@calimero-network/mero-js 26.11.0 → 27.0.0

package/dist/mero-js.js

@@ -1,469 +0,0 @@
-import { createBrowserHttpClient } from './http-client/index.js';
-import { createAuthApiClientFromHttpClient } from './auth-api/index.js';
-import { createAdminApiClientFromHttpClient } from './admin-api/index.js';
-import { parseAuthCallback, buildAuthLoginUrl } from './auth/index.js';
-import { createProofSigner } from './request/index.js';
-import { RpcClient } from './rpc/index.js';
-import { SseClient } from './events/sse.js';
-import { WsClient } from './events/ws.js';
-import { EphemeralClient } from './ephemeral/index.js';
-import { CloudClient } from './cloud/cloud-client.js';
-/**
- * Accept either the keys or a ready signer.
- *
- * Taking a callback as well as an options object is not a convenience: it is
- * how a caller keeps the signing key out of the SDK entirely when it lives
- * somewhere the SDK cannot reach.
- */
-function resolveProofSigner(config) {
-    if (!config)
-        return undefined;
-    return typeof config === 'function' ? config : createProofSigner(config);
-}
-/** Name of the Web Lock that serializes token refresh across tabs / webviews. */
-const REFRESH_LOCK_NAME = 'mero-js:token-refresh';
-/** Returns `navigator.locks` when the runtime supports the Web Locks API. */
-function getLockManager() {
-    const nav = globalThis.navigator;
-    const locks = nav?.locks;
-    return locks && typeof locks.request === 'function' ? locks : null;
-}
-/** Key a token bundle to its node: origin plus path prefix, so nodes behind one host stay apart. */
-function nodeKeyOf(baseUrl) {
-    try {
-        const { origin, pathname } = new URL(baseUrl);
-        return origin === 'null' ? baseUrl : origin + pathname.replace(/\/+$/, '');
-    }
-    catch {
-        return baseUrl;
-    }
-}
-/** Try to extract `exp` (seconds) from a JWT, return ms timestamp or fallback. */
-function expiresAtFromJwt(token, fallbackMs) {
-    try {
-        const parts = token.split('.');
-        if (parts.length === 3) {
-            // JWT uses base64url encoding: replace -/_ with +// and add padding
-            let b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
-            while (b64.length % 4)
-                b64 += '=';
-            const payload = JSON.parse(atob(b64));
-            if (typeof payload.exp === 'number') {
-                return payload.exp * 1000;
-            }
-        }
-    }
-    catch {
-        // not a JWT or can't parse
-    }
-    return fallbackMs;
-}
-/**
- * Main MeroJs SDK class that manages all API clients and authentication
- */
-export class MeroJs {
-    constructor(config) {
-        this.tokenData = null;
-        this.refreshPromise = null;
-        // True while the store is known to hold our tokens; a store that cannot persist never sets it.
-        this.storeHoldsTokens = false;
-        // Bumped when local tokens are dropped, so a refresh already in flight cannot restore them.
-        this.tokenGeneration = 0;
-        this.onStorage = () => {
-            if (this.signedOutElsewhere())
-                this.dropLocalTokens();
-        };
-        this.rpcClient = null;
-        this.sseClient = null;
-        this.wsClient = null;
-        this.wsWarned = false;
-        this.config = {
-            timeoutMs: 10000,
-            ...config,
-        };
-        this.tokenStore = config.tokenStore ?? null;
-        this.nodeKey = nodeKeyOf(config.baseUrl);
-        // Restore tokens from store if available
-        this.tokenData = this.readStoredTokens();
-        if (this.tokenStore) {
-            this.storeHoldsTokens = this.tokenData !== null;
-            if (typeof window !== 'undefined')
-                window.addEventListener('storage', this.onStorage);
-        }
-        // Create HTTP client with token management
-        // For Tauri, explicitly set credentials to 'omit' to avoid network errors
-        const isTauri = typeof window !== 'undefined' && '__TAURI_INTERNALS__' in window;
-        // One signer for the whole connection: `authClient` and `adminClient` are
-        // both built FROM this transport, so wiring it here covers every request
-        // either of them makes.
-        const getProof = resolveProofSigner(this.config.requestProof);
-        this.httpClient = createBrowserHttpClient({
-            baseUrl: this.config.baseUrl,
-            fetch: this.config.fetch,
-            getProof,
-            getAuthToken: async () => {
-                const token = await this.getValidToken();
-                return token?.access_token || '';
-            },
-            refreshToken: async () => {
-                const refreshed = await this.performTokenRefresh();
-                return refreshed.access_token;
-            },
-            onTokenRefresh: async (newToken) => {
-                if (this.tokenData) {
-                    this.tokenData.access_token = newToken;
-                    this.persistTokens();
-                }
-            },
-            onAuthRevoked: async () => {
-                // The refresh-token family is gone (a single-use refresh token was
-                // replayed, or the token was revoked). Nothing left to refresh with —
-                // drop the bundle so the app can force a re-login, then let the app react.
-                this.clearToken();
-                try {
-                    await this.config.onAuthRevoked?.();
-                }
-                catch {
-                    // A failing app callback must not mask the auth error.
-                }
-            },
-            timeoutMs: this.config.timeoutMs,
-            credentials: this.config.requestCredentials ?? (isTauri ? 'omit' : undefined),
-        });
-        // Create API clients
-        this.authClient = createAuthApiClientFromHttpClient(this.httpClient, {
-            baseUrl: this.config.baseUrl,
-            getAuthToken: async () => {
-                const token = await this.getValidToken();
-                return token?.access_token || '';
-            },
-            timeoutMs: this.config.timeoutMs,
-        });
-        this.adminClient = createAdminApiClientFromHttpClient(this.httpClient, {
-            baseUrl: this.config.baseUrl,
-            getAuthToken: async () => {
-                const token = await this.getValidToken();
-                return token?.access_token || '';
-            },
-            timeoutMs: this.config.timeoutMs,
-        });
-    }
-    /**
-     * Get the Auth API client
-     */
-    get auth() {
-        return this.authClient;
-    }
-    /**
-     * Get the Admin API client
-     */
-    get admin() {
-        return this.adminClient;
-    }
-    /**
-     * Get the RPC client (lazy initialized)
-     */
-    get rpc() {
-        if (!this.rpcClient) {
-            this.rpcClient = new RpcClient({ httpClient: this.httpClient });
-        }
-        return this.rpcClient;
-    }
-    /**
-     * Get the SSE event client (lazy initialized)
-     */
-    get events() {
-        if (!this.sseClient) {
-            this.sseClient = new SseClient({
-                baseUrl: this.config.baseUrl,
-                fetch: this.config.fetch,
-                getAuthToken: async () => {
-                    const token = await this.getValidToken();
-                    return token?.access_token || '';
-                },
-            });
-        }
-        return this.sseClient;
-    }
-    /**
-     * Get the ephemeral-presence client (lazy initialized).
-     *
-     * Shares this instance's SSE client, so `subscribe` reuses the one event
-     * stream rather than opening a second connection.
-     */
-    get ephemeral() {
-        if (!this.ephemeralClient) {
-            this.ephemeralClient = new EphemeralClient({
-                httpClient: this.httpClient,
-                sse: this.events,
-            });
-        }
-        return this.ephemeralClient;
-    }
-    /**
-     * Calimero Cloud (lazy initialized).
-     *
-     * Available whether or not `cloud` was configured — an app that signs in
-     * later gets an unauthenticated client it can call `signInWithGoogle` on,
-     * which is one fewer construction path than making the getter conditional.
-     * It is entirely independent of this instance's node credential: the cloud
-     * knows nothing about the node's tokens and the node knows nothing about the
-     * cloud session.
-     */
-    get cloud() {
-        if (!this.cloudClient) {
-            this.cloudClient = new CloudClient(this.config.cloud ?? {});
-        }
-        return this.cloudClient;
-    }
-    /**
-     * Get the WebSocket event client (lazy initialized).
-     * @experimental Use `events` (SSE) for production. WsClient is experimental.
-     */
-    get ws() {
-        if (!this.wsWarned) {
-            this.wsWarned = true;
-            console.warn('[mero-js] WsClient is experimental. Use mero.events (SSE) for production.');
-        }
-        if (!this.wsClient) {
-            this.wsClient = new WsClient({
-                baseUrl: this.config.baseUrl,
-                getAuthToken: async () => {
-                    const token = await this.getValidToken();
-                    return token?.access_token || '';
-                },
-            });
-        }
-        return this.wsClient;
-    }
-    /**
-     * Authenticate with the provided credentials
-     * This will create the root key on first use
-     */
-    async authenticate(credentials) {
-        const creds = credentials || this.config.credentials;
-        if (!creds) {
-            throw new Error('No credentials provided for authentication');
-        }
-        try {
-            const requestBody = {
-                auth_method: 'user_password',
-                public_key: creds.username,
-                client_name: 'mero-js-sdk',
-                permissions: ['admin'],
-                timestamp: Math.floor(Date.now() / 1000),
-                provider_data: {
-                    username: creds.username,
-                    password: creds.password,
-                },
-            };
-            const response = await this.authClient.generateTokens(requestBody);
-            const accessToken = response.data.access_token;
-            this.tokenData = {
-                access_token: accessToken,
-                refresh_token: response.data.refresh_token,
-                expires_at: expiresAtFromJwt(accessToken, Date.now() + 3600000),
-            };
-            this.persistTokens();
-            return this.tokenData;
-        }
-        catch (error) {
-            throw new Error(`Authentication failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
-        }
-    }
-    persistTokens() {
-        if (!this.tokenStore || !this.tokenData)
-            return;
-        this.tokenStore.setTokens({ ...this.tokenData, node_origin: this.nodeKey });
-        this.storeHoldsTokens = this.tokenStore.getTokens() !== null;
-    }
-    /** The stored bundle, only if this node issued it; a legacy or foreign entry reads as empty. */
-    readStoredTokens() {
-        const stored = this.tokenStore?.getTokens();
-        if (!stored || stored.node_origin !== this.nodeKey)
-            return null;
-        return {
-            access_token: stored.access_token,
-            refresh_token: stored.refresh_token,
-            expires_at: stored.expires_at,
-        };
-    }
-    // Raw store read: an empty store is a logout, another node's bundle is not.
-    signedOutElsewhere() {
-        return this.storeHoldsTokens && !this.tokenStore?.getTokens();
-    }
-    dropLocalTokens() {
-        this.tokenGeneration++;
-        this.refreshPromise = null;
-        this.tokenData = null;
-        this.storeHoldsTokens = false;
-    }
-    /**
-     * Get a valid token. Returns the current token as-is.
-     * The server rejects refresh attempts while the access token is still valid,
-     * so we never proactively refresh. Instead, the WebHttpClient handles 401
-     * responses reactively via the refreshToken transport hook.
-     */
-    async getValidToken() {
-        return this.tokenData;
-    }
-    /**
-     * Refresh the access token. Single-flight: every caller (including the HTTP
-     * transport's 401 hook) goes through here.
-     *
-     * Refresh tokens are single-use (calimero-network/core#3083): each refresh
-     * consumes the presented token and returns a new one, and replaying a consumed
-     * token makes the server revoke the whole family. A refresh must therefore
-     * happen exactly once per rotation, which needs three layers:
-     *  - an in-process promise, so concurrent 401s in this instance share one call;
-     *  - a Web Lock (when available), so other tabs/webviews don't refresh at the
-     *    same time on the same stored token;
-     *  - a re-read of the token store inside the lock, so a bundle that another
-     *    instance already rotated is adopted instead of replaying a stale token.
-     */
-    async performTokenRefresh() {
-        if (this.refreshPromise) {
-            return this.refreshPromise;
-        }
-        // The access token that triggered this refresh. If the store holds a different
-        // one by the time we get the lock, someone else already rotated for us.
-        const triggeringAccessToken = this.tokenData?.access_token;
-        const promise = this.withRefreshLock(() => this.performTokenRefreshLocked(triggeringAccessToken));
-        this.refreshPromise = promise;
-        try {
-            return await promise;
-        }
-        finally {
-            if (this.refreshPromise === promise) {
-                this.refreshPromise = null;
-            }
-        }
-    }
-    /**
-     * Run `fn` under the refresh lock: the token store's own (shared across
-     * processes), else the cross-tab Web Lock, else directly.
-     */
-    withRefreshLock(fn) {
-        if (this.tokenStore?.withLock)
-            return this.tokenStore.withLock(fn);
-        const locks = getLockManager();
-        return locks ? locks.request(REFRESH_LOCK_NAME, fn) : fn();
-    }
-    /**
-     * Perform the actual token refresh. Runs with the refresh lock held.
-     */
-    async performTokenRefreshLocked(triggeringAccessToken) {
-        // Another instance/tab may have rotated the bundle while we were queued behind
-        // the lock — the store, not our in-memory copy, is the source of truth.
-        if (this.signedOutElsewhere()) {
-            // Another holder signed out and emptied the store; refreshing would undo that.
-            this.dropLocalTokens();
-            throw new Error('Signed out in another tab');
-        }
-        const stored = this.readStoredTokens();
-        if (stored?.refresh_token) {
-            this.storeHoldsTokens = true;
-            this.tokenData = stored;
-            if (triggeringAccessToken && stored.access_token !== triggeringAccessToken) {
-                // Someone else already refreshed. Reuse their bundle rather than replaying
-                // our (now consumed) refresh token, which would revoke the family.
-                return stored;
-            }
-        }
-        if (!this.tokenData?.refresh_token) {
-            throw new Error('No refresh token available');
-        }
-        // The store held the token we present; if it no longer does after the refresh, the
-        // session was replaced or signed out meanwhile and our rotated tokens must not be written.
-        const generation = this.tokenGeneration;
-        const presented = this.tokenData.access_token;
-        const storeHeldPresented = this.tokenStore?.getTokens()?.access_token === presented;
-        try {
-            const response = await this.authClient.refreshToken({
-                access_token: this.tokenData.access_token,
-                refresh_token: this.tokenData.refresh_token,
-            });
-            // A local drop already set the state; a store change by another tab is adopted.
-            if (generation !== this.tokenGeneration)
-                throw new Error('Signed out during token refresh');
-            if (storeHeldPresented && this.tokenStore?.getTokens()?.access_token !== presented) {
-                this.tokenData = this.tokenStore?.getTokens() ?? null;
-                this.storeHoldsTokens = this.tokenData !== null;
-                throw new Error('Signed out during token refresh');
-            }
-            const accessToken = response.data.access_token;
-            this.tokenData = {
-                access_token: accessToken,
-                // The refresh token is rotated on every refresh — persist the new one or
-                // the next refresh replays a consumed token.
-                refresh_token: response.data.refresh_token,
-                expires_at: expiresAtFromJwt(accessToken, Date.now() + 3600000),
-            };
-            this.persistTokens();
-            return this.tokenData;
-        }
-        catch (error) {
-            // Don't clear tokens on refresh failure — the access token may still be
-            // valid (server rejects refresh while access token hasn't expired yet).
-            // A genuinely dead family arrives as `x-auth-error: token_reuse` and is
-            // handled by the onAuthRevoked transport hook. Let the caller handle this.
-            throw new Error(`Token refresh failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
-        }
-    }
-    /**
-     * Clear the current token
-     */
-    clearToken() {
-        this.dropLocalTokens();
-        this.tokenStore?.clear();
-    }
-    /**
-     * Check if the SDK is authenticated
-     */
-    isAuthenticated() {
-        return this.tokenData !== null;
-    }
-    /**
-     * Set token data directly (e.g., from auth callback).
-     * If `expires_at` is missing or 0, attempts to parse the JWT exp claim,
-     * falling back to 1 hour from now.
-     */
-    setTokenData(data) {
-        const expiresAt = data.expires_at || expiresAtFromJwt(data.access_token, Date.now() + 3600000);
-        this.tokenData = { ...data, expires_at: expiresAt };
-        this.persistTokens();
-    }
-    /**
-     * Get the current token data (for debugging)
-     */
-    getTokenData() {
-        return this.tokenData;
-    }
-    /**
-     * Close all event connections and clean up resources
-     */
-    close() {
-        if (typeof window !== 'undefined')
-            window.removeEventListener('storage', this.onStorage);
-        this.sseClient?.close();
-        this.wsClient?.close();
-    }
-    /**
-     * Parse an auth callback URL hash fragment (static utility)
-     */
-    static parseAuthCallback(url, options) {
-        return parseAuthCallback(url, options);
-    }
-    /**
-     * Build an auth login URL (static utility)
-     */
-    static buildAuthLoginUrl(nodeUrl, opts) {
-        return buildAuthLoginUrl(nodeUrl, opts);
-    }
-}
-/**
- * Create a new MeroJs SDK instance
- */
-export function createMeroJs(config) {
-    return new MeroJs(config);
-}

package/dist/namespace-op/index.d.ts

@@ -1,2 +0,0 @@
-export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from './namespace-op.js';
-export type { SignMemberJoinInput } from './namespace-op.js';

package/dist/namespace-op/index.js

@@ -1,3 +0,0 @@
-// Signing a namespace governance op from the SDK — the membership op a keyholder
-// presents to an admitter, which it could not produce before.
-export { signMemberJoinOp, encodeSignedInvitation, SIGNED_NAMESPACE_OP_SCHEMA_VERSION, } from './namespace-op.js';

package/dist/namespace-op/namespace-op.d.ts

@@ -1,150 +0,0 @@
-/**
- * Sign a namespace governance op from the SDK — specifically the membership op a
- * keyholder needs to join without running a node.
- *
- * `admitJoin` carries an already-signed op to a node the inviter named as an
- * admitter. Producing that op is the piece a keyholder could not do before: the
- * op must be signed by the device key in the credential it carries, because every
- * peer checks `signer == credential.statement.sign_pk` when applying a join. An
- * admitter can relay it and can never author it.
- *
- * The encoding is borsh, hand-written to match core's structs. Correctness is not
- * asserted against bytes recorded here — a layout transcribed by eye is exactly
- * how a golden ends up confidently wrong. It is asserted by a node accepting the
- * op, which is what the e2e does.
- */
-import type { SignedGroupOpenInvitation } from '../admin-api/admin-types.js';
-import { type Signer } from '../signer/signer.js';
-/**
- * Core's `SIGNED_NAMESPACE_OP_SCHEMA_VERSION`. A node refuses any other value.
- *
- * 15: core went to 13 (TEE rows locked to the TEE roles, a TEE's relay role
- * read at its namespace root row, inherited read-only roles read-only in Open
- * subgroups), then 14 (`GroupOp::ContextRegisteredOnBehalf`) and 15
- * (`GroupOp::OnBehalf` / `RootOp::OnBehalf`) for delegated context creation and
- * governance through a relay. None of these changes a layout this module
- * signs; the version moves with core's so nodes on different versions never
- * share a namespace.
- *
- * 16: a namespace can be founded through a relay (a delegated
- * `NamespaceCreatedV2`), and `GroupOp::FoundingRelayAttested` lets that relay
- * admit itself as the namespace's first TEE. Again no layout this module signs.
- *
- * 17: `RootOp::GroupCreated` carries a `salt`, and its `group_id` must be the
- * one `createdSubgroupId(admin, parentId, restricted, salt)` derives
- * (calimero-network/core#4244), so two concurrent creates for one id can never
- * name different creators. The layout of that variant changed.
- *
- * 18: owner-level ops need the account ROOT, not only a device of it
- * (calimero-network/core, root-guarded owner ops). `GroupOp::RootGuarded` and
- * `RootOp::RootGuarded` are appended and carry a root-signed proof, and the bare
- * `TransferOwnership`, `AdminChanged`, `GroupDelete` and TEE policy ops are
- * refused. No layout this module signs changes; see `../owner-op` for the proof.
- *
- * 19 is reserved for calimero-network/core#4269.
- *
- * 20: no layout change. A delegated `GroupCreated` whose executor is a TEE at
- * the namespace root now seats that TEE in the new subgroup
- * (calimero-network/core#4276), an apply-time rule older peers disagree on.
- * Core signs and checks at 20, so every op this module signs must too.
- *
- * 21: no layout change. An op concurrent with its signer's removal is void
- * (calimero-network/core#4275), an apply-time rule older peers disagree on.
- * Core signs and checks at 21 from 0.11.0-rc.75. 23.4.0 and 23.4.1 still sign
- * at 20, so against rc.75 every namespace op an account signs with them (a
- * join, a create, any governance op) is refused "schema version mismatch:
- * expected 21, got 20".
- *
- * 22: `GroupOp::SharedWritersRotated` is appended, a `SharedStorage` cell's
- * writer-set step (calimero-network/core#4263), and a capability revoke voids
- * the member's concurrent ops that needed a removed bit
- * (calimero-network/core#4453). No layout this module signs changes.
