@terminal3/t3n-sdk 4.19.0 → 4.22.0

package/dist/index.d.ts

@@ -1997,12 +1997,15 @@ declare class T3nClient {
      * standard authenticated `action.execute` path. The node injects the
      * caller's DID into the contract call context, and the contract refuses
      * unless the caller is listed as an admin of `organisationDid`. A brand
-     * new secp256k1 wallet is minted in-TEE for the agent; its eth-derived
-     * DID and its raw private key are both returned. The private key is the
-     * "authentication token" the MCP sidecar uses to authenticate as this
-     * agent (the existing `PRIVATE_KEY` eth auth mode) — it is generated and
-     * returned exactly once here and is never persisted or recoverable
-     * afterwards, so the caller must capture it immediately.
+     * new secp256k1 wallet is minted in-TEE for the agent (its eth-derived
+     * DID is returned), but the raw private key never leaves the TEE.
+     * Instead the contract mints an opaque bearer API key —
+     * `t3n_key_<key_id_hex>.<secret_hex>` — and returns it plus its `keyId`
+     * (the 16-hex lookup id). The `apiKey` is the credential relayed verbatim
+     * in the `X-T3N-Api-Key` header of a stateless `POST /api/invoke` call; only
+     * its hash is stored on-ledger, so it is generated and returned exactly
+     * once here and is never persisted or recoverable afterwards — the caller
+     * must capture it immediately.
      *
      * Atomic provisioning + card hosting: the SAME transaction mints the
      * agent, writes the agent-registry record (owner binding + the org's
@@ -2027,8 +2030,8 @@ declare class T3nClient {
      *   (`did:t3n:<40-hex>`); the caller must be one of its admins
      * @param name - human-readable agent name (1..=128 bytes)
      * @param options - optional atomic registration + card hosting
-     * @returns the new agent's DID and its one-time private key, plus
-     *   `agentUri` / `cardEntryId` (the hosted PRIVATE card's entry id)
+     * @returns the new agent's DID and its one-time opaque `apiKey` + `keyId`,
+     *   plus `agentUri` / `cardEntryId` (the hosted PRIVATE card's entry id)
      *   when the atomic path ran
      * @throws if the session is not authenticated, or if the contract
      *   refuses (e.g. the caller is not an admin of `organisationDid`, the
@@ -2041,7 +2044,8 @@ declare class T3nClient {
         defaultCard?: boolean;
     }): Promise<{
         agentDid: Did;
-        privateKey: string;
+        apiKey: string;
+        keyId: string;
         agentUri?: string;
         cardEntryId?: string;
     }>;
@@ -2784,6 +2788,123 @@ declare function createRandomHandler(): GuestToHostHandler;
  */
 declare function createDefaultHandlers(baseUrl: string, trustAnchor: TrustAnchorOrUnsafe): GuestToHostHandlers;
 
+/**
+ * Stateless `api_key` agent auth.
+ *
+ * `invoke` posts once to `POST /api/invoke` — an HTTPS-only
+ * endpoint (see the HTTPS-guard note below) that authenticates an org agent
+ * by an opaque API key (`X-T3N-Api-Key: t3n_key_<...>`) and executes a
+ * `z:` contract as that agent in the SAME request. Unlike
+ * {@link T3nClient.execute}, there is **no** ML-KEM handshake, **no**
+ * `Session-Id`, and **no** session state: the node derives the acting agent
+ * DID from the relayed key per-call (`resolve_stateless_credential`
+ * driving the session contract's `api_key` action), then runs the same
+ * execute pipeline `action.execute` runs after `check_authentication`
+ * (`ActionService::execute_as_did`), and returns the contract's decoded
+ * result as a plain `Json(result)` body — NOT a JSON-RPC envelope.
+ *
+ * Because the response is the bare decoded value (no `{jsonrpc,result,id}`
+ * wrapper to unwrap), decoding reuses {@link parseContractResponse} — the
+ * exact same JSON.parse + optional-schema path {@link T3nClient.executeAndDecode}
+ * uses for the session `execute` RPC — so callers get identical typed /
+ * schema-validated decoding on either path.
+ *
+ * This module intentionally does NOT import {@link T3nClient}, the WASM
+ * component loader, or any handshake/session machinery — `invoke` is
+ * a single fetch, nothing else.
+ *
+ * ### HTTPS guard (CodeRabbit T2)
+ * The API key is a long-lived bearer credential relayed in a plain header,
+ * so `invoke` refuses to send it over an insecure transport: `baseUrl`
+ * must be `https:`, unless the host is a local-dev loopback
+ * (`localhost` / `127.0.0.1` / `[::1]`), in which case plain `http:` is
+ * allowed. The check runs before any network activity — an insecure
+ * `baseUrl` never gets as far as a `fetch` call.
+ *
+ * ### Error hygiene (CodeRabbit T3/T4/T5)
+ * Every error `invoke` throws is a fixed, generic
+ * {@link InvokeError} message — the response body text, the
+ * underlying network error's message, and the api key are never
+ * interpolated into it. This is defense in depth against a server (or a
+ * malicious intermediary) that echoes the key or other secrets back in an
+ * error body: whatever comes back over the wire on a non-2xx response is
+ * discarded, not surfaced. The timeout timer also stays armed until the
+ * response body has been fully read (or has itself timed out) — see
+ * {@link invoke}'s implementation — so a connection that delivers
+ * headers and then stalls on the body still respects `timeoutMs`.
+ */
+
+/**
+ * Wire body for `POST /api/invoke` — mirrors the server's
+ * server-side `ExecuteActionRequest`, the same shape
+ * `T3nClient`'s `execute*` wrappers build for the session `action.execute`
+ * RPC. Field names are load-bearing: the server deserialises strictly into
+ * `script_name` / `script_version` / `function_name` (see
+ * `T3nClient.executeSystemContract`'s doc comment) — `contract` / `version`
+ * / `function` produce a 400.
+ */
+interface InvokeRequest {
+    script_name: string;
+    script_version: string;
+    function_name: string;
+    /** Delegated-call target member; omitted for a self (non-delegated) call. */
+    pii_did?: string;
+    input?: unknown;
+}
+/** Options for {@link invoke}. */
+interface InvokeOptions {
+    /**
+     * RPC base URL of the T3n node, e.g. `https://node.example.com`. Must be
+     * `https:` unless the host is a local-dev loopback (`localhost` /
+     * `127.0.0.1` / `[::1]`) — see the module doc comment's HTTPS-guard note.
+     */
+    baseUrl: string;
+    /**
+     * The agent's opaque API key (`t3n_key_<...>`), relayed verbatim in the
+     * `X-T3N-Api-Key` header. Never logged and never interpolated into any
+     * error this module throws — see the module doc comment and
+     * {@link InvokeError}.
+     */
+    apiKey: string;
+    /** The wire request to execute, built to the {@link InvokeRequest} shape. */
+    request: InvokeRequest;
+    /** Fetch timeout in ms. Defaults to 30s, matching {@link HttpTransport}. */
+    timeoutMs?: number;
+}
+/**
+ * Thrown when `POST /api/invoke` fails at the transport or HTTP
+ * layer (network failure, timeout, non-2xx status). Contract-level errors
+ * the node returns as a 2xx JSON error value are NOT wrapped here — they
+ * flow through {@link parseContractResponse}'s normal return, same as the
+ * session `execute` path.
+ *
+ * The message is always one of a small set of fixed, generic strings — it
+ * NEVER contains the raw api key, the response body text, or the
+ * underlying network error's message (CodeRabbit T4/T5): a server (or a
+ * misbehaving intermediary) that echoes the key or other secrets back in
+ * an error body must not be able to leak them through this error's
+ * message.
+ */
+declare class InvokeError extends T3nError {
+    readonly status?: number | undefined;
+    constructor(message: string, status?: number | undefined);
+}
+/**
+ * Execute a `z:` contract as an org agent, authenticating with an opaque
+ * API key — one request, no handshake, no session.
+ *
+ * @param opts - baseUrl, apiKey, and the wire request to execute
+ * @param schema - optional validator applied to the decoded result (e.g. a
+ *   zod schema); anything exposing `.parse(value)` is accepted, same as
+ *   {@link T3nClient.executeAndDecode}
+ * @returns the contract's decoded result, typed as `T`
+ * @throws {InvokeError} if `baseUrl` is insecure, on a network
+ *   failure/timeout, or on a non-2xx response
+ * @throws {ContractResponseError} if the node returns a 2xx with a body
+ *   that is not valid JSON
+ */
+declare function invoke<T = unknown>(opts: InvokeOptions, schema?: ContractResponseSchema<T>): Promise<T>;
+
 /**
  * Token fixed-point units (USDT-style 6 decimals).
  *
@@ -3898,6 +4019,116 @@ interface ConfigValidationResult {
     errors: string[];
 }
 
+/**
+ * Operator-signed trust-manifest distribution.
+ *
+ * The SDK's attestation check (see `TrustAnchor`) needs a trusted source
+ * for the expected cluster identity — the set of node peer IDs and the
+ * allow-listed RTMR3 image measurements. Without a trusted source, every
+ * caller has to hand-pin those values or fall back to
+ * `{ unsafe_trust_server: true }`, which disables verification entirely.
+ *
+ * A trust manifest is a small JSON document published by the cluster
+ * operator to a public URL (a GCS bucket) and signed with the operator's
+ * secp256k1 key. Its public half is baked into the SDK per environment
+ * (`OPERATOR_PUBLIC_KEYS`). `fetchTrustedManifest(env)` fetches the
+ * manifest, verifies the signature against the pinned operator key, and
+ * returns a {@link TrustAnchor} that plugs straight into
+ * `T3nClientConfig.trustAnchor`.
+ *
+ * Trust model: the operator key is the root of trust. A network attacker
+ * can serve any bytes at the manifest URL, but cannot forge a signature
+ * for a manifest naming their own node identities/measurements without
+ * the operator's private key. The manifest only ever *narrows* trust to
+ * the real cluster — it never widens what the on-quote RTMR3 pinning and
+ * peer-id set-equality already enforce inside the WASM verifier.
+ */
+
+/**
+ * The signed payload an operator publishes. `signature` covers every
+ * other field (see {@link canonicalManifestBytes}); it is excluded from
+ * its own signing input.
+ */
+interface SignedTrustManifest {
+    /** Environment the manifest describes (e.g. `"production"`). */
+    cluster: string;
+    /** Monotonic manifest version; lets a client reject a rolled-back manifest. */
+    version: number;
+    /** Base58 peer IDs of the expected cluster nodes. */
+    peer_ids: string[];
+    /** Base64-encoded 48-byte RTMR3 measurements of the expected image(s). */
+    rtmr3_allowlist: string[];
+    /** RFC 3339 timestamp the manifest was signed. */
+    signed_at: string;
+    /** Hex secp256k1 signature (compact 64-byte r‖s) over the canonical payload. */
+    signature: string;
+}
+/** The payload fields the signature covers — the manifest minus `signature`. */
+type TrustManifestPayload = Omit<SignedTrustManifest, "signature">;
+/**
+ * Verify a manifest's signature against an operator public key (hex
+ * compressed secp256k1). Returns `true` iff the signature is valid for
+ * the manifest's canonical payload. Never throws on a bad signature —
+ * malformed inputs (non-hex key/signature) return `false`.
+ */
+declare function verifyManifestSignature(manifest: SignedTrustManifest, operatorPublicKeyHex: string): boolean;
+/** Project a verified manifest onto the `TrustAnchor` the client pins. */
+declare function manifestToTrustAnchor(manifest: SignedTrustManifest): TrustAnchor;
+/** Options for {@link fetchTrustedManifest}. */
+interface FetchTrustedManifestOptions {
+    /**
+     * Override the node base URL the manifest is fetched from (defaults to
+     * the environment's `NODE_URLS` entry). Use for a private-cloud cluster
+     * on a custom host — the manifest is served at `<baseUrl>/api/trust-manifest`.
+     */
+    baseUrl?: string;
+    /**
+     * Override the full manifest URL outright (takes precedence over
+     * `baseUrl`). Primarily for tests and non-standard deployments.
+     */
+    manifestUrl?: string;
+    /**
+     * Override the operator public key (hex compressed secp256k1). Defaults
+     * to the SDK-pinned key for the environment. Primarily for tests.
+     */
+    operatorPublicKeyHex?: string;
+    /**
+     * Reject any manifest whose `version` is below this floor, even when its
+     * signature is valid. Pass this when the application persists the last
+     * accepted version across restarts — it closes the rollback window the
+     * in-process high-water mark cannot cover (a fresh process trusts the
+     * first manifest it sees).
+     */
+    minVersion?: number;
+}
+/** Reset the per-environment rollback floor. Useful in tests. */
+declare function clearManifestVersionFloor(): void;
+/**
+ * Fetch and verify the operator-signed trust manifest for an environment,
+ * returning a {@link TrustAnchor} ready to pass as
+ * `T3nClientConfig.trustAnchor`.
+ *
+ * Throws if the environment has no pinned operator key (the manifest
+ * infrastructure is not provisioned for it yet), if the manifest cannot
+ * be fetched or is malformed, if the signature does not verify against
+ * the pinned operator key, or if the manifest's `version` is below the
+ * rollback floor (see {@link FetchTrustedManifestOptions.minVersion}).
+ * It never returns an unverified anchor.
+ *
+ * Deliberately uncached (unlike the ML-KEM `keyCache`): the manifest is
+ * re-published on deploys and this function is expected to run once per
+ * application startup, not per handshake. Fetch it once, keep the
+ * returned anchor for the process lifetime, and re-fetch only when a
+ * handshake starts failing verification (a sign the cluster rolled).
+ *
+ * The manifest is served by the node itself at `/api/trust-manifest`
+ * (there is no external bucket) — same origin as the node the anchor
+ * describes. That co-location does not weaken the trust: authenticity is
+ * the operator signature verified against the SDK-pinned key, and the
+ * monotonic version floor rejects replays of an old signed manifest.
+ */
+declare function fetchTrustedManifest(env: Environment, opts?: FetchTrustedManifestOptions): Promise<TrustAnchor>;
+
 /**
  * Configuration validation for T3n SDK
  */
@@ -4384,5 +4615,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isAgentCardResponse, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isUnsafeTrustServer, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
-export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AssignRolesInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetRoleInput, SetWritersInput, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, invoke, isAgentCardResponse, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
+export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AssignRolesInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };