@terminal3/t3n-sdk 4.26.0 → 4.28.0

package/dist/index.d.ts

@@ -1681,6 +1681,15 @@ interface ActivityEntry {
     function: string;
     /** success / denied / error — host-stamped from the dispatch result. */
     outcome: ActivityOutcome;
+    /**
+     * Role ids the acting authority carried at call time: the actor's role in
+     * the organisation on a self-call, the roles the owner granted the agent on
+     * a delegated call. Omitted when the authority carried no role (direct
+     * grants, an individual, or an entry recorded before roles were captured).
+     * On a `denied` entry this is the caller's *claimed* authority, not a
+     * validated one.
+     */
+    roles?: string[];
 }
 /**
  * One page of the organisation's activity report — **newest first**, i.e.
@@ -3315,6 +3324,67 @@ interface DataListResponse {
 }
 /** Shallow runtime guard for {@link DataListResponse}. */
 declare function isDataListResponse(value: unknown): value is DataListResponse;
+/** Secret shape discriminator (mirrors the contract `SecretKind`). */
+type SecretKind = "single_value" | "json";
+/** Metadata common to every {@link SecretView} entry. */
+interface SecretViewBase {
+    /** Secret name (the `(org, name)` key tail). */
+    name: string;
+    /** Monotonic version, bumped on each value rotation and ACL edit. */
+    version: number;
+    /** Unix seconds of the most recent write. */
+    updated_at_secs: number;
+}
+/**
+ * The redacted per-secret summary `org-secret-list` returns — a discriminated
+ * union on `kind`. The value is NEVER present: a single-value exposes only its
+ * last four characters and a json secret only its sorted top-level field names.
+ */
+type SecretView = (SecretViewBase & {
+    kind: "single_value";
+    /** Last four characters of the value (whole value when ≤ 4 chars). */
+    last4: string;
+}) | (SecretViewBase & {
+    kind: "json";
+    /** Sorted top-level object field names (keys only, no values). */
+    field_names: string[];
+});
+/** Shallow runtime guard for {@link SecretView}. */
+declare function isSecretView(value: unknown): value is SecretView;
+/**
+ * Full secret record returned by `org-secret-get` — the value IS included
+ * (the deliberate read-back path the READ axis exists for), along with all
+ * three ACLs.
+ */
+interface SecretRecord {
+    name: string;
+    kind: SecretKind;
+    /** The value as text: the scalar for a single-value, canonical JSON object for a json secret. */
+    value: string;
+    version: number;
+    /** READ axis — DIDs allowed to read the value back. */
+    reader_dids: string[];
+    /** READ axis — role ids allowed to read the value back. */
+    reader_roles: string[];
+    /** MANAGE axis — DIDs allowed to rotate the value. */
+    manager_dids: string[];
+    /** MANAGE axis — role ids allowed to rotate the value. */
+    manager_roles: string[];
+    /** USE axis — canonical contract ids allowed to have the value injected. */
+    contract_allowlist: string[];
+    created_at_secs: number;
+    updated_at_secs: number;
+    /** DID of the caller who last wrote the record. */
+    updated_by: string;
+}
+/** Shallow runtime guard for {@link SecretRecord}. */
+declare function isSecretRecord(value: unknown): value is SecretRecord;
+/** Response for `org-secret-list`: redacted per-kind views, no values. */
+interface SecretListResponse {
+    secrets: SecretView[];
+}
+/** Shallow runtime guard for {@link SecretListResponse}. */
+declare function isSecretListResponse(value: unknown): value is SecretListResponse;
 /** Response for `org-data-get`. */
 interface DataGetResponse {
     entry_id: string;
@@ -3436,6 +3506,47 @@ interface DeleteGrantsInput {
     orgDid: string;
     contractId: string;
 }
+/**
+ * Create or replace a secret and its three ACLs (org-admin only). `value` is
+ * optional on a replace — omitting it preserves the stored bytes so an admin
+ * can edit the ACLs without handling the secret; it is required on first
+ * create. `contractAllowlist` is the USE axis: canonical contract ids allowed
+ * to have the value injected into an outbound call.
+ */
+interface SecretWriteInput {
+    orgDid: string;
+    name: string;
+    kind: SecretKind;
+    /** The value (scalar for `single_value`; JSON object text for `json`). */
+    value?: string;
+    readerDids?: string[];
+    readerRoles?: string[];
+    managerDids?: string[];
+    managerRoles?: string[];
+    contractAllowlist?: string[];
+}
+/** Rotate a secret's value only (manager-gated; ACLs untouched). */
+interface SecretSetValueInput {
+    orgDid: string;
+    name: string;
+    value: string;
+}
+/** Read (`org-secret-get`) or delete (`org-secret-delete`) a secret by name. */
+interface SecretNameInput {
+    orgDid: string;
+    name: string;
+}
+/** List an org's secrets (`org-secret-list`). */
+interface SecretListInput {
+    orgDid: string;
+}
+/**
+ * Build the snake_case `org-secret-write` wire body from the camelCase input:
+ * the value is omitted on an ACL-only replace (so the contract preserves the
+ * stored bytes), and each ACL / allowlist list defaults to empty. Exported so
+ * the input-shape test can assert the mapping directly.
+ */
+declare function buildSecretWriteArgs(input: SecretWriteInput): Record<string, unknown>;
 interface SetRoleInput {
     orgDid: string;
     role: RoleDefinition;
@@ -3636,6 +3747,20 @@ declare class OrgDataClient {
      * Scope names are canonicalised to lowercase before storage.
      */
     setWriters(input: SetWritersInput): Promise<MutationResponse>;
+    /**
+     * Create or replace an org secret and its three ACLs (org-admin only). Omit
+     * `value` on a replace to edit the ACLs without handling the secret; it is
+     * required on first create.
+     */
+    secretWrite(input: SecretWriteInput): Promise<MutationResponse>;
+    /** Rotate a secret's value only (manager-gated; ACLs untouched). */
+    secretSetValue(input: SecretSetValueInput): Promise<MutationResponse>;
+    /** Read a secret's value and metadata (reader-gated). */
+    secretGet(input: SecretNameInput): Promise<SecretRecord>;
+    /** List the org's secrets as redacted per-kind views (no values). */
+    secretList(input: SecretListInput): Promise<SecretView[]>;
+    /** Delete a secret entirely (org-admin only). */
+    secretDelete(input: SecretNameInput): Promise<MutationResponse>;
     /**
      * Full replacement of the user-grant list for a contract.
      *
@@ -3817,6 +3942,16 @@ declare class SessionOrgDataClient {
     updateMeta(input: UpdateMetaInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.setWriters}. */
     setWriters(input: SetWritersInput): Promise<MutationResponse>;
+    /** Mirrors {@link OrgDataClient.secretWrite}. */
+    secretWrite(input: SecretWriteInput): Promise<MutationResponse>;
+    /** Mirrors {@link OrgDataClient.secretSetValue}. */
+    secretSetValue(input: SecretSetValueInput): Promise<MutationResponse>;
+    /** Mirrors {@link OrgDataClient.secretGet}. */
+    secretGet(input: SecretNameInput): Promise<SecretRecord>;
+    /** Mirrors {@link OrgDataClient.secretList}. */
+    secretList(input: SecretListInput): Promise<SecretView[]>;
+    /** Mirrors {@link OrgDataClient.secretDelete}. */
+    secretDelete(input: SecretNameInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.setGrants}. */
     setGrants(input: SetGrantsInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.deleteGrants}. */
@@ -4803,5 +4938,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, invoke, isAgentCardResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, invoke, isAgentCardResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
+export type { ActivityCallerType, ActivityEntry, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };