@calimero-network/mero-js 19.18.0 → 19.20.0

package/dist/index.cjs

@@ -41,6 +41,7 @@ __export(index_exports, {
   accountForRoot: () => accountForRoot,
   accountRootFromPhrase: () => accountRootFromPhrase,
   accountRootFromSecret: () => accountRootFromSecret,
+  admitterAddrsFromNetworkStatus: () => admitterAddrsFromNetworkStatus,
   buildAuthLoginUrl: () => buildAuthLoginUrl,
   callerProof: () => callerProof,
   combineSignals: () => combineSignals,
@@ -1765,6 +1766,15 @@ var AdminApiClient = class {
     const response = await this.httpClient.get(`/admin-api/groups/${groupId}/settings/tee-admission-policy`);
     return response.data ?? response;
   }
+  /**
+   * Sets which admitted TEEs may author as the TEE authority. Pass
+   * `{ allowedMrtd: [] }` to turn TEE authorship off. `groupId` must be a
+   * namespace root; the node refuses a subgroup. The node exposes no read-back
+   * route for this policy.
+   */
+  async setTeeAuthoringPolicy(groupId, request) {
+    await this.httpClient.put(`/admin-api/groups/${groupId}/settings/tee-authoring-policy`, request);
+  }
   // ---- Group / member / context metadata ----
   async setGroupMetadata(groupId, request) {
     await this.httpClient.put(`/admin-api/groups/${groupId}/metadata`, request);
@@ -5501,17 +5511,27 @@ var CloudClient = class {
    * Ask the fleet to host a claimed namespace — the step that gets a relay
    * assigned.
    *
-   * Takes no body: {@link claimNamespace} already established ownership, and
-   * this is the separate "now host it" half. Idempotent.
+   * Carries no proof: {@link claimNamespace} already established ownership,
+   * and this is the separate "now host it" half. Idempotent.
+   *
+   * `admitterAddrs` is where the owner's own node can be dialed — take it from
+   * that node's network status with {@link admitterAddrsFromNetworkStatus}.
+   * The first fleet node placed on a namespace has nobody but the owner to ask
+   * for admission, and without these it can only broadcast and hope the
+   * owner's node — often a laptop behind a relay — hears it. They are a dial
+   * hint, not a grant: the owner's node admits by its own policy. Omit them to
+   * leave whatever the cloud already holds; pass them again when the node's
+   * relay address changes, and they replace the stored ones.
    *
    * Not to be confused with {@link enableHA}, which opens the cloud's web flow
    * in a browser tab for a user to complete by hand. This is the API call.
    */
-  async enableNamespaceHa(namespaceId) {
+  async enableNamespaceHa(namespaceId, options = {}) {
+    const body = options.admitterAddrs === void 0 ? {} : { admitter_addrs: [...options.admitterAddrs] };
     return this.request(
       "POST",
       `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/enable-ha`,
-      { body: {} }
+      { body }
     );
   }
   /**
@@ -5835,6 +5855,23 @@ var CloudClient = class {
     void this.notifySession(this.session);
   }
 };
+function admitterAddrsFromNetworkStatus(status) {
+  const record = status && typeof status === "object" ? status.data ?? status : void 0;
+  if (!record || typeof record !== "object") return [];
+  const peerId = record.localPeerId;
+  const external = record.externalAddrs;
+  if (typeof peerId !== "string" || !peerId || !Array.isArray(external)) return [];
+  const suffix = `/p2p/${peerId}`;
+  const out = [];
+  for (const entry of external) {
+    if (typeof entry !== "string") continue;
+    const addr = entry.trim();
+    if (!addr.startsWith("/")) continue;
+    const dialable = addr.endsWith(suffix) ? addr : `${addr}${suffix}`;
+    if (!out.includes(dialable)) out.push(dialable);
+  }
+  return out;
+}
 
 // src/mero-js.ts
 function resolveProofSigner(config) {