@terminal3/t3n-sdk 4.2.0 → 4.7.0

package/dist/index.d.ts

@@ -1263,6 +1263,7 @@ declare class HttpTransport implements Transport {
  * mockTransport.mockResponse("auth.handshake", { result: "..." });
  *
  * const client = new T3nClient({
+ *   trustAnchor: { unsafe_trust_server: true },
  *   transport: mockTransport,
  *   wasmComponent: mockWasm,
  * });
@@ -1317,6 +1318,112 @@ declare class MockTransport implements Transport {
     send(request: JsonRpcRequest, headers: Record<string, string>): Promise<JsonRpcResponse>;
 }
 
+/**
+ * TDX quote verifier backed by the Rust `signature` crate compiled to
+ * WASM. Full cryptographic verification: ECDSA P-256 attestation-key
+ * signature, PCK certificate chain walk to Intel's root CA, and
+ * report_data + RTMR comparison.
+ *
+ * The WASM bytes are inlined as base64 (see quote_verifier_bytes.ts)
+ * so the SDK works without bundler WASM plugins and without runtime
+ * asset URL resolution.
+ */
+interface QuoteVerifyResult {
+    valid: boolean;
+    error?: string;
+    rtmr3?: string;
+    report_data?: string;
+}
+interface PeerQuoteResult {
+    peer_id: string;
+    valid: boolean;
+    error?: string;
+    rtmr3?: string;
+}
+interface DkgVerifyResult {
+    valid: boolean;
+    results: PeerQuoteResult[];
+    valid_count: number;
+    expected_count: number;
+    error?: string;
+}
+/**
+ * Client-pinned anchor the DKG attestation bundle is verified against.
+ *
+ * Without it, "the server proved it runs in a TEE" only means "*some*
+ * TDX box somewhere" — any attacker with their own TDX cloud VM can
+ * forge a complete, cryptographically-valid bundle for their own key
+ * (SP-003). The anchor is the independent ground truth that closes it:
+ * the bundle must describe *our* cluster (`expected_peer_ids`) running
+ * *our* image (`rtmr3_allowlist`).
+ */
+interface TrustAnchor {
+    /**
+     * Base58 peer IDs the client expects in the cluster. The bundle's
+     * `peer_ids` must equal this set exactly (order-insensitive) — a MITM
+     * cannot substitute its own single-node participant set.
+     */
+    expected_peer_ids: string[];
+    /**
+     * Base64-encoded 48-byte RTMR3 measurements of the expected node
+     * image. Every quote's RTMR3 must be a member. **Must be non-empty.**
+     * An array (not a singleton) so a rolling deploy's two in-flight
+     * image measurements both verify.
+     */
+    rtmr3_allowlist: string[];
+}
+/**
+ * Escape hatch for local dev / tests against a node whose attestation
+ * can't be anchored (e.g. a mock signer that publishes no bundle).
+ *
+ * The name is deliberately alarming so it stands out in code review and
+ * grep — it is the *only* way to skip DKG attestation verification on
+ * the handshake path.
+ */
+interface UnsafeTrustServer {
+    unsafe_trust_server: true;
+}
+type TrustAnchorOrUnsafe = TrustAnchor | UnsafeTrustServer;
+/** Narrow a {@link TrustAnchorOrUnsafe} to the explicit opt-out arm. */
+declare function isUnsafeTrustServer(anchor: TrustAnchorOrUnsafe): anchor is UnsafeTrustServer;
+/**
+ * Verify a single TDX attestation quote with full cryptographic verification.
+ *
+ * @param quoteB64 - Base64-encoded raw TDX v4 quote
+ * @param attestationMsgB64 - Base64-encoded attestation message
+ *   (for DKG: encaps_key || sorted_peer_id_bytes)
+ * @param expectedRtmr3B64 - Optional base64-encoded 48-byte RTMR3
+ * @returns Verification result with extracted measurements
+ */
+declare function verifyTdxQuote(quoteB64: string, attestationMsgB64: string, expectedRtmr3B64?: string): Promise<QuoteVerifyResult>;
+/**
+ * Verify a full DKG attestation bundle against a client-pinned
+ * {@link TrustAnchor}: multiple TDX quotes from all participating
+ * nodes, plus the binding between the quotes and the ML-KEM
+ * encapsulation key. Checks:
+ *   1. `expected_peer_ids` / `rtmr3_allowlist` are both non-empty
+ *   2. the bundle's `peer_ids` equal the pinned set exactly
+ *   3. attestationMsg starts with encapsKey (server can't swap the key)
+ *   4. every quote's ECDSA signature chains to Intel's SGX root CA
+ *   5. every quote's report_data == keccak512(attestationMsg)
+ *   6. every quote's RTMR3 is a member of `rtmr3_allowlist`
+ *
+ * The anchor is **required**: there is no unauthenticated mode. Callers
+ * that genuinely want to trust the server must not call this at all —
+ * see `unsafe_trust_server` on the client config, which branches around
+ * the whole verify path.
+ *
+ * @param encapsKeyB64 - Base64-encoded ML-KEM encapsulation key
+ *   (from `/status.encaps_key`)
+ * @param attestationMsgB64 - Base64-encoded raw attestation message
+ *   (from `/status.dkg_attestation.attestation_msg`)
+ * @param peerIds - Base58 peer IDs as reported by the bundle
+ * @param quotes - Map of peer_id → base64-encoded TDX quote
+ * @param anchor - Client-pinned expected peer IDs + RTMR3 allowlist
+ * @returns Per-peer verification results and overall validity
+ */
+declare function verifyDkgAttestation(encapsKeyB64: string, attestationMsgB64: string, peerIds: string[], quotes: Record<string, string>, anchor: TrustAnchor): Promise<DkgVerifyResult>;
+
 /**
  * Configuration types for T3n Client
  */
@@ -1346,6 +1453,20 @@ interface T3nClientConfig {
     logger?: Logger;
     /** Optional guest-to-host request handlers - provides custom behavior for WASM requests */
     handlers?: GuestToHostHandlers;
+    /**
+     * **Required.** Client-pinned trust anchor the node's DKG attestation
+     * is verified against before the handshake trusts its ML-KEM key
+     * (SP-003). Either a {@link TrustAnchor} (`expected_peer_ids` +
+     * `rtmr3_allowlist`) or the explicit `{ unsafe_trust_server: true }`
+     * opt-out for local dev / mock-signer nodes.
+     *
+     * Without this, a network attacker with their own TDX VM can hand the
+     * SDK a forged-but-valid attestation for a key it controls and read
+     * every session. It is a required field precisely so no caller can
+     * omit it by accident — bypassing verification must be a visible,
+     * grep-able choice.
+     */
+    trustAnchor: TrustAnchorOrUnsafe;
 }
 
 /**
@@ -1452,6 +1573,29 @@ interface AgentAuthEntry {
     agentDid: string;
     scripts: AgentAuthScriptGrant[];
 }
+/**
+ * The full agent-auth policy document in the camelCase write shape:
+ * the per-agent grants plus the document-level discovery grants.
+ *
+ * `discoverDids` (contract wire: `discover_dids`) is the
+ * list of DIDs the user lets their registered agents *enumerate the
+ * contracts of* via `listContracts`: an org DID grants org-mode discovery,
+ * the user's own DID grants self-mode discovery. It lives at document
+ * level — not on a script grant — because discovery must surface contracts
+ * the agent cannot yet call. The node's discovery gate additionally
+ * requires the calling agent to be named in `agents` (subject binding), so
+ * an unregistered agent discovers nothing regardless of this list.
+ */
+interface AgentAuthPolicy {
+    agents: AgentAuthEntry[];
+    discoverDids: string[];
+}
+/**
+ * Parse a full `agent-auth-get` response (the stored snake_case policy
+ * document) into the camelCase write shape, including the document-level
+ * `discover_dids`. A `null` / absent response is the empty policy.
+ */
+declare function parseAgentAuthPolicy(response: unknown): AgentAuthPolicy;
 /** Extract the `agents` array from an `agent-auth-get` response. */
 declare function parseAgentAuthGet(response: unknown): AgentAuthEntry[];
 interface AgentAuthMergeResult {
@@ -1462,27 +1606,42 @@ interface AgentAuthMergeResult {
 }
 /** Input to the full-document write {@link T3nClient.agentAuthUpdate}. The
  *  document IS the new state: an empty `agents` list revokes all agent
- *  access. Mirrors the contract `AgentAuthPolicy`. */
+ *  access, and an omitted / empty `discoverDids` persists an empty
+ *  discovery-grant list (the contract has no per-field merge). Mirrors the
+ *  contract `AgentAuthPolicy`. */
 interface AgentAuthUpdateInput {
     agents: AgentAuthEntry[];
+    /** Document-level discovery grants — see {@link AgentAuthPolicy}. */
+    discoverDids?: string[];
 }
 /**
- * Serialise a camelCase `agents` list to the contract's canonical
+ * Serialise a camelCase policy document to the contract's canonical
  * snake_case `agent-auth-update` wire (`agent_did` / `script_name` /
  * `version_req` / `read_scopes` / `valid_from_secs` / `valid_until_secs` /
- * `allowed_hosts`), so neither write path relies on the contract's
- * compatibility aliases. Absent optionals are omitted (never sent as
- * `null`); empty `scopes` / `read_scopes` are omitted (the contract
- * defaults both to empty). `functions` and `allowed_hosts` are always
- * emitted — the contract requires explicit functions (`["*"]` = all) and
- * reads an absent `allowed_hosts` as deny-all egress.
- */
-declare function toAgentAuthUpdateWire(agents: AgentAuthEntry[]): {
+ * `allowed_hosts` / `discover_dids`), so neither write path relies on the
+ * contract's compatibility aliases. Absent optionals are omitted (never
+ * sent as `null`); empty `scopes` / `read_scopes` are omitted (the
+ * contract defaults both to empty). `functions` and `allowed_hosts` are
+ * always emitted — the contract requires explicit functions (`["*"]` =
+ * all) and reads an absent `allowed_hosts` as deny-all egress. The
+ * document-level `discover_dids` (strictly snake_case — the contract
+ * defines no camelCase alias for it) is emitted only when non-empty; the
+ * contract defaults an absent list to empty.
+ */
+declare function toAgentAuthUpdateWire(agents: AgentAuthEntry[], discoverDids?: string[]): {
     agents: Array<{
         agent_did: string;
         scripts: Array<Record<string, unknown>>;
     }>;
+    discover_dids?: string[];
 };
+/**
+ * Order-preserving deduplicating union of discovery-grant DID lists —
+ * the read-merge-write counterpart of {@link mergeAgentAuthEntries} for
+ * the document-level `discoverDids` (the contract rejects duplicate
+ * entries, so the union must dedupe).
+ */
+declare function mergeDiscoverDids(existing: string[], additions: string[]): string[];
 /**
  * Merge new agent entries into the existing policy with script-level union
  * semantics: for an agent DID present on both sides, script rows whose
@@ -1628,6 +1787,95 @@ declare class KycStatusTimeoutError extends T3nError {
     lastStatus?: KycStatus | undefined);
 }
 
+/**
+ * Contract-discovery wire shapes.
+ *
+ * Field-for-field mirrors of the node's `contracts.list` and `delegation.check`
+ * JSON-RPC responses (`service::contract_discovery::{ListedContract,
+ * ListContractsResponse}` and `service::grant_check::{GrantRef,
+ * GrantCheckResponse}`). Both methods are session-authenticated plaintext reads
+ * dispatched over `/api/rpc` — the same posture as `token.get-usage` — so the
+ * SDK wrappers return the parsed `result` object directly.
+ */
+/** The navigable starting points of the discovery funnel. */
+type ListContractsScope = "core" | "org" | "self";
+/** Params for `contracts.list` (every field optional; `{}` lists core). */
+interface ListContractsParams {
+    /** `"core"` (default) | `"org"` | `"self"`. */
+    scope?: ListContractsScope;
+    /** Target org DID (required for scope `"org"`). */
+    org_did?: string;
+    /** The member the agent acts for (required for scope `"org"` / `"self"`). */
+    pii_did?: string;
+    /** Page offset (defaults to 0 server-side). */
+    offset?: number;
+    /** Page size (defaults + clamped server-side). */
+    limit?: number;
+}
+/** Contract kind — `"core"` platform system contract, `"tenant"` z-space. */
+type ContractKind = "core" | "tenant";
+/** One contract as presented by `contracts.list`. */
+interface ListedContract {
+    /** Canonical name: `tee:<name>` for core, `z:<tid>:<tail>` for tenant. */
+    name: string;
+    kind: ContractKind;
+    /** Current registered version; `null` when the contract is not registered. */
+    version: string | null;
+    /** Descriptor summary, or empty when no descriptor is published. */
+    summary: string;
+    /** Descriptor tags, or empty. */
+    tags: string[];
+    /** Owning DID: the org DID (org mode) or the member's own DID (self mode). */
+    owner_org_did?: string;
+    /**
+     * Human-facing short name: the trailing segment of `name` (`payroll` from
+     * `z:<tid>:payroll`, `user` from `tee:user`). Present this to people instead
+     * of the full canonical `name`, which remains the dispatch key.
+     */
+    short_name: string;
+}
+/** Response body for `contracts.list`. */
+interface ListContractsResult {
+    scope: string;
+    contracts: ListedContract[];
+    next_offset: number | null;
+}
+/** Which standing grant a satisfied/missing entry refers to. */
+type DelegationGrantKind = "agent_auth" | "user_grant";
+/** Params for `delegation.check` (the generic capability read). */
+interface GrantCheckParams {
+    /** The target contract whose requirements are checked. */
+    contract: string;
+    /** The member the agent wants to act for (the subject). */
+    pii_did: string;
+    /** Functions the intended action needs. */
+    functions: string[];
+    /** Org-data scopes the intended action needs. */
+    scopes: string[];
+}
+/** One grant requirement — satisfied or missing. */
+interface DelegationGrantRef {
+    grant: DelegationGrantKind;
+    /** The target contract's canonical name. */
+    contract: string;
+    functions: string[];
+    scopes: string[];
+}
+/**
+ * Response for `delegation.check`: the `agent_auth ∩ UserGrant` verdict.
+ *
+ * `disclosed` is `true` only when the agent is registered under `pii_did`, so
+ * org-side status was safe to disclose; `false` yields the uniform,
+ * non-disclosive verdict (`authorised:false, satisfied:[], missing:[]`) that is
+ * byte-invariant to the requested capability (R5 anti-enumeration).
+ */
+interface GrantCheckResult {
+    authorised: boolean;
+    disclosed: boolean;
+    satisfied: DelegationGrantRef[];
+    missing: DelegationGrantRef[];
+}
+
 /**
  * T3n Client - Main SDK class
  *
@@ -1809,6 +2057,35 @@ declare class T3nClient {
      * server-side handler does not run the encryption layer.
      */
     getUsage(opts?: GetUsageOptions): Promise<UsagePage>;
+    /**
+     * List the caller's discoverable contracts (`contracts.list`) — the
+     * node-backed source for the MCP `listContracts` funnel tool.
+     *
+     * `scope` selects the starting point: `"core"` (curated platform contracts,
+     * the default), `"org"` (one org's contracts — pass `org_did` + `pii_did`),
+     * or `"self"` (the member's own contracts — pass `pii_did`). The acting agent
+     * DID is resolved server-side from the session; org / self modes are
+     * discovery-grant gated and return a uniform, non-disclosive empty page on a
+     * gate miss (R5 anti-enumeration).
+     *
+     * Plaintext session read (like {@link getUsage}): the response carries only
+     * public contract-registry metadata, so it is not sealed.
+     */
+    listContracts(params?: ListContractsParams): Promise<ListContractsResult>;
+    /**
+     * Generic capability check (`delegation.check`) — the
+     * node-backed source for the MCP `checkDelegation` funnel tool.
+     *
+     * Returns the `agent_auth ∩ UserGrant` verdict for `(agent, contract,
+     * pii_did)`: whether the acting agent (resolved from the session) holds the
+     * standing grants that `contract`'s `functions` / `scopes` need for member
+     * `pii_did`. The org half is vacuous for no-org (Individual-owned) targets,
+     * and the verdict is uniform + non-disclosive (`disclosed:false`) when the
+     * agent is not registered under the member (R5 anti-enumeration).
+     *
+     * Plaintext session read (like {@link getUsage}).
+     */
+    checkDelegation(params: GrantCheckParams): Promise<GrantCheckResult>;
     /**
      * Fetch a page of audit events. With no `pii_did`, returns
      * the caller's own audit trail (every actor). With a `pii_did` set to
@@ -1873,10 +2150,12 @@ declare class T3nClient {
      * `tee:user/contracts`, which is **SelfOnly**, so this always returns the
      * caller's own `AGENT_AUTH_MAP[self]` document.
      *
-     * @returns the `agents` entries (normalised to the camelCase write shape)
+     * @returns the full policy document (normalised to the camelCase write
+     *   shape): the per-agent `agents` entries plus the document-level
+     *   `discoverDids` discovery grants
      * @throws if the session is not authenticated, or the contract refuses
      */
-    getAgentAuth(): Promise<AgentAuthEntry[]>;
+    getAgentAuth(): Promise<AgentAuthPolicy>;
     /**
      * Authorise an agent for one contract on the caller's own behalf
      * (envelope-free authorisation). Read-merge-writes the
@@ -1893,13 +2172,24 @@ declare class T3nClient {
      * parameters for. The caller MUST be the delegating user, authenticated as
      * themselves — only they may create their own grant.
      *
+     * The document-level `discoverDids` discovery grants ride the same
+     * read-merge-write: the existing list is always carried forward (the
+     * contract persists the whole document, so dropping it here would revoke
+     * standing discovery), and any `options.discoverDids` are unioned in
+     * (order-preserving, deduplicated).
+     *
      * @param agentDid - the agent DID being authorised
      * @param grant - the single script grant to set (contract, functions,
      *   scopes, validity, egress hosts)
+     * @param options - optional `discoverDids` to union into the document's
+     *   discovery grants (org DIDs for org-mode `listContracts`, the caller's
+     *   own DID for self mode)
      * @returns the script rows preserved from the existing policy (audit aid)
      * @throws if the session is not authenticated, or the contract refuses
      */
-    updateAgentAuth(agentDid: string, grant: AgentAuthScriptGrant): Promise<{
+    updateAgentAuth(agentDid: string, grant: AgentAuthScriptGrant, options?: {
+        discoverDids?: string[];
+    }): Promise<{
         preservedRows: string[];
     }>;
     /**
@@ -2151,15 +2441,18 @@ declare class T3nClient {
     /**
      * Replace this user's agent-authorisation policy (`tee:user/contracts` →
      * `agent-auth-update`). The supplied document IS the new state: an empty
-     * `agents` array revokes all agent access. This is the full-document
+     * `agents` array revokes all agent access, and an omitted `discoverDids`
+     * persists an empty discovery-grant list. This is the full-document
      * write — use {@link T3nClient.updateAgentAuth} for the single-grant
-     * read-merge-write that preserves other contracts' grants.
+     * read-merge-write that preserves other contracts' grants and the
+     * standing discovery grants.
      *
      * Typed wrapper over the raw contract call: callers pass camelCase input;
      * the SDK emits the canonical snake_case wire via
      * {@link toAgentAuthUpdateWire} (carrying `scopes` / `read_scopes` /
-     * validity alongside `functions` / `allowed_hosts`), so it does not rely
-     * on the contract's compatibility aliases.
+     * validity alongside `functions` / `allowed_hosts`, plus the
+     * document-level `discover_dids`), so it does not rely on the contract's
+     * compatibility aliases.
      *
      * @throws {RpcError} if the contract rejects the policy (validation failure,
      *   too many agents/grants).
@@ -2398,8 +2691,9 @@ declare function metamask_get_address(): Promise<string>;
 declare function eth_get_address(privateKey: string): string;
 /**
  * Create an MlKemPublicKey handler that lazily fetches the root public key
- * from `${baseUrl}/status` on first invocation and caches the encoded
- * response for subsequent calls.
+ * from `${baseUrl}/status` on first invocation, verifies it against the
+ * DKG attestation trust anchor (SP-003), and caches the encoded response
+ * for subsequent calls.
  *
  * @param baseUrl - **Required**. The node URL whose `/status` endpoint should
  *                  serve the ML-KEM public key. Must be the same URL the
@@ -2411,8 +2705,12 @@ declare function eth_get_address(privateKey: string): string;
  *                  hit the wrong node. Three downstream consumers (demo.ts,
  *                  t3-apps dev wallet hooks, t3n-mcp session manager) all
  *                  hit this trap before we tightened the type.
+ * @param trustAnchor - **Required**. Client-pinned expected peer IDs +
+ *                  RTMR3 allowlist the DKG bundle is verified against, or
+ *                  `{ unsafe_trust_server: true }` to skip verification.
+ *                  The key is only cached/returned once verification passes.
  */
-declare function createMlKemPublicKeyHandler(baseUrl: string): GuestToHostHandler;
+declare function createMlKemPublicKeyHandler(baseUrl: string, trustAnchor: TrustAnchorOrUnsafe): GuestToHostHandler;
 /**
  * Create Random handler backed by crypto.getRandomValues
  * Note: The Rust Vec<u8> type serializes as an array of bytes, not a base64 string
@@ -2423,8 +2721,11 @@ declare function createRandomHandler(): GuestToHostHandler;
  *
  * @param baseUrl - **Required**. Forwarded to `createMlKemPublicKeyHandler`
  *                  so the lazy /status fetch hits the right node.
+ * @param trustAnchor - **Required**. Forwarded to the ML-KEM handler so the
+ *                  fetched key is verified against the DKG attestation
+ *                  (SP-003) before the handshake trusts it.
  */
-declare function createDefaultHandlers(baseUrl: string): GuestToHostHandlers;
+declare function createDefaultHandlers(baseUrl: string, trustAnchor: TrustAnchorOrUnsafe): GuestToHostHandlers;
 
 /**
  * Payroll request shapes + shared encoding utilities.
@@ -2650,6 +2951,17 @@ interface OrgDataClientOptions extends ExecuteOrgDataActionOptions {
      * header (e.g. the staging Cloud Armor bypass token).
      */
     headers?: Record<string, string>;
+    /**
+     * **Required.** Trust anchor for the internal `T3nClient`'s DKG
+     * attestation check (SP-003). Mirrors `T3nClientConfig.trustAnchor`:
+     * either a pinned {@link TrustAnchor} or the explicit
+     * `{ unsafe_trust_server: true }` opt-out. Required (no silent default)
+     * so bypassing verification is always a visible, grep-able choice —
+     * an authenticated ETH-key caller is still MITM-able on the ML-KEM key.
+     * Signed trust-anchor manifests are not published yet, so most callers
+     * pass `{ unsafe_trust_server: true }` today.
+     */
+    trustAnchor: TrustAnchorOrUnsafe;
 }
 /**
  * Client for session-authenticated org-data contract execution.
@@ -2666,7 +2978,7 @@ declare class OrgDataClient {
     private readonly userDid;
     private readonly opts;
     private clientPromise;
-    constructor(baseUrl: string, ethSecret: Uint8Array, userDid: string, opts?: OrgDataClientOptions);
+    constructor(baseUrl: string, ethSecret: Uint8Array, userDid: string, opts: OrgDataClientOptions);
     private getAuthenticatedClient;
     private initialiseClient;
     private call;
@@ -2866,6 +3178,46 @@ declare function formatTokens(baseUnits: number | bigint): string;
  */
 declare function toBaseUnits(tokens: number): number;
 
+/** Closed-vocabulary serialisation annotations for a contract function's body. */
+interface WireBlock {
+    /**
+     * Field paths whose values are emitted as decimal strings. A path ending in
+     * `.*` applies to every value of the named object/array (e.g.
+     * `historical_baselines.*`).
+     */
+    u64_as_string?: string[];
+    /**
+     * Byte fields carried as typed strings. The value is passed through when it
+     * is already a string; a byte input (`Uint8Array` or a `number[]` of octets)
+     * is encoded per its kind.
+     */
+    string_encoded?: Record<string, StringEncoding>;
+}
+/** The closed set of `string_encoded` field kinds. */
+type StringEncoding = "did" | "address" | "hash";
+/**
+ * Raised when a `wire` block asks for a projection the closed vocabulary cannot
+ * express — an unrepresentable value for a declared field. It signals a
+ * descriptor↔contract mismatch on the author's side, so callers surface it as a
+ * terminal `unsupported_wire_encoding` rather than retrying.
+ */
+declare class WireEncodingError extends T3nError {
+    readonly field: string;
+    readonly encoding?: StringEncoding | undefined;
+    constructor(message: string, field: string, encoding?: StringEncoding | undefined);
+}
+type JsonRecord = Record<string, unknown>;
+/**
+ * Project `args` into the plain-args body a z-space contract deserialises,
+ * applying the descriptor's `wire` annotations. Returns a new object; `args` is
+ * never mutated. With no `wire` block the body is returned unchanged (the
+ * JSON-plain path).
+ *
+ * @throws {WireEncodingError} when a declared field holds a value the
+ *   vocabulary cannot express.
+ */
+declare function requestToWire(args: JsonRecord, wire?: WireBlock): JsonRecord;
+
 /**
  * Cryptographic utilities for T3n SDK
  *
@@ -2991,65 +3343,6 @@ interface ConfigValidationResult {
     errors: string[];
 }
 
-/**
- * TDX quote verifier backed by the Rust `signature` crate compiled to
- * WASM. Full cryptographic verification: ECDSA P-256 attestation-key
- * signature, PCK certificate chain walk to Intel's root CA, and
- * report_data + RTMR comparison.
- *
- * The WASM bytes are inlined as base64 (see quote_verifier_bytes.ts)
- * so the SDK works without bundler WASM plugins and without runtime
- * asset URL resolution.
- */
-interface QuoteVerifyResult {
-    valid: boolean;
-    error?: string;
-    rtmr3?: string;
-    report_data?: string;
-}
-interface PeerQuoteResult {
-    peer_id: string;
-    valid: boolean;
-    error?: string;
-    rtmr3?: string;
-}
-interface DkgVerifyResult {
-    valid: boolean;
-    results: PeerQuoteResult[];
-    valid_count: number;
-    expected_count: number;
-    error?: string;
-}
-/**
- * Verify a single TDX attestation quote with full cryptographic verification.
- *
- * @param quoteB64 - Base64-encoded raw TDX v4 quote
- * @param attestationMsgB64 - Base64-encoded attestation message
- *   (for DKG: encaps_key || sorted_peer_id_bytes)
- * @param expectedRtmr3B64 - Optional base64-encoded 48-byte RTMR3
- * @returns Verification result with extracted measurements
- */
-declare function verifyTdxQuote(quoteB64: string, attestationMsgB64: string, expectedRtmr3B64?: string): Promise<QuoteVerifyResult>;
-/**
- * Verify a full DKG attestation bundle: multiple TDX quotes from all
- * participating nodes, plus the binding between the quotes and the
- * ML-KEM encapsulation key. Checks:
- *   1. attestationMsg starts with encapsKey (server can't swap the key)
- *   2. Every quote's ECDSA signature chains to Intel's SGX root CA
- *   3. Every quote's report_data == keccak512(attestationMsg)
- *   4. Optional RTMR3 pinning per quote
- *
- * @param encapsKeyB64 - Base64-encoded ML-KEM encapsulation key
- *   (from `/status.encaps_key`)
- * @param attestationMsgB64 - Base64-encoded raw attestation message
- *   (from `/status.dkg_attestation.attestation_msg`)
- * @param peerIds - Sorted array of base58 peer IDs
- * @param quotes - Map of peer_id → base64-encoded TDX quote
- * @param expectedRtmr3B64 - Optional base64-encoded 48-byte RTMR3
- * @returns Per-peer verification results and overall validity
- */
-declare function verifyDkgAttestation(encapsKeyB64: string, attestationMsgB64: string, peerIds: string[], quotes: Record<string, string>, expectedRtmr3B64?: string): Promise<DkgVerifyResult>;
-
 /**
  * Configuration validation for T3n SDK
  */
@@ -3262,6 +3555,22 @@ interface ContractPublishInput {
      */
     source_hash?: string;
 }
+/**
+ * Input for `TenantContractsNamespace.setDescriptor`: publish the agent-facing
+ * descriptor document for an already-registered contract version via
+ * `tee:tenant/contracts.set-descriptor`.
+ */
+interface ContractSetDescriptorInput {
+    tail: string;
+    /** Semver the descriptor is bound to; the `name@version` must already be registered. */
+    version: string;
+    /**
+     * The descriptor document — contract-level metadata plus a non-empty
+     * `functions` array of function descriptors — embedded as JSON and stored
+     * verbatim at the version-scoped `:descriptor` sidecar.
+     */
+    descriptor: unknown;
+}
 interface ContractExecuteInput {
     version: string;
     functionName: string;
@@ -3293,6 +3602,7 @@ interface ExecuteBusinessContractOptions<T = unknown> {
 type TenantMapCreateInput = MapCreateInput;
 type TenantMapUpdatePatch = MapUpdateInput;
 type TenantContractPublishInput = ContractPublishInput;
+type TenantContractSetDescriptorInput = ContractSetDescriptorInput;
 type TenantContractExecuteInput = ContractExecuteInput;
 /**
  * Options shared by the `tee:tenant` management calls that accept an optional
@@ -3352,6 +3662,15 @@ declare class TenantContractsNamespace {
     constructor(client: TenantClient);
     publish(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<ContractRegisterResult>;
     register(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<ContractRegisterResult>;
+    /**
+     * Publish the agent-facing descriptor document for a registered
+     * `name@version` via `set-descriptor`. Owner-gated by the
+     * same tenant-resolution rules as `register`, and refused when the
+     * `name@version` is not registered. The node serves the stored document as
+     * the sole descriptor source for the MCP dispatch funnel, so a contract
+     * without one is not dispatchable through it.
+     */
+    setDescriptor(input: ContractSetDescriptorInput, opts?: TenantTargetOptions): Promise<unknown>;
     disable(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
     enable(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
     unregister(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
@@ -3459,5 +3778,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createWorkloadAuthInput, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgWriters, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, metamask_get_address, metamask_sign, parseAgentAuthGet, parseContractResponse, redactSecrets, redactSecretsFromJson, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
-export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createWorkloadAuthInput, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgWriters, isUnsafeTrustServer, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
+export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };