@terminal3/t3n-sdk 4.39.1 → 4.42.0

package/dist/index.d.ts

@@ -1026,6 +1026,25 @@ interface BoundGrant {
     /** Agent edge only: optional validity time-box. */
     window?: Validity;
 }
+/**
+ * Capability grant in the pre-collapse (`UserGrant`) wire shape — the element
+ * of the legacy `org-policy-set-grants` input and `org-grants-get` output. The
+ * grantee is carried as `user_did` (not `grantee`), and there is no
+ * `contract_id` on the element (the enclosing {@link OrgContractGrants} carries
+ * it) nor any agent-edge qualifiers.
+ *
+ * @deprecated Use {@link BoundGrant}. Retained so consumers on the legacy
+ * org-grant vocabulary keep compiling and decoding while the contract still
+ * emits this shape during the delegation-vocabulary deprecation window.
+ */
+interface UserGrant {
+    /** The user this grant applies to (`did:t3n:<40-hex>`). */
+    user_did: string;
+    /** WIT function names the user may invoke (e.g. `"set-records"`). */
+    functions: string[];
+    /** Data scope paths the user may access (e.g. `"example/records"`). */
+    scopes: string[];
+}
 /**
  * Policy record for an organisation's data tier.
  *
@@ -1143,6 +1162,29 @@ interface OrgContractDelegation {
  * here would create maintenance churn against benign field additions.
  */
 declare function isOrgContractDelegation(value: unknown): value is OrgContractDelegation;
+/**
+ * Response type alias for the legacy `org-grants-get`.
+ *
+ * Same envelope as {@link OrgContractDelegation} (`contract_id` + a grant
+ * list), but each grant is the legacy {@link UserGrant} shape (`user_did`
+ * rather than `grantee`), matching what the contract emits during the
+ * deprecation window.
+ *
+ * @deprecated Use {@link OrgContractDelegation}.
+ */
+interface OrgContractGrants {
+    contract_id: string;
+    grants: UserGrant[];
+}
+/**
+ * Shallow runtime guard for {@link OrgContractGrants}. Validates the immediate
+ * envelope (`contract_id: string`, `grants: array`) only — the same structural
+ * check as {@link isOrgContractDelegation}, since the two responses share an
+ * envelope and differ only in the grant element shape.
+ *
+ * @deprecated Use {@link isOrgContractDelegation}.
+ */
+declare function isOrgContractGrants(value: unknown): value is OrgContractGrants;
 /**
  * One grant inside a role: a capability body (functions + scopes, without the
  * grantee, which is bound at assignment time) plus the target contract.
@@ -1482,6 +1524,153 @@ declare function mergeGrants(existing: BoundGrant[], additions: BoundGrant[]): G
  */
 declare function mergeDiscoverDids(existing: string[], additions: string[]): string[];
 
+/**
+ * Agent-auth grants — the pre-collapse (camelCase) delegation surface, retained
+ * as a deprecated compatibility layer alongside the flat, snake_case
+ * {@link MemberDelegationDoc} surface in `./member-delegation`.
+ *
+ * `AGENT_AUTH_MAP` is keyed by the *user* DID — one policy document per user,
+ * global across orgs, with at most one entry per agent DID. Reads
+ * (`agent-auth-get`) and writes (`agent-auth-update`) on
+ * `tee:authorisations/contracts` (the policy's owning contract) are
+ * **SelfOnly**: only the user, authenticated as themselves, may read or write
+ * their own grants.
+ *
+ * The write shape carries `scopes` + a validity window: the agent's delegated
+ * org-data scopes, and an optional `[valid_from_secs, valid_until_secs]`
+ * window. The ≤ cap *length* check is enforced contract-side at write time; the
+ * expiry gate is host-side at read time.
+ *
+ * The merge below is a script-level union: writing a grant for one
+ * `(agent_did, script_name)` preserves every other script row on that agent's
+ * entry, and every other agent's entry, unchanged.
+ *
+ * @deprecated Use `./member-delegation` (`MemberDelegationDoc`,
+ * `parseMemberDelegationDoc`, `mergeGrants`) and the `*MemberDelegation*`
+ * client methods. This module maps onto the legacy `agent-auth-*` wire the
+ * contract still accepts during the delegation-vocabulary deprecation window.
+ */
+
+/**
+ * A single script grant in the camelCase write-request shape.
+ *
+ * @deprecated Use `BoundGrant` from `../org-data/types`.
+ */
+interface AgentAuthScriptGrant {
+    /** Contract name, or `"*"`. */
+    scriptName: string;
+    /** Optional semver requirement; `null` to match any version. */
+    versionReq?: string | null;
+    /** Functions the agent may invoke on this contract. */
+    functions: string[];
+    /** Org-data scopes delegated to the agent for the contract functions to
+     *  read on its behalf. */
+    scopes?: string[];
+    /** Direct-read scopes the agent may enumerate itself, via whichever read
+     *  function the contract exposes for direct enumeration. A strict subset of
+     *  `scopes` (enforced contract-side). */
+    readScopes?: string[];
+    /** Optional validity-window start (unix seconds). */
+    validFromSecs?: number | null;
+    /** Optional validity-window end (unix seconds). */
+    validUntilSecs?: number | null;
+    /** Egress hosts the agent may reach for this contract. */
+    allowedHosts: string[];
+}
+/**
+ * One agent's entry in the write-request shape.
+ *
+ * @deprecated Use the flat `BoundGrant` list on `MemberDelegationDoc`.
+ */
+interface AgentAuthEntry {
+    agentDid: string;
+    scripts: AgentAuthScriptGrant[];
+}
+/**
+ * The full agent-auth policy document in the camelCase write shape:
+ * the per-agent grants plus the document-level discovery grants.
+ *
+ * `discoverDids` (contract wire: `discover_dids`) is the list of DIDs the user
+ * lets their registered agents *enumerate the contracts of* via
+ * `listContracts`: an org DID grants org-mode discovery, the user's own DID
+ * grants self-mode discovery. It lives at document level — not on a script
+ * grant — because discovery must surface contracts the agent cannot yet call.
+ * The node's discovery gate additionally requires the calling agent to be named
+ * in `agents` (subject binding), so an unregistered agent discovers nothing
+ * regardless of this list.
+ *
+ * @deprecated Use {@link MemberDelegationDoc}.
+ */
+interface AgentAuthPolicy {
+    agents: AgentAuthEntry[];
+    discoverDids: string[];
+}
+/**
+ * Parse a full `agent-auth-get` response (the stored snake_case policy
+ * document) into the camelCase write shape, including the document-level
+ * `discover_dids`. A `null` / absent response is the empty policy.
+ *
+ * @deprecated Use `parseMemberDelegationDoc`.
+ */
+declare function parseAgentAuthPolicy(response: unknown): AgentAuthPolicy;
+/**
+ * Extract the `agents` array from an `agent-auth-get` response.
+ *
+ * @deprecated Read `MemberDelegationDoc.grants` instead.
+ */
+declare function parseAgentAuthGet(response: unknown): AgentAuthEntry[];
+/** @deprecated Use `GrantsMergeResult` from `./member-delegation`. */
+interface AgentAuthMergeResult {
+    /** Full merged `agents` list, ready for `agent-auth-update`. */
+    agents: AgentAuthEntry[];
+    /** `"<agentDid> → <scriptName>"` rows preserved from the existing policy. */
+    preservedRows: string[];
+}
+/**
+ * Input to the full-document write {@link T3nClient.agentAuthUpdate}. The
+ * document IS the new state: an empty `agents` list revokes all agent access,
+ * and an omitted / empty `discoverDids` persists an empty discovery-grant list
+ * (the contract has no per-field merge). Mirrors the contract `AgentAuthPolicy`.
+ *
+ * @deprecated Use {@link MemberDelegationDoc}.
+ */
+interface AgentAuthUpdateInput {
+    agents: AgentAuthEntry[];
+    /** Document-level discovery grants — see {@link AgentAuthPolicy}. */
+    discoverDids?: string[];
+}
+/**
+ * Serialise a camelCase policy document to the contract's canonical snake_case
+ * `agent-auth-update` wire (`agent_did` / `script_name` / `version_req` /
+ * `read_scopes` / `valid_from_secs` / `valid_until_secs` / `allowed_hosts` /
+ * `discover_dids`). Absent optionals are omitted (never sent as `null`); empty
+ * `scopes` / `read_scopes` are omitted (the contract defaults both to empty).
