@calimero-network/mero-js 22.0.0 → 22.1.0

package/dist/admin-api/admin-types.d.ts

@@ -1252,6 +1252,18 @@ export interface GroupInfo {
     metadata?: MetadataRecord | null;
 }
 export type GroupInfoResponseData = GroupInfo;
+/**
+ * A group member's role, as the node serializes it (PascalCase).
+ *
+ * The two TEE roles are minted by hardware-attestation admission only, never by
+ * an invitation or a role change:
+ * - `ReadOnlyTee` — a TEE **replica**: replicates and anchors sync, never
+ *   relays a member's write (a relay intent to one is refused with a 403).
+ * - `RelayTee` — a TEE **relay**: a replica that may also author members'
+ *   writes under their signed warrants, with no `CAN_AUTHOR_ON_BEHALF` grant.
+ *   Admitted when the namespace's {@link TeeAdmissionMode} is `relay`.
+ */
+export type GroupMemberRole = 'Admin' | 'Member' | 'ReadOnly' | 'ReadOnlyTee' | 'RelayTee';
 export interface GroupMember {
     /**
      * The member's ACCOUNT: 64 hex characters.
@@ -1264,7 +1276,7 @@ export interface GroupMember {
      * to {@link GroupMemberInput}.
      */
     identity: string;
-    role: string;
+    role: GroupMemberRole;
     name?: string;
 }
 export interface ListGroupMembersResponseData {
@@ -1399,6 +1411,14 @@ export interface SignedReleaseTeePolicy {
     /** The oldest release admitted (`2.3.72`); any signed release when absent. */
     minReleaseVersion?: string;
 }
+/**
+ * Which role a namespace admits attested TEE nodes with: `replica`
+ * (`ReadOnlyTee`, the default) or `relay` (`RelayTee`, which may also author
+ * members' writes under their warrants). Part of the admin-signed policy, so
+ * every node admits with the same role; changing it converts the TEEs already
+ * admitted.
+ */
+export type TeeAdmissionMode = 'replica' | 'relay';
 /** A policy that lists the measurements it admits. */
 export interface MeasurementTeeAdmissionPolicyRequest {
     allowedMrtd: string[];
@@ -1408,16 +1428,22 @@ export interface MeasurementTeeAdmissionPolicyRequest {
     allowedRtmr3: string[];
     allowedTcbStatuses: string[];
     acceptMock: boolean;
+    /** Absent means `replica`. */
+    mode?: TeeAdmissionMode;
 }
 /** A policy that admits by signed release. The node refuses measurement lists beside it. */
 export interface SignedReleaseTeeAdmissionPolicyRequest {
     signedRelease: SignedReleaseTeePolicy;
     allowedTcbStatuses: string[];
     acceptMock: boolean;
+    /** Absent means `replica`. */
+    mode?: TeeAdmissionMode;
 }
 export type SetTeeAdmissionPolicyRequest = MeasurementTeeAdmissionPolicyRequest | SignedReleaseTeeAdmissionPolicyRequest;
 export type SetTeeAdmissionPolicyResponseData = Record<string, never>;
 export interface GetTeeAdmissionPolicyResponseData {
+    /** `false` when no policy is set; the rest are then empty. */
+    enabled?: boolean;
     allowedMrtd: string[];
     allowedRtmr0: string[];
     allowedRtmr1: string[];
@@ -1427,6 +1453,11 @@ export interface GetTeeAdmissionPolicyResponseData {
     acceptMock: boolean;
     /** Set when the policy admits by signed release; the lists are then empty. */
     signedRelease?: SignedReleaseTeePolicy;
+    /**
+     * The role admitted TEEs receive. `replica` for a policy set before the mode
+     * existed; absent only from a node that predates it.
+     */
+    mode?: TeeAdmissionMode;
 }
 /**
  * Which admitted TEEs may author as the group's TEE authority (the writer behind

package/dist/events/group.d.ts

@@ -1,3 +1,4 @@
+import type { GroupMemberRole } from '../admin-api/admin-types.js';
 /** Parsed group-membership event (core's untagged `NodeEvent` group variant). */
 export interface GroupMembershipEventData {
     groupId: string;
@@ -10,7 +11,7 @@ export interface GroupMembershipEventData {
         memberAccount: string;
         /** Absent on `MemberRemoved`, and on a `MemberJoined` inherited from an Open
          * subgroup. Core's set is closed. */
-        role?: 'Admin' | 'Member' | 'ReadOnly' | 'ReadOnlyTee';
+        role?: GroupMemberRole;
     };
 }
 /**