@calimero-network/mero-js 26.11.0 → 27.0.1

package/dist/warrant/creation-warrant.d.ts

@@ -1,163 +0,0 @@
-/**
- * Mint a creation warrant: the author's consent for one relay to create one
- * context in one group, once.
- *
- * The intent warrant in `warrant.ts` lets an account with no node *write* to a
- * context; this lets it *create* one. The relay executes the warrant and
- * publishes `GroupOp::ContextRegisteredOnBehalf` carrying it, and every peer
- * checks the **author's** `CAN_CREATE_CONTEXT` (or admin) — the relay needs no
- * create rights of its own, only standing to act for members. The app's `init`
- * runs as the author's account.
- *
- * Same primitives and the same two-widths trap as `warrant.ts`: counts **inside
- * the encoding** are borsh `u32`, counts the **signing preimage** hashes are
- * `u64`. The two `Option<String>` labels add a third shape: on the wire an
- * option is a one-byte tag followed (when present) by a `u32`-prefixed string,
- * while the preimage hashes the tag and the bytes as two separate parts, the
- * bytes empty when absent. That is what keeps `None` and `Some("")` distinct in
- * both.
- *
- * **The byte contract is pinned in core**, at
- * `crates/account/src/tests/creation_wire_fixture.rs`, and this module's test
- * asserts the same vectors. A drift would surface at a relay as a 403.
- */
-import { type Signer } from '../signer/signer.js';
-/** What a creation warrant authorises. */
-export interface CreationWarrantInput {
-    /** The group the context is created in, hex (32 bytes). */
-    group: string;
-    /**
-     * The seed the node derives the new context's id from, hex (32 bytes).
-     *
-     * Optional: when absent, 32 random bytes are drawn and returned alongside the
-     * warrant. Pass one only to make the id predictable — reusing a seed asks for
-     * a context that already exists.
-     */
-    seed?: string;
-    /** The author's account, hex — whose consent this is, and who runs `init`. */
-    authorAccount: string;
-    /** The relay's account, hex: the subject its authorship grant is held by. */
-    executor: string;
-    /** The one signing key of `executor` that may carry it out, hex: discovery's `executorKey`. */
-    executorKey: string;
-    /** The application the context is created with, hex (32 bytes). */
-    applicationId: string;
-    /**
-     * Which service of a multi-service bundle, or absent for the default.
-     *
-     * Absent and `""` are different values and sign differently. At most 256
-     * UTF-8 bytes.
-     */
-    serviceName?: string;
-    /** A display name for the context, or absent. At most 256 UTF-8 bytes. */
-    name?: string;
-    /**
-     * The JSON the app's `init()` will receive.
-     *
-     * Committed to rather than carried: the relay is sent the same value
-     * separately and the node checks it hashes to what was signed, so pass the
-     * exact value you will send. See {@link creationInitHash}.
-     */
-    initArgs: unknown;
-    /**
-     * Monotonic per author **device**. Spent in the *new* context's warrant
-     * ledger, so the same per-device nonce source `RelayClient` uses is correct.
-     */
-    nonce: number | bigint;
-    /** Unix seconds after which the relay must refuse it. */
-    notAfter: number | bigint;
-    /** Account-log heads the author saw, each hex (32 bytes). At most 64. */
-    accountHeads?: string[];
-    /**
-     * Governance heads the author's view descended from, each hex (32 bytes). At
-     * most 64. The same caveat as the intent warrant's floor applies: one the
-     * relay supplied is one the relay chose.
-     */
-    governanceFloor?: string[];
-    /**
-     * The author device's ed25519 signing secret, hex (32 bytes). Never sent.
-     *
-     * Mutually exclusive with {@link CreationWarrantInput.signer}: exactly one is required.
-     * Prefer `signer` in a browser, since a secret held as a string is readable
-     * by anything on the origin.
-     */
-    deviceSecret?: string;
-    /**
-     * The author device's signer, in place of {@link CreationWarrantInput.deviceSecret}: for a
-     * key that cannot be exported to hex (a non-extractable WebCrypto key, a
-     * passkey, a hardware or remote signer). Its `publicKey` becomes the
-     * warrant's `author_device_key`, and it signs the 32-byte preimage as is.
-     */
-    signer?: Signer;
-}
-/** A signed creation warrant and the seed it commits to. */
-export interface SignedCreationWarrant {
-    /** Hex borsh `ContextCreationWarrant`, ready for the relay. */
-    warrant: string;
-    /** The seed, hex — the one passed in, or the one drawn when none was. */
-    seed: string;
-}
-/** A creation warrant's fields, decoded from the wire encoding. */
-export interface CreationWarrantFields {
-    group: string;
-    seed: string;
-    authorAccount: string;
-    /** The author device key: the signer's public key. */
-    deviceKey: string;
-    executor: string;
-    executorKey: string;
-    applicationId: string;
-    /** `null` when absent — distinct from `""`. */
-    serviceName: string | null;
-    /** `null` when absent — distinct from `""`. */
-    name: string | null;
-    initHash: string;
-    accountHeads: string[];
-    governanceFloor: string[];
-    nonce: bigint;
-    notAfter: bigint;
-    signature: string;
-}
-/**
- * The commitment a creation warrant carries in place of the init arguments.
- *
- * Hashes `JSON.stringify(initArgs)`, the same bytes `RelayClient.createContext`
- * sends, under its own domain.
- */
-export declare function creationInitHash(initArgs: unknown): Promise<Uint8Array>;
-/** The already-decoded fields the signature covers. Internal. */
-export interface CreationPreimageParts {
-    group: Uint8Array;
-    seed: Uint8Array;
-    authorAccount: Uint8Array;
-    deviceKey: Uint8Array;
-    executor: Uint8Array;
-    executorKey: Uint8Array;
-    applicationId: Uint8Array;
-    serviceName: Uint8Array | null;
-    name: Uint8Array | null;
-    initHash: Uint8Array;
-    accountHeads: Uint8Array[];
-    governanceFloor: Uint8Array[];
-    nonce: number | bigint;
-    notAfter: number | bigint;
-}
-/**
- * The bytes the device key signs. Exported for the conformance test only — not
- * from the package root.
- */
-export declare function creationWarrantPreimage(p: CreationPreimageParts): Promise<Uint8Array>;
-/**
- * Sign a creation warrant and return it hex-encoded, with its seed.
- *
- * Returns the encoding rather than an object for the reason `signWarrant`
- * does: the signature covers exactly these bytes.
- */
-export declare function signCreationWarrant(input: CreationWarrantInput): Promise<SignedCreationWarrant>;
-/**
- * Decode a hex creation warrant back into its fields.
- *
- * Refuses truncated or trailing bytes rather than reading a neighbouring field.
- * Does not verify the signature.
- */
-export declare function parseCreationWarrant(warrant: string): CreationWarrantFields;

package/dist/warrant/creation-warrant.js

@@ -1,194 +0,0 @@
-/**
- * Mint a creation warrant: the author's consent for one relay to create one
- * context in one group, once.
- *
- * The intent warrant in `warrant.ts` lets an account with no node *write* to a
- * context; this lets it *create* one. The relay executes the warrant and
- * publishes `GroupOp::ContextRegisteredOnBehalf` carrying it, and every peer
- * checks the **author's** `CAN_CREATE_CONTEXT` (or admin) — the relay needs no
- * create rights of its own, only standing to act for members. The app's `init`
- * runs as the author's account.
- *
- * Same primitives and the same two-widths trap as `warrant.ts`: counts **inside
- * the encoding** are borsh `u32`, counts the **signing preimage** hashes are
- * `u64`. The two `Option<String>` labels add a third shape: on the wire an
- * option is a one-byte tag followed (when present) by a `u32`-prefixed string,
- * while the preimage hashes the tag and the bytes as two separate parts, the
- * bytes empty when absent. That is what keeps `None` and `Some("")` distinct in
- * both.
- *
- * **The byte contract is pinned in core**, at
- * `crates/account/src/tests/creation_wire_fixture.rs`, and this module's test
- * asserts the same vectors. A drift would surface at a relay as a 403.
- */
-import { concat, domainHash, fromHex, hex, u32le, u64le } from '../crypto/internal.js';
-import { resolveSigner } from '../signer/signer.js';
-import { checkedSignature, citedHeads } from './warrant.js';
-const SIGN_DOMAIN = new TextEncoder().encode('calimero.context-creation-warrant.v1');
-const INIT_DOMAIN = new TextEncoder().encode('calimero.context-creation.init.v1');
-/** core's cap on `service_name` and `name`, in UTF-8 bytes. */
-const MAX_LABEL_BYTES = 256;
-/**
- * The commitment a creation warrant carries in place of the init arguments.
- *
- * Hashes `JSON.stringify(initArgs)`, the same bytes `RelayClient.createContext`
- * sends, under its own domain.
- */
-export async function creationInitHash(initArgs) {
-    const bytes = new TextEncoder().encode(JSON.stringify(initArgs));
-    return domainHash(INIT_DOMAIN, [bytes]);
-}
-/**
- * The bytes the device key signs. Exported for the conformance test only — not
- * from the package root.
- */
-export async function creationWarrantPreimage(p) {
-    // An option is two parts here — its tag, then its bytes (empty when absent) —
-    // so `None` and `Some("")` hash differently. u64 counts HERE; u32 on the wire.
-    return domainHash(SIGN_DOMAIN, [
-        p.group,
-        p.seed,
-        p.authorAccount,
-        p.deviceKey,
-        p.executor,
-        p.executorKey,
-        p.applicationId,
-        new Uint8Array([p.serviceName === null ? 0 : 1]),
-        p.serviceName ?? new Uint8Array(0),
-        new Uint8Array([p.name === null ? 0 : 1]),
-        p.name ?? new Uint8Array(0),
-        p.initHash,
-        u64le(p.accountHeads.length),
-        ...p.accountHeads,
-        u64le(p.governanceFloor.length),
-        ...p.governanceFloor,
-        u64le(p.nonce),
-        u64le(p.notAfter),
-    ]);
-}
-/**
- * Sign a creation warrant and return it hex-encoded, with its seed.
- *
- * Returns the encoding rather than an object for the reason `signWarrant`
- * does: the signature covers exactly these bytes.
- */
-export async function signCreationWarrant(input) {
-    const group = fromHex(input.group, 'group', 32);
-    const seed = input.seed === undefined
-        ? crypto.getRandomValues(new Uint8Array(32))
-        : fromHex(input.seed, 'seed', 32);
-    const authorAccount = fromHex(input.authorAccount, 'authorAccount', 32);
-    const executor = fromHex(input.executor, 'executor', 32);
-    const executorKey = fromHex(input.executorKey, 'executorKey', 32);
-    const applicationId = fromHex(input.applicationId, 'applicationId', 32);
-    const serviceName = label(input.serviceName, 'serviceName');
-    const name = label(input.name, 'name');
-    const accountHeads = citedHeads(input.accountHeads, 'accountHeads');
-    const governanceFloor = citedHeads(input.governanceFloor, 'governanceFloor');
-    const signer = await resolveSigner(input.deviceSecret, input.signer, 'deviceSecret');
-    const deviceKey = fromHex(signer.publicKey, 'signer.publicKey', 32);
-    const initHash = await creationInitHash(input.initArgs);
-    const preimage = await creationWarrantPreimage({
-        group,
-        seed,
-        authorAccount,
-        deviceKey,
-        executor,
-        executorKey,
-        applicationId,
-        serviceName,
-        name,
-        initHash,
-        accountHeads,
-        governanceFloor,
-        nonce: input.nonce,
-        notAfter: input.notAfter,
-    });
-    const signature = checkedSignature(await signer.sign(preimage));
-    const warrant = hex(concat(group, seed, authorAccount, deviceKey, executor, executorKey, applicationId, borshOption(serviceName), borshOption(name), initHash, u32le(accountHeads.length), ...accountHeads, u32le(governanceFloor.length), ...governanceFloor, u64le(input.nonce), u64le(input.notAfter), signature));
-    return { warrant, seed: hex(seed) };
-}
-/**
- * Decode a hex creation warrant back into its fields.
- *
- * Refuses truncated or trailing bytes rather than reading a neighbouring field.
- * Does not verify the signature.
- */
-export function parseCreationWarrant(warrant) {
-    const clean = warrant.trim();
-    if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
-        throw new Error('creation warrant must be an even number of hex characters');
-    }
-    const bytes = new Uint8Array(clean.length / 2);
-    for (let i = 0; i < bytes.length; i += 1) {
-        bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-    }
-    const view = new DataView(bytes.buffer);
-    let o = 0;
-    const take = (n, what) => {
-        if (o + n > bytes.length) {
-            throw new Error(`creation warrant ends inside ${what} (${bytes.length} bytes)`);
-        }
-        const out = bytes.subarray(o, o + n);
-        o += n;
-        return out;
-    };
-    const u32 = (what) => view.getUint32(take(4, what).byteOffset, true);
-    const u64 = (what) => view.getBigUint64(take(8, what).byteOffset, true);
-    const option = (what) => {
-        const tag = take(1, what)[0];
-        if (tag === 0)
-            return null;
-        if (tag !== 1)
-            throw new Error(`${what} has option tag ${tag}, expected 0 or 1`);
-        const len = u32(what);
-        if (len > MAX_LABEL_BYTES) {
-            throw new Error(`${what} is ${len} bytes, over the ${MAX_LABEL_BYTES} a node accepts`);
-        }
-        return new TextDecoder('utf-8', { fatal: true }).decode(take(len, what));
-    };
-    const heads = (what) => {
-        const count = u32(what);
-        if (count > 64) {
-            throw new Error(`${what} cites ${count} heads, over the 64 a node accepts`);
-        }
-        return Array.from({ length: count }, () => hex(take(32, what)));
-    };
-    const fields = {
-        group: hex(take(32, 'group')),
-        seed: hex(take(32, 'seed')),
-        authorAccount: hex(take(32, 'authorAccount')),
-        deviceKey: hex(take(32, 'deviceKey')),
-        executor: hex(take(32, 'executor')),
-        executorKey: hex(take(32, 'executorKey')),
-        applicationId: hex(take(32, 'applicationId')),
-        serviceName: option('serviceName'),
-        name: option('name'),
-        initHash: hex(take(32, 'initHash')),
-        accountHeads: heads('accountHeads'),
-        governanceFloor: heads('governanceFloor'),
-        nonce: u64('nonce'),
-        notAfter: u64('notAfter'),
-        signature: hex(take(64, 'signature')),
-    };
-    if (o !== bytes.length) {
-        throw new Error(`creation warrant is ${bytes.length} bytes but its fields account for ${o}`);
-    }
-    return fields;
-}
-/** UTF-8 encode an optional label, refusing one longer than a node accepts. */
-function label(value, what) {
-    if (value === undefined)
-        return null;
-    const bytes = new TextEncoder().encode(value);
-    if (bytes.length > MAX_LABEL_BYTES) {
-        throw new Error(`${what} is ${bytes.length} UTF-8 bytes, over the ${MAX_LABEL_BYTES} a node accepts`);
-    }
-    return bytes;
-}
-/** Borsh `Option<String>`: `0x00`, or `0x01` then a u32 length and the bytes. */
-function borshOption(bytes) {
-    if (bytes === null)
-        return new Uint8Array([0]);
-    return concat(new Uint8Array([1]), u32le(bytes.length), bytes);
-}

package/dist/warrant/governance-op.d.ts

@@ -1,202 +0,0 @@
-/**
- * Encode the governance ops a member may have a relay publish for them.
- *
- * A governance warrant commits to an op's **borsh bytes**, not to a description
- * of it, so the client has to produce exactly the bytes the node decodes. These
- * encoders cover the delegable ops (core's `GroupOp::delegable_form` and
- * `RootOp::delegable_form`) that a keyholder app is likely to need. Every
- * discriminant is a variant's position in core's enum, which is how borsh
- * encodes a Rust enum; they are pinned against core's own vectors in the test.
- *
- * **Delegable form.** A removal, a leave and a cascade delete carry fields only
- * the publisher can compute (post-state hashes, the enumerated subtree). The
- * member signs them cleared, and these encoders only ever produce the cleared
- * form, which is the one a relay accepts. The relay fills them in afterwards.
- *
- * Sources in core, for the next person to check a discriminant:
- * `crates/governance-types/src/lib.rs` (`GroupOp`, `RootOp`),
- * `crates/primitives/src/context.rs` (`GroupMemberRole`),
- * `crates/account/src/namespace_id.rs` (`founded_namespace_id`), and the vectors in
- * `crates/governance-types/src/tests.rs` (`delegated_governance_op_vectors_are_stable`).
- */
-/**
- * Which plane an op is published on: `group` is a `GroupOp` on the group's own
- * log, `root` a `RootOp` on the namespace log. The kind is signed over, so
- * consent to one can never be presented as the other.
- */
-export type GovernanceOpKind = 'group' | 'root';
-/** An encoded governance op and the plane it belongs to. */
-export interface GovernanceOp {
-    kind: GovernanceOpKind;
-    /** The op's borsh bytes in delegable form: what the warrant commits to. */
-    bytes: Uint8Array;
-}
-/** A group member's role. Borsh discriminants follow core's `GroupMemberRole`. */
-export type GovernanceMemberRole = 'Admin' | 'Member' | 'ReadOnly';
-/**
- * Add `member` (an account, hex) to the group with `role`.
- *
- * Applied as the author: adding a `Member` needs `MANAGE_MEMBERS` or admin,
- * adding an `Admin` needs admin.
- */
-export declare function memberAddedOp(member: string, memberRole: GovernanceMemberRole): GovernanceOp;
-/**
- * Remove `member` (an account, hex) from the group, in delegable form: both
- * post-state claims cleared, for the relay to compute from its own view.
- */
-export declare function memberRemovedOp(member: string): GovernanceOp;
-/**
- * The author leaves the group, in delegable form. The node applies it only when
- * `member` is the author's own account.
- */
-export declare function memberLeftOp(member: string): GovernanceOp;
-/** Set `member`'s role (an account, hex). */
-export declare function memberRoleSetOp(member: string, memberRole: GovernanceMemberRole): GovernanceOp;
-/**
- * The id `admin` derives for a subgroup under `parentId` with birth visibility
- * `restricted` and `salt` (all hex), as core's `created_subgroup_id` does:
- * `domain_hash("calimero.subgroup.id.v1", [admin, parentId, [restricted], salt])`.
- *
- * A subgroup's id is bound to its create, so nobody but its creator can name
- * it: a node refuses a `GroupCreated` whose fields do not reproduce its id.
- * That is what stops a second member racing a concurrent create for an id it
- * saw gossiped.
- */
-export declare function createdSubgroupId(admin: string, parentId: string, restricted: boolean, salt: string): Promise<string>;
-/**
- * Choose the application a group runs (`GroupOp::TargetApplicationSet`), in
- * its delegable form: `bytecode_id` is left for the relay to fill (32 zero
- * bytes), resolved from `package@version` in the registry. The member signs
- * the application id, package and version, so the relay can pick no other
- * build; the application id binds package and signer, and every node checks
- * the bundle's signature.
- *
- * Through a relay this is accepted only as a group's FIRST application, on a
- * group that targets none yet (a namespace an account founded). Moving an
- * existing target is an upgrade, which never goes through a relay.
- */
-export declare function targetApplicationSetOp(input: {
-    applicationId: string;
-    package: string;
-    version: string;
-}): GovernanceOp;
-export declare function defaultCapabilitiesSetOp(capabilities: number): GovernanceOp;
-/** What a subgroup is created with. */
-export interface GroupCreatedInput {
-    /**
-     * The new subgroup's id, hex (32 bytes). It must be
-     * `createdSubgroupId(admin, parentId, restricted, salt)`; a node refuses any
-     * other. {@link subgroupCreation} draws the salt and derives it for you.
-     */
-    groupId: string;
-    /** The group it is nested under, hex: the namespace root or an existing subgroup. */
-    parentId: string;
-    /** `true` for a Restricted subgroup, `false` for born-Open (the default). */
-    restricted: boolean;
-    /**
-     * The subgroup's founding admin, hex: the **author's** account. The node
-     * refuses any other, since the op is applied as the author.
-     */
-    admin: string;
-    /** The salt `groupId` was derived with, hex (32 bytes). Random; need not be kept. */
-    salt: string;
-}
-/**
- * Create a subgroup under `parentId`, a root op published on the namespace.
- *
- * Needs `CAN_CREATE_SUBGROUP` or admin on the parent; the author, not the
- * relay, becomes the new subgroup's admin.
- */
-export declare function groupCreatedOp(input: GroupCreatedInput): GovernanceOp;
-/** A new subgroup's create: its derived id, the salt it was derived with, and the op. */
-export interface SubgroupCreation {
-    groupId: string;
-    salt: string;
-    op: GovernanceOp;
-}
-/**
- * Create a subgroup under `parentId`: draws a fresh salt (unless one is given),
- * derives the id with {@link createdSubgroupId}, and encodes the op.
- */
-export declare function subgroupCreation(input: Omit<GroupCreatedInput, 'groupId' | 'salt'> & {
-    salt?: string;
-}): Promise<SubgroupCreation>;
-/** Move `childGroupId` under `newParentId`, a root op. */
-export declare function groupReparentedOp(childGroupId: string, newParentId: string): GovernanceOp;
-/**
- * Delete `rootGroupId` and its subtree, in delegable form: both cascade lists
- * empty, for the relay to enumerate.
- */
-export declare function groupDeletedOp(rootGroupId: string): GovernanceOp;
-/**
- * The id of the namespace `founder` founds with `salt`: core's
- * `founded_namespace_id`, `domain_hash("calimero.namespace.id.v1", [founder, salt])`.
- *
- * Anyone holding the pair can recompute it, and only the founder's account
- * hashes to it, which is why a relay founding a namespace for a member cannot
- * choose the id: the member computes it and signs it.
- */
-export declare function foundedNamespaceId(founder: string, salt: string): Promise<string>;
-/** What a namespace is founded with. */
-export interface NamespaceCreatedInput {
-    /** The founding account, hex: the **author's**. It becomes founder, owner and admin. */
-    founder: string;
-    /**
-     * The founder's `AccountProof<DeviceCert>`, hex: the credential the author
-     * already presents as `authorProof`. Its account must be `founder` and its
-     * device key the one that signs the warrant; the genesis apply checks both
-     * and binds the founder's device from it.
-     */
-    credential: string;
-    /**
-     * The salt the namespace id is derived with, hex (32 bytes). Choose it at
-     * random; {@link foundedNamespaceId} gives the id it yields.
-     */
-    salt: string;
-}
-/**
- * Found a namespace: core's `RootOp::NamespaceCreatedV2` genesis, a root op
- * published on the new namespace's own log.
- *
- * Its delegable form is the op itself, nothing cleared, so the author signs the
- * exact genesis. Borsh is `[9] || founder || credential || salt`: the credential
- * is a nested struct, not a length-prefixed byte string, so it is written
- * inline. The warrant's scope must be {@link foundedNamespaceId}`(founder, salt)`.
- */
-export declare function namespaceCreatedOp(input: NamespaceCreatedInput): GovernanceOp;
-/** Set `member`'s capabilities in the group (`GroupOp::MemberCapabilitySet`). Bit 9 is refused. */
-export declare function memberCapabilitySetOp(member: string, capabilities: number): GovernanceOp;
-/** Detach a context from the group (`GroupOp::ContextDetached`). */
-export declare function contextDetachedOp(contextId: string): GovernanceOp;
-/** Make a subgroup open (members of the parent may join it themselves) or restricted. */
-export declare function subgroupVisibilitySetOp(mode: 'open' | 'restricted'): GovernanceOp;
-/** Name the group, with optional key/value data (`GroupOp::GroupMetadataSet`). */
-export declare function groupMetadataSetOp(input?: {
-    name?: string;
-    data?: Record<string, string>;
-}): GovernanceOp;
-/** Name a member in the group (`GroupOp::MemberMetadataSet`). */
-export declare function memberMetadataSetOp(member: string, input?: {
-    name?: string;
-    data?: Record<string, string>;
-}): GovernanceOp;
-/** Name a context in the group (`GroupOp::ContextMetadataSet`). */
-export declare function contextMetadataSetOp(contextId: string, input?: {
-    name?: string;
-    data?: Record<string, string>;
-}): GovernanceOp;
-/** Grant `member` a per-context capability (`GroupOp::ContextCapabilityGranted`). */
-export declare function contextCapabilityGrantedOp(contextId: string, member: string, capability: number): GovernanceOp;
-/** Revoke a per-context capability from `member` (`GroupOp::ContextCapabilityRevoked`). */
-export declare function contextCapabilityRevokedOp(contextId: string, member: string, capability: number): GovernanceOp;
-/**
- * Join an open subgroup yourself (`RootOp::MemberJoinedOpen`), a root op posted
- * to the namespace. `member` must be the author; `credential` is the author's
- * own `AccountProof<DeviceCert>`, hex, carried as-is. The author's
- * `CAN_JOIN_OPEN_SUBGROUPS` and the open inheritance path are checked as usual.
- */
-export declare function memberJoinedOpenOp(input: {
-    member: string;
-    groupId: string;
-    credential: string;
-}): GovernanceOp;