+ * `functions` and `allowed_hosts` are always emitted — the contract requires
+ * explicit functions (`["*"]` = all) and reads an absent `allowed_hosts` as
+ * deny-all egress. The document-level `discover_dids` is emitted only when
+ * non-empty; the contract defaults an absent list to empty.
+ *
+ * @deprecated The new write path passes `MemberDelegationDoc` straight through
+ * with no casing transform.
+ */
+declare function toAgentAuthUpdateWire(agents: AgentAuthEntry[], discoverDids?: string[]): {
+    agents: Array<{
+        agent_did: string;
+        scripts: Array<Record<string, unknown>>;
+    }>;
+    discover_dids?: string[];
+};
+/**
+ * Merge new agent entries into the existing policy with script-level union
+ * semantics: for an agent DID present on both sides, script rows whose
+ * `scriptName` is not being written are preserved; rows with a matching
+ * `scriptName` are replaced by the new grant. Entries for other agent DIDs
+ * pass through unchanged.
+ *
+ * @deprecated Use `mergeGrants` from `./member-delegation`.
+ */
+declare function mergeAgentAuthEntries(existing: AgentAuthEntry[], newEntries: AgentAuthEntry[]): AgentAuthMergeResult;
+
 /**
  * KYC types for the `tee:user/contracts::kyc-status` short-poll
  * function.
@@ -2133,7 +2322,20 @@ interface ActivityReport {
      */
     next_seq: number | null;
 }
-/** Params for one activity-report page. All optional; `{}` is valid. */
+/**
+ * Params for one activity-report page. All optional; `{}` is valid.
+ *
+ * The row filters (`caller_type`, `outcome`, `did`, `contract`, `function`)
+ * are AND-ed and applied node-side before the page is filled, so `limit` keeps
+ * counting *matching* rows and the cursor keeps its meaning — page a filtered
+ * report exactly as an unfiltered one, resending the same filters with every
+ * `before_seq`. They narrow what comes back, not what the node scans, so short
+ * and empty pages with a live `next_seq` are the normal case under a selective
+ * filter.
+ *
+ * A field the node does not recognise is rejected (400) rather than ignored,
+ * so a filter never silently widens a query back to the whole organisation.
+ */
 interface GetActivityLogOptions {
     /** Window start, Unix ms, inclusive. Defaults to 0 (no lower bound). */
     from_ms?: number;
@@ -2152,6 +2354,31 @@ interface GetActivityLogOptions {
      * the node's own scan cap can trip first. See {@link ActivityReport.next_seq}.
      */
     limit?: number;
+    /** Keep only calls made by an agent, or only those made by a human. */
+    caller_type?: ActivityCallerType;
+    /** Keep only calls that ended in this outcome. */
+    outcome?: ActivityOutcome;
+    /**
+     * Keep only calls this DID took part in — as the {@link ActivityEntry.actor}
+     * that ran them, or as the {@link ActivityEntry.on_behalf_of} owner they ran
+     * for. Both sides match: "what did this agent do" and "what was done in my
+     * name" are the same question from the two ends of one delegation.
+     *
+     * One whole `did:t3n:<40-hex>`. A partial DID is rejected rather than widened
+     * into a prefix search, so a search box should send this only once it holds a
+     * complete DID.
+     */
+    did?: string;
+    /**
+     * Keep only calls whose {@link ActivityEntry.contract} contains this
+     * substring, compared case-insensitively. Must not be empty.
+     */
+    contract?: string;
+    /**
+     * Keep only calls whose {@link ActivityEntry.function} contains this
+     * substring, compared case-insensitively. Must not be empty.
+     */
+    function?: string;
 }
 
 /**
@@ -2207,7 +2434,11 @@ interface ListContractsResult {
     contracts: ListedContract[];
     next_offset: number | null;
 }
-/** Which standing grant a satisfied/missing entry refers to. */
+/**
+ * Which standing grant a satisfied/missing entry refers to — the stable,
+ * caller-facing values. Reads are normalised to these two, so switch logic on
+ * them stays exhaustive.
+ */
 type DelegationGrantKind = "member_delegation" | "org_delegation";
 /** Params for `delegation.check` (the generic capability read). */
 interface GrantCheckParams {
@@ -2623,6 +2854,22 @@ declare class T3nClient {
      *   cursor = page.next_seq ?? undefined;
      * } while (cursor !== undefined);
      * ```
+     *
+     * The optional row filters — `caller_type`, `outcome`, `did`, `contract`,
+     * `function` — are AND-ed node-side and applied before the page is filled, so
+     * they compose freely with each other and with the cursor. Resend the same
+     * filters with every page; changing them mid-walk changes what the cursor
+     * means. Because a filter narrows what comes back rather than what the node
+     * scans, short and empty pages are the normal case — page until `next_seq` is
+     * `null`.
+     *
+     * ```ts
+     * // Everything one agent did, or had done in its name, that was refused.
+     * const denied = await client.getActivityLog({
+     *   did: "did:t3n:8a2fbc8a2fbc8a2fbc8a2fbc8a2fbc8a2fbc8a2f",
+     *   outcome: "denied",
+     * });
+     * ```
      */
     getActivityLog(opts?: GetActivityLogOptions): Promise<ActivityReport>;
     /**
@@ -3196,6 +3443,68 @@ declare class T3nClient {
      *   too many delegatees/grants).
      */
     memberDelegationUpdate(input: MemberDelegationDoc): Promise<void>;
+    /**
+     * Revoke the caller's own agent delegations scoped to one org (detach-cascade
+     * `agent_auth` half). Dispatches `agent-auth-revoke-org` on
+     * `tee:user/contracts` (**SelfOnly**): every grant targeting a `z:<orgTid>:*`
+     * contract is removed from the caller's own delegation document.
+     *
+     * @param orgTid - the org's z-space tenant id (`did:t3n:<hex>` or bare
+     *   40-hex) — i.e. the `<tid>` in the org's `z:<tid>:…` contract names
+     * @deprecated Use {@link T3nClient.revokeMemberDelegationForOrg}.
+     */
+    revokeAgentAuthForOrg(orgTid: string): Promise<void>;
+    /**
+     * Read the authenticated user's own agent-auth policy — the standing grants
+     * delegated to agents — in the legacy camelCase shape. Dispatches
+     * `agent-auth-get` on `tee:authorisations/contracts` (**SelfOnly**), so this
+     * always returns the caller's own policy document.
+     *
+     * @returns the full policy document normalised to the camelCase write shape:
+     *   the per-agent `agents` entries plus the document-level `discoverDids`
+     *   discovery grants
+     * @throws if the session is not authenticated, or the contract refuses
+     * @deprecated Use {@link T3nClient.getMemberDelegation}.
+     */
+    getAgentAuth(): Promise<AgentAuthPolicy>;
+    /**
+     * Authorise an agent for one contract on the caller's own behalf, in the
+     * legacy camelCase shape. Read-merge-writes the caller's policy document via
+     * `agent-auth-update` (**SelfOnly**) with script-level union semantics, so
+     * other contracts' grants for this or any agent survive untouched.
+     *
+     * @param agentDid - the agent DID being authorised
+     * @param grant - the single script grant to set (contract, functions,
+     *   scopes, validity, egress hosts)
+     * @param options - optional `discoverDids` to union into the document's
+     *   discovery grants
+     * @returns the script rows preserved from the existing policy (audit aid)
+     * @throws if the session is not authenticated, or the contract refuses
+     * @deprecated Use {@link T3nClient.updateMemberDelegation} (note it drops the
+     *   leading `agentDid` argument — the `grantee` lives on the grant).
