@terminal3/t3n-sdk 5.14.0 → 5.15.2

package/dist/index.d.ts

@@ -592,14 +592,24 @@ declare class MockTransport implements Transport {
 }
 
 /**
- * TDX quote verifier backed by the Rust `signature` crate compiled to
- * WASM. Full cryptographic verification: ECDSA P-256 attestation-key
- * signature, PCK certificate chain walk to Intel's root CA, and
- * report_data + RTMR comparison.
+ * TDX and SEV-SNP quote verifier backed by the Rust `tee-quote` crate
+ * compiled to WASM. Full cryptographic verification: TDX's ECDSA P-256
+ * attestation-key signature + PCK certificate chain walk to Intel's root
+ * CA, or SEV-SNP's report signature + VCEK/VLEK chain walk to AMD's
+ * pinned root + CRL revocation check — plus report_data + measurement
+ * comparison either way.
  *
  * The WASM bytes are inlined as base64 (see quote_verifier_bytes.ts)
  * so the SDK works without bundler WASM plugins and without runtime
  * asset URL resolution.
+ *
+ * SEV-SNP verification needs AMD KDS collateral (VCEK/VLEK leaf,
+ * intermediate chain, CRL) this module never fetches itself — see
+ * {@link SevSnpCollateral} and {@link fetchSevSnpCollateral} in
+ * `sev-snp-kds.ts`. Confirmed empirically: AMD's KDS (kdsintf.amd.com)
+ * sends `Access-Control-Allow-Origin: *` on all three endpoints a
+ * verifier needs, so a browser can fetch them directly, no CORS proxy
+ * required.
  */
 interface QuoteVerifyResult {
     valid: boolean;
@@ -612,13 +622,42 @@ interface QuoteVerifyResult {
     rtmr1?: string;
     report_data?: string;
 }
+/** Result of {@link verifySevSnpReport}. */
+interface SevSnpVerifyResult {
+    valid: boolean;
+    error?: string;
+    /** Base64-encoded 48-byte MEASUREMENT extracted from the report. */
+    measurement?: string;
+}
+/**
+ * AMD KDS collateral for one SEV-SNP report — the VCEK/VLEK leaf
+ * certificate, the `[ASK,ARK]`/`[ASVK,ARK]` intermediate chain, and the
+ * matching CRL, all base64-encoded. Fetch these directly from AMD KDS
+ * (confirmed CORS-open) — see `fetchSevSnpCollateral` in
+ * `sev-snp-kds.ts`.
+ */
+interface SevSnpCollateral {
+    /** VCEK/VLEK leaf certificate (DER, base64). */
+    leaf_der_b64: string;
+    /** `[ASK, ARK]` / `[ASVK, ARK]` intermediate chain (PEM, base64). */
+    kds_chain_pem_b64: string;
+    /** Matching CRL (DER, base64). */
+    crl_der_b64: string;
+}
 interface PeerQuoteResult {
     peer_id: string;
     valid: boolean;
     error?: string;
+    /** TDX only. */
     rtmr3?: string;
-    /** See {@link QuoteVerifyResult.rtmr1}. */
+    /** TDX only. See {@link QuoteVerifyResult.rtmr1}. */
     rtmr1?: string;
+    /**
+     * Base64-encoded 48-byte SEV-SNP MEASUREMENT (SEV-SNP only). Mutually
+     * exclusive with `rtmr3`/`rtmr1` — a raw quote is one vendor or the
+     * other (see {@link detectQuoteVendor}).
+     */
+    measurement?: string;
 }
 interface DkgVerifyResult {
     valid: boolean;
@@ -673,6 +712,23 @@ interface TrustAnchor {
      * here.
      */
     rtmr1_allowlist: string[];
+    /**
+     * Base64-encoded 48-byte SEV-SNP MEASUREMENT values of the expected
+     * node image. Every SEV-SNP peer's MEASUREMENT must be a member —
+     * applies only to peers whose quote is an SEV-SNP report (auto-detected,
+     * see {@link detectQuoteVendor}), so `[]` is correct for an all-TDX
+     * fleet. Unlike `rtmr1_allowlist`, MEASUREMENT is confirmed
+     * host-invariant, so this is a simple exact-match allowlist, not a
+     * per-host-firmware union — still an array so a rolling deploy's
+     * old‖new images both verify.
+     */
+    sev_snp_measurement_allowlist: string[];
+    /**
+     * AMD product line (`"Milan"`/`"Genoa"`) the cluster's SEV-SNP nodes
+     * run on — selects the pinned ARK root. Required only if the cluster
+     * actually has SEV-SNP peers; omit for an all-TDX fleet.
+     */
+    sev_snp_product?: string;
     /**
      * Optional provenance of the pinned values, for diagnostics only —
      * never passed to the verifier and never part of any security
@@ -738,16 +794,83 @@ declare function verifyTdxQuote(quoteB64: string, attestationMsgB64: string, exp
  * see `unsafe_trust_server` on the client config, which branches around
  * the whole verify path.
  *
+ * For a mixed TDX/SEV-SNP fleet, each peer's vendor is auto-detected from
+ * its raw quote bytes (see {@link detectQuoteVendor}); an SEV-SNP peer
+ * verifies against `sevSnpCollateral`/`anchor.sev_snp_measurement_allowlist`/
+ * `anchor.sev_snp_product` instead of the RTMR1/RTMR3 allowlists. Pure and
+ * synchronous like the TDX path — this function never fetches anything
+ * itself; a caller with SEV-SNP peers fetches each one's own AMD KDS
+ * collateral first (see `fetchSevSnpCollateral` in `sev-snp-kds.ts`) and
+ * passes it in.
+ *
  * @param encapsKeyB64 - Base64-encoded ML-KEM encapsulation key
  *   (from `/status.encaps_key`)
  * @param attestationMsgB64 - Base64-encoded raw attestation message
  *   (from `/status.dkg_attestation.attestation_msg`)
  * @param peerIds - Base58 peer IDs as reported by the bundle
- * @param quotes - Map of peer_id → base64-encoded TDX quote
- * @param anchor - Client-pinned expected peer IDs + RTMR allowlists
+ * @param quotes - Map of peer_id → base64-encoded quote (TDX or SEV-SNP)
+ * @param anchor - Client-pinned expected peer IDs + RTMR/MEASUREMENT
+ *   allowlists
+ * @param sevSnpCollateral - Map of peer_id → AMD KDS collateral, for
+ *   peers detected as SEV-SNP. Omit (or pass `{}`) for an all-TDX fleet.
  * @returns Per-peer verification results and overall validity
  */
-declare function verifyDkgAttestation(encapsKeyB64: string, attestationMsgB64: string, peerIds: string[], quotes: Record<string, string>, anchor: TrustAnchor): Promise<DkgVerifyResult>;
+declare function verifyDkgAttestation(encapsKeyB64: string, attestationMsgB64: string, peerIds: string[], quotes: Record<string, string>, anchor: TrustAnchor, sevSnpCollateral?: Record<string, SevSnpCollateral>): Promise<DkgVerifyResult>;
+/**
+ * Verify a single SEV-SNP attestation report with full cryptographic
+ * verification: report signature to the pinned AMD root (via
+ * caller-supplied KDS collateral), CRL revocation, and
+ * report_data + MEASUREMENT comparison. The offline, single-report
+ * sibling of {@link verifyTdxQuote}.
+ *
+ * Deliberately simpler than the node's own P2P peer-admission policy:
+ * VCEK-only (a VLEK report's leaf isn't served by KDS at all — it comes
+ * from the guest's own host GHCB table — and carries no per-chip binding
+ * anyway) and no TCB floor (an operational fleet-hygiene concern, not a
+ * client trust boundary — the MEASUREMENT allowlist is what proves *this
+ * is our approved image*).
+ *
+ * @param reportB64 - Base64-encoded raw 1184-byte SEV-SNP `ATTESTATION_REPORT`
+ * @param attestationMsgB64 - Base64-encoded attestation message
+ *   (for DKG: encaps_key || sorted_peer_id_bytes)
+ * @param collateral - AMD KDS collateral for this specific report
+ * @param expectedMeasurementB64 - Optional base64-encoded 48-byte
+ *   expected MEASUREMENT
+ * @param product - AMD product line (`"Milan"`/`"Genoa"`)
+ * @returns Verification result with the extracted measurement
+ */
+declare function verifySevSnpReport(reportB64: string, attestationMsgB64: string, collateral: SevSnpCollateral, expectedMeasurementB64: string | undefined, product: string): Promise<SevSnpVerifyResult>;
+/**
+ * Which vendor produced a raw quote/report — `"tdx"`, `"sev-snp"`, or
+ * `"unknown"`. Lets a caller decide whether it needs to fetch AMD KDS
+ * collateral for a given peer before calling {@link verifyDkgAttestation},
+ * without duplicating the WASM module's own quote-parsing logic in JS.
+ *
+ * @param quoteB64 - Base64-encoded raw quote/report bytes
+ */
+declare function detectQuoteVendor(quoteB64: string): Promise<"tdx" | "sev-snp" | "unknown">;
+/** Result of {@link sevSnpVcekUrl}. */
+interface VcekUrlResult {
+    url?: string;
+    error?: string;
+}
+/**
+ * Build the AMD KDS URL for an SEV-SNP report's VCEK leaf certificate —
+ * the one collateral endpoint whose URL depends on the report itself
+ * (`CHIP_ID` + the four `REPORTED_TCB` security-patch-level components).
+ * `cert_chain`/`crl` URLs need no report data and can be templated
+ * directly: `https://kdsintf.amd.com/vcek/v1/<product>/cert_chain` and
+ * `.../crl` — see `fetchSevSnpCollateral` in `sev-snp-kds.ts`, which
+ * assembles all three.
+ *
+ * This does no cryptographic verification — parsing a report proves
+ * nothing about its authenticity; it only reads two fields needed to
+ * address the KDS request.
+ *
+ * @param reportB64 - Base64-encoded raw SEV-SNP `ATTESTATION_REPORT`
+ * @param product - AMD product line (`"Milan"`/`"Genoa"`)
+ */
+declare function sevSnpVcekUrl(reportB64: string, product: string): Promise<VcekUrlResult>;
 
 /**
  * Configuration types for T3n Client
@@ -5780,6 +5903,32 @@ interface ConfigValidationResult {
     errors: string[];
 }
 
+/**
+ * Fetches the AMD KDS collateral (VCEK/VLEK leaf, intermediate chain,
+ * CRL) an SEV-SNP peer's report needs for offline verification (see
+ * {@link SevSnpCollateral}).
+ *
+ * Confirmed empirically: AMD's KDS (kdsintf.amd.com) sends
+ * `Access-Control-Allow-Origin: *` on all three endpoints below, so a
+ * browser can fetch them directly — no CORS proxy needed. This is the
+ * TypeScript half of the split responsibility `quote-verifier-loader.ts`
+ * documents: TypeScript fetches, WASM verifies fully offline against a
+ * pinned AMD root.
+ */
+
+/**
+ * Fetch the full AMD KDS collateral bundle (VCEK leaf, intermediate
+ * chain, CRL) needed to verify one SEV-SNP report, ready to pass as
+ * `verifyDkgAttestation`'s/`verifySevSnpReport`'s `SevSnpCollateral`
+ * argument.
+ *
+ * @param reportB64 - Base64-encoded raw SEV-SNP `ATTESTATION_REPORT`
+ * @param product - AMD product line (`"Milan"`/`"Genoa"`)
+ * @throws if the report can't be parsed for its VCEK URL, or any of the
+ *   three KDS fetches fails
+ */
+declare function fetchSevSnpCollateral(reportB64: string, product: string): Promise<SevSnpCollateral>;
+
 /**
  * Operator-signed trust-manifest distribution.
  *
@@ -5828,6 +5977,20 @@ interface SignedTrustManifest {
     rtmr3_allowlist: string[];
     /** Base64-encoded 48-byte RTMR1 measurements of the expected image(s). */
     rtmr1_allowlist: string[];
+    /**
+     * Base64-encoded 48-byte SEV-SNP MEASUREMENT values of the expected
+     * image(s) — applies only to peers whose quote is an SEV-SNP report
+     * (see `detectQuoteVendor`). Optional and defaults to `[]`: an
+     * all-TDX-fleet manifest, or one published before this field existed,
+     * simply omits it.
+     */
+    sev_snp_measurement_allowlist?: string[];
+    /**
+     * AMD product line (`"Milan"`/`"Genoa"`) the cluster's SEV-SNP nodes
+     * run on. Optional — required only if `sev_snp_measurement_allowlist`
+     * is non-empty.
+     */
+    sev_snp_product?: string;
     /** RFC 3339 timestamp the manifest was signed. */
     signed_at: string;
     /** Hex secp256k1 signature (compact 64-byte r‖s) over the canonical payload. */
@@ -6600,5 +6763,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isContractAgentCountsResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, detectQuoteVendor, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchSevSnpCollateral, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isContractAgentCountsResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, sevSnpVcekUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifySevSnpReport, verifyTdxQuote };
+export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetGrantsInput, SetRoleInput, SetWritersInput, SevSnpCollateral, SevSnpVerifyResult, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, VcekUrlResult, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };