@calimero-network/mero-js 24.4.1 → 24.6.0

package/dist/mero-js.d.ts

@@ -174,7 +174,10 @@ export declare class MeroJs {
      *    instance already rotated is adopted instead of replaying a stale token.
      */
     private performTokenRefresh;
-    /** Run `fn` under the cross-tab refresh lock, or directly if Web Locks are unavailable. */
+    /**
+     * Run `fn` under the refresh lock: the token store's own (shared across
+     * processes), else the cross-tab Web Lock, else directly.
+     */
     private withRefreshLock;
     /**
      * Perform the actual token refresh. Runs with the refresh lock held.

package/dist/mero-js.js

@@ -290,8 +290,13 @@ export class MeroJs {
             }
         }
     }
-    /** Run `fn` under the cross-tab refresh lock, or directly if Web Locks are unavailable. */
+    /**
+     * Run `fn` under the refresh lock: the token store's own (shared across
+     * processes), else the cross-tab Web Lock, else directly.
+     */
     withRefreshLock(fn) {
+        if (this.tokenStore?.withLock)
+            return this.tokenStore.withLock(fn);
         const locks = getLockManager();
         return locks ? locks.request(REFRESH_LOCK_NAME, fn) : fn();
     }

package/dist/namespace-op/namespace-op.d.ts

@@ -65,8 +65,13 @@ import { type Signer } from '../signer/signer.js';
  * (calimero-network/core#4265). Neither is an op this module signs, so only
  * the version byte moves. Core signs and checks at 23 from 0.11.0-rc.81, the
  * first release with both 22 and 23.
+ *
+ * 24: no layout change. Only a subgroup's creator may open it - flip it to
+ * `Open` (calimero-network/core#4522) - an apply-time rule older peers
+ * disagree on, since they let any of its admins open it. A UI that offers
+ * "make public" should offer it to the creator alone.
  */
-export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 23;
+export declare const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 24;
 /**
  * Borsh-encode a `SignedGroupOpenInvitation`.
  *

package/dist/namespace-op/namespace-op.js

@@ -51,8 +51,13 @@ import { resolveSigner } from '../signer/signer.js';
  * (calimero-network/core#4265). Neither is an op this module signs, so only
  * the version byte moves. Core signs and checks at 23 from 0.11.0-rc.81, the
  * first release with both 22 and 23.
+ *
+ * 24: no layout change. Only a subgroup's creator may open it - flip it to
+ * `Open` (calimero-network/core#4522) - an apply-time rule older peers
+ * disagree on, since they let any of its admins open it. A UI that offers
+ * "make public" should offer it to the creator alone.
  */
-export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 23;
+export const SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 24;
 /** Domain prefixed to the signable bytes; core's `NAMESPACE_GOVERNANCE_SIGN_DOMAIN`. */
 const NAMESPACE_SIGN_DOMAIN = new TextEncoder().encode('calimero.namespace.v1');
 /** `NamespaceOp::Root` is the first variant. */

package/dist/token-store/index.d.ts

@@ -3,6 +3,14 @@ export interface TokenStore {
     getTokens(): TokenData | null;
     setTokens(data: TokenData): void;
     clear(): void;
+    /**
+     * Run `fn` holding a lock that every process sharing this store respects.
+     * MeroJs holds it around a token refresh, so two processes on one store never
+     * spend the same single-use refresh token. Web Locks cover tabs of one
+     * browser; a store shared across processes (a file read by several CLIs, say)
+     * needs its own lock, and implements this. Takes precedence over Web Locks.
+     */
+    withLock?<T>(fn: () => Promise<T>): Promise<T>;
 }
 export declare class MemoryTokenStore implements TokenStore {
     private tokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "24.4.1",
+  "version": "24.6.0",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {