@terminal3/t3n-sdk 5.23.1 → 5.25.0

package/dist/index.d.ts

@@ -2500,6 +2500,13 @@ interface ActivityEntry {
      * validated one.
      */
     roles?: string[];
+    /**
+     * Labels the contract chose for this call — the `custom` object it returned
+     * in its response, which the node removes from the response and stores on
+     * the entry. Flat string → string, capped node-side. Omitted when the
+     * contract returned none, and always on `denied` / `error`.
+     */
+    custom?: Record<string, string>;
 }
 /**
  * One page of the organisation's activity report — **newest first**, i.e.
@@ -2576,6 +2583,17 @@ interface GetActivityLogOptions {
      * substring, compared case-insensitively. Must not be empty.
      */
     function?: string;
+    /**
+     * Keep only calls whose {@link ActivityEntry.custom} labels carry every one
+     * of these pairs, compared exactly. A call without labels never matches.
+     * Must name at least one key; keys and values must not be empty.
+     */
+    custom?: Record<string, string>;
+    /**
+     * `true` keeps only calls carrying at least one `custom` label, `false` only
+     * those carrying none.
+     */
+    has_custom?: boolean;
 }
 /**
  * Params for a CSV export of the activity log (`exportActivityLog`).
@@ -2610,7 +2628,8 @@ interface ActivityExportFile {
     /**
      * The CSV text, header row first. Columns are fixed: `seq_no`, `timestamp_ms`,
      * `caller_type`, `actor`, `on_behalf_of`, `org`, `contract`, `function`,
-     * `outcome`. For a browser download, wrap it in a `Blob` and click
+     * `outcome`, `custom` (the entry's labels as one JSON object, empty when
+     * none). For a browser download, wrap it in a `Blob` and click
      * an `<a download>` — the response is sealed, so there is no URL to navigate.
      */
     csv: string;
@@ -2822,6 +2841,28 @@ interface DescribeFunctionResult {
  * All cryptographic complexity is handled in WASM components.
  */
 
+/** Input to {@link T3nClient.createDelegatedAgent}. */
+interface CreateDelegatedAgentParams {
+    /**
+     * Label of the node's configured OIDC provider (`Configs[provider:oidc]`)
+     * the token is verified against. Its configured `client_id` is the audience,
+     * so it must be the harness's client.
+     */
+    provider: string;
+    /** The caller's own ID token, issued by `provider` to the harness's client. */
+    harnessIdToken: string;
+    /** OAuth client the agent will authenticate as: the `azp` its tokens carry. */
+    clientId: string;
+    /** Display name, e.g. "Maria's Claude Agent". */
+    name: string;
+}
+/** A delegated per-user agent, as `create-delegated-agent` reports it. */
+interface DelegatedAgent {
+    agentDid: Did;
+    ownerDid: Did;
+    /** The name as stored, which the contract may have truncated. */
+    name: string;
+}
 declare class T3nClient {
     private readonly config;
     private readonly transport;
@@ -3291,6 +3332,36 @@ declare class T3nClient {
         publicCardDeleted: boolean;
         privateCardDeleted: boolean;
     }>;
+    /**
+     * Create the caller's own delegated agent for an AI harness (AI-261).
+     *
+     * Dispatches `create-delegated-agent` on `tee:organisation/contracts`. The
+     * contract verifies `harnessIdToken` in-enclave against `provider`, requires
+     * its identity to belong to the session's DID, and keys the agent on
+     * `(iss, user_id, clientId)`. So the session must be the person's own human
+     * DID, signed in through an OIDC provider, not an agent's or a stray key's.
+     *
+     * Not idempotent: a second call for the same identity and `clientId` is
+     * refused, and {@link revokeDelegatedAgent} is the only way to retire one.
+     *
+     * @throws {RpcError} when the contract refuses (token verification, a token
+     *   belonging to another DID, an existing agent, the per-owner cap)
+     * @throws {ContractResponseError} when the response does not name the agent
+     */
+    createDelegatedAgent(params: CreateDelegatedAgentParams): Promise<DelegatedAgent>;
+    /**
+     * Stop one of the caller's own delegated agents authenticating.
+     *
+     * Dispatches `revoke-delegated-agent` on `tee:organisation/contracts`.
+     * Revocation marks the agent's record; its DID and registry record remain.
+     * Idempotent.
+     *
+     * @throws {RpcError} when the caller owns no delegated agent with that DID
+     * @throws {ContractResponseError} when the response does not name the agent
+     */
+    revokeDelegatedAgent(agentDid: string): Promise<{
+        agentDid: Did;
+    }>;
     /**
      * Provision a fresh org-owned agent.
      *
@@ -3427,6 +3498,8 @@ declare class T3nClient {
      * `did:t3n:<40 hex>` or bare 40 hex.
      */
     private static didToWire;
+    /** Read a DID field (`did:t3n:<40 hex>` or bare hex) from a contract response. */
+    private static didFromResponse;
     /**
      * Resolve the deployed version of `contractId`, refusing before any dispatch
      * when it is older than the caller needs, with a message naming the version the
@@ -6551,4 +6624,4 @@ declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
 export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, detectQuoteVendor, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fanOutGrant, fetchDkgAttestation, fetchMlKemPublicKey, fetchSevSnpCollateral, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isContractAgentCountsResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseContractResponse, parseMemberDelegationDoc, readOnlyScopes, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, sevSnpVcekUrl, stringToBytes, tenantDidHex, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifySevSnpReport, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, ScopeAccessVerb, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetRoleInput, SetWritersInput, SevSnpCollateral, SevSnpVerifyResult, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserInputProfile, UserUpsertErrorKind, Validity, VcekUrlResult, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WireScope, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreateDelegatedAgentParams, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegatedAgent, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, ScopeAccessVerb, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetRoleInput, SetWritersInput, SevSnpCollateral, SevSnpVerifyResult, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserInputProfile, UserUpsertErrorKind, Validity, VcekUrlResult, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WireScope, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };