@terminal3/t3n-sdk 4.40.0 → 4.43.0

package/dist/index.d.ts

@@ -1523,6 +1523,24 @@ declare function mergeGrants(existing: BoundGrant[], additions: BoundGrant[]): G
  * dedupe).
  */
 declare function mergeDiscoverDids(existing: string[], additions: string[]): string[];
+/**
+ * One target for the batch remove-grants op
+ * ({@link T3nClient.removeMemberDelegationGrants}). Mirrors the contract
+ * `RemoveTarget` wire shape verbatim (snake_case): a `grantee` DID and, when
+ * removing a single contract's grant, its `contract_id`.
+ *
+ * Omit `contract_id` to remove the WHOLE delegatee edge — every direct grant to
+ * that grantee plus its discovery authority (the org-owned `roles` slot
+ * survives). The removed ids are opaque: the contract validates nothing, so this
+ * doubles as the cleanup path for a legacy-invalid grant a validating write
+ * could no longer touch.
+ */
+interface RemoveTarget {
+    /** The delegatee (`did:t3n:<40-hex>`) whose grant(s) are being removed. */
+    grantee: string;
+    /** The single contract to drop; omit to remove the whole delegatee edge. */
+    contract_id?: string;
+}
 
 /**
  * Agent-auth grants — the pre-collapse (camelCase) delegation surface, retained
@@ -2322,7 +2340,20 @@ interface ActivityReport {
      */
     next_seq: number | null;
 }
-/** Params for one activity-report page. All optional; `{}` is valid. */
+/**
+ * Params for one activity-report page. All optional; `{}` is valid.
+ *
+ * The row filters (`caller_type`, `outcome`, `did`, `contract`, `function`)
+ * are AND-ed and applied node-side before the page is filled, so `limit` keeps
+ * counting *matching* rows and the cursor keeps its meaning — page a filtered
+ * report exactly as an unfiltered one, resending the same filters with every
+ * `before_seq`. They narrow what comes back, not what the node scans, so short
+ * and empty pages with a live `next_seq` are the normal case under a selective
+ * filter.
+ *
+ * A field the node does not recognise is rejected (400) rather than ignored,
+ * so a filter never silently widens a query back to the whole organisation.
+ */
 interface GetActivityLogOptions {
     /** Window start, Unix ms, inclusive. Defaults to 0 (no lower bound). */
     from_ms?: number;
@@ -2341,6 +2372,31 @@ interface GetActivityLogOptions {
      * the node's own scan cap can trip first. See {@link ActivityReport.next_seq}.
      */
     limit?: number;
+    /** Keep only calls made by an agent, or only those made by a human. */
+    caller_type?: ActivityCallerType;
+    /** Keep only calls that ended in this outcome. */
+    outcome?: ActivityOutcome;
+    /**
+     * Keep only calls this DID took part in — as the {@link ActivityEntry.actor}
+     * that ran them, or as the {@link ActivityEntry.on_behalf_of} owner they ran
+     * for. Both sides match: "what did this agent do" and "what was done in my
+     * name" are the same question from the two ends of one delegation.
+     *
+     * One whole `did:t3n:<40-hex>`. A partial DID is rejected rather than widened
+     * into a prefix search, so a search box should send this only once it holds a
+     * complete DID.
+     */
+    did?: string;
+    /**
+     * Keep only calls whose {@link ActivityEntry.contract} contains this
+     * substring, compared case-insensitively. Must not be empty.
+     */
+    contract?: string;
+    /**
+     * Keep only calls whose {@link ActivityEntry.function} contains this
+     * substring, compared case-insensitively. Must not be empty.
+     */
+    function?: string;
 }
 
 /**
@@ -2816,6 +2872,22 @@ declare class T3nClient {
      *   cursor = page.next_seq ?? undefined;
      * } while (cursor !== undefined);
      * ```
+     *
+     * The optional row filters — `caller_type`, `outcome`, `did`, `contract`,
+     * `function` — are AND-ed node-side and applied before the page is filled, so
+     * they compose freely with each other and with the cursor. Resend the same
+     * filters with every page; changing them mid-walk changes what the cursor
+     * means. Because a filter narrows what comes back rather than what the node
+     * scans, short and empty pages are the normal case — page until `next_seq` is
+     * `null`.
+     *
+     * ```ts
+     * // Everything one agent did, or had done in its name, that was refused.
+     * const denied = await client.getActivityLog({
+     *   did: "did:t3n:8a2fbc8a2fbc8a2fbc8a2fbc8a2fbc8a2fbc8a2f",
+     *   outcome: "denied",
+     * });
+     * ```
      */
     getActivityLog(opts?: GetActivityLogOptions): Promise<ActivityReport>;
     /**
@@ -3451,6 +3523,56 @@ declare class T3nClient {
      * @deprecated Use {@link T3nClient.memberDelegationUpdate}.
      */
     agentAuthUpdate(input: AgentAuthUpdateInput): Promise<void>;
+    /**
+     * Add a batch of grants to the caller's own delegation edges
+     * (`tee:authorisations/contracts` → `member-delegation-add-grants`,
+     * **SelfOnly**). A surgical, additive write: it dispatches the supplied list
+     * as-is and does NOT read-merge — contrast {@link updateMemberDelegation},
+     * which reads the whole document, merges one grant, and writes it back. A
+     * batch of one is a point add; a longer list adds across several delegatees in
+     * one atomic call.
+     *
+     * Each grant is upserted onto its `grantee`'s edge by `contract_id`, so the
+     * delegatee's other contracts' grants survive untouched. Because this never
+     * reads the stored document, a legacy-invalid grant elsewhere in the member's
+     * delegation cannot block the add — but the contract validates every grant in
+     * the submitted batch server-side (grammar, per-delegatee and per-document
+     * caps, validity policy), so one malformed grant rejects the whole batch and
+     * nothing is written.
+     *
+     * The {@link BoundGrant} rows are the flat snake_case wire shape, passed
+     * through verbatim. Each carries the `grantee` DID it authorises and its own
+     * `contract_id`.
+     *
+     * @param grants - the grants to add, each a {@link BoundGrant} naming its
+     *   delegatee `grantee` and target `contract_id`
+     * @param options - optional `discoverDids` unioned onto every touched edge
+     *   (never replaced or cleared) — org DIDs for org-mode `listContracts`, the
+     *   caller's own DID for self mode
+     * @throws {RpcError} if the contract rejects any grant in the batch
+     *   (validation failure, too many delegatees/grants).
+     */
+    addMemberDelegationGrants(grants: BoundGrant[], options?: {
+        discoverDids?: string[];
+    }): Promise<void>;
+    /**
+     * Remove a batch of grants from the caller's own delegation edges
+     * (`tee:authorisations/contracts` → `member-delegation-remove-grants`,
+     * **SelfOnly**). A surgical, subtractive write with no read-merge: it
+     * dispatches the target list as-is. A batch of one is a point removal; a
+     * longer list removes across several delegatees in one atomic call.
+     *
+     * The removed ids are opaque — the contract validates nothing — so this also
+     * clears a legacy-invalid grant (a bad `contract_id`) that a validating write
+     * could no longer touch. Each {@link RemoveTarget} names a `grantee`; supply a
+     * `contract_id` to drop that single contract's grant, or omit it to remove the
+     * whole delegatee edge (its direct grants and discovery authority; the
+     * org-owned `roles` slot survives).
+     *
+     * @param targets - the `(grantee[, contract_id])` targets to remove
+     * @throws {RpcError} if the contract refuses the removal.
+     */
+    removeMemberDelegationGrants(targets: RemoveTarget[]): Promise<void>;
     /**
      * Convenience helper: run the explicit OTP roundtrip and submit
      * the slim user-upsert in one call.
@@ -4064,6 +4186,44 @@ interface DeleteGrantsInput {
     orgDid: string;
     contractId: string;
 }
+/**
+ * Add a batch of org→grantee grants via {@link OrgDataClient.addDelegationGrants}.
+ *
+ * Unlike {@link OrgDelegationSetInput} (a full per-contract replacement), each
+ * grant here self-describes: it carries its own `grantee` and `contract_id`, so
+ * one batch can add grants across several contracts and grantees in a single
+ * atomic call — each touching only the edge it names. The contract validates
+ * only each submitted grant body (never the stored record), so a legacy-invalid
+ * sibling on a target grantee's edge cannot block the add. Org grants confer
+ * only `functions` + `scopes`; the agent-edge qualifiers on {@link BoundGrant}
+ * (`version_req` / `read_scopes` / `allowed_hosts` / `window`) must be left unset
+ * — the contract rejects a grant that sets them.
+ */
+interface OrgDelegationAddGrantsInput {
+    orgDid: string;
+    grants: BoundGrant[];
+}
+/**
+ * One `(grantee, contract_id)` grant to drop via
+ * {@link OrgDataClient.removeDelegationGrants}. Both fields are required — unlike
+ * the member-delegation remove target, the org edge has no whole-delegatee
+ * removal in this batch op. The id is opaque (nothing is validated), so a
+ * legacy-invalid grant can be cleaned up.
+ */
+interface OrgRemoveGrantTarget {
+    grantee: string;
+    contractId: string;
+}
+/**
+ * Remove a batch of org→grantee grants via
+ * {@link OrgDataClient.removeDelegationGrants}. Each target names a
+ * `(grantee, contractId)` pair; the removals span several contracts and grantees
+ * in one atomic call, touching only the edges they name.
+ */
+interface OrgDelegationRemoveGrantsInput {
+    orgDid: string;
+    targets: OrgRemoveGrantTarget[];
+}
 /**
  * Grant or replace the outbound host allow-list an org-owned agent may use
  * while executing one of the org's contracts (org-admin only).
@@ -4389,6 +4549,22 @@ declare class OrgDataClient {
      * @deprecated Use {@link OrgDataClient.setDelegation}.
      */
     setGrants(input: SetGrantsInput): Promise<MutationResponse>;
+    /**
+     * Add a batch of org→grantee grants (org-admin only).
+     *
+     * A surgical, additive write, contrasting {@link setDelegation}'s full
+     * per-contract replacement: each grant carries its own `grantee` and
+     * `contract_id`, so one call adds grants across several contracts and grantees
+     * at once, touching only the edges it names. The contract validates only each
+     * submitted grant body (never the stored record) and persists through a
+     * non-validating edge write, so a legacy-invalid sibling on a target grantee's
+     * edge cannot block the add. The `(org, contract_id)` reverse index is updated
+     * incrementally in the same transaction.
+     *
+     * The {@link BoundGrant} rows are the snake_case wire shape, passed through
+     * verbatim (each already carries its `contract_id`).
+     */
+    addDelegationGrants(input: OrgDelegationAddGrantsInput): Promise<MutationResponse>;
     /**
      * Delete the grant entry for a contract entirely, via the legacy
      * `org-policy-delete-grants` function.
@@ -4396,6 +4572,15 @@ declare class OrgDataClient {
      * @deprecated Use {@link OrgDataClient.deleteDelegation}.
      */
     deleteGrants(input: DeleteGrantsInput): Promise<MutationResponse>;
+    /**
+     * Remove a batch of `(grantee, contract_id)` org grants (org-admin only).
+     *
+     * A surgical, subtractive write: the ids are opaque (nothing is validated, so a
+     * legacy-invalid grant can be cleaned up) and each edge is persisted through a
+     * non-validating write, so a sibling for another contract cannot block the
+     * removal. The reverse index is updated in the same transaction.
+     */
+    removeDelegationGrants(input: OrgDelegationRemoveGrantsInput): Promise<MutationResponse>;
     /**
      * Grant or replace the outbound host allow-list an org-owned agent may use
      * while executing one of the org's contracts (org-admin only).
@@ -4637,12 +4822,16 @@ declare class SessionOrgDataClient {
      * @deprecated Use {@link SessionOrgDataClient.setDelegation}.
      */
     setGrants(input: SetGrantsInput): Promise<MutationResponse>;
+    /** Mirrors {@link OrgDataClient.addDelegationGrants}. */
+    addDelegationGrants(input: OrgDelegationAddGrantsInput): Promise<MutationResponse>;
     /**
      * Mirrors {@link OrgDataClient.deleteGrants}.
      *
      * @deprecated Use {@link SessionOrgDataClient.deleteDelegation}.
      */
     deleteGrants(input: DeleteGrantsInput): Promise<MutationResponse>;
+    /** Mirrors {@link OrgDataClient.removeDelegationGrants}. */
+    removeDelegationGrants(input: OrgDelegationRemoveGrantsInput): Promise<MutationResponse>;
     /**
      * Grant or replace the outbound host allow-list an org-owned agent may use
      * while executing one of the org's contracts (org-admin only).
@@ -5760,4 +5949,4 @@ declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
 export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export type { ActivityCallerType, ActivityEntry, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };