(signer.publicKey);
-    const keyEpoch = 0;
-    const payload = await deviceCertPayload({
-        account,
-        device: input.device,
-        signPublicKey: input.signPublicKey,
-        kemPublicKey: input.kemPublicKey,
-        keyEpoch,
-        deviceEpoch: input.deviceEpoch,
-    });
-    const signature = await signer.sign(payload);
-    const credential = accountProofBytes({
-        rootPublicKey,
-        account,
-        device: input.device,
-        signPublicKey: input.signPublicKey,
-        kemPublicKey: input.kemPublicKey,
-        keyEpoch,
-        deviceEpoch: input.deviceEpoch,
-        signature,
-    });
-    return hex(credential);
-}
-/**
- * Read an `AccountProof<DeviceCert>` back apart — the inverse of
- * {@link accountProofBytes}, and deliberately in the same file as it.
- *
- * A decoder that lives away from its encoder drifts: the layout is only checked
- * by a peer rejecting a signature, which points at the signature rather than at
- * whichever copy went stale.
- *
- * This checks the *shape* and nothing else — it says what the bytes claim, not
- * whether the claim is true. {@link verifyDeviceCredential} is the one that
- * answers that, and it is the one a caller acting on a credential from another
- * origin wants.
- *
- * @throws on a wrong genesis version, a non-empty handoff chain, or trailing
- * bytes. A non-empty chain is refused rather than skipped: verifying a handed-off
- * root means walking the chain, and a decoder that returned the statement while
- * ignoring who was entitled to sign it would hand a verifier the wrong root.
- */
-export function parseDeviceCredential(credential) {
-    const bytes = fromHex(credential, 'credential', 
-    // Fixed-width with an empty chain: 1 + 32 + 4 + 32*4 + 4 + 4 + 64.
-    ACCOUNT_PROOF_BYTES);
-    if (bytes[0] !== ACCOUNT_GENESIS_VERSION) {
-        throw new Error(`this credential has account genesis version ${bytes[0]}, not ` +
-            `${ACCOUNT_GENESIS_VERSION} — it names a different account than its root ` +
-            'key derives here, and core would refuse it');
-    }
-    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-    const chainLength = view.getUint32(33, true);
-    if (chainLength !== 0) {
-        throw new Error(`this credential carries a ${chainLength}-handoff root chain, which this ` +
-            'SDK cannot verify yet — the signing root is not the genesis root, so ' +
-            'checking it means walking the chain');
-    }
-    const at = (offset, length) => hex(bytes.subarray(offset, offset + length));
-    return {
-        rootPublicKey: at(1, 32),
-        account: at(37, 32),
-        device: at(69, 32),
-        signPublicKey: at(101, 32),
-        kemPublicKey: at(133, 32),
-        keyEpoch: view.getUint32(165, true),
-        deviceEpoch: view.getUint32(169, true),
-        signature: at(173, 64),
-    };
-}
-/**
- * Check that a credential says what it claims: the root signed it, the
- * account it names is the one that root derives, and the device id was minted
- * for that account.
- *
- * The first two matter and neither implies the other. The signature says the
- * genesis root consented to these exact keys; the account derivation says the
- * certificate cannot have been re-pointed at a different account while keeping a
- * signature that verifies. A caller that checked only the first would accept a
- * certificate naming an account whose root never signed anything. The third
- * stops a root claiming a device id minted for another account.
- *
- * What it does **not** establish is that the account is one the caller wanted.
- * Anyone can mint a root offline and certify any public key with it, so a
- * credential arriving from elsewhere proves a *consistent* account, not *your*
- * account — see `cloud/enrol-redirect.ts` for the binding that closes that.
- *
- * @throws with which check failed, rather than returning false — every failure
- * here is a credential that must not be stored, and a boolean gets ignored.
- */
-export async function verifyDeviceCredential(credential) {
-    const parsed = parseDeviceCredential(credential);
-    const derived = await accountForRootPublicKey(parsed.rootPublicKey);
-    if (derived !== parsed.account) {
-        throw new Error(`this credential names account ${parsed.account}, but its root key ` +
-            `derives ${derived} — the certificate was re-pointed at another account`);
-    }
-    const nonce = fromHex(parsed.device, 'device', 32).subarray(0, 16);
-    if ((await mintDeviceId(parsed.account, nonce)) !== parsed.device) {
-        throw new Error(`this credential names device ${parsed.device}, which was not minted for ` +
-            `account ${parsed.account}; core refuses it`);
-    }
-    const signed = await verifySignature(parsed.rootPublicKey, fromHex(parsed.signature, 'signature', 64), await deviceCertPayload(parsed));
-    if (!signed) {
-        throw new Error(`the root key of account ${parsed.account} did not sign this certificate`);
-    }
-    return parsed;
-}
-/** The account this root owns — the content address of its genesis. */
-export async function accountForRoot(rootSecret) {
-    return accountForRootPublicKey(hex(await derivePublicKey(rootSecret)));
-}
-/**
- * The same account id, from the root's **public** half.
- *
- * The form a root that cannot be exported needs. It is also the honest shape of
- * the derivation: an account id is a function of the public key, and asking for
- * the secret only ever meant "let me derive the public key first".
- *
- * @param rootPublicKey the root's ed25519 public key, 64 hex
- */
-export async function accountForRootPublicKey(rootPublicKey) {
-    return hex(await domainHash(ACCOUNT_ID_DOMAIN, [
-        concat(new Uint8Array([ACCOUNT_GENESIS_VERSION]), fromHex(rootPublicKey, 'rootPublicKey', 32)),
-    ]));
-}