@calimero-network/mero-js 26.11.0 → 27.0.0

package/dist/warrant/governance-op.js

@@ -1,355 +0,0 @@
-/**
- * Encode the governance ops a member may have a relay publish for them.
- *
- * A governance warrant commits to an op's **borsh bytes**, not to a description
- * of it, so the client has to produce exactly the bytes the node decodes. These
- * encoders cover the delegable ops (core's `GroupOp::delegable_form` and
- * `RootOp::delegable_form`) that a keyholder app is likely to need. Every
- * discriminant is a variant's position in core's enum, which is how borsh
- * encodes a Rust enum; they are pinned against core's own vectors in the test.
- *
- * **Delegable form.** A removal, a leave and a cascade delete carry fields only
- * the publisher can compute (post-state hashes, the enumerated subtree). The
- * member signs them cleared, and these encoders only ever produce the cleared
- * form, which is the one a relay accepts. The relay fills them in afterwards.
- *
- * Sources in core, for the next person to check a discriminant:
- * `crates/governance-types/src/lib.rs` (`GroupOp`, `RootOp`),
- * `crates/primitives/src/context.rs` (`GroupMemberRole`),
- * `crates/account/src/namespace_id.rs` (`founded_namespace_id`), and the vectors in
- * `crates/governance-types/src/tests.rs` (`delegated_governance_op_vectors_are_stable`).
- */
-import { CAPABILITIES, hasCap } from '../capabilities.js';
-import { concat, domainHash, fromHex, fromHexUnsized, hex, u32le } from '../crypto/internal.js';
-/**
- * `GroupMemberRole` discriminants. The two TEE roles (3 and 4) are minted only
- * by attestation admission and never by a member's op, so they are not offered.
- */
-const ROLE = {
-    Admin: 0,
-    Member: 1,
-    ReadOnly: 2,
-};
-/** `GroupOp` discriminants, by position in core's enum. */
-const GROUP_OP = {
-    MemberAdded: 1,
-    MemberRemoved: 2,
-    MemberLeft: 3,
-    MemberRoleSet: 4,
-    MemberCapabilitySet: 5,
-    DefaultCapabilitiesSet: 6,
-    TargetApplicationSet: 7,
-    ContextDetached: 9,
-    SubgroupVisibilitySet: 10,
-    GroupMetadataSet: 11,
-    MemberMetadataSet: 12,
-    ContextMetadataSet: 13,
-    ContextCapabilityGranted: 16,
-    ContextCapabilityRevoked: 17,
-};
-/** `RootOp` discriminants, by position in core's enum. */
-const ROOT_OP = {
-    GroupCreated: 0,
-    GroupReparented: 1,
-    GroupDeleted: 2,
-    MemberJoinedOpen: 7,
-    NamespaceCreatedV2: 9,
-};
-/** core's `NAMESPACE_ID_DOMAIN`, which a founded namespace id is hashed under. */
-const NAMESPACE_ID_DOMAIN = new TextEncoder().encode('calimero.namespace.id.v1');
-/** A post-state hash left for the relay to compute: 32 zero bytes. */
-const CLEARED_HASH = new Uint8Array(32);
-/** An empty borsh `Vec`: a zero `u32` count. */
-const EMPTY_VEC = u32le(0);
-function role(value) {
-    const byte = ROLE[value];
-    if (byte === undefined) {
-        throw new Error(`role must be Admin, Member or ReadOnly, got ${String(value)}`);
-    }
-    return new Uint8Array([byte]);
-}
-function tag(byte) {
-    return new Uint8Array([byte]);
-}
-/**
- * Add `member` (an account, hex) to the group with `role`.
- *
- * Applied as the author: adding a `Member` needs `MANAGE_MEMBERS` or admin,
- * adding an `Admin` needs admin.
- */
-export function memberAddedOp(member, memberRole) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.MemberAdded), fromHex(member, 'member', 32), role(memberRole)),
-    };
-}
-/**
- * Remove `member` (an account, hex) from the group, in delegable form: both
- * post-state claims cleared, for the relay to compute from its own view.
- */
-export function memberRemovedOp(member) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.MemberRemoved), fromHex(member, 'member', 32), CLEARED_HASH, EMPTY_VEC),
-    };
-}
-/**
- * The author leaves the group, in delegable form. The node applies it only when
- * `member` is the author's own account.
- */
-export function memberLeftOp(member) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.MemberLeft), fromHex(member, 'member', 32), CLEARED_HASH, EMPTY_VEC),
-    };
-}
-/** Set `member`'s role (an account, hex). */
-export function memberRoleSetOp(member, memberRole) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.MemberRoleSet), fromHex(member, 'member', 32), role(memberRole)),
-    };
-}
-/** Domain of core's `created_subgroup_id`. */
-const SUBGROUP_ID_DOMAIN = new TextEncoder().encode('calimero.subgroup.id.v1');
-/**
- * The id `admin` derives for a subgroup under `parentId` with birth visibility
- * `restricted` and `salt` (all hex), as core's `created_subgroup_id` does:
- * `domain_hash("calimero.subgroup.id.v1", [admin, parentId, [restricted], salt])`.
- *
- * A subgroup's id is bound to its create, so nobody but its creator can name
- * it: a node refuses a `GroupCreated` whose fields do not reproduce its id.
- * That is what stops a second member racing a concurrent create for an id it
- * saw gossiped.
- */
-export async function createdSubgroupId(admin, parentId, restricted, salt) {
-    return hex(await domainHash(SUBGROUP_ID_DOMAIN, [
-        fromHex(admin, 'admin', 32),
-        fromHex(parentId, 'parentId', 32),
-        new Uint8Array([restricted ? 1 : 0]),
-        fromHex(salt, 'salt', 32),
-    ]));
-}
-/**
- * Set the group's default capability mask (`MemberCapabilities` bits, a `u32`),
- * the capabilities every member holds without a per-member grant. Needs admin.
- *
- * The relay refuses any change to `CAN_AUTHOR_ON_BEHALF` (bit 9) through this
- * path, and no namespace starts with it in its default mask, so a mask that
- * sets it is refused here rather than burning a nonce on a certain 403.
- */
-/** A borsh `String`: a u32 byte length, then the UTF-8 bytes. */
-function borshString(value, what) {
-    if (value.length === 0)
-        throw new Error(`${what} must not be empty`);
-    const bytes = new TextEncoder().encode(value);
-    return concat(u32le(bytes.length), bytes);
-}
-/**
- * Choose the application a group runs (`GroupOp::TargetApplicationSet`), in
- * its delegable form: `bytecode_id` is left for the relay to fill (32 zero
- * bytes), resolved from `package@version` in the registry. The member signs
- * the application id, package and version, so the relay can pick no other
- * build; the application id binds package and signer, and every node checks
- * the bundle's signature.
- *
- * Through a relay this is accepted only as a group's FIRST application, on a
- * group that targets none yet (a namespace an account founded). Moving an
- * existing target is an upgrade, which never goes through a relay.
- */
-export function targetApplicationSetOp(input) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.TargetApplicationSet), CLEARED_HASH, fromHex(input.applicationId, 'applicationId', 32), borshString(input.package, 'package'), borshString(input.version, 'version')),
-    };
-}
-export function defaultCapabilitiesSetOp(capabilities) {
-    if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
-        throw new Error(`capabilities must be a u32 bit mask, got ${String(capabilities)}`);
-    }
-    // Never changed through a relay.
-    if (hasCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
-        throw new Error('capabilities may not include CAN_AUTHOR_ON_BEHALF (512): a relay never carries a change to it');
-    }
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.DefaultCapabilitiesSet), u32le(capabilities)),
-    };
-}
-/**
- * Create a subgroup under `parentId`, a root op published on the namespace.
- *
- * Needs `CAN_CREATE_SUBGROUP` or admin on the parent; the author, not the
- * relay, becomes the new subgroup's admin.
- */
-export function groupCreatedOp(input) {
-    return {
-        kind: 'root',
-        bytes: concat(tag(ROOT_OP.GroupCreated), fromHex(input.groupId, 'groupId', 32), fromHex(input.parentId, 'parentId', 32), tag(input.restricted ? 1 : 0), fromHex(input.admin, 'admin', 32), fromHex(input.salt, 'salt', 32)),
-    };
-}
-/**
- * Create a subgroup under `parentId`: draws a fresh salt (unless one is given),
- * derives the id with {@link createdSubgroupId}, and encodes the op.
- */
-export async function subgroupCreation(input) {
-    const salt = input.salt ?? hex(crypto.getRandomValues(new Uint8Array(32)));
-    const groupId = await createdSubgroupId(input.admin, input.parentId, input.restricted, salt);
-    return { groupId, salt, op: groupCreatedOp({ ...input, groupId, salt }) };
-}
-/** Move `childGroupId` under `newParentId`, a root op. */
-export function groupReparentedOp(childGroupId, newParentId) {
-    return {
-        kind: 'root',
-        bytes: concat(tag(ROOT_OP.GroupReparented), fromHex(childGroupId, 'childGroupId', 32), fromHex(newParentId, 'newParentId', 32)),
-    };
-}
-/**
- * Delete `rootGroupId` and its subtree, in delegable form: both cascade lists
- * empty, for the relay to enumerate.
- */
-export function groupDeletedOp(rootGroupId) {
-    return {
-        kind: 'root',
-        bytes: concat(tag(ROOT_OP.GroupDeleted), fromHex(rootGroupId, 'rootGroupId', 32), EMPTY_VEC, EMPTY_VEC),
-    };
-}
-/**
- * The id of the namespace `founder` founds with `salt`: core's
- * `founded_namespace_id`, `domain_hash("calimero.namespace.id.v1", [founder, salt])`.
- *
- * Anyone holding the pair can recompute it, and only the founder's account
- * hashes to it, which is why a relay founding a namespace for a member cannot
- * choose the id: the member computes it and signs it.
- */
-export async function foundedNamespaceId(founder, salt) {
-    return hex(await domainHash(NAMESPACE_ID_DOMAIN, [
-        fromHex(founder, 'founder', 32),
-        fromHex(salt, 'salt', 32),
-    ]));
-}
-/**
- * Found a namespace: core's `RootOp::NamespaceCreatedV2` genesis, a root op
- * published on the new namespace's own log.
- *
- * Its delegable form is the op itself, nothing cleared, so the author signs the
- * exact genesis. Borsh is `[9] || founder || credential || salt`: the credential
- * is a nested struct, not a length-prefixed byte string, so it is written
- * inline. The warrant's scope must be {@link foundedNamespaceId}`(founder, salt)`.
- */
-export function namespaceCreatedOp(input) {
-    const credential = fromHexUnsized(input.credential, 'credential');
-    if (credential.length === 0) {
-        throw new Error('credential must be the founder\'s AccountProof<DeviceCert>, got nothing');
-    }
-    return {
-        kind: 'root',
-        bytes: concat(tag(ROOT_OP.NamespaceCreatedV2), fromHex(input.founder, 'founder', 32), credential, fromHex(input.salt, 'salt', 32)),
-    };
-}
-// ---------------------------------------------------------------------------
-// The rest of the delegable set. Layouts are pinned against core's
-// `delegable_governance_op_vectors_for_non_rust_encoders_are_stable`
-// (crates/governance-types/src/tests.rs, core#4272).
-/** A borsh `String`: a u32 byte length, then the UTF-8 bytes. */
-function str(value) {
-    const bytes = new TextEncoder().encode(value);
-    return concat(u32le(bytes.length), bytes);
-}
-/** A borsh `Option<String>`: 0, or 1 then the string. */
-function optionalStr(value) {
-    return value === undefined ? tag(0) : concat(tag(1), str(value));
-}
-/**
- * A borsh `BTreeMap<String, String>`: a u32 count, then each entry in the
- * map's own order, which is by key BYTES (not JS string order).
- */
-function stringMap(data = {}) {
-    const enc = new TextEncoder();
-    const entries = Object.entries(data)
-        .map(([k, v]) => [enc.encode(k), v, k])
-        .sort(([a], [b]) => {
-        for (let i = 0; i < Math.min(a.length, b.length); i++)
-            if (a[i] !== b[i])
-                return a[i] - b[i];
-        return a.length - b.length;
-    });
-    return concat(u32le(entries.length), ...entries.flatMap(([, v, k]) => [str(k), str(v)]));
-}
-/** Validate a u32 capability mask a relay may carry: never bit 9. */
-function relayableMask(capabilities, what) {
-    if (!Number.isInteger(capabilities) || capabilities < 0 || capabilities > 4294967295) {
-        throw new Error(`${what} must be a u32 bit mask, got ${String(capabilities)}`);
-    }
-    if (hasCap(capabilities, CAPABILITIES.CAN_AUTHOR_ON_BEHALF)) {
-        throw new Error(`${what} may not include CAN_AUTHOR_ON_BEHALF (512): a relay never carries a change to it`);
-    }
-    return capabilities;
-}
-/** Set `member`'s capabilities in the group (`GroupOp::MemberCapabilitySet`). Bit 9 is refused. */
-export function memberCapabilitySetOp(member, capabilities) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.MemberCapabilitySet), fromHex(member, 'member', 32), u32le(relayableMask(capabilities, 'capabilities'))),
-    };
-}
-/** Detach a context from the group (`GroupOp::ContextDetached`). */
-export function contextDetachedOp(contextId) {
-    return { kind: 'group', bytes: concat(tag(GROUP_OP.ContextDetached), fromHex(contextId, 'contextId', 32)) };
-}
-/** Make a subgroup open (members of the parent may join it themselves) or restricted. */
-export function subgroupVisibilitySetOp(mode) {
-    if (mode !== 'open' && mode !== 'restricted')
-        throw new Error(`mode must be open or restricted, got ${String(mode)}`);
-    return { kind: 'group', bytes: concat(tag(GROUP_OP.SubgroupVisibilitySet), tag(mode === 'open' ? 0 : 1)) };
-}
-/** Name the group, with optional key/value data (`GroupOp::GroupMetadataSet`). */
-export function groupMetadataSetOp(input = {}) {
-    return { kind: 'group', bytes: concat(tag(GROUP_OP.GroupMetadataSet), optionalStr(input.name), stringMap(input.data)) };
-}
-/** Name a member in the group (`GroupOp::MemberMetadataSet`). */
-export function memberMetadataSetOp(member, input = {}) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.MemberMetadataSet), fromHex(member, 'member', 32), optionalStr(input.name), stringMap(input.data)),
-    };
-}
-/** Name a context in the group (`GroupOp::ContextMetadataSet`). */
-export function contextMetadataSetOp(contextId, input = {}) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.ContextMetadataSet), fromHex(contextId, 'contextId', 32), optionalStr(input.name), stringMap(input.data)),
-    };
-}
-function contextCapability(capability) {
-    if (!Number.isInteger(capability) || capability < 1 || capability > 0xff) {
-        throw new Error(`capability must be a non-zero u8, got ${String(capability)}`);
-    }
-    return tag(capability);
-}
-/** Grant `member` a per-context capability (`GroupOp::ContextCapabilityGranted`). */
-export function contextCapabilityGrantedOp(contextId, member, capability) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.ContextCapabilityGranted), fromHex(contextId, 'contextId', 32), fromHex(member, 'member', 32), contextCapability(capability)),
-    };
-}
-/** Revoke a per-context capability from `member` (`GroupOp::ContextCapabilityRevoked`). */
-export function contextCapabilityRevokedOp(contextId, member, capability) {
-    return {
-        kind: 'group',
-        bytes: concat(tag(GROUP_OP.ContextCapabilityRevoked), fromHex(contextId, 'contextId', 32), fromHex(member, 'member', 32), contextCapability(capability)),
-    };
-}
-/**
- * Join an open subgroup yourself (`RootOp::MemberJoinedOpen`), a root op posted
- * to the namespace. `member` must be the author; `credential` is the author's
- * own `AccountProof<DeviceCert>`, hex, carried as-is. The author's
- * `CAN_JOIN_OPEN_SUBGROUPS` and the open inheritance path are checked as usual.
- */
-export function memberJoinedOpenOp(input) {
-    return {
-        kind: 'root',
-        bytes: concat(tag(ROOT_OP.MemberJoinedOpen), fromHex(input.member, 'member', 32), fromHex(input.groupId, 'groupId', 32), fromHexUnsized(input.credential, 'credential')),
-    };
-}

package/dist/warrant/governance-warrant.d.ts

@@ -1,124 +0,0 @@
-/**
- * Mint a governance warrant: the author's consent for one relay to publish one
- * governance op in the author's name, once.
- *
- * The intent warrant lets an account with no node write to a context and the
- * creation warrant lets it create one. This covers the governance around them:
- * adding the other person to a DM, creating a channel's subgroup, changing a
- * role. The relay wraps the op in `OnBehalf` and publishes it; every peer applies
- * the inner op **as the author**, so the author's own authority decides
- * (`MANAGE_MEMBERS` to add a member, `CAN_CREATE_SUBGROUP` to create a subgroup,
- * and so on) and the relay needs only standing to act for members.
- *
- * **It commits to the op's bytes.** The warrant carries
- * `H(kind || op bytes)` over the op's delegable form (see `governance-op.ts`), so
- * what the op does, to whom and where is signed byte for byte and the relay
- * chooses nothing about it. `kind` is inside the commitment, so a group op can
- * never be presented as a root op whose bytes happen to coincide.
- *
- * **`scope` is where the op is published**: the group itself for a group op,
- * the namespace for a root op.
- *
- * Same primitives and the same two-widths trap as `warrant.ts`: counts inside
- * the encoding are borsh `u32`, counts in the signing preimage are `u64`.
- *
- * **The byte contract is pinned in core**, at
- * `crates/account/src/tests/governance_wire_fixture.rs`, and this module's test
- * asserts the same vectors. A drift would surface at a relay as a 400.
- */
-import { type Signer } from '../signer/signer.js';
-import type { GovernanceOp, GovernanceOpKind } from './governance-op.js';
-/** What a governance warrant authorises. */
-export interface GovernanceWarrantInput {
-    /**
-     * Where the op is published, hex (32 bytes): the group for a group op, the
-     * namespace for a root op. The relay refuses a warrant presented anywhere else.
-     */
-    scope: string;
-    /** The op, from one of the encoders in `governance-op.ts`. Its kind is signed over. */
-    op: GovernanceOp;
-    /** The author's account, hex: whose authority the op is applied under. */
-    authorAccount: string;
-    /** The relay's account, hex: the subject its authorship grant is held by. */
-    executor: string;
-    /** The one signing key of `executor` that may publish it, hex: discovery's `executorKey`. */
-    executorKey: string;
-    /**
-     * Monotonic per author **device**, spent in a per-group ledger. The same
-     * nonce source `RelayClient` uses for every other warrant is correct.
-     */
-    nonce: number | bigint;
-    /** Unix seconds after which the relay must refuse it. */
-    notAfter: number | bigint;
-    /** Account-log heads the author saw, each hex (32 bytes). At most 64. */
-    accountHeads?: string[];
-    /** Governance heads the author's view descended from, each hex (32 bytes). At most 64. */
-    governanceFloor?: string[];
-    /**
-     * The author device's ed25519 signing secret, hex (32 bytes). Never sent.
-     *
-     * Mutually exclusive with {@link GovernanceWarrantInput.signer}: exactly one is required.
-     * Prefer `signer` in a browser, since a secret held as a string is readable
-     * by anything on the origin.
-     */
-    deviceSecret?: string;
-    /**
-     * The author device's signer, in place of {@link GovernanceWarrantInput.deviceSecret}: for a
-     * key that cannot be exported to hex (a non-extractable WebCrypto key, a
-     * passkey, a hardware or remote signer). Its `publicKey` becomes the
-     * warrant's `author_device_key`, and it signs the 32-byte preimage as is.
-     */
-    signer?: Signer;
-}
-/** A governance warrant's fields, decoded from the wire encoding. */
-export interface GovernanceWarrantFields {
-    scope: string;
-    kind: GovernanceOpKind;
-    authorAccount: string;
-    /** The author device key: the signer's public key. */
-    deviceKey: string;
-    executor: string;
-    executorKey: string;
-    opHash: string;
-    accountHeads: string[];
-    governanceFloor: string[];
-    nonce: bigint;
-    notAfter: bigint;
-    signature: string;
-}
-/**
- * The commitment a governance warrant carries in place of the op:
- * `H(kind || op bytes)` under its own domain.
- */
-export declare function governanceOpHash(op: GovernanceOp): Promise<Uint8Array>;
-/** The already-decoded fields the signature covers. Internal. */
-export interface GovernancePreimageParts {
-    scope: Uint8Array;
-    kind: GovernanceOpKind;
-    authorAccount: Uint8Array;
-    deviceKey: Uint8Array;
-    executor: Uint8Array;
-    executorKey: Uint8Array;
-    opHash: Uint8Array;
-    accountHeads: Uint8Array[];
-    governanceFloor: Uint8Array[];
-    nonce: number | bigint;
-    notAfter: number | bigint;
-}
-/**
- * The bytes the device key signs. Exported for the conformance test only, not
- * from the package root.
- */
-export declare function governanceWarrantPreimage(p: GovernancePreimageParts): Promise<Uint8Array>;
-/**
- * Sign a governance warrant and return it hex-encoded (borsh
- * `GovernanceWarrant`), ready for the relay alongside the op's own bytes.
- */
-export declare function signGovernanceWarrant(input: GovernanceWarrantInput): Promise<string>;
-/**
- * Decode a hex governance warrant back into its fields.
- *
- * Refuses truncated or trailing bytes and an unknown kind. Does not verify the
- * signature.
- */
-export declare function parseGovernanceWarrant(warrant: string): GovernanceWarrantFields;

package/dist/warrant/governance-warrant.js

@@ -1,164 +0,0 @@
-/**
- * Mint a governance warrant: the author's consent for one relay to publish one
- * governance op in the author's name, once.
- *
- * The intent warrant lets an account with no node write to a context and the
- * creation warrant lets it create one. This covers the governance around them:
- * adding the other person to a DM, creating a channel's subgroup, changing a
- * role. The relay wraps the op in `OnBehalf` and publishes it; every peer applies
- * the inner op **as the author**, so the author's own authority decides
- * (`MANAGE_MEMBERS` to add a member, `CAN_CREATE_SUBGROUP` to create a subgroup,
- * and so on) and the relay needs only standing to act for members.
- *
- * **It commits to the op's bytes.** The warrant carries
- * `H(kind || op bytes)` over the op's delegable form (see `governance-op.ts`), so
- * what the op does, to whom and where is signed byte for byte and the relay
- * chooses nothing about it. `kind` is inside the commitment, so a group op can
- * never be presented as a root op whose bytes happen to coincide.
- *
- * **`scope` is where the op is published**: the group itself for a group op,
- * the namespace for a root op.
- *
- * Same primitives and the same two-widths trap as `warrant.ts`: counts inside
- * the encoding are borsh `u32`, counts in the signing preimage are `u64`.
- *
- * **The byte contract is pinned in core**, at
- * `crates/account/src/tests/governance_wire_fixture.rs`, and this module's test
- * asserts the same vectors. A drift would surface at a relay as a 400.
- */
-import { concat, domainHash, fromHex, hex, u32le, u64le } from '../crypto/internal.js';
-import { resolveSigner } from '../signer/signer.js';
-import { checkedSignature, citedHeads } from './warrant.js';
-const SIGN_DOMAIN = new TextEncoder().encode('calimero.governance-warrant.v1');
-const OP_DOMAIN = new TextEncoder().encode('calimero.governance-warrant.op.v1');
-/** core's `GovernanceOpKind` discriminants. */
-const KIND_BYTE = { group: 0, root: 1 };
-/**
- * The commitment a governance warrant carries in place of the op:
- * `H(kind || op bytes)` under its own domain.
- */
-export async function governanceOpHash(op) {
-    return domainHash(OP_DOMAIN, [new Uint8Array([kindByte(op.kind)]), op.bytes]);
-}
-/**
- * The bytes the device key signs. Exported for the conformance test only, not
- * from the package root.
- */
-export async function governanceWarrantPreimage(p) {
-    // u64 counts HERE; u32 on the wire. The counts keep the two adjacent head
-    // lists from being relabelled into each other.
-    return domainHash(SIGN_DOMAIN, [
-        p.scope,
-        new Uint8Array([kindByte(p.kind)]),
-        p.authorAccount,
-        p.deviceKey,
-        p.executor,
-        p.executorKey,
-        p.opHash,
-        u64le(p.accountHeads.length),
-        ...p.accountHeads,
-        u64le(p.governanceFloor.length),
-        ...p.governanceFloor,
-        u64le(p.nonce),
-        u64le(p.notAfter),
-    ]);
-}
-/**
- * Sign a governance warrant and return it hex-encoded (borsh
- * `GovernanceWarrant`), ready for the relay alongside the op's own bytes.
- */
-export async function signGovernanceWarrant(input) {
-    const scope = fromHex(input.scope, 'scope', 32);
-    const authorAccount = fromHex(input.authorAccount, 'authorAccount', 32);
-    const executor = fromHex(input.executor, 'executor', 32);
-    const executorKey = fromHex(input.executorKey, 'executorKey', 32);
-    const accountHeads = citedHeads(input.accountHeads, 'accountHeads');
-    const governanceFloor = citedHeads(input.governanceFloor, 'governanceFloor');
-    const kind = kindByte(input.op.kind);
-    const signer = await resolveSigner(input.deviceSecret, input.signer, 'deviceSecret');
-    const deviceKey = fromHex(signer.publicKey, 'signer.publicKey', 32);
-    const opHash = await governanceOpHash(input.op);
-    const preimage = await governanceWarrantPreimage({
-        scope,
-        kind: input.op.kind,
-        authorAccount,
-        deviceKey,
-        executor,
-        executorKey,
-        opHash,
-        accountHeads,
-        governanceFloor,
-        nonce: input.nonce,
-        notAfter: input.notAfter,
-    });
-    const signature = checkedSignature(await signer.sign(preimage));
-    return hex(concat(scope, new Uint8Array([kind]), authorAccount, deviceKey, executor, executorKey, opHash, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, u64le(input.nonce), u64le(input.notAfter), signature));
-}
-/**
- * Decode a hex governance warrant back into its fields.
- *
- * Refuses truncated or trailing bytes and an unknown kind. Does not verify the
- * signature.
- */
-export function parseGovernanceWarrant(warrant) {
-    const clean = warrant.trim();
-    if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
-        throw new Error('governance warrant must be an even number of hex characters');
-    }
-    const bytes = new Uint8Array(clean.length / 2);
-    for (let i = 0; i < bytes.length; i += 1) {
-        bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-    }
-    const view = new DataView(bytes.buffer);
-    let o = 0;
-    const take = (n, what) => {
-        if (o + n > bytes.length) {
-            throw new Error(`governance warrant ends inside ${what} (${bytes.length} bytes)`);
-        }
-        const out = bytes.subarray(o, o + n);
-        o += n;
-        return out;
-    };
-    const u32 = (what) => view.getUint32(take(4, what).byteOffset, true);
-    const u64 = (what) => view.getBigUint64(take(8, what).byteOffset, true);
-    const heads = (what) => {
-        const count = u32(what);
-        if (count > 64) {
-            throw new Error(`${what} cites ${count} heads, over the 64 a node accepts`);
-        }
-        return Array.from({ length: count }, () => hex(take(32, what)));
-    };
-    const kind = () => {
-        const byte = take(1, 'kind')[0];
-        if (byte === 0)
-            return 'group';
-        if (byte === 1)
-            return 'root';
-        throw new Error(`governance warrant has kind ${byte}, expected 0 (group) or 1 (root)`);
-    };
-    const fields = {
-        scope: hex(take(32, 'scope')),
-        kind: kind(),
-        authorAccount: hex(take(32, 'authorAccount')),
-        deviceKey: hex(take(32, 'deviceKey')),
-        executor: hex(take(32, 'executor')),
-        executorKey: hex(take(32, 'executorKey')),
-        opHash: hex(take(32, 'opHash')),
-        accountHeads: heads('accountHeads'),
-        governanceFloor: heads('governanceFloor'),
-        nonce: u64('nonce'),
-        notAfter: u64('notAfter'),
-        signature: hex(take(64, 'signature')),
-    };
-    if (o !== bytes.length) {
-        throw new Error(`governance warrant is ${bytes.length} bytes but its fields account for ${o}`);
-    }
-    return fields;
-}
-function kindByte(kind) {
-    const byte = KIND_BYTE[kind];
-    if (byte === undefined) {
-        throw new Error(`op kind must be 'group' or 'root', got ${String(kind)}`);
-    }
-    return byte;
-}

package/dist/warrant/index.d.ts

@@ -1,8 +0,0 @@
-export { signWarrant, intentHash } from './warrant.js';
-export type { WarrantInput } from './warrant.js';
-export { signCreationWarrant, parseCreationWarrant, creationInitHash, } from './creation-warrant.js';
-export type { CreationWarrantInput, CreationWarrantFields, SignedCreationWarrant, } from './creation-warrant.js';
-export { signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, } from './governance-warrant.js';
-export type { GovernanceWarrantInput, GovernanceWarrantFields, } from './governance-warrant.js';
-export { memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, memberCapabilitySetOp, contextDetachedOp, subgroupVisibilitySetOp, groupMetadataSetOp, memberMetadataSetOp, contextMetadataSetOp, contextCapabilityGrantedOp, contextCapabilityRevokedOp, memberJoinedOpenOp, namespaceCreatedOp, defaultCapabilitiesSetOp, targetApplicationSetOp, foundedNamespaceId, } from './governance-op.js';
-export type { GovernanceOp, GovernanceOpKind, GovernanceMemberRole, GroupCreatedInput, SubgroupCreation, NamespaceCreatedInput, } from './governance-op.js';

package/dist/warrant/index.js

@@ -1,5 +0,0 @@
-// Warrant signing — the author's half of delegated authorship
-export { signWarrant, intentHash } from './warrant.js';
-export { signCreationWarrant, parseCreationWarrant, creationInitHash, } from './creation-warrant.js';
-export { signGovernanceWarrant, parseGovernanceWarrant, governanceOpHash, } from './governance-warrant.js';
-export { memberAddedOp, memberRemovedOp, memberLeftOp, memberRoleSetOp, groupCreatedOp, createdSubgroupId, subgroupCreation, groupReparentedOp, groupDeletedOp, memberCapabilitySetOp, contextDetachedOp, subgroupVisibilitySetOp, groupMetadataSetOp, memberMetadataSetOp, contextMetadataSetOp, contextCapabilityGrantedOp, contextCapabilityRevokedOp, memberJoinedOpenOp, namespaceCreatedOp, defaultCapabilitiesSetOp, targetApplicationSetOp, foundedNamespaceId, } from './governance-op.js';