- *
- * 23: a TEE admission op carries the quote it was admitted on and a TEE
- * authority evidence op the credential it was made for
- * (calimero-network/core#4265). Neither is an op this module signs, so only
- * the version byte moves. Core signs and checks at 23 from 0.11.0-rc.81, the
- * first release with both 22 and 23.
- *
- * 24: no layout change. Only a subgroup's creator may open it - flip it to
- * `Open` (calimero-network/core#4522) - an apply-time rule older peers
- * disagree on, since they let any of its admins open it. A UI that offers
- * "make public" should offer it to the creator alone.
- *
- * 25: no layout change; refused device link/unlink/descope ops are never logged.
- *
- * 26: no layout change. A device link's scope is judged against every
- * application the group may have targeted at the link's cut, not its live
- * target (calimero-network/core#4603), so replicas agree on a link that races
- * a target change; older peers judge it by fold order.
- *
- * 27: no layout change. The namespace founder is seated as an admin by the
- * genesis op itself, so a founder who transfers ownership stays a member
- * (calimero-network/core#4625); older peers seat her from the root's current
- * owner and drop her.
- */
-export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 27;
-/**
- * Borsh-encode a `SignedGroupOpenInvitation`.
- *
- * Re-encoded rather than passed through, because it has to go inside the op that
- * gets signed. That makes this function version-locked to core: a field added to
- * the invitation and omitted here produces an op whose inner invitation no longer
- * matches the inviter's signature over it. That exact drift, in client-py, broke
- * 93 scenarios — the failure surfaces as `invalid invitation signature` and points
- * nowhere near the encoder.
- */
-export declare function encodeSignedInvitation(signed: SignedGroupOpenInvitation): Uint8Array;
-export interface SignMemberJoinInput {
-    /** The namespace being joined, 64 hex. */
-    readonly namespaceId: string;
-    /** The account joining, 64 hex — the subject of the credential. */
-    readonly member: string;
-    /** The invitation, as the admin API returned it. */
-    readonly invitation: SignedGroupOpenInvitation;
-    /**
-     * The joiner's `AccountProof<DeviceCert>`, hex — from `signDeviceCert`.
-     *
-     * Its `sign_pk` must be the public key of `deviceSecret`; a peer checks that
-     * when applying the join and refuses otherwise.
-     */
-    readonly credential: string;
-    /**
-     * The device signing secret, 64 hex. Must match the credential's `sign_pk`.
-     *
-     * Mutually exclusive with {@link SignMemberJoinInput.signer}. A browser should
-     * prefer the signer: joining is the one governance op a keyholder signs for
-     * itself, and it should not need the key in a form script can read.
-     */
-    readonly deviceSecret?: string;
-    /**
-     * The joiner's signer — use instead of
-     * {@link SignMemberJoinInput.deviceSecret} when the key cannot be exported.
-     */
-    readonly signer?: Signer;
-    /**
-     * Heads this op is written against. Empty means "signed against an empty head"
-     * — which is NOT the same as genesis, and a node with a non-empty head will
-     * reject it as stale rather than treat it as a first op.
-     */
-    readonly parentOpHashes?: readonly string[];
-    /** Anti-replay nonce; a node keeps a window per signer. */
-    readonly nonce: number | bigint;
-    /**
-     * When the join happened, unix seconds. Defaults to now.
-     *
-     * Carried only by `MemberJoinedAt`, which is the variant used whenever the
-     * invitation expires — and since core clamps every invitation to
-     * `MAX_INVITATION_VALIDITY_SECS`, that is every invitation. The variant is
-     * inferred from the invitation rather than selected by a flag: an expiring
-     * invitation joined with plain `MemberJoined` is refused at apply with
-     * "expiration is set but joined_at is absent", which is not a mistake worth
-     * leaving available.
-     */
-    readonly joinedAt?: number | bigint;
-}
-/**
- * Sign a `MemberJoined` (or `MemberJoinedAt`) namespace op and return it
- * borsh-encoded and hex — the `signedOp` that `admitJoin` takes.
- */
-export declare function signMemberJoinOp(input: SignMemberJoinInput): Promise<string>;