@terminal3/t3n-sdk 5.1.0 → 5.3.0

package/dist/index.d.ts

@@ -605,6 +605,11 @@ interface QuoteVerifyResult {
     valid: boolean;
     error?: string;
     rtmr3?: string;
+    /**
+     * Base64-encoded RTMR1 (48 bytes). The real rootfs-integrity signal —
+     * see {@link TrustAnchor.rtmr1_allowlist}.
+     */
+    rtmr1?: string;
     report_data?: string;
 }
 interface PeerQuoteResult {
@@ -612,6 +617,8 @@ interface PeerQuoteResult {
     valid: boolean;
     error?: string;
     rtmr3?: string;
+    /** See {@link QuoteVerifyResult.rtmr1}. */
+    rtmr1?: string;
 }
 interface DkgVerifyResult {
     valid: boolean;
@@ -628,7 +635,15 @@ interface DkgVerifyResult {
  * forge a complete, cryptographically-valid bundle for their own key
  * (SP-003). The anchor is the independent ground truth that closes it:
  * the bundle must describe *our* cluster (`expected_peer_ids`) running
- * *our* image (`rtmr3_allowlist`).
+ * *our* image (`rtmr1_allowlist`).
+ *
+ * `rtmr3_allowlist` is checked too, for backward compatibility, but is
+ * **not** the real protection: `tee-init.sh` no longer extends RTMR3
+ * with a content hash, so RTMR3 is a fixed value every
+ * image reports identically. `rtmr1_allowlist` is what actually pins
+ * image identity now — RTMR1 is the TD loader measurement, which under
+ * Trinity's direct-UEFI UKI boot chain captures the UKI PE binary
+ * (embedding the dm-verity root hash in its kernel cmdline).
  */
 interface TrustAnchor {
     /**
@@ -641,9 +656,23 @@ interface TrustAnchor {
      * Base64-encoded 48-byte RTMR3 measurements of the expected node
      * image. Every quote's RTMR3 must be a member. **Must be non-empty.**
      * An array (not a singleton) so a rolling deploy's two in-flight
-     * image measurements both verify.
+     * image measurements both verify. Kept for backward compatibility —
+     * see {@link TrustAnchor} above for why this alone no longer protects
+     * against SP-003.
      */
     rtmr3_allowlist: string[];
+    /**
+     * Base64-encoded 48-byte RTMR1 measurements of the expected node
+     * image. Every quote's RTMR1 must be a member. **Must be non-empty.**
+     * This is the real SP-003 mitigation — see {@link TrustAnchor} above.
+     * Unlike RTMR3's old rolling-deploy-only reason for being an array
+     * (two in-flight image measurements), RTMR1 legitimately needs **more**
+     * entries than that: confirmed empirically, RTMR1 varies by physical
+     * host TDX firmware even for a single, unchanged image, so a fleet's
+     * full firmware diversity — not just old‖new — must all be represented
+     * here.
+     */
+    rtmr1_allowlist: string[];
     /**
      * Optional provenance of the pinned values, for diagnostics only —
      * never passed to the verifier and never part of any security
@@ -684,20 +713,25 @@ declare function isUnsafeTrustServer(anchor: TrustAnchorOrUnsafe): anchor is Uns
  * @param attestationMsgB64 - Base64-encoded attestation message
  *   (for DKG: encaps_key || sorted_peer_id_bytes)
  * @param expectedRtmr3B64 - Optional base64-encoded 48-byte RTMR3
+ * @param expectedRtmr1B64 - Optional base64-encoded 48-byte RTMR1 — the
+ *   real rootfs-integrity signal (see {@link TrustAnchor})
  * @returns Verification result with extracted measurements
  */
-declare function verifyTdxQuote(quoteB64: string, attestationMsgB64: string, expectedRtmr3B64?: string): Promise<QuoteVerifyResult>;
+declare function verifyTdxQuote(quoteB64: string, attestationMsgB64: string, expectedRtmr3B64?: string, expectedRtmr1B64?: string): Promise<QuoteVerifyResult>;
 /**
  * Verify a full DKG attestation bundle against a client-pinned
  * {@link TrustAnchor}: multiple TDX quotes from all participating
  * nodes, plus the binding between the quotes and the ML-KEM
  * encapsulation key. Checks:
- *   1. `expected_peer_ids` / `rtmr3_allowlist` are both non-empty
+ *   1. `expected_peer_ids` / `rtmr3_allowlist` / `rtmr1_allowlist` are
+ *      all non-empty
  *   2. the bundle's `peer_ids` equal the pinned set exactly
  *   3. attestationMsg starts with encapsKey (server can't swap the key)
  *   4. every quote's ECDSA signature chains to Intel's SGX root CA
  *   5. every quote's report_data == keccak512(attestationMsg)
  *   6. every quote's RTMR3 is a member of `rtmr3_allowlist`
+ *   7. every quote's RTMR1 is a member of `rtmr1_allowlist` — the real
+ *      SP-003 mitigation (see {@link TrustAnchor})
  *
  * The anchor is **required**: there is no unauthenticated mode. Callers
  * that genuinely want to trust the server must not call this at all —
@@ -710,7 +744,7 @@ declare function verifyTdxQuote(quoteB64: string, attestationMsgB64: string, exp
  *   (from `/status.dkg_attestation.attestation_msg`)
  * @param peerIds - Base58 peer IDs as reported by the bundle
  * @param quotes - Map of peer_id → base64-encoded TDX quote
- * @param anchor - Client-pinned expected peer IDs + RTMR3 allowlist
+ * @param anchor - Client-pinned expected peer IDs + RTMR allowlists
  * @returns Per-peer verification results and overall validity
  */
 declare function verifyDkgAttestation(encapsKeyB64: string, attestationMsgB64: string, peerIds: string[], quotes: Record<string, string>, anchor: TrustAnchor): Promise<DkgVerifyResult>;
@@ -748,8 +782,9 @@ interface T3nClientConfig {
      * **Required.** Client-pinned trust anchor the node's DKG attestation
      * is verified against before the handshake trusts its ML-KEM key
      * (SP-003). Either a {@link TrustAnchor} (`expected_peer_ids` +
-     * `rtmr3_allowlist`) or the explicit `{ unsafe_trust_server: true }`
-     * opt-out for local dev / mock-signer nodes.
+     * `rtmr1_allowlist` + `rtmr3_allowlist`) or the explicit
+     * `{ unsafe_trust_server: true }` opt-out for local dev / mock-signer
+     * nodes.
      *
      * Without this, a network attacker with their own TDX VM can hand the
      * SDK a forged-but-valid attestation for a key it controls and read
@@ -2426,6 +2461,44 @@ interface GetActivityLogOptions {
      */
     function?: string;
 }
+/**
+ * Params for a CSV export of the activity log (`exportActivityLog`).
+ *
+ * The read's options minus the paging fields: an export walks the whole window
+ * itself, and the node refuses a request carrying either. Nothing caps the size,
+ * so `{}` on a long-lived organisation is a long walk — send a date range.
+ */
+type ExportActivityLogOptions = Omit<GetActivityLogOptions, "limit" | "before_seq">;
+/**
+ * Where an export has got to. Discriminate on `status`; the shape follows it.
+ *
+ * `pending` carries nothing — a half-walked row count is not a fact about the
+ * report. On `failed`, show `reason`: it decides between retrying and narrowing.
+ */
+type ActivityExportStatus = {
+    status: "pending";
+} | {
+    status: "ready";
+    rows: number;
+    bytes: number;
+} | {
+    status: "failed";
+    reason: string;
+};
+/** A finished export, as the node hands it back. */
+interface ActivityExportFile {
+    /** Data rows, excluding the header line. */
+    rows: number;
+    /** Size of {@link csv} in bytes. */
+    bytes: number;
+    /**
+     * The CSV text, header row first. Columns are fixed: `seq_no`, `timestamp_ms`,
+     * `caller_type`, `actor`, `on_behalf_of`, `org`, `contract`, `function`,
+     * `outcome`. For a browser download, wrap it in a `Blob` and click
+     * an `<a download>` — the response is sealed, so there is no URL to navigate.
+     */
+    csv: string;
+}
 
 /**
  * Contract-discovery wire shapes.
@@ -2929,6 +3002,38 @@ declare class T3nClient {
      * ```
      */
     getActivityLog(opts?: GetActivityLogOptions): Promise<ActivityReport>;
+    /**
+     * Start a CSV export of the caller's organisation's activity log, returning
+     * its id. Scope and filters are {@link getActivityLog}'s — the export is that
+     * read walked to exhaustion. Poll {@link getActivityLogExportStatus}, then
+     * {@link downloadActivityLogExport}, or let {@link exportActivityLog} do all
+     * three. A caller who already has one running gets `-32002`.
+     */
+    startActivityLogExport(opts?: ExportActivityLogOptions): Promise<string>;
+    /**
+     * Where one of the caller's own exports has got to. Anyone else's id reads as
+     * absent — an export id is not a capability.
+     */
+    getActivityLogExportStatus(exportId: string): Promise<ActivityExportStatus>;
+    /**
+     * Fetch a finished export — the whole file in one sealed response, so hold the
+     * result rather than re-fetching per render. Fetchable until your next export
+     * replaces it, so a dead transfer retries on the same id; called while the walk
+     * still runs, it throws instead of waiting.
+     */
+    downloadActivityLogExport(exportId: string): Promise<ActivityExportFile>;
+    /**
+     * Export the activity log to CSV: start, poll, return the file. Use the three
+     * calls above instead when the UI must own the polling (to survive a page
+     * reload). Rejects with the node's reason if the export gives up, and on
+     * `timeoutMs` — after which the job keeps running, so the id stays pollable.
+     */
+    exportActivityLog(opts?: ExportActivityLogOptions, poll?: {
+        /** Gap between status polls. Default 1s. */
+        pollIntervalMs?: number;
+        /** Give up waiting after this. Default 5 minutes. */
+        timeoutMs?: number;
+    }): Promise<ActivityExportFile>;
     /**
      * Execute an action with an attached binary blob using multipart RPC.
      */
@@ -5289,7 +5394,9 @@ interface ConfigValidationResult {
  *
  * The SDK's attestation check (see `TrustAnchor`) needs a trusted source
  * for the expected cluster identity — the set of node peer IDs and the
- * allow-listed RTMR3 image measurements. Without a trusted source, every
+ * allow-listed RTMR1/RTMR3 image measurements (RTMR1 is the real rootfs
+ * signal, RTMR3 is kept for backward compatibility — see `TrustAnchor`'s
+ * own doc comment). Without a trusted source, every
  * caller has to hand-pin those values or fall back to
  * `{ unsafe_trust_server: true }`, which disables verification entirely.
  *
@@ -5305,8 +5412,9 @@ interface ConfigValidationResult {
  * can serve any bytes at the manifest URL, but cannot forge a signature
  * for a manifest naming their own node identities/measurements without
  * the operator's private key. The manifest only ever *narrows* trust to
- * the real cluster — it never widens what the on-quote RTMR3 pinning and
- * peer-id set-equality already enforce inside the WASM verifier.
+ * the real cluster — it never widens what the on-quote RTMR1/RTMR3
+ * pinning and peer-id set-equality already enforce inside the WASM
+ * verifier.
  */
 
 /**
@@ -5321,8 +5429,14 @@ interface SignedTrustManifest {
     version: number;
     /** Base58 peer IDs of the expected cluster nodes. */
     peer_ids: string[];
-    /** Base64-encoded 48-byte RTMR3 measurements of the expected image(s). */
+    /**
+     * Base64-encoded 48-byte RTMR3 measurements of the expected image(s).
+     * Kept for backward compatibility — see `TrustAnchor`'s doc comment
+     * for why `rtmr1_allowlist` is the real rootfs-integrity signal.
+     */
     rtmr3_allowlist: string[];
+    /** Base64-encoded 48-byte RTMR1 measurements of the expected image(s). */
+    rtmr1_allowlist: string[];
     /** RFC 3339 timestamp the manifest was signed. */
     signed_at: string;
     /** Hex secp256k1 signature (compact 64-byte r‖s) over the canonical payload. */
@@ -5988,4 +6102,4 @@ declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
 export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };