@terminal3/t3n-sdk 5.26.0 → 5.28.0

package/dist/index.d.ts

@@ -1124,8 +1124,8 @@ declare function parseContractResponse<T = unknown>(raw: string, schema?: Contra
 
 /**
  * Delegated agents and the T3N OAuth connections that act as them. Wire types
- * and strict decoders for the `tee:organisation` functions the `T3nClient`
- * wrappers dispatch.
+ * and strict decoders for the functions the `T3nClient` wrappers dispatch:
+ * agents on `tee:organisation`, OAuth connections on `tee:session`.
  */
 
 /**
@@ -2533,8 +2533,20 @@ interface AuditBatch {
      * commit? `false` means the call rolled back or trapped, so an event's
      * `outcome: "success"` in this batch is the contract's *claim*, not a
      * committed fact — filter on this when you need only durable events.
+     * This holds for approval events too (`details.event_type` is
+     * `action.escalated`, `action.reviewed` or `action.executed`): a
+     * rolled-back approver batch can list `action.reviewed` as `success` next
+     * to a failed `action.executed`, so always check `committed`. Events in a
+     * batch share one timestamp and are ordered by their position in `events`.
      */
     committed: boolean;
+    /**
+     * Present when the platform, not a client, started this dispatch, for
+     * example `"hitl-resume:<run id>"` for a call resumed after a human
+     * approval. Absent for a client call. The id after the prefix may itself
+     * contain colons, so do not split on them.
+     */
+    origin?: string;
     events: AuditEvent[];
 }
 /**
@@ -2634,6 +2646,14 @@ interface ActivityEntry {
      * validated one.
      */
     roles?: string[];
+    /**
+     * Present when the node, not the caller, started the call, for example
+     * `"hitl-resume:<run id>"` for the call the node ran as the requester
+     * once an approval was granted. Stamped by the node, never by a contract.
+     * Absent when the caller started the call. The id after the prefix may
+     * itself contain colons, so do not split on them.
+     */
+    origin?: string;
     /**
      * Labels the contract chose for this call — the `custom` object it returned
      * in its response, which the node removes from the response and stores on
@@ -3498,7 +3518,7 @@ declare class T3nClient {
      * What the consent page shows about an OAuth client, before any
      * authorisation. Read only.
      *
-     * Dispatches `oauth-describe-client` on `tee:organisation/contracts`. The
+     * Dispatches `oauth-describe-client` on `tee:session/contracts`. The
      * enclave fetches a CIMD client's metadata document itself and checks
      * `redirectUri` against the client's registration and the operator's
      * policy. On a refusal the page shows the error and does not redirect.
@@ -3512,7 +3532,7 @@ declare class T3nClient {
      * Let an OAuth client act as one of the caller's own T3N agents, and get the
      * one-time code to send back to it.
      *
-     * Dispatches `oauth-authorise` on `tee:organisation/contracts`. The session
+     * Dispatches `oauth-authorise` on `tee:session/contracts`. The session
      * must be a person acting for themselves. The code is bound to the client,
      * the redirect URI, the resource and the PKCE challenge; the client redeems
      * it at the node's token endpoint.
@@ -3527,7 +3547,7 @@ declare class T3nClient {
      * The caller's own OAuth connections, including revoked and expired ones
      * not yet swept. Self only.
      *
-     * Dispatches `list-oauth-connections` on `tee:organisation/contracts`.
+     * Dispatches `list-oauth-connections` on `tee:session/contracts`.
      *
      * @throws {RpcError} when the contract refuses
      * @throws {ContractResponseError} when the response does not match its shape
@@ -3538,7 +3558,7 @@ declare class T3nClient {
      * working at once; an access token already issued runs to its expiry. The
      * agent is untouched. Idempotent.
      *
-     * Dispatches `revoke-oauth-connection` on `tee:organisation/contracts`.
+     * Dispatches `revoke-oauth-connection` on `tee:session/contracts`.
      *
      * @throws {RpcError} when the caller owns no connection with that id
      * @throws {ContractResponseError} when the response does not name the connection