@terminal3/t3n-sdk 4.10.1 → 4.12.0

package/dist/index.d.ts

@@ -939,8 +939,9 @@ declare function parseContractResponse<T = unknown>(raw: string, schema?: Contra
  * `AGENT_AUTH_MAP` is keyed by the *user* DID — one policy document per
  * user, global across orgs, with at most one entry per agent DID. Reads
  * (`agent-auth-get`) and writes (`agent-auth-update`) on
- * `tee:user/contracts` are **SelfOnly**: only the user, authenticated as
- * themselves, may read or write their own grants. This is the user-approval
+ * `tee:authorisations/contracts` (the policy's owning contract) are
+ * **SelfOnly**: only the user, authenticated as themselves, may read or
+ * write their own grants. This is the user-approval
  * proof the per-call delegation credential's `user_sig` used to carry.
  *
  * The write shape gained `scopes` + a validity window: the
@@ -1974,8 +1975,9 @@ declare class T3nClient {
     /**
      * Read the authenticated user's own agent-auth policy — the standing
      * grants delegated to agents. Dispatches `agent-auth-get` on
-     * `tee:user/contracts`, which is **SelfOnly**, so this always returns the
-     * caller's own `AGENT_AUTH_MAP[self]` document.
+     * `tee:authorisations/contracts` (the policy's owning contract), which is
+     * **SelfOnly**, so this always returns the caller's own
+     * `AGENT_AUTH_MAP[self]` document.
      *
      * @returns the full policy document (normalised to the camelCase write
      *   shape): the per-agent `agents` entries plus the document-level
@@ -2044,6 +2046,14 @@ declare class T3nClient {
      * implicit.
      */
     private executeUserContract;
+    /**
+     * Same glue as {@link executeUserContract}, parameterised over the
+     * target system contract — the agent-auth wrappers dispatch on
+     * `tee:authorisations/contracts` (the authorisation policy's owning
+     * contract) while the rest of the user-contract surface stays on
+     * `tee:user/contracts`.
+     */
+    private executeSystemContract;
     /**
      * Return the authenticated user's Ethereum address from their
      * T3N-hosted per-user wallet, as a 0x-prefixed lowercase hex string.
@@ -2701,6 +2711,20 @@ interface OrgPolicyView {
 }
 /** Shallow runtime guard for {@link OrgPolicyView}. */
 declare function isOrgPolicyView(value: unknown): value is OrgPolicyView;
+/**
+ * Caller-scoped admin status returned by `org-am-i-admin`.
+ *
+ * Reports only whether the **calling** session's DID is in the org's admin
+ * list — never the roster itself (contrast {@link OrgPolicyMeta}, returned by
+ * the admin-gated `org-policy-get`). Readable by any authenticated session.
+ * Mirrors the org-data `AmIAdminResponse` wire shape.
+ */
+interface OrgAdminStatus {
+    /** Whether the calling session is an admin of the queried org. */
+    is_admin: boolean;
+}
+/** Shallow runtime guard for {@link OrgAdminStatus}. */
+declare function isOrgAdminStatus(value: unknown): value is OrgAdminStatus;
 /**
  * Standard response returned by all policy write and data mutation operations.
  *
@@ -3046,6 +3070,17 @@ declare class OrgDataClient {
      * without needing admin access.
      */
     policyView(input: PolicyGetInput): Promise<OrgPolicyView>;
+    /**
+     * Whether the calling session is an admin of the given org.
+     *
+     * Composes with {@link T3nClient.myOrgs} to classify the caller's role per
+     * org: `myOrgs()` lists the orgs the caller belongs to; this reports
+     * admin-vs-plain-member for one of them. Unlike {@link policyGet} it is not
+     * admin-gated — it discloses only the caller's own standing (a single bool),
+     * never the admin roster — so a plain member gets `false` rather than a
+     * `NotOrgAdmin` error. Returns `false` when the org has no policy.
+     */
+    amIAdmin(input: PolicyGetInput): Promise<boolean>;
     /** Read the writer list for a scope (admin-only). */
     writersGet(input: WritersGetInput): Promise<OrgWriters>;
     /** Read the grant list for a contract (admin-only). */
@@ -3121,6 +3156,8 @@ declare class SessionOrgDataClient {
     policyGet(input: PolicyGetInput): Promise<OrgPolicyMeta>;
     /** Mirrors {@link OrgDataClient.policyView}. */
     policyView(input: PolicyGetInput): Promise<OrgPolicyView>;
+    /** Mirrors {@link OrgDataClient.amIAdmin}. */
+    amIAdmin(input: PolicyGetInput): Promise<boolean>;
     /** Mirrors {@link OrgDataClient.writersGet}. */
     writersGet(input: WritersGetInput): Promise<OrgWriters>;
     /** Mirrors {@link OrgDataClient.grantsGet}. */
@@ -3942,5 +3979,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isUnsafeTrustServer, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
-export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isUnsafeTrustServer, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
+export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };