@terminal3/t3n-sdk 3.12.7 → 3.14.0

package/dist/index.d.ts

@@ -725,6 +725,29 @@ declare class UserUpsertError extends T3nError {
      */
     static fromWire(raw: string): UserUpsertError | null;
 }
+/** One contract-scoped grant for an agent. Wire form is snake_case
+ *  (`script_name` / `version_req` / `allowed_hosts`); `agentAuthUpdate`
+ *  performs the conversion. */
+interface AgentScriptGrant {
+    scriptName: string;
+    /** SemVer requirement (e.g. `"^1.0.0"`). Omit / null = any version. */
+    versionReq?: string | null;
+    /** Allowed function names. Omit / null = all functions. */
+    functions?: string[] | null;
+    /** Allowed outbound HTTP hosts. Omit = none. */
+    allowedHosts?: string[];
+}
+/** Per-agent authorisation grant binding an agent DID to its script grants. */
+interface AgentGrantInput {
+    agentDid: string;
+    scripts: AgentScriptGrant[];
+}
+/** Input to {@link T3nClient.agentAuthUpdate}. The document IS the new state:
+ *  an empty `agents` list revokes all agent access. Mirrors the contract
+ *  `AgentAuthPolicy`. */
+interface AgentAuthUpdateInput {
+    agents: AgentGrantInput[];
+}
 
 /**
  * Org-data wire types mirroring the org-data contract wire shapes.
@@ -1970,6 +1993,20 @@ declare class T3nClient {
      * @throws {RpcError} for non-typed transport / decode failures.
      */
     submitUserInput(input: SubmitUserInputArgs): Promise<SubmitUserInputResult>;
+    /**
+     * Replace this user's agent-authorisation policy (`tee:user/contracts` →
+     * `agent-auth-update`). The supplied document IS the new state: an empty
+     * `agents` array revokes all agent access.
+     *
+     * Typed wrapper over the raw contract call: callers pass
+     * camelCase input; the SDK emits the canonical snake_case wire
+     * (`agent_did` / `script_name` / `version_req` / `allowed_hosts`), so it no
+     * longer relies on the contract's compatibility aliases.
+     *
+     * @throws {RpcError} if the contract rejects the policy (validation failure,
+     *   too many agents/grants).
+     */
+    agentAuthUpdate(input: AgentAuthUpdateInput): Promise<void>;
     /**
      * Convenience helper: run the explicit OTP roundtrip and submit
      * the slim user-upsert in one call.
@@ -3307,6 +3344,14 @@ interface MapCreateInput {
     tail: string;
     visibility: MapVisibility;
     writers: WriterSet;
+    /**
+     * Who may read the map. **Optional, but omitting it is a footgun:**
+     * the runtime defaults an unspecified `readers` to a *deny-all* policy, so the
+     * map is created successfully yet nobody — not even the creator — can read it,
+     * with no error. `maps.create` emits a `console.warn` when this is omitted.
+     * Set it explicitly: `"all"` for public reads, `{ only: [contractId, ...] }`
+     * to scope reads, or `{ only: [] }` to deliberately make the map write-only.
+     */
     readers?: ReaderSet;
     keyValidator?: unknown;
 }
@@ -3344,6 +3389,17 @@ interface ContractExecuteInput {
     functionName: string;
     input?: unknown;
 }
+/**
+ * Result of a successful {@link TenantContractsNamespace.register} /
+ * {@link TenantContractsNamespace.publish}. Mirrors the tenant contract's
+ * `RegisterResponse` wire shape.
+ */
+interface ContractRegisterResult {
+    /** Canonical `z:<tid>:<tail>` name the contract was registered under. */
+    name: string;
+    /** Stable monotonic numeric contract id assigned at registration time. */
+    contract_id: number;
+}
 
 type JsonObject = Record<string, unknown>;
 interface TenantExecutionSession {
@@ -3416,8 +3472,8 @@ declare class TenantMapsNamespace {
 declare class TenantContractsNamespace {
     private readonly client;
     constructor(client: TenantClient);
-    publish(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<unknown>;
-    register(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<unknown>;
+    publish(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<ContractRegisterResult>;
+    register(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<ContractRegisterResult>;
     disable(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
     enable(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
     unregister(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
@@ -3474,6 +3530,15 @@ declare class TenantClient {
     readonly contracts: TenantContractsNamespace;
     readonly token: TenantTokenNamespace;
     constructor(config: TenantClientConfig);
+    /**
+     * Validate up front that every config field an operation needs is present,
+     * throwing ONE error naming all missing fields instead of
+     * discovering them one runtime error at a time. All `TenantClientConfig`
+     * fields are optional by design (a control-plane-only client legitimately
+     * omits some), so validation is per-operation against that op's true
+     * dependency set — never an eager constructor check.
+     */
+    requireConfig(op: string, fields: Array<keyof TenantClientConfig>): void;
     /**
      * Admit an org-owned tenant via the cluster-admin `tenant.admit-for-org`
      * action.
@@ -3517,4 +3582,4 @@ declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
 export { AGENT_PUBKEY_LEN, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, DELEGATION_CREDENTIAL_DOMAIN, DELEGATION_INVOCATION_DOMAIN, DelegationCustodialClient, ETH_SIG_LEN, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MAX_FUNCTIONS_PER_CREDENTIAL, MockTransport, NODE_URLS, NONCE_LEN, OrgDataClient, OtpRateLimitedError, REQUEST_HASH_LEN, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, VC_ID_LEN, WasmError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildDelegationCredential, buildInvocationPreimage, buildPayrollDirectInvocation, buildPayrollInvocation, bytesToString, canonicalTenantName, canonicaliseCredential, canonicaliseRequest, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, decodeWasmErrorMessage, eip191Digest, ethRecoverEip191, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgWriters, loadConfig, loadWasmComponent, maskKeyMaterial, metamask_get_address, metamask_sign, parseContractResponse, redactSecrets, redactSecretsFromJson, requestHash, revokeDelegation, setEnvironment, setGlobalLogLevel, setNodeUrl, signAgentInvocation, signCredential, stringToBytes, tenantDidHex, toBaseUnits, validateConfig, validateCredentialBody, validateTail, verifyDkgAttestation, verifyTdxQuote };
-export type { AdmitForOrgOptions, AuthInput, BalanceRow, BuildDelegationCredentialOpts, BuildPayrollDirectInvocationOpts, BuildPayrollInvocationOpts, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractPublishInput, ContractResponseSchema, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationCredential, DelegationCustodialClientOpts, DelegationEnvelope, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollInvocation, PayrollInvocationDelegated, PayrollInvocationDirect, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, RevokeDelegationOpts, RevokeDelegationResult, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, SignCustodialResult, SignDelegationResponse, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WriteDataInput, WriterSet, WritersGetInput };
+export type { AdmitForOrgOptions, AgentAuthUpdateInput, AgentGrantInput, AgentScriptGrant, AuthInput, BalanceRow, BuildDelegationCredentialOpts, BuildPayrollDirectInvocationOpts, BuildPayrollInvocationOpts, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationCredential, DelegationCustodialClientOpts, DelegationEnvelope, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollInvocation, PayrollInvocationDelegated, PayrollInvocationDirect, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, RevokeDelegationOpts, RevokeDelegationResult, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, SignCustodialResult, SignDelegationResponse, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WriteDataInput, WriterSet, WritersGetInput };