+     */
+    updateAgentAuth(agentDid: string, grant: AgentAuthScriptGrant, options?: {
+        discoverDids?: string[];
+    }): Promise<{
+        preservedRows: string[];
+    }>;
+    /**
+     * Replace this user's agent-authorisation policy in the legacy camelCase
+     * shape (`tee:authorisations/contracts` → `agent-auth-update`). The supplied
+     * document IS the new state: an empty `agents` array revokes all agent
+     * access, and an omitted `discoverDids` persists an empty discovery-grant
+     * list. Use {@link T3nClient.updateAgentAuth} for the single-grant
+     * read-merge-write.
+     *
+     * The SDK emits the canonical snake_case wire via {@link toAgentAuthUpdateWire}
+     * (carrying `scopes` / `read_scopes` / validity alongside `functions` /
+     * `allowed_hosts`, plus the document-level `discover_dids`).
+     *
+     * @throws {RpcError} if the contract rejects the policy (validation failure,
+     *   too many agents/grants).
+     * @deprecated Use {@link T3nClient.memberDelegationUpdate}.
+     */
+    agentAuthUpdate(input: AgentAuthUpdateInput): Promise<void>;
     /**
      * Convenience helper: run the explicit OTP roundtrip and submit
      * the slim user-upsert in one call.
@@ -3789,6 +4098,26 @@ interface OrgDelegationDeleteInput {
     orgDid: string;
     contractId: string;
 }
+/**
+ * Legacy input for {@link OrgDataClient.setGrants}. Carries the full
+ * {@link UserGrant} list verbatim (grantee as `user_did`).
+ *
+ * @deprecated Use {@link OrgDelegationSetInput}.
+ */
+interface SetGrantsInput {
+    orgDid: string;
+    contractId: string;
+    grants: UserGrant[];
+}
+/**
+ * Legacy input for {@link OrgDataClient.deleteGrants}.
+ *
+ * @deprecated Use {@link OrgDelegationDeleteInput}.
+ */
+interface DeleteGrantsInput {
+    orgDid: string;
+    contractId: string;
+}
 /**
  * Grant or replace the outbound host allow-list an org-owned agent may use
  * while executing one of the org's contracts (org-admin only).
@@ -3933,6 +4262,16 @@ interface OrgRemoveMemberDelegationInput {
     /** DID (`did:t3n:<40-hex>` or bare hex) to drop from every grant list. */
     memberDid: string;
 }
+/**
+ * Legacy input for {@link OrgDataClient.removeMemberGrants}.
+ *
+ * @deprecated Use {@link OrgRemoveMemberDelegationInput}.
+ */
+interface RemoveMemberGrantsInput {
+    orgDid: string;
+    /** DID (`did:t3n:<40-hex>` or bare hex) to drop from every grant list. */
+    memberDid: string;
+}
 interface PolicyGetInput {
     orgDid: string;
 }
@@ -3944,6 +4283,15 @@ interface OrgDelegationGetInput {
     orgDid: string;
     contractId: string;
 }
+/**
+ * Legacy input for {@link OrgDataClient.grantsGet}.
+ *
+ * @deprecated Use {@link OrgDelegationGetInput}.
+ */
+interface GrantsGetInput {
+    orgDid: string;
+    contractId: string;
+}
 interface DataListInput {
     orgDid: string;
     scope: string;
@@ -4086,6 +4434,22 @@ declare class OrgDataClient {
      * Delete the grant entry for a contract entirely.
      */
     deleteDelegation(input: OrgDelegationDeleteInput): Promise<MutationResponse>;
+    /**
+     * Full replacement of the user-grant list for a contract, in the legacy
+     * `UserGrant` wire shape (grantee as `user_did`). Passing an empty list
+     * removes the entry. Dispatches the legacy `org-policy-set-grants` function
+     * the contract still accepts during the deprecation window.
+     *
+     * @deprecated Use {@link OrgDataClient.setDelegation}.
+     */
+    setGrants(input: SetGrantsInput): Promise<MutationResponse>;
+    /**
+     * Delete the grant entry for a contract entirely, via the legacy
+     * `org-policy-delete-grants` function.
+     *
+     * @deprecated Use {@link OrgDataClient.deleteDelegation}.
+     */
+    deleteGrants(input: DeleteGrantsInput): Promise<MutationResponse>;
     /**
      * Grant or replace the outbound host allow-list an org-owned agent may use
      * while executing one of the org's contracts (org-admin only).
@@ -4182,6 +4546,13 @@ declare class OrgDataClient {
      * `deleted_entries` reports how many contract grant lists were rewritten.
      */
     removeMemberDelegation(input: OrgRemoveMemberDelegationInput): Promise<MutationResponse>;
+    /**
+     * Detach-cascade grant sweep via the legacy `org-remove-member-grants`
+     * function.
+     *
+     * @deprecated Use {@link OrgDataClient.removeMemberDelegation}.
+     */
+    removeMemberGrants(input: RemoveMemberGrantsInput): Promise<MutationResponse>;
     /** Read the policy metadata for an org (admin-only). */
     policyGet(input: PolicyGetInput): Promise<OrgPolicyMeta>;
     /**
@@ -4209,6 +4580,13 @@ declare class OrgDataClient {
     writersGet(input: WritersGetInput): Promise<OrgWriters>;
     /** Read the grant list for a contract (admin-only). */
     getDelegation(input: OrgDelegationGetInput): Promise<OrgContractDelegation>;
+    /**
+     * Read the grant list for a contract (admin-only) in the legacy `UserGrant`
+     * wire shape, via the legacy `org-grants-get` function.
+     *
+     * @deprecated Use {@link OrgDataClient.getDelegation}.
+     */
+    grantsGet(input: GrantsGetInput): Promise<OrgContractGrants>;
     /**
      * List entry IDs for a scope (admin-only), paginated.
      *
@@ -4307,6 +4685,18 @@ declare class SessionOrgDataClient {
     setDelegation(input: OrgDelegationSetInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.deleteDelegation}. */
     deleteDelegation(input: OrgDelegationDeleteInput): Promise<MutationResponse>;
+    /**
+     * Mirrors {@link OrgDataClient.setGrants}.
+     *
+     * @deprecated Use {@link SessionOrgDataClient.setDelegation}.
+     */
+    setGrants(input: SetGrantsInput): Promise<MutationResponse>;
+    /**
+     * Mirrors {@link OrgDataClient.deleteGrants}.
+     *
+     * @deprecated Use {@link SessionOrgDataClient.deleteDelegation}.
+     */
+    deleteGrants(input: DeleteGrantsInput): Promise<MutationResponse>;
     /**
      * Grant or replace the outbound host allow-list an org-owned agent may use
      * while executing one of the org's contracts (org-admin only).
@@ -4357,6 +4747,12 @@ declare class SessionOrgDataClient {
     purgeOrg(input: PurgeOrgInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.removeMemberDelegation}. */
     removeMemberDelegation(input: OrgRemoveMemberDelegationInput): Promise<MutationResponse>;
+    /**
+     * Mirrors {@link OrgDataClient.removeMemberGrants}.
+     *
+     * @deprecated Use {@link SessionOrgDataClient.removeMemberDelegation}.
+     */
+    removeMemberGrants(input: RemoveMemberGrantsInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.policyGet}. */
     policyGet(input: PolicyGetInput): Promise<OrgPolicyMeta>;
     /** Mirrors {@link OrgDataClient.policyView}. */
@@ -4367,6 +4763,12 @@ declare class SessionOrgDataClient {
     writersGet(input: WritersGetInput): Promise<OrgWriters>;
     /** Mirrors {@link OrgDataClient.getDelegation}. */
     getDelegation(input: OrgDelegationGetInput): Promise<OrgContractDelegation>;
+    /**
+     * Mirrors {@link OrgDataClient.grantsGet}.
+     *
+     * @deprecated Use {@link SessionOrgDataClient.getDelegation}.
+     */
+    grantsGet(input: GrantsGetInput): Promise<OrgContractGrants>;
     /** Mirrors {@link OrgDataClient.dataList}. */
     dataList(input: DataListInput): Promise<DataListResponse>;
     /** Mirrors {@link OrgDataClient.dataGet}. */
@@ -5411,5 +5813,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgDataActionWire, OrgDataClientOptions, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
+export type { ActivityCallerType, ActivityEntry, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };