@terminal3/t3n-sdk 4.16.0 → 4.17.0

package/dist/index.d.ts

@@ -1883,11 +1883,9 @@ declare class T3nClient {
      * Like {@link getAuditEvents} / {@link execute}, this runs the
      * session-payload encryption: balance and ledger history are
      * self-only data, so the request params and response are sealed to
-     * the session key rather than sent plaintext over TLS. (Transitional:
-     * the node still accepts the legacy plaintext shape during the
-     * staggered rollout, so a leaked `Session-Id` alone is not fully
-     * de-fanged on this endpoint until the sealed shape becomes
-     * mandatory.)
+     * the session key rather than sent plaintext over TLS. The node
+     * **requires** the sealed shape — a bare `Session-Id` without a blob
+     * that opens under the session key is rejected.
      */
     getUsage(opts?: GetUsageOptions): Promise<UsagePage>;
     /**
@@ -1897,10 +1895,9 @@ declare class T3nClient {
      * session-payload encryption: the balance is self-only data, so the
      * request (an empty sealed blob showing possession of the session
      * key) and the response are sealed to the session key rather than
-     * sent plaintext over TLS. (Transitional: the node still accepts the
-     * legacy plaintext shape during the staggered rollout.) Prefer this
-     * over reading `getUsage().balance` when only the credit row is
-     * needed.
+     * sent plaintext over TLS. The node **requires** the sealed shape — a
+     * bare `Session-Id` is not enough. Prefer this over reading
+     * `getUsage().balance` when only the credit row is needed.
      */
     getBalance(): Promise<BalanceRow>;
     /**
@@ -2007,15 +2004,19 @@ declare class T3nClient {
      * returned exactly once here and is never persisted or recoverable
      * afterwards, so the caller must capture it immediately.
      *
-     * Atomic registration + card hosting: pass `options.agentUri` and the
-     * SAME transaction also writes the agent-registry record (URI + the
-     * org's publish-consent link, born together) and — unless
-     * `options.defaultCard === false` — hosts a PRIVATE card for the new
-     * agent in the org's `agent-cards` scope. The card body is
+     * Atomic provisioning + card hosting: the SAME transaction mints the
+     * agent, writes the agent-registry record (owner binding + the org's
+     * publish-consent link), and — unless `options.defaultCard === false` —
+     * hosts a PRIVATE card in the org's `agent-cards` scope. The card body is
      * `options.card` when given (object or pre-serialised JSON string);
      * otherwise the CONTRACT builds and hosts its default (which can even
      * name the agent DID, minted inside the same transaction).
      *
+     * `options.agentUri` is **optional**: a T3N-hosted card is served at
+     * `/api/agent-card/<did>`, so an agent needs no external URI. Pass one
+     * only to record an external endpoint in the DID document's
+     * `AgentService`; the card is hosted either way.
+     *
      * The card is deliberately NOT published: an org-bound agent must not
      * become world-discoverable as a side effect of provisioning. Publish
      * explicitly with `agentCardPublish` (one call — the consent link