@calimero-network/mero-js 27.0.2 → 27.1.0

package/README.md

@@ -74,11 +74,14 @@ Pinned measurements go through `policy.verifyQuote` (`createQuoteVerifier`).
 - **Calls**: `call`, `callConfirmed`, `view`, `events`. A call always carries an idempotency key, and is sent again with it while the node answers `503`.
 - **Blobs and presence**: `uploadBlob`, `downloadBlob`, `listBlobs`, `blobInfo`, `deleteBlob`; `publishPresence`, `presence`, `presenceStream`.
 - **Organizations**: `createOrg`, `getOrg`, `deleteOrg`, `setOrgMetadata`, `setMember`, `removeMember`, `setMemberMetadata`, `setCapabilities` (`ORG_CAPABILITIES`), teams, `invite`, `redeemInvite`.
-- **Owner decisions** (passkey approval): `upgradeOrg`, `upgradeRun`, `retryUpgradeRun`, `approveRelease`, `approveOutbound`.
+- **Owner decisions** (passkey approval, never from an app's frontend): `upgradeOrg`, `upgradeRun`, `retryUpgradeRun`, `approveRelease`, `approveOutbound`, `bindPublisher`, `upgradePublished`.
+- **Approvals from an app**: `appsReport`, `releaseRules`, `pendingApprovals`, then `requestConsent` / `openConsentPage` to send the user to the node's consent page, and `consentResult`. See [Ask your users to approve node images and app upgrades](https://calimero-network.github.io/mero-js/guides/user-approvals/).
+- **Operator** (ops token): `opsApps`, `opsOrgs`, `setReleaseDeadline`, `liftReleaseDeadline`.
 - **Any route**: `get`, `post`, `put`, `delete`; `postConfirmed` and `deleteConfirmed` answer a `412 CONFIRM_REQUIRED` with a passkey.
 
 Refusals are typed (`LoginRequired`, `NotFound`, `ConfirmRequired`, `ConfirmCancelled`,
-`ArgsTooLarge`, `IdempotencyMismatch`, `AppError`, `TrapError`, `UnavailableError`),
+`ArgsTooLarge`, `IdempotencyMismatch`, `ReleaseDeadlineError`, `ConsentStale`, `AppError`, `TrapError`,
+`UnavailableError`),
 all extending `CalimeroError` with the node's `status` and `code`. See the
 [error model](https://calimero-network.github.io/mero-js/reference/error-model/).
 

package/dist/cloud-v2/approvals.d.ts

@@ -0,0 +1,344 @@
+/**
+ * Release and upgrade approvals as core's node reports them, and the consent
+ * page an app sends its user to when one is theirs to make.
+ *
+ * An app never approves in its own page. A passkey assertion is blind (the
+ * authenticator shows a site name, never what the challenge commits to), so
+ * the page that runs the ceremony decides what the person believes they
+ * approve. The node therefore refuses every approval route to a session
+ * opened on an app's frontend, and serves its own **consent page** instead:
+ * the app asks for a request (`POST /consent/requests`), sends the person to
+ * the page's `url` on the node's own origin, and reads the decision when the
+ * page sends them back (`returnTo?request_id=…&result=…`) or from
+ * `GET /consent/{id}/result`. See core's
+ * [consent page](https://calimero-network.github.io/core/protocol/consent-page/)
+ * and [governance](https://calimero-network.github.io/core/protocol/governance/).
+ */
+/**
+ * Who holds one decision on a cluster (core's `Authority`), fixed at genesis
+ * and attested by every replica. `owner`: the parties around each app, with a
+ * passkey (for release approvals the app's publisher, for upgrades whoever
+ * its package's manifest names); `operator`: the operator, for every app.
+ */
+export type Authority = 'owner' | 'operator';
+/** Core's `Governance`: which side holds each decision on this cluster. */
+export interface Governance {
+    releases: Authority;
+    appUpgrades: Authority;
+    outbound: Authority;
+}
+/**
+ * Who upgrades a package's instances, as its signed manifest declares
+ * (`upgrades`; absent means `owner`), where the cluster leaves app upgrades to
+ * owners. `owner`: each instance's owner (an organization's
+ * `MANAGE_APPLICATION` holders); `publisher`: the `MANAGE_APPLICATION`
+ * holders of the organization the package's signing key is bound to, for
+ * every instance ({@link CalimeroClient.upgradePublished}). A package may move
+ * from `publisher` to `owner` in a later release, never back.
+ */
+export type UpgradeAuthority = 'owner' | 'publisher';
+/** Whose approvals a report covers: an organization's, or the account's own apps. */
+export type ReportScope = {
+    kind: 'account';
+} | {
+    kind: 'org';
+    org: string;
+};
+/** A package release as a report names it. */
+export interface ReportedRelease {
+    package: string;
+    version: string;
+    /** The service, for a multi-service bundle (account reports only). */
+    service?: string | null;
+}
+/** A bundle as a report names it: its digest, and its release where the reader may see it. */
+export interface ReportedBundle {
+    bundle: string;
+    package?: string;
+    version?: string;
+}
+/** Who made an upgrade, by kind. */
+export type ActorKind = 'owner' | 'member' | 'operator';
+/** An app's last upgrade. `actor`, `error` and `run` are left out of the operator's report. */
+export interface LastUpgrade {
+    from: ReportedBundle;
+    to: ReportedBundle;
+    /** Unix seconds. */
+    at: number;
+    ok: boolean;
+    actorKind: ActorKind;
+    actor?: string;
+    error?: unknown;
+    run?: string;
+}
+/** One replica of an app: its node, the node's attested release, and whether the app's set approves it. */
+export interface ReportedReplica {
+    node: number;
+    /** `null` while the node's release is not known yet (it then holds nothing). */
+    release: string | null;
+    approved: boolean;
+}
+/** One app in a report. `name`, `team` and `availableVersions` are in members' and accounts' reports only. */
+export interface ReportedApp {
+    app: string;
+    group: number;
+    scope: ReportScope;
+    /** `hex(SHA-256)` of the WASM it runs. */
+    bundle: string;
+    package: ReportedRelease | null;
+    /** The package's pinned signer (`did:key`). */
+    publisher: {
+        signer: string;
+    } | null;
+    upgradesHeldBy: Authority;
+    lastUpgrade: LastUpgrade | null;
+    /** The releases approved to hold this app (its publisher's set, or its scope's); `null`: unrestricted. */
+    approvedReleases: string[] | null;
+    replicas: ReportedReplica[];
+    name?: string;
+    team?: string;
+    /** Newer releases of its package it may be upgraded to, oldest first (at most 16, the newest). */
+    availableVersions?: string[];
+}
+/** A mero-tee release the cluster's nodes run, with how many and whether the scope approved it. */
+export interface ClusterRelease {
+    release: string;
+    nodes: number;
+    approved: boolean;
+}
+/** `GET /auth/apps` or `GET /orgs/{org}/apps`: one page. */
+export interface AppsReport {
+    scope: ReportScope;
+    governance: Governance;
+    /** The scope's own approved set, newest last; `null`: none ever recorded (unrestricted). */
+    approvedReleases: string[] | null;
+    clusterReleases: ClusterRelease[];
+    apps: ReportedApp[];
+    /** Pass as `after` for the next page; `null` on the last. */
+    next: string | null;
+}
+/** `GET /ops/apps`: one page, for the operator. */
+export interface OpsAppsReport {
+    /** This node had caught up with the system leader. */
+    fresh: boolean;
+    governance: Governance;
+    apps: ReportedApp[];
+    next: string | null;
+}
+/** `GET /ops/orgs`: one page, for the operator. */
+export interface OpsOrgsReport {
+    fresh: boolean;
+    governance: Governance;
+    orgs: Array<{
+        org: string;
+        approvedReleases: string[] | null;
+    }>;
+    next: string | null;
+}
+/** A page of a report: entries after the id `after`, at most `limit` (1 to {@link MAX_REPORT_PAGE}). */
+export interface PageOptions {
+    after?: string;
+    limit?: number;
+}
+/** The most entries one page of a report answers (core's `MAX_REPORT_PAGE`). */
+export declare const MAX_REPORT_PAGE = 100;
+/** `?after=&limit=` for a report route; `limit` outside 1 to 100 is refused before sending. */
+export declare function pageQuery(page?: PageOptions): string;
+/** A release's end-of-new-work deadline. */
+export interface ReleaseDeadline {
+    version: string;
+    /** RFC 3339. */
+    after: string;
+    /** Unix seconds. */
+    afterSecs: number;
+}
+/** `GET /releases`: the cluster's release rules, public inside the sealed channel. */
+export interface ReleaseRules {
+    governance: Governance;
+    /** Oldest release first. */
+    deadlines: ReleaseDeadline[];
+}
+/** Semver order (core's `compare_versions`); text order for versions that are not semver. */
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * Whether a scope whose approved set is `approved` has lost new work at `now`
+ * (Unix seconds), as core's `SystemState::stalled` judges it: a release's
+ * deadline has passed and the newest approved release is older. Names the
+ * newest such release, since approving it lifts every one. `null` approved
+ * (unrestricted) is never stalled.
+ */
+export declare function stalledBy(approved: string[] | null, deadlines: ReleaseDeadline[], now?: number): ReleaseDeadline | null;
+/** `GET /publishers/{signerId}`: what a key signs to bind it here next. */
+export interface PublisherBindingInfo {
+    signerId: string;
+    /** The cluster's name, as the binding message names it. */
+    cluster: string;
+    /** How many bindings the key has had here: a signature binds once. */
+    generation: number;
+    bound: boolean;
+}
+/**
+ * The text a package signing key signs to bind it to `org` as its publisher
+ * (core's `system::publisher_binding_message`). Take `cluster` and
+ * `generation` from {@link CalimeroClient.publisherBinding}; sign the UTF-8
+ * bytes with the key's Ed25519 secret and send
+ * {@link CalimeroClient.bindPublisher}.
+ */
+export declare function publisherBindingMessage(cluster: string, org: string, signerId: string, generation: number): string;
+/** {@link publisherBindingMessage} as the bytes to sign. */
+export declare function publisherBindingBytes(cluster: string, org: string, signerId: string, generation: number): Uint8Array;
+/** `POST /orgs/{org}/publishers`: the key's proof, base64url without padding. */
+export interface PublisherProof {
+    signerId: string;
+    /** The Ed25519 public key the `did:key` names. */
+    publicKey: string;
+    /** Its signature over {@link publisherBindingMessage}. */
+    signature: string;
+}
+/** Whose approval a release or outbound request is for. */
+export type ConsentScope = 'account' | {
+    org: string;
+};
+/** What the app asks its user to approve (`POST /consent/requests`). Unknown fields are refused. */
+export type ConsentRequest = {
+    kind: 'release';
+    scope: ConsentScope;
+    /** `withdraw: true` asks to withdraw the release's approval instead of approving it. */
+    subject: {
+        version: string;
+        withdraw?: boolean;
+    };
+    /** Where the page sends the person back: the package's frontend origin, or one its manifest names. */
+    returnTo: string;
+} | {
+    kind: 'upgrade';
+    subject: {
+        app: string;
+        toVersion: string;
+    };
+    returnTo: string;
+} | {
+    kind: 'outbound';
+    scope: ConsentScope;
+    /** `package`: a package-bound session's own when left out; `prefixes`: every one the latest release declares. */
+    subject: {
+        package?: string;
+        prefixes?: string[];
+    };
+    returnTo: string;
+};
+/** The node's answer to a consent request: send the person to `url`. */
+export interface ConsentStarted {
+    requestId: string;
+    /** The consent page, on the node's own origin. */
+    url: string;
+    /** Unix seconds; a request lives 10 minutes. */
+    expiresAt: number;
+}
+export type ConsentStatus = 'pending' | 'approved' | 'declined';
+/** `GET /consent/{id}/result`. */
+export interface ConsentResult {
+    requestId: string;
+    kind: ConsentRequest['kind'];
+    status: ConsentStatus;
+    /** Unix seconds, once decided. */
+    decidedAt: number | null;
+}
+/**
+ * What the consent page put on `returnTo` when it sent the person back, or
+ * `null` when `href` carries none. A hint only (anyone can type a URL): confirm
+ * with {@link CalimeroClient.consentResult} before acting on it.
+ */
+export declare function consentReturn(href: string | URL): {
+    requestId: string;
+    result: 'approved' | 'declined';
+} | null;
+/** The public verifier for mero-tee releases (`attestation-verifier`). */
+export declare const RELEASE_VERIFIER = "https://mero-tee.vercel.app";
+/** A mero-tee release's notes on GitHub. */
+export declare function releaseNotesUrl(version: string): string;
+/** The public verifier's page for a mero-tee release. */
+export declare function verifyReleaseUrl(version: string): string;
+/** A mero-tee release the cluster's nodes run that the scope has not approved. */
+export interface PendingRelease {
+    version: string;
+    /** How many of the cluster's nodes run it. */
+    nodes: number;
+    /** Whether the scope's side holds release approvals (else the operator does). */
+    actionable: boolean;
+    releaseNotesUrl: string;
+    verifyUrl: string;
+    /** Its deadline, when it carries one. */
+    deadline: ReleaseDeadline | null;
+}
+/** An app with newer releases of its package. */
+export interface PendingUpgrade {
+    app: string;
+    name: string | null;
+    package: string;
+    from: string;
+    /** The newest it may move to. */
+    to: string;
+    /** Every newer release it may move to, oldest first. */
+    available: string[];
+    /** Whether owners hold app upgrades on this cluster; the node checks the package's own `upgrades` when asked. */
+    actionable: boolean;
+}
+/** What {@link CalimeroClient.pendingApprovals} answers. */
+export interface PendingApprovals {
+    scope: ReportScope;
+    governance: Governance;
+    approvedReleases: string[] | null;
+    releases: PendingRelease[];
+    upgrades: PendingUpgrade[];
+    /** A passed deadline has stopped new work for the scope: approve `stalledBy.version` (or newer) to lift it. */
+    stalledBy: ReleaseDeadline | null;
+    /** Whether anything here is the user's to approve. */
+    actionable: boolean;
+}
+/**
+ * The pending list from a scope's report pages (every page's apps
+ * concatenated into `report.apps`) and the cluster's release rules.
+ */
+export declare function pendingApprovalsFrom(report: AppsReport, rules: ReleaseRules, now?: number): PendingApprovals;
+/**
+ * The consent request that approves `version` for `scope`, or with
+ * `{ withdraw: true }` withdraws its approval ({@link withdrawConsent}).
+ */
+export declare function releaseConsent(scope: ReportScope, version: string, returnTo: string, options?: {
+    withdraw?: boolean;
+}): ConsentRequest;
+/**
+ * The consent request that withdraws `version`'s approval for `scope`: nodes
+ * on it are then sent none of the scope's apps' data (nothing already there
+ * moves). The page fetches no measurements for it. Withdrawing the scope's
+ * last approved release is refused on the page (`400 REJECTED`, the request
+ * stays pending), and the page warns before.
+ */
+export declare function withdrawConsent(scope: ReportScope, version: string, returnTo: string): ConsentRequest;
+/**
+ * The `release` part of a release request's model, as the consent page reads
+ * it (`GET /consent/{id}/model`, on the node's origin; the app never needs
+ * it). An approval carries the release's signed measurements; a withdrawal
+ * carries none, and says whether the release is approved now and whether it
+ * is the scope's last approved release (which cannot be withdrawn).
+ */
+export type ConsentReleaseModel = {
+    version: string;
+    change: 'approve';
+    alreadyApproved: boolean;
+    approved: unknown;
+    nodes: unknown;
+    profile: string | null;
+    measurements: Record<string, unknown>;
+} | {
+    version: string;
+    change: 'withdraw';
+    currentlyApproved: boolean;
+    lastApproved: boolean;
+    approved: unknown;
+    nodes: unknown;
+    profile: string | null;
+};
+/** The consent request that upgrades `app` to `toVersion`. */
+export declare function upgradeConsent(app: string, toVersion: string, returnTo: string): ConsentRequest;

package/dist/cloud-v2/approvals.js

@@ -0,0 +1,170 @@
+/**
+ * Release and upgrade approvals as core's node reports them, and the consent
+ * page an app sends its user to when one is theirs to make.
+ *
+ * An app never approves in its own page. A passkey assertion is blind (the
+ * authenticator shows a site name, never what the challenge commits to), so
+ * the page that runs the ceremony decides what the person believes they
+ * approve. The node therefore refuses every approval route to a session
+ * opened on an app's frontend, and serves its own **consent page** instead:
+ * the app asks for a request (`POST /consent/requests`), sends the person to
+ * the page's `url` on the node's own origin, and reads the decision when the
+ * page sends them back (`returnTo?request_id=…&result=…`) or from
+ * `GET /consent/{id}/result`. See core's
+ * [consent page](https://calimero-network.github.io/core/protocol/consent-page/)
+ * and [governance](https://calimero-network.github.io/core/protocol/governance/).
+ */
+import { compareReleaseVersions } from '../sealed/release.js';
+/** The most entries one page of a report answers (core's `MAX_REPORT_PAGE`). */
+export const MAX_REPORT_PAGE = 100;
+/** `?after=&limit=` for a report route; `limit` outside 1 to 100 is refused before sending. */
+export function pageQuery(page = {}) {
+    const q = new URLSearchParams();
+    if (page.after !== undefined)
+        q.set('after', page.after);
+    if (page.limit !== undefined) {
+        if (!Number.isInteger(page.limit) || page.limit < 1 || page.limit > MAX_REPORT_PAGE) {
+            throw new RangeError(`limit is 1 to ${MAX_REPORT_PAGE}`);
+        }
+        q.set('limit', String(page.limit));
+    }
+    const s = q.toString();
+    return s ? `?${s}` : '';
+}
+/** Semver order (core's `compare_versions`); text order for versions that are not semver. */
+export function compareVersions(a, b) {
+    try {
+        return compareReleaseVersions(a, b);
+    }
+    catch {
+        return a < b ? -1 : a > b ? 1 : 0;
+    }
+}
+/**
+ * Whether a scope whose approved set is `approved` has lost new work at `now`
+ * (Unix seconds), as core's `SystemState::stalled` judges it: a release's
+ * deadline has passed and the newest approved release is older. Names the
+ * newest such release, since approving it lifts every one. `null` approved
+ * (unrestricted) is never stalled.
+ */
+export function stalledBy(approved, deadlines, now = Date.now() / 1000) {
+    if (approved === null || approved.length === 0)
+        return null;
+    const newest = approved.reduce((a, b) => (compareVersions(a, b) >= 0 ? a : b));
+    let stall = null;
+    for (const d of deadlines) {
+        if (d.afterSecs <= now && compareVersions(newest, d.version) < 0) {
+            if (stall === null || compareVersions(d.version, stall.version) > 0)
+                stall = d;
+        }
+    }
+    return stall;
+}
+/**
+ * The text a package signing key signs to bind it to `org` as its publisher
+ * (core's `system::publisher_binding_message`). Take `cluster` and
+ * `generation` from {@link CalimeroClient.publisherBinding}; sign the UTF-8
+ * bytes with the key's Ed25519 secret and send
+ * {@link CalimeroClient.bindPublisher}.
+ */
+export function publisherBindingMessage(cluster, org, signerId, generation) {
+    return `calimero-publisher-binding/v1\n${cluster}\n${org}\n${signerId}\n${generation}`;
+}
+/** {@link publisherBindingMessage} as the bytes to sign. */
+export function publisherBindingBytes(cluster, org, signerId, generation) {
+    return new TextEncoder().encode(publisherBindingMessage(cluster, org, signerId, generation));
+}
+/**
+ * What the consent page put on `returnTo` when it sent the person back, or
+ * `null` when `href` carries none. A hint only (anyone can type a URL): confirm
+ * with {@link CalimeroClient.consentResult} before acting on it.
+ */
+export function consentReturn(href) {
+    const url = typeof href === 'string' ? new URL(href) : href;
+    const requestId = url.searchParams.get('request_id');
+    const result = url.searchParams.get('result');
+    if (!requestId || (result !== 'approved' && result !== 'declined'))
+        return null;
+    return { requestId, result };
+}
+// ---------------------------------------------------------------- pending
+/** The public verifier for mero-tee releases (`attestation-verifier`). */
+export const RELEASE_VERIFIER = 'https://mero-tee.vercel.app';
+/** A mero-tee release's notes on GitHub. */
+export function releaseNotesUrl(version) {
+    return `https://github.com/calimero-network/mero-tee/releases/tag/mero-tee-v${encodeURIComponent(version)}`;
+}
+/** The public verifier's page for a mero-tee release. */
+export function verifyReleaseUrl(version) {
+    return `${RELEASE_VERIFIER}/mero-tee?release_tag=${encodeURIComponent(`mero-tee-v${version}`)}`;
+}
+/**
+ * The pending list from a scope's report pages (every page's apps
+ * concatenated into `report.apps`) and the cluster's release rules.
+ */
+export function pendingApprovalsFrom(report, rules, now = Date.now() / 1000) {
+    const deadlineOf = (v) => rules.deadlines.find((d) => d.version === v) ?? null;
+    const releasesActionable = report.governance.releases === 'owner';
+    const upgradesActionable = report.governance.appUpgrades === 'owner';
+    const releases = report.clusterReleases
+        .filter((r) => !r.approved)
+        .sort((a, b) => compareVersions(b.release, a.release))
+        .map((r) => ({
+        version: r.release,
+        nodes: r.nodes,
+        actionable: releasesActionable,
+        releaseNotesUrl: releaseNotesUrl(r.release),
+        verifyUrl: verifyReleaseUrl(r.release),
+        deadline: deadlineOf(r.release),
+    }));
+    const upgrades = [];
+    for (const a of report.apps) {
+        const available = a.availableVersions ?? [];
+        if (a.package === null || available.length === 0)
+            continue;
+        upgrades.push({
+            app: a.app,
+            name: a.name ?? null,
+            package: a.package.package,
+            from: a.package.version,
+            to: available[available.length - 1],
+            available,
+            actionable: upgradesActionable,
+        });
+    }
+    return {
+        scope: report.scope,
+        governance: report.governance,
+        approvedReleases: report.approvedReleases,
+        releases,
+        upgrades,
+        stalledBy: stalledBy(report.approvedReleases, rules.deadlines, now),
+        actionable: releases.some((r) => r.actionable) || upgrades.some((u) => u.actionable),
+    };
+}
+/**
+ * The consent request that approves `version` for `scope`, or with
+ * `{ withdraw: true }` withdraws its approval ({@link withdrawConsent}).
+ */
+export function releaseConsent(scope, version, returnTo, options = {}) {
+    return {
+        kind: 'release',
+        scope: scope.kind === 'org' ? { org: scope.org } : 'account',
+        subject: options.withdraw ? { version, withdraw: true } : { version },
+        returnTo,
+    };
+}
+/**
+ * The consent request that withdraws `version`'s approval for `scope`: nodes
+ * on it are then sent none of the scope's apps' data (nothing already there
+ * moves). The page fetches no measurements for it. Withdrawing the scope's
+ * last approved release is refused on the page (`400 REJECTED`, the request
+ * stays pending), and the page warns before.
+ */
+export function withdrawConsent(scope, version, returnTo) {
+    return releaseConsent(scope, version, returnTo, { withdraw: true });
+}
+/** The consent request that upgrades `app` to `toVersion`. */
+export function upgradeConsent(app, toVersion, returnTo) {
+    return { kind: 'upgrade', subject: { app, toVersion }, returnTo };
+}

package/dist/cloud-v2/capabilities.d.ts

@@ -12,7 +12,7 @@ export declare const ORG_CAPABILITIES: {
     readonly JOIN_OPEN_TEAMS: number;
     /** Add and remove a team's members. */
     readonly MANAGE_MEMBERS: number;
-    /** Upgrade the organization's apps, start org upgrade runs, approve outbound hosts (org-wide). */
+    /** Upgrade the organization's apps (and, as a publisher, every instance of its `publisher` packages), start org upgrade runs, approve outbound hosts (org-wide). */
     readonly MANAGE_APPLICATION: number;
     /** Create a top-level team without being an admin. */
     readonly CREATE_TEAM: number;
@@ -22,6 +22,13 @@ export declare const ORG_CAPABILITIES: {
     readonly MANAGE_VISIBILITY: number;
     /** Set the organization's and its teams' metadata. */
     readonly MANAGE_METADATA: number;
+    /**
+     * Approve (or withdraw) the mero-tee releases that hold the apps the
+     * organization governs (those of the packages it publishes, and its own of
+     * unbound packages), and bind a package signing key to it
+     * (`bindPublisher`). Organization-wide only. Bit 9 is left unused.
+     */
+    readonly APPROVE_RELEASES: number;
 };
 export type OrgCapability = keyof typeof ORG_CAPABILITIES;
 /** What a member holds unless an admin says otherwise. */

package/dist/cloud-v2/capabilities.js

@@ -12,7 +12,7 @@ export const ORG_CAPABILITIES = {
     JOIN_OPEN_TEAMS: 1 << 2,
     /** Add and remove a team's members. */
     MANAGE_MEMBERS: 1 << 3,
-    /** Upgrade the organization's apps, start org upgrade runs, approve outbound hosts (org-wide). */
+    /** Upgrade the organization's apps (and, as a publisher, every instance of its `publisher` packages), start org upgrade runs, approve outbound hosts (org-wide). */
     MANAGE_APPLICATION: 1 << 4,
     /** Create a top-level team without being an admin. */
     CREATE_TEAM: 1 << 5,
@@ -22,6 +22,13 @@ export const ORG_CAPABILITIES = {
     MANAGE_VISIBILITY: 1 << 7,
     /** Set the organization's and its teams' metadata. */
     MANAGE_METADATA: 1 << 8,
+    /**
+     * Approve (or withdraw) the mero-tee releases that hold the apps the
+     * organization governs (those of the packages it publishes, and its own of
+     * unbound packages), and bind a package signing key to it
+     * (`bindPublisher`). Organization-wide only. Bit 9 is left unused.
+     */
+    APPROVE_RELEASES: 1 << 10,
 };
 /** What a member holds unless an admin says otherwise. */
 export const DEFAULT_ORG_CAPABILITIES = ORG_CAPABILITIES.JOIN_OPEN_TEAMS;