@terminal3/t3n-sdk 5.20.0 → 5.22.0

package/dist/index.d.ts

@@ -1232,25 +1232,6 @@ interface BoundGrant {
     /** Agent edge only: optional validity time-box. */
     window?: Validity;
 }
-/**
- * Capability grant in the pre-collapse (`UserGrant`) wire shape — the element
- * of the legacy `org-policy-set-grants` input and `org-grants-get` output. The
- * grantee is carried as `user_did` (not `grantee`), and there is no
- * `contract_id` on the element (the enclosing {@link OrgContractGrants} carries
- * it) nor any agent-edge qualifiers.
- *
- * @deprecated Use {@link BoundGrant}. Retained so consumers on the legacy
- * org-grant vocabulary keep compiling and decoding while the contract still
- * emits this shape during the delegation-vocabulary deprecation window.
- */
-interface UserGrant {
-    /** The user this grant applies to (`did:t3n:<40-hex>`). */
-    user_did: string;
-    /** WIT function names the user may invoke (e.g. `"set-records"`). */
-    functions: string[];
-    /** Data scope paths the user may access (e.g. `"example/records"`). */
-    scopes: string[];
-}
 /**
  * Policy record for an organisation's data tier.
  *
@@ -1406,29 +1387,6 @@ interface OrgContractDelegation {
  * for their shape.
  */
 declare function isOrgContractDelegation(value: unknown): value is OrgContractDelegation;
-/**
- * Response type alias for the legacy `org-grants-get`.
- *
- * Same envelope as {@link OrgContractDelegation} (`contract_id` + a grant
- * list), but each grant is the legacy {@link UserGrant} shape (`user_did`
- * rather than `grantee`), matching what the contract emits during the
- * deprecation window.
- *
- * @deprecated Use {@link OrgContractDelegation}.
- */
-interface OrgContractGrants {
-    contract_id: string;
-    grants: UserGrant[];
-}
-/**
- * Shallow runtime guard for {@link OrgContractGrants}. Validates the immediate
- * envelope (`contract_id: string`, `grants: array`) only — the same structural
- * check as {@link isOrgContractDelegation}, since the two responses share an
- * envelope and differ only in the grant element shape.
- *
- * @deprecated Use {@link isOrgContractDelegation}.
- */
-declare function isOrgContractGrants(value: unknown): value is OrgContractGrants;
 /**
  * One grant inside a role: a capability body (functions + scopes, without the
  * grantee, which is bound at assignment time) plus the target contract.
@@ -1910,163 +1868,6 @@ interface RemoveTarget {
     contract_id?: string;
 }
 
-/**
- * Agent-auth grants — the pre-collapse (camelCase) delegation surface, retained
- * as a deprecated compatibility layer alongside the flat, snake_case
- * {@link MemberDelegationDoc} surface in `./member-delegation`.
- *
- * `AGENT_AUTH_MAP` is keyed by the *user* DID — one policy document per user,
- * global across orgs, with at most one entry per agent DID. Reads
- * (`agent-auth-get`) and writes (`agent-auth-update`) on
- * `tee:authorisations/contracts` (the policy's owning contract) are
- * **SelfOnly**: only the user, authenticated as themselves, may read or write
- * their own grants.
- *
- * The write shape carries `scopes` + a validity window: the agent's delegated
- * org-data scopes, and an optional `[valid_from_secs, valid_until_secs]`
- * window. The ≤ cap *length* check is enforced contract-side at write time; the
- * expiry gate is host-side at read time.
- *
- * The merge below is a script-level union: writing a grant for one
- * `(agent_did, script_name)` preserves every other script row on that agent's
- * entry, and every other agent's entry, unchanged.
- *
- * @deprecated Use `./member-delegation` (`MemberDelegationDoc`,
- * `parseMemberDelegationDoc`, `mergeGrants`) and the `*MemberDelegation*`
- * client methods. This module maps onto the legacy `agent-auth-*` wire the
- * contract still accepts during the delegation-vocabulary deprecation window.
- */
-
-/**
- * A single script grant in the camelCase write-request shape.
- *
- * @deprecated Use `BoundGrant` from `../org-data/types`.
- */
-interface AgentAuthScriptGrant {
-    /** Contract name, or `"*"`. */
-    scriptName: string;
-    /** Optional semver requirement; `null` to match any version. */
-    versionReq?: string | null;
-    /** Functions the agent may invoke on this contract. */
-    functions: string[];
-    /** Org-data scopes delegated to the agent for the contract functions to
-     *  read on its behalf. */
-    scopes?: string[];
-    /** Direct-read scopes the agent may enumerate itself, via whichever read
-     *  function the contract exposes for direct enumeration. A strict subset of
-     *  `scopes` (enforced contract-side). */
-    readScopes?: string[];
-    /** Optional validity-window start (unix seconds). */
-    validFromSecs?: number | null;
-    /** Optional validity-window end (unix seconds). */
-    validUntilSecs?: number | null;
-    /** Egress hosts the agent may reach for this contract. */
-    allowedHosts: string[];
-}
-/**
- * One agent's entry in the write-request shape.
- *
- * @deprecated Use the flat `BoundGrant` list on `MemberDelegationDoc`.
- */
-interface AgentAuthEntry {
-    agentDid: string;
-    scripts: AgentAuthScriptGrant[];
-}
-/**
- * The full agent-auth policy document in the camelCase write shape:
- * the per-agent grants plus the document-level discovery grants.
- *
- * `discoverDids` (contract wire: `discover_dids`) is the list of DIDs the user
- * lets their registered agents *enumerate the contracts of* via
- * `listContracts`: an org DID grants org-mode discovery, the user's own DID
- * grants self-mode discovery. It lives at document level — not on a script
- * grant — because discovery must surface contracts the agent cannot yet call.
- * The node's discovery gate additionally requires the calling agent to be named
- * in `agents` (subject binding), so an unregistered agent discovers nothing
- * regardless of this list.
- *
- * Every entry must be a canonical `did:t3n:<40-hex>` identifier. The legacy
- * document is converted onto the current one before it is stored, and that
- * conversion decodes each entry, so anything else refuses the write with the
- * failing index named.
- *
- * @deprecated Use {@link MemberDelegationDoc}.
- */
-interface AgentAuthPolicy {
-    agents: AgentAuthEntry[];
-    /** Document-level discovery grants (`did:t3n:<40-hex>` entries). */
-    discoverDids: string[];
-}
-/**
- * Parse a full `agent-auth-get` response (the stored snake_case policy
- * document) into the camelCase write shape, including the document-level
- * `discover_dids`. A `null` / absent response is the empty policy.
- *
- * @deprecated Use `parseMemberDelegationDoc`.
- */
-declare function parseAgentAuthPolicy(response: unknown): AgentAuthPolicy;
-/**
- * Extract the `agents` array from an `agent-auth-get` response.
- *
- * @deprecated Read `MemberDelegationDoc.grants` instead.
- */
-declare function parseAgentAuthGet(response: unknown): AgentAuthEntry[];
-/** @deprecated Use `GrantsMergeResult` from `./member-delegation`. */
-interface AgentAuthMergeResult {
-    /** Full merged `agents` list, ready for `agent-auth-update`. */
-    agents: AgentAuthEntry[];
-    /** `"<agentDid> → <scriptName>"` rows preserved from the existing policy. */
-    preservedRows: string[];
-}
-/**
- * Input to the full-document write {@link T3nClient.agentAuthUpdate}. The
- * document IS the new state: an empty `agents` list revokes all agent access,
- * and an omitted / empty `discoverDids` persists an empty discovery-grant list
- * (the contract has no per-field merge). Mirrors the contract `AgentAuthPolicy`.
- *
- * @deprecated Use {@link MemberDelegationDoc}.
- */
-interface AgentAuthUpdateInput {
-    agents: AgentAuthEntry[];
-    /** Document-level discovery grants — see {@link AgentAuthPolicy}. */
-    discoverDids?: string[];
-}
-/**
- * Serialise a camelCase policy document to the contract's canonical snake_case
- * `agent-auth-update` wire (`agent_did` / `script_name` / `version_req` /
- * `read_scopes` / `valid_from_secs` / `valid_until_secs` / `allowed_hosts` /
- * `discover_dids`). Absent optionals are omitted (never sent as `null`); empty
- * `scopes` / `read_scopes` are omitted (the contract defaults both to empty).
- * `functions` and `allowed_hosts` are always emitted — the contract requires
- * explicit functions (`["*"]` = all) and reads an absent `allowed_hosts` as
- * deny-all egress. The document-level `discover_dids` is emitted only when
- * non-empty; the contract defaults an absent list to empty.
- *
- * Discovery DIDs are copied through verbatim — no canonicalisation, no dedupe —
- * so a non-canonical or repeated entry is refused by the contract rather than
- * quietly repaired here. Build the list with `mergeDiscoverDids`.
- *
- * @deprecated The new write path passes `MemberDelegationDoc` straight through
- * with no casing transform.
- */
-declare function toAgentAuthUpdateWire(agents: AgentAuthEntry[], discoverDids?: string[]): {
-    agents: Array<{
-        agent_did: string;
-        scripts: Array<Record<string, unknown>>;
-    }>;
-    discover_dids?: string[];
-};
-/**
- * Merge new agent entries into the existing policy with script-level union
- * semantics: for an agent DID present on both sides, script rows whose
- * `scriptName` is not being written are preserved; rows with a matching
- * `scriptName` are replaced by the new grant. Entries for other agent DIDs
- * pass through unchanged.
- *
- * @deprecated Use `mergeGrants` from `./member-delegation`.
- */
-declare function mergeAgentAuthEntries(existing: AgentAuthEntry[], newEntries: AgentAuthEntry[]): AgentAuthMergeResult;
-
 /**
  * KYC types for the `tee:user/contracts::kyc-status` short-poll
  * function.
@@ -3074,6 +2875,14 @@ declare class T3nClient {
      */
     private finalizedPayload;
     private did;
+    /**
+     * Address the last OIDC login proved, read from its `Finish` reply.
+     * `null` when the login proved none — the claim its provider row governs
+     * carried no usable address — which is the case that still needs
+     * `otpRequest` / `otpVerify` before `submitUserInput`.
+     * Exposed through {@link getProvenEmail}.
+     */
+    private provenEmail;
     private handshakeResult;
     constructor(config: T3nClientConfig);
     /**
@@ -3130,7 +2939,9 @@ declare class T3nClient {
      * Validates the `oidc_auth_action` tag before reading `did`: a decodable but
      * non-`Finish` reply is reported as such rather than silently misread as a
      * missing DