@terminal3/t3n-sdk 4.3.0 → 4.8.0

package/dist/index.d.ts

@@ -1573,6 +1573,29 @@ interface AgentAuthEntry {
     agentDid: string;
     scripts: AgentAuthScriptGrant[];
 }
+/**
+ * The full agent-auth policy document in the camelCase write shape:
+ * the per-agent grants plus the document-level discovery grants.
+ *
+ * `discoverDids` (contract wire: `discover_dids`) is the
+ * list of DIDs the user lets their registered agents *enumerate the
+ * contracts of* via `listContracts`: an org DID grants org-mode discovery,
+ * the user's own DID grants self-mode discovery. It lives at document
+ * level — not on a script grant — because discovery must surface contracts
+ * the agent cannot yet call. The node's discovery gate additionally
+ * requires the calling agent to be named in `agents` (subject binding), so
+ * an unregistered agent discovers nothing regardless of this list.
+ */
+interface AgentAuthPolicy {
+    agents: AgentAuthEntry[];
+    discoverDids: string[];
+}
+/**
+ * Parse a full `agent-auth-get` response (the stored snake_case policy
+ * document) into the camelCase write shape, including the document-level
+ * `discover_dids`. A `null` / absent response is the empty policy.
+ */
+declare function parseAgentAuthPolicy(response: unknown): AgentAuthPolicy;
 /** Extract the `agents` array from an `agent-auth-get` response. */
 declare function parseAgentAuthGet(response: unknown): AgentAuthEntry[];
 interface AgentAuthMergeResult {
@@ -1583,27 +1606,42 @@ interface AgentAuthMergeResult {
 }
 /** Input to the full-document write {@link T3nClient.agentAuthUpdate}. The
  *  document IS the new state: an empty `agents` list revokes all agent
- *  access. Mirrors the contract `AgentAuthPolicy`. */
+ *  access, and an omitted / empty `discoverDids` persists an empty
+ *  discovery-grant list (the contract has no per-field merge). Mirrors the
+ *  contract `AgentAuthPolicy`. */
 interface AgentAuthUpdateInput {
     agents: AgentAuthEntry[];
+    /** Document-level discovery grants — see {@link AgentAuthPolicy}. */
+    discoverDids?: string[];
 }
 /**
- * Serialise a camelCase `agents` list to the contract's canonical
+ * Serialise a camelCase policy document to the contract's canonical
  * snake_case `agent-auth-update` wire (`agent_did` / `script_name` /
  * `version_req` / `read_scopes` / `valid_from_secs` / `valid_until_secs` /
- * `allowed_hosts`), so neither write path relies on the contract's
- * compatibility aliases. Absent optionals are omitted (never sent as
- * `null`); empty `scopes` / `read_scopes` are omitted (the contract
- * defaults both to empty). `functions` and `allowed_hosts` are always
- * emitted — the contract requires explicit functions (`["*"]` = all) and
- * reads an absent `allowed_hosts` as deny-all egress.
- */
-declare function toAgentAuthUpdateWire(agents: AgentAuthEntry[]): {
+ * `allowed_hosts` / `discover_dids`), so neither write path relies on the
+ * contract's compatibility aliases. Absent optionals are omitted (never
+ * sent as `null`); empty `scopes` / `read_scopes` are omitted (the
+ * contract defaults both to empty). `functions` and `allowed_hosts` are
+ * always emitted — the contract requires explicit functions (`["*"]` =
+ * all) and reads an absent `allowed_hosts` as deny-all egress. The
+ * document-level `discover_dids` (strictly snake_case — the contract
+ * defines no camelCase alias for it) is emitted only when non-empty; the
+ * contract defaults an absent list to empty.
+ */
+declare function toAgentAuthUpdateWire(agents: AgentAuthEntry[], discoverDids?: string[]): {
     agents: Array<{
         agent_did: string;
         scripts: Array<Record<string, unknown>>;
     }>;
+    discover_dids?: string[];
 };
+/**
+ * Order-preserving deduplicating union of discovery-grant DID lists —
+ * the read-merge-write counterpart of {@link mergeAgentAuthEntries} for
+ * the document-level `discoverDids` (the contract rejects duplicate
+ * entries, so the union must dedupe).
