@calimero-network/mero-js 26.9.1 → 26.11.0

package/dist/admin-api/admin-client.d.ts

@@ -1,5 +1,5 @@
 import { HttpClient } from '../http-client/index.js';
-import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, ActivateGroupUpgradeRequest, ActivateGroupUpgradeResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MigrationStatus, NamespaceRevokedDevices, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData, CreateAccessGrantRequest, AccessGrant, CreatedAccessGrant, RevokeAccessGrantResponseData, AccessGrantCallRequest, AccessGrantCallResponseData } from './admin-types.js';
+import type { HealthStatus, ReadinessStatus, AdminAuthStatus, InstallApplicationRequest, InstallApplicationResponseData, InstallDevApplicationRequest, UninstallApplicationResponseData, ListApplicationsResponseData, GetApplicationResponseData, ApplicationVersionEntry, GetApplicationAbiResponseData, GetLatestVersionResponseData, ListPackagesResponseData, ListVersionsResponseData, CreateContextRequest, CreateContextResponseData, DeleteContextResponseData, GetContextsResponseData, Context, GenerateContextIdentityResponseData, GetContextIdentitiesResponseData, JoinContextResponseData, JoinSubgroupInheritanceResponseData, ContextGroupResponseData, ContextStorageResponseData, UpdateContextApplicationRequest, ResyncContextRequest, ResyncContextResponseData, ContextsWithExecutorsResponseData, UploadBlobRequest, UploadBlobResponseData, DeleteBlobResponseData, ListBlobsResponseData, GetBlobInfoResponseData, BlobReadOptions, CreateContextAliasRequest, CreateApplicationAliasRequest, CreateDeviceAliasRequest, CreateAliasResponseData, LookupAliasResponseData, DeleteAliasResponseData, ListAliasesResponseData, ListNamespacesResponseData, CreateNamespaceRequest, CreateNamespaceResponseData, OutboundApproval, SetOutboundApprovalRequest, SetOutboundApprovalResponseData, DeleteNamespaceResponseData, CreateNamespaceInvitationRequest, CreateNamespaceInvitationResponseData, CreateRecursiveInvitationResponseData, JoinNamespaceRequest, JoinNamespaceResponseData, CreateGroupInNamespaceRequest, CreateGroupInNamespaceResponseData, SubgroupEntry, Namespace, NodeIdentity, AccountPairInitRequest, AccountPairInitResponseData, AccountPairCompleteRequest, AccountPairCompleteResponseData, AccountSignWithRootRequest, AccountSignWithRootResponseData, RelinkDeviceRequest, RelinkDeviceResponseData, RescopeDeviceRequest, RescopeDeviceResponseData, LabelDeviceRequest, LabelDeviceResponseData, AccountDeviceEntry, AccountApplicationEntry, RevokeAccountDeviceRequest, LinkAccountDeviceRequest, LinkAccountDeviceResponseData, RevokeAccountDeviceResponseData, MemberDevicesEntry, ListMemberDevicesOptions, GroupInfoResponseData, CreateGroupRequest, CreateGroupResponseData, DeleteGroupResponseData, ListGroupMembersResponseData, ListGroupContextsResponseData, AddGroupMembersRequest, RemoveGroupMembersRequest, UpdateMemberRoleRequest, MemberCapabilities, SetMemberCapabilitiesRequest, SetDefaultCapabilitiesRequest, SetMemberAutoFollowRequest, SetSubgroupVisibilityRequest, SetTeeAdmissionPolicyRequest, GetTeeAdmissionPolicyResponseData, SetTeeAuthoringPolicyRequest, TransferOwnershipRequest, ChangeNamespaceAdminRequest, OwnerDeleteGroupRequest, RootGuardedOpRequest, SetGroupMetadataRequest, SetMemberMetadataRequest, SetContextMetadataRequest, MetadataRecord, SyncGroupResponseData, ActivateGroupUpgradeRequest, ActivateGroupUpgradeResponseData, UpgradeGroupRequest, UpgradeGroupResponseData, GroupUpgradeStatusResponseData, MissingRelease, MigrationStatus, NamespaceRevokedDevices, CascadeStatusEntry, RetryGroupUpgradeResponseData, ReparentGroupRequest, ReparentGroupResponseData, IssueOwnershipProofRequest, IssueNamespaceOwnershipProofRequest, IssueOwnershipProofResponseData, CreateGroupInvitationRequest, CreateGroupInvitationResponseData, CreateRecursiveGroupInvitationResponseData, JoinGroupRequest, JoinGroupResponseData, TeeInfoResponseData, TeeAttestRequest, TeeAttestResponseData, PerformIntentRequest, PerformIntentResponseData, IntentRelayInfo, QueryContextRequest, QueryContextResponseData, ListMemberDevicesResponseData, SealToAccountRequest, SealedEnvelope, AdmitJoinRequest, AdmitJoinResponseData, CreateAccessGrantRequest, AccessGrant, CreatedAccessGrant, RevokeAccessGrantResponseData, AccessGrantCallRequest, AccessGrantCallResponseData } from './admin-types.js';
 import { type RedeemOutcome } from './redeem-invitation.js';
 /**
  * Compare two version strings by SemVer 2.0 precedence, ascending: negative if
@@ -219,6 +219,14 @@ export declare class AdminApiClient {
     getIntentRelay(contextId: string): Promise<IntentRelayInfo>;
     listNamespacesForApplication(applicationId: string): Promise<ListNamespacesResponseData>;
     createNamespace(request: CreateNamespaceRequest): Promise<CreateNamespaceResponseData>;
+    /** What `namespaceId` approves for outbound requests, one entry per publisher. */
+    listOutboundApprovals(namespaceId: string): Promise<OutboundApproval[]>;
+    /**
+     * Set what `namespaceId` approves for the publisher of `request.applicationId`
+     * to exactly `request.approve`: `'manifest'` or a list of URL prefixes, and
+     * `[]` revokes everything. Takes effect at the app's next run.
+     */
+    setOutboundApproval(namespaceId: string, request: SetOutboundApprovalRequest): Promise<SetOutboundApprovalResponseData>;
     deleteNamespace(namespaceId: string): Promise<DeleteNamespaceResponseData>;
     createNamespaceInvitation(namespaceId: string, request?: CreateNamespaceInvitationRequest): Promise<CreateNamespaceInvitationResponseData | CreateRecursiveInvitationResponseData>;
     /**
@@ -616,6 +624,8 @@ export declare class AdminApiClient {
     syncGroup(groupId: string): Promise<SyncGroupResponseData>;
     upgradeGroup(groupId: string, request: UpgradeGroupRequest): Promise<UpgradeGroupResponseData>;
     getGroupUpgradeStatus(groupId: string): Promise<GroupUpgradeStatusResponseData>;
+    /** Releases to install before activating the upgrade, in list order (oldest first). An older server returns []. */
+    getGroupMissingReleases(groupId: string): Promise<MissingRelease[]>;
     /**
      * The operator-facing "have all peers migrated?" rollup for a namespace.
      * The handler serializes the payload directly, so there is no `{ data }`

package/dist/admin-api/admin-client.js

@@ -507,6 +507,20 @@ export class AdminApiClient {
     async createNamespace(request) {
         return unwrap(await this.httpClient.post('/admin-api/namespaces', request));
     }
+    /** What `namespaceId` approves for outbound requests, one entry per publisher. */
+    async listOutboundApprovals(namespaceId) {
+        return unwrap(await this.httpClient.get(`/admin-api/namespaces/${pathSegment(namespaceId)}/outbound-approvals`));
+    }
+    /**
+     * Set what `namespaceId` approves for the publisher of `request.applicationId`
+     * to exactly `request.approve`: `'manifest'` or a list of URL prefixes, and
+     * `[]` revokes everything. Takes effect at the app's next run.
+     */
+    async setOutboundApproval(namespaceId, request) {
+        return unwrap(await this.httpClient.put(`/admin-api/namespaces/${pathSegment(namespaceId)}/outbound-approvals`, 
+        // Core declares this body `deny_unknown_fields`, so send exactly these.
+        { applicationId: request.applicationId, approve: request.approve }));
+    }
     async deleteNamespace(namespaceId) {
         // Core requires `Content-Type: application/json` on this DELETE even though
         // the body is always empty, so send the header and an empty JSON object.
@@ -1097,6 +1111,11 @@ export class AdminApiClient {
     async getGroupUpgradeStatus(groupId) {
         return unwrap(await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/upgrade/status`));
     }
+    /** Releases to install before activating the upgrade, in list order (oldest first). An older server returns []. */
+    async getGroupMissingReleases(groupId) {
+        const res = await this.httpClient.get(`/admin-api/groups/${pathSegment(groupId)}/upgrade/status`);
+        return res.missingReleases ?? [];
+    }
     /**
      * The operator-facing "have all peers migrated?" rollup for a namespace.
      * The handler serializes the payload directly, so there is no `{ data }`

package/dist/admin-api/admin-types.d.ts

@@ -672,11 +672,50 @@ export interface CreateNamespaceRequest {
     name?: string;
     /** Hex 32-byte blob id; pins the namespace to a specific installed version. */
     appKey?: string;
+    /**
+     * Approve outbound requests for the app's publisher in the new namespace, in
+     * the same call. Absent approves none, and the app's requests are refused
+     * (`NotApproved`) until an admin approves them.
+     */
+    approveOutbound?: OutboundSelection;
 }
 export interface CreateNamespaceResponseData {
     namespaceId: string;
     /** What the id was derived from. Absent on nodes that predate derived ids. */
     founding?: NamespaceFounding;
+    /** What the namespace approves for the app's publisher; present only when the request set `approveOutbound`. */
+    outboundApproval?: OutboundApproval;
+}
+/**
+ * Which outbound URL prefixes a namespace approves for an app's publisher:
+ * `'manifest'` approves every prefix the app's manifest declares, a list
+ * approves exactly those prefixes. The node rejects any other string.
+ */
+export type OutboundSelection = 'manifest' | string[];
+/**
+ * What a namespace approves for one publisher (the bundle signer): the URL
+ * prefixes its apps may send outbound requests under, and the prefixes an
+ * approver was shown.
+ */
+export interface OutboundApproval {
+    /** The publisher's signer id (`did:key`). */
+    signer: string;
+    prefixes: string[];
+    reviewed: string[];
+}
+/**
+ * `PUT /admin-api/namespaces/:namespaceId/outbound-approvals` — set what the
+ * namespace approves for an installed app's publisher to exactly `approve`.
+ * `[]` revokes everything.
+ */
+export interface SetOutboundApprovalRequest {
+    applicationId: string;
+    approve: OutboundSelection;
+}
+export interface SetOutboundApprovalResponseData extends OutboundApproval {
+    namespaceId: string;
+    /** `false` when nothing changed, so no op was published. */
+    published: boolean;
 }
 export interface DeleteNamespaceResponseData {
     isDeleted: boolean;
@@ -1311,6 +1350,11 @@ export interface CreateGroupRequest {
 export interface CreateGroupResponseData {
     groupId: string;
 }
+export interface MissingRelease {
+    package: string;
+    version: string;
+    applicationId: string;
+}
 export interface GroupUpgradeStatus {
     fromVersion: string;
     toVersion: string;
@@ -1768,6 +1812,10 @@ export interface UpgradeGroupRequest {
     /** Publish without first trialling the migration on the admin's own contexts.
      *  Server default: false, so a migration that fails the trial is refused with a 409. */
     skipTrial?: boolean;
+    /** Approve outbound requests for the target's publisher in the group's
+     *  namespace before upgrading. Added to what the namespace already approves;
+     *  a prefix the target declares that nobody approved waits (`AwaitingApproval`). */
+    approveOutbound?: OutboundSelection;
 }
 export interface UpgradeGroupResponseData {
     groupId: string;
@@ -1777,6 +1825,8 @@ export interface UpgradeGroupResponseData {
     localContextsFailed?: number;
     contextsTrialled?: number;
     contextsNotHeld?: number;
+    /** What the namespace approves for the target's publisher; present only when the request set `approveOutbound`. */
+    outboundApproval?: OutboundApproval;
 }
 export type GroupUpgradeStatusResponseData = GroupUpgradeStatus | null;
 export type RetryGroupUpgradeResponseData = UpgradeGroupResponseData;