@calimero-network/mero-js 26.6.0 → 26.8.0

package/dist/admin-api/admin-client.d.ts

@@ -219,6 +219,13 @@ export declare class AdminApiClient {
      */
     admitJoin(namespaceId: string, request: AdmitJoinRequest): Promise<AdmitJoinResponseData>;
     joinNamespace(namespaceId: string, request: JoinNamespaceRequest): Promise<JoinNamespaceResponseData>;
+    /**
+     * Bring back a namespace the user removed from this node while the account
+     * stayed a member (POST /admin-api/namespaces/:namespace_id/join, no
+     * invitation). Such namespaces are the `forgotten` ones in
+     * {@link listNamespacesForApplication}.
+     */
+    restoreNamespace(namespaceId: string): Promise<JoinNamespaceResponseData>;
     /**
      * Join the namespace an invitation grants, and say what happened — including
      * when the request failed but the join landed anyway.
@@ -623,8 +630,15 @@ export declare class AdminApiClient {
     leaveGroup(groupId: string): Promise<void>;
     /** Leave a context (POST /admin-api/contexts/:context_id/leave). */
     leaveContext(contextId: string): Promise<void>;
-    /** Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave). */
-    leaveNamespace(namespaceId: string): Promise<void>;
+    /**
+     * Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave).
+     *
+     * With `purge`, every device of the account also takes the namespace off its
+     * disk. Core reads `purge` from the query string, so it is not in the body.
+     */
+    leaveNamespace(namespaceId: string, options?: {
+        purge?: boolean;
+    }): Promise<void>;
     /** Issue a group ownership proof (POST /admin-api/groups/:group_id/issue-ownership-proof). */
     issueOwnershipProof(groupId: string, request: IssueOwnershipProofRequest): Promise<IssueOwnershipProofResponseData>;
     /** Issue a namespace ownership proof (POST /admin-api/groups/:group_id/issue-namespace-ownership-proof). */

package/dist/admin-api/admin-client.js

@@ -523,6 +523,15 @@ export class AdminApiClient {
         }
         return data;
     }
+    /**
+     * Bring back a namespace the user removed from this node while the account
+     * stayed a member (POST /admin-api/namespaces/:namespace_id/join, no
+     * invitation). Such namespaces are the `forgotten` ones in
+     * {@link listNamespacesForApplication}.
+     */
+    async restoreNamespace(namespaceId) {
+        return unwrap(await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/join`, {}, { timeoutMs: 65000 }));
+    }
     /**
      * Join the namespace an invitation grants, and say what happened — including
      * when the request failed but the join landed anyway.
@@ -1137,9 +1146,15 @@ export class AdminApiClient {
     async leaveContext(contextId) {
         await this.httpClient.post(`/admin-api/contexts/${pathSegment(contextId)}/leave`, {});
     }
-    /** Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave). */
-    async leaveNamespace(namespaceId) {
-        await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/leave`, {});
+    /**
+     * Leave a namespace (POST /admin-api/namespaces/:namespace_id/leave).
+     *
+     * With `purge`, every device of the account also takes the namespace off its
+     * disk. Core reads `purge` from the query string, so it is not in the body.
+     */
+    async leaveNamespace(namespaceId, options = {}) {
+        const query = options.purge ? '?purge=true' : '';
+        await this.httpClient.post(`/admin-api/namespaces/${pathSegment(namespaceId)}/leave${query}`, {});
     }
     /** Issue a group ownership proof (POST /admin-api/groups/:group_id/issue-ownership-proof). */
     async issueOwnershipProof(groupId, request) {

package/dist/admin-api/admin-types.d.ts

@@ -377,6 +377,12 @@ export interface Namespace {
      * current on another. Absent when nothing is held, and on nodes that predate it.
      */
     heldOps?: NamespaceHeldOps;
+    /**
+     * The user removed this namespace from this node and the account is still a
+     * member. Set only by {@link AdminApiClient.listNamespacesForApplication};
+     * {@link AdminApiClient.restoreNamespace} brings it back.
+     */
+    forgotten?: boolean;
 }
 /** The group ops a namespace holds unapplied on the node that answered. */
 export interface NamespaceHeldOps {
@@ -669,6 +675,8 @@ export interface JoinNamespaceResponseData {
      * is how the caller addresses the member it just became.
      */
     memberAccount: string;
+    /** The name a restored namespace had when it was removed. Set only by a restore. */
+    name?: string;
 }
 export interface CreateGroupInNamespaceRequest {
     groupName?: string;

package/dist/agent-gate/policy.d.ts

@@ -36,11 +36,17 @@ export interface VerifySignedAgentPolicyOptions {
     identity?: string;
     /** The OIDC issuer required. Defaults to {@link KMS_RELEASE_SIGNER}'s. */
     issuer?: string;
+    /**
+     * The image role the allowlist must be for: `agent` (the default), or
+     * `inference`, the release's `kms-inference-attestation-policy.<profile>.json`
+     * for its private inference image. Both have the same shape and signer.
+     */
+    role?: 'agent' | 'inference';
 }
 /**
  * Verify an agent allowlist against its cosign bundle, as `cosign verify-blob`
  * would, and return it parsed. Rejects unless it was signed by the KMS release
- * workflow, it is an agent allowlist (`role: "agent"`) for the profile asked
+ * workflow, it is an allowlist for `options.role` (default `agent`) and the profile asked
  * for, every list in it is non-empty, and `expectedVersion`, when given, is its
  * `version`.
  */

package/dist/agent-gate/policy.js

@@ -27,7 +27,7 @@ const LISTS = [
 /**
  * Verify an agent allowlist against its cosign bundle, as `cosign verify-blob`
  * would, and return it parsed. Rejects unless it was signed by the KMS release
- * workflow, it is an agent allowlist (`role: "agent"`) for the profile asked
+ * workflow, it is an allowlist for `options.role` (default `agent`) and the profile asked
  * for, every list in it is non-empty, and `expectedVersion`, when given, is its
  * `version`.
  */
@@ -44,8 +44,9 @@ export async function verifySignedAgentPolicy(policy, bundle, options = {}) {
     catch {
         throw new Error('The signed agent policy is not JSON');
     }
-    if (parsed?.role !== 'agent') {
-        throw new Error(`The signed file is a ${JSON.stringify(parsed?.role)} policy, not an agent one`);
+    const role = options.role ?? 'agent';
+    if (parsed?.role !== role) {
+        throw new Error(`The signed file is a ${JSON.stringify(parsed?.role)} policy, not an ${role} one`);
     }
     const profile = options.profile ?? PRODUCTION_PROFILE;
     if (parsed.profile !== profile) {