+ */
+declare function mergeDiscoverDids(existing: string[], additions: string[]): string[];
 /**
  * Merge new agent entries into the existing policy with script-level union
  * semantics: for an agent DID present on both sides, script rows whose
@@ -1749,6 +1787,95 @@ declare class KycStatusTimeoutError extends T3nError {
     lastStatus?: KycStatus | undefined);
 }
 
+/**
+ * Contract-discovery wire shapes.
+ *
+ * Field-for-field mirrors of the node's `contracts.list` and `delegation.check`
+ * JSON-RPC responses (`service::contract_discovery::{ListedContract,
+ * ListContractsResponse}` and `service::grant_check::{GrantRef,
+ * GrantCheckResponse}`). Both methods are session-authenticated plaintext reads
+ * dispatched over `/api/rpc` — the same posture as `token.get-usage` — so the
+ * SDK wrappers return the parsed `result` object directly.
+ */
+/** The navigable starting points of the discovery funnel. */
+type ListContractsScope = "core" | "org" | "self";
+/** Params for `contracts.list` (every field optional; `{}` lists core). */
+interface ListContractsParams {
+    /** `"core"` (default) | `"org"` | `"self"`. */
+    scope?: ListContractsScope;
+    /** Target org DID (required for scope `"org"`). */
+    org_did?: string;
+    /** The member the agent acts for (required for scope `"org"` / `"self"`). */
+    pii_did?: string;
+    /** Page offset (defaults to 0 server-side). */
+    offset?: number;
+    /** Page size (defaults + clamped server-side). */
+    limit?: number;
+}
+/** Contract kind — `"core"` platform system contract, `"tenant"` z-space. */
+type ContractKind = "core" | "tenant";
+/** One contract as presented by `contracts.list`. */
+interface ListedContract {
+    /** Canonical name: `tee:<name>` for core, `z:<tid>:<tail>` for tenant. */
+    name: string;
+    kind: ContractKind;
+    /** Current registered version; `null` when the contract is not registered. */
+    version: string | null;
+    /** Descriptor summary, or empty when no descriptor is published. */
+    summary: string;
+    /** Descriptor tags, or empty. */
+    tags: string[];
+    /** Owning DID: the org DID (org mode) or the member's own DID (self mode). */
+    owner_org_did?: string;
+    /**
+     * Human-facing short name: the trailing segment of `name` (`payroll` from
+     * `z:<tid>:payroll`, `user` from `tee:user`). Present this to people instead
+     * of the full canonical `name`, which remains the dispatch key.
+     */
+    short_name: string;
+}
+/** Response body for `contracts.list`. */
+interface ListContractsResult {
+    scope: string;
+    contracts: ListedContract[];
+    next_offset: number | null;
+}
+/** Which standing grant a satisfied/missing entry refers to. */
+type DelegationGrantKind = "agent_auth" | "user_grant";
+/** Params for `delegation.check` (the generic capability read). */
+interface GrantCheckParams {
+    /** The target contract whose requirements are checked. */
+    contract: string;
+    /** The member the agent wants to act for (the subject). */
+    pii_did: string;
+    /** Functions the intended action needs. */
+    functions: string[];
+    /** Org-data scopes the intended action needs. */
+    scopes: string[];
+}
+/** One grant requirement — satisfied or missing. */
+interface DelegationGrantRef {
+    grant: DelegationGrantKind;
+    /** The target contract's canonical name. */
+    contract: string;
+    functions: string[];
+    scopes: string[];
+}
+/**
+ * Response for `delegation.check`: the `agent_auth ∩ UserGrant` verdict.
+ *
+ * `disclosed` is `true` only when the agent is registered under `pii_did`, so
+ * org-side status was safe to disclose; `false` yields the uniform,
+ * non-disclosive verdict (`authorised:false, satisfied:[], missing:[]`) that is
+ * byte-invariant to the requested capability (R5 anti-enumeration).
+ */
+interface GrantCheckResult {
+    authorised: boolean;
+    disclosed: boolean;
+    satisfied: DelegationGrantRef[];
+    missing: DelegationGrantRef[];
+}
+
 /**
  * T3n Client - Main SDK class
  *
@@ -1930,6 +2057,35 @@ declare class T3nClient {
      * server-side handler does not run the encryption layer.
      */
     getUsage(opts?: GetUsageOptions): Promise<UsagePage>;
+    /**
+     * List the caller's discoverable contracts (`contracts.list`) — the
+     * node-backed source for the MCP `listContracts` funnel tool.
+     *
+     * `scope` selects the starting point: `"core"` (curated platform contracts,
+     * the default), `"org"` (one org's contracts — pass `org_did` + `pii_did`),
+     * or `"self"` (the member's own contracts — pass `pii_did`). The acting agent
+     * DID is resolved server-side from the session; org / self modes are
+     * discovery-grant gated and return a uniform, non-disclosive empty page on a
+     * gate miss (R5 anti-enumeration).
+     *
+     * Plaintext session read (like {@link getUsage}): the response carries only
+     * public contract-registry metadata, so it is not sealed.
+     */
+    listContracts(params?: ListContractsParams): Promise<ListContractsResult>;
+    /**
+     * Generic capability check (`delegation.check`) — the
+     * node-backed source for the MCP `checkDelegation` funnel tool.
+     *
+     * Returns the `agent_auth ∩ UserGrant` verdict for `(agent, contract,
+     * pii_did)`: whether the acting agent (resolved from the session) holds the
+     * standing grants that `contract`'s `functions` / `scopes` need for member
+     * `pii_did`. The org half is vacuous for no-org (Individual-owned) targets,
+     * and the verdict is uniform + non-disclosive (`disclosed:false`) when the
+     * agent is not registered under the member (R5 anti-enumeration).
+     *
+     * Plaintext session read (like {@link getUsage}).
+     */
+    checkDelegation(params: GrantCheckParams): Promise<GrantCheckResult>;
     /**
      * Fetch a page of audit events. With no `pii_did`, returns
      * the caller's own audit trail (every actor). With a `pii_did` set to
@@ -1994,10 +2150,12 @@ declare class T3nClient {
      * `tee:user/contracts`, which is **SelfOnly**, so this always returns the
      * caller's own `AGENT_AUTH_MAP[self]` document.
      *
-     * @returns the `agents` entries (normalised to the camelCase write shape)
+     * @returns the full policy document (normalised to the camelCase write
+     *   shape): the per-agent `agents` entries plus the document-level
+     *   `discoverDids` discovery grants
      * @throws if the session is not authenticated, or the contract refuses
      */
-    getAgentAuth(): Promise<AgentAuthEntry[]>;
+    getAgentAuth(): Promise<AgentAuthPolicy>;
     /**
      * Authorise an agent for one contract on the caller's own behalf
      * (envelope-free authorisation). Read-merge-writes the
@@ -2014,13 +2172,24 @@ declare class T3nClient {
      * parameters for. The caller MUST be the delegating user, authenticated as
      * themselves — only they may create their own grant.
      *
+     * The document-level `discoverDids` discovery grants ride the same
+     * read-merge-write: the existing list is always carried forward (the
+     * contract persists the whole document, so dropping it here would revoke
+     * standing discovery), and any `options.discoverDids` are unioned in
+     * (order-preserving, deduplicated).
+     *
      * @param agentDid - the agent DID being authorised
      * @param grant - the single script grant to set (contract, functions,
      *   scopes, validity, egress hosts)
+     * @param options - optional `discoverDids` to union into the document's
+     *   discovery grants (org DIDs for org-mode `listContracts`, the caller's
+     *   own DID for self mode)
      * @returns the script rows preserved from the existing policy (audit aid)
      * @throws if the session is not authenticated, or the contract refuses
      */
-    updateAgentAuth(agentDid: string, grant: AgentAuthScriptGrant): Promise<{
+    updateAgentAuth(agentDid: string, grant: AgentAuthScriptGrant, options?: {
+        discoverDids?: string[];
+    }): Promise<{
         preservedRows: string[];
     }>;
     /**
@@ -2103,6 +2272,33 @@ declare class T3nClient {
      *   a JSON array.
      */
     getWalletHistory(walletAddress: string): Promise<unknown[]>;
+    /**
+     * Return the organisations the authenticated user is a member of, as
+     * canonical `did:t3n:<40-hex>` strings.
+     *
+     * Backed by `tee:user/my-organisations`, which reads the caller's
+     * membership set (`UserOrganisations`) keyed on the session DID — the
+     * request carries no body, and a user cannot query anyone else's
+     * memberships. An **empty array means the user belongs to no
+     * organisation**; this is the intended signal for an org-scoped app to
+     * gate entry on (authentication itself is org-agnostic — a user in no
+     * org still authenticates successfully).
+     *
+     * Note this reflects *affiliation*, not per-contract authorisation:
+     * membership does not by itself grant admin rights or a scope grant.
+     * Org-scoped operations remain gated server-side (403) on the org's
+     * admin list / grants regardless of what this returns.
+     *
+     * `my-organisations` is an additive export, so any registered
+     * user-contract version exposes it; {@link executeUserContract}
+     * resolves `"latest"` to the current version so this wrapper doesn't
+     * drift on every `CONTRACT_VERSION` bump.
+     *
+     * @returns the caller's organisation DIDs (`did:t3n:<40-hex>`), possibly empty.
+     * @throws if unauthenticated, if the node rejects the action, or if the
+     *   response shape is unexpected.
+     */
+    myOrgs(): Promise<Did[]>;
     /**
      * Remove the authenticated user's account AND explicitly abandon
      * any wallets. Writes `Abandoned` audit rows to wallet history,
@@ -2272,15 +2468,18 @@ declare class T3nClient {
     /**
      * Replace this user's agent-authorisation policy (`tee:user/contracts` →
      * `agent-auth-update`). The supplied document IS the new state: an empty
-     * `agents` array revokes all agent access. This is the full-document
+     * `agents` array revokes all agent access, and an omitted `discoverDids`
+     * persists an empty discovery-grant list. This is the full-document
      * write — use {@link T3nClient.updateAgentAuth} for the single-grant
-     * read-merge-write that preserves other contracts' grants.
+     * read-merge-write that preserves other contracts' grants and the
+     * standing discovery grants.
      *
      * Typed wrapper over the raw contract call: callers pass camelCase input;
      * the SDK emits the canonical snake_case wire via
      * {@link toAgentAuthUpdateWire} (carrying `scopes` / `read_scopes` /
-     * validity alongside `functions` / `allowed_hosts`), so it does not rely
-     * on the contract's compatibility aliases.
+     * validity alongside `functions` / `allowed_hosts`, plus the
+     * document-level `discover_dids`), so it does not rely on the contract's
+     * compatibility aliases.
      *
      * @throws {RpcError} if the contract rejects the policy (validation failure,
      *   too many agents/grants).
@@ -3006,6 +3205,46 @@ declare function formatTokens(baseUnits: number | bigint): string;
  */
 declare function toBaseUnits(tokens: number): number;
 
+/** Closed-vocabulary serialisation annotations for a contract function's body. */
+interface WireBlock {
+    /**
+     * Field paths whose values are emitted as decimal strings. A path ending in
+     * `.*` applies to every value of the named object/array (e.g.
+     * `historical_baselines.*`).
+     */
+    u64_as_string?: string[];
+    /**
+     * Byte fields carried as typed strings. The value is passed through when it
+     * is already a string; a byte input (`Uint8Array` or a `number[]` of octets)
+     * is encoded per its kind.
+     */
+    string_encoded?: Record<string, StringEncoding>;
+}
+/** The closed set of `string_encoded` field kinds. */
+type StringEncoding = "did" | "address" | "hash";
+/**
+ * Raised when a `wire` block asks for a projection the closed vocabulary cannot
+ * express — an unrepresentable value for a declared field. It signals a
+ * descriptor↔contract mismatch on the author's side, so callers surface it as a
+ * terminal `unsupported_wire_encoding` rather than retrying.
+ */
+declare class WireEncodingError extends T3nError {
+    readonly field: string;
+    readonly encoding?: StringEncoding | undefined;
+    constructor(message: string, field: string, encoding?: StringEncoding | undefined);
+}
+type JsonRecord = Record<string, unknown>;
+/**
+ * Project `args` into the plain-args body a z-space contract deserialises,
+ * applying the descriptor's `wire` annotations. Returns a new object; `args` is
+ * never mutated. With no `wire` block the body is returned unchanged (the
+ * JSON-plain path).
+ *
+ * @throws {WireEncodingError} when a declared field holds a value the
+ *   vocabulary cannot express.
+ */
+declare function requestToWire(args: JsonRecord, wire?: WireBlock): JsonRecord;
+
 /**
  * Cryptographic utilities for T3n SDK
  *
@@ -3343,6 +3582,22 @@ interface ContractPublishInput {
      */
     source_hash?: string;
 }
+/**
+ * Input for `TenantContractsNamespace.setDescriptor`: publish the agent-facing
+ * descriptor document for an already-registered contract version via
+ * `tee:tenant/contracts.set-descriptor`.
+ */
+interface ContractSetDescriptorInput {
+    tail: string;
+    /** Semver the descriptor is bound to; the `name@version` must already be registered. */
+    version: string;
+    /**
+     * The descriptor document — contract-level metadata plus a non-empty
+     * `functions` array of function descriptors — embedded as JSON and stored
+     * verbatim at the version-scoped `:descriptor` sidecar.
+     */
+    descriptor: unknown;
+}
 interface ContractExecuteInput {
     version: string;
     functionName: string;
@@ -3374,6 +3629,7 @@ interface ExecuteBusinessContractOptions<T = unknown> {
 type TenantMapCreateInput = MapCreateInput;
 type TenantMapUpdatePatch = MapUpdateInput;
 type TenantContractPublishInput = ContractPublishInput;
+type TenantContractSetDescriptorInput = ContractSetDescriptorInput;
 type TenantContractExecuteInput = ContractExecuteInput;
 /**
  * Options shared by the `tee:tenant` management calls that accept an optional
@@ -3433,6 +3689,15 @@ declare class TenantContractsNamespace {
     constructor(client: TenantClient);
     publish(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<ContractRegisterResult>;
     register(input: ContractPublishInput, opts?: TenantTargetOptions): Promise<ContractRegisterResult>;
+    /**
+     * Publish the agent-facing descriptor document for a registered
+     * `name@version` via `set-descriptor`. Owner-gated by the
+     * same tenant-resolution rules as `register`, and refused when the
+     * `name@version` is not registered. The node serves the stored document as
+     * the sole descriptor source for the MCP dispatch funnel, so a contract
+     * without one is not dispatchable through it.
+     */
+    setDescriptor(input: ContractSetDescriptorInput, opts?: TenantTargetOptions): Promise<unknown>;
     disable(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
     enable(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
     unregister(tail: string, opts?: TenantTargetOptions): Promise<unknown>;
@@ -3540,5 +3805,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createWorkloadAuthInput, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgWriters, isUnsafeTrustServer, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, metamask_get_address, metamask_sign, parseAgentAuthGet, parseContractResponse, redactSecrets, redactSecretsFromJson, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
-export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, T3nClient, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, bytesToString, canonicalTenantName, clearKeyCache, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createWorkloadAuthInput, decodeWasmErrorMessage, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, formatTokens, generateRandomString, generateUUID, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, getScriptVersion, isDataGetResponse, isDataListResponse, isMutationResponse, isObject, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgWriters, isUnsafeTrustServer, loadConfig, loadWasmComponent, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyTdxQuote };
+export type { AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AuthInput, BalanceRow, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractExecuteInput, ContractKind, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, Did, Direction, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GrantsGetInput, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListContractsParams, ListContractsResult, ListContractsScope, ListedContract, Logger, MapCreateInput, MapResponse, MapUpdateInput, MapVisibility, MutationResponse, OidcAuthInput, OidcCredentials, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgPolicyMeta, OrgPolicyView, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, QuoteVerifyResult, ReaderSet, SdkConfig, SessionCrypto, SessionId, SetGrantsInput, SetWritersInput, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UserGrant, UserInputProfile, UserUpsertErrorKind, WasmComponent, WasmNextResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };