Glossary

Short definitions for the terms used throughout these docs. For the full protocol-level treatment, see the Calimero Core docs.

Node & runtime

Node / merod : A running Calimero node — the merod process the SDK talks to. It exposes a REST admin API, a JSON-RPC endpoint, and SSE/WebSocket event streams. baseUrl points MeroJs at one.

Application : A WASM bundle installed on a node. Installed from a URL, a dev path, or a registry package. Identified by an application ID. A single bundle can expose multiple services.

Context : A running instance of an application’s shared state — the unit you execute methods against and subscribe to. Has a contextId, a state hash, and DAG heads. For multi-service apps you pick a serviceName when creating one.

Context identity : A keypair representing you within a context. Generated per context; used to join and to sign operations.

Governance

Namespace : An application instance boundary that groups contexts and members under a shared upgrade policy (Automatic or LazyOnAccess). Members are invited into a namespace; it can contain groups and subgroups.

Group : A governance boundary within a namespace — a set of members with roles and capabilities, owning one or more contexts. Groups can have subgroups.

Subgroup : A group nested under a parent group. Subgroups can inherit the parent’s membership and admission policy.

Member / role : A participant in a group, identified by their identity key, with a role and a capability mask.

Capabilities (bitmask) : A u32 bitmask describing what a member may do — create contexts, invite members, manage members/application, manage subgroups/visibility/metadata. The SDK exposes the CAPABILITIES constants and hasCap/withCap/withoutCap helpers. See groups & governance.

Invitation : A signed token that lets a new member join a group or namespace. Can be single-target or recursive (covering subgroups).

Data

Blob : An opaque binary object stored on the node — e.g. an application bundle or app data. Identified by a blobId; the SDK uploads, lists, downloads (raw ArrayBuffer), inspects (HEAD), and deletes them. See blobs.

Alias : A human-readable name mapped to a context, application, or context identity, so you can refer to "my-context" instead of a raw ID.

Metadata : A small key/value record (MetadataRecord) attachable to a group, member, or context — a name plus a Record<string, string>, with updatedAt/updatedBy.

Calls & events

RPC / execute : A JSON-RPC call to /jsonrpc that runs a WASM contract method in a context and returns its decoded output. The SDK’s RpcClient.execute<T>(). See executing methods.

SSE (Server-Sent Events) : The recommended real-time transport — a one-way stream of context events from the node’s /sse endpoint. SseClient / sdk.events.

WebSocket (WS) : An experimental alternative to SSE with the same subscription shape. WsClient / sdk.ws.

Identity & security

Access token / refresh token : The JWT pair returned by login. The access token is attached to every request; the (single-use) refresh token mints a new pair when the access token expires. See the token lifecycle.

Root key : A top-level authentication key registered on the node (e.g. a public key with an auth method). Managed via sdk.auth — list/create/delete and permissions.

Client key : A scoped, derived credential issued under a root key — often bound to a context identity with a narrower permission set.

TEE (Trusted Execution Environment) : Hardware-isolated execution. A group can carry a TEE admission policy (allowed MRTD/RTMR measurements, TCB statuses, whether mock attestation is accepted) controlling which nodes may join. The SDK reads/sets that policy and can attest/verify quotes. See groups & governance.

High Availability (HA) : A cloud-managed redundancy mode for a context’s TEE. Toggled through the redirect-based CloudClient.