@terminal3/t3n-sdk 4.0.4 → 4.2.0

package/dist/index.d.ts

@@ -282,7 +282,8 @@ declare enum SessionStatus {
 declare enum AuthMethod {
     Ethereum = "eth",
     OIDC = "oidc",
-    EmailOtp = "email_otp"
+    EmailOtp = "email_otp",
+    Workload = "workload"
 }
 /**
  * OIDC credentials interface.
@@ -344,16 +345,42 @@ interface EmailOtpAuthInput extends BaseAuthInput {
     method: AuthMethod.EmailOtp;
     credentials: EmailOtpCredentials;
 }
+/**
+ * Workload authentication input (keyless hosted-agent auth).
+ *
+ * Unlike {@link OidcAuthInput}, this is a SINGLE-call flow: there is no
+ * session-binding nonce and no `InitOidcAuth` round-trip. The caller
+ * supplies a pre-fetched OIDC **workload** `idToken` (the agent's own
+ * machine identity — its `(iss, sub)`) directly by value, and the node
+ * verifies it and mints/resolves the DID `oidc:<iss>:<sub>` server-side
+ * via a single `SubmitWorkloadToken` action.
+ *
+ * The token is carried by value (not behind a `getIdToken(nonce)`
+ * callback like {@link OidcCredentials}) because callers re-source a
+ * fresh token per session open — `id_token`s expire, so nothing here
+ * should be cached across sessions.
+ */
+interface WorkloadAuthInput extends BaseAuthInput {
+    method: AuthMethod.Workload;
+    provider: string;
+    idToken: string;
+}
 /**
  * Union type for all supported authentication inputs
  */
-type AuthInput = EthAuthInput | OidcAuthInput | EmailOtpAuthInput;
+type AuthInput = EthAuthInput | OidcAuthInput | EmailOtpAuthInput | WorkloadAuthInput;
 /**
  * Helper functions to create auth inputs
  */
 declare function createEthAuthInput(address: string, options?: EthAuthOptions): EthAuthInput;
 declare function createOidcAuthInput(credentials: OidcCredentials): OidcAuthInput;
 declare function createEmailOtpAuthInput(credentials: EmailOtpCredentials): EmailOtpAuthInput;
+/**
+ * Build a keyless workload auth input from a pre-fetched OIDC workload
+ * `id_token`. Single-call (no nonce round-trip); the token must be the
+ * agent's OWN machine identity — see {@link WorkloadAuthInput}.
+ */
+declare function createWorkloadAuthInput(provider: string, idToken: string): WorkloadAuthInput;
 
 /**
  * Error classes for T3n SDK
@@ -1713,6 +1740,35 @@ declare class T3nClient {
      *    returns `Finish { did }`.
      */
     private authenticateOidc;
+    /**
+     * Parse a `Finish { did }` reply shared by the manual (non-WASM) auth flows
+     * that bypass the client state machine (interactive OIDC, keyless workload).
+     *
+     * Validates the `oidc_auth_action` tag before reading `did`: a decodable but
+     * non-`Finish` reply is reported as such rather than silently misread as a
+     * missing DID (which would discard whatever the server actually said). Returns
+     * the session {@link Did}.
+     */
+    private parseFinishDid;
+    /**
+     * Workload (keyless hosted-agent) single-call authentication.
+     *
+     * A hosted agent authenticates with its OWN OIDC workload identity —
+     * a machine `id_token` whose `(iss, sub)` the caller has already
+     * fetched — forwarded through this transport by value. Distinct from
+     * the interactive {@link authenticateOidc} flow: there is NO
+     * session-binding nonce and NO `InitOidcAuth` round-trip. We make a
+     * SINGLE encrypted RPC call:
+     *
+     * 1. `SubmitWorkloadToken { provider, id_token }` → the node verifies
+     *    the token and mints/resolves the DID `oidc:<iss>:<sub>` →
+     *    returns `Finish { did }`.
+     *
+     * Bypasses the WASM client state machine (mirrors `authenticateOidc` /
+     * `authenticateEmailOtp`); the `SubmitWorkloadToken` action tag is
+     * matched server-side.
+     */
+    private authenticateWorkload;
     /**
      * Email-OTP two-step authentication.
      *
@@ -3403,5 +3459,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgWriters, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, metamask_get_address, metamask_sign, parseAgentAuthGet, parseContractResponse, redactSecrets, redactSecretsFromJson, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
-export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WriteDataInput, WriterSet, WritersGetInput };
+export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createWorkloadAuthInput, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgWriters, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, metamask_get_address, metamask_sign, parseAgentAuthGet, parseContractResponse, redactSecrets, redactSecretsFromJson, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
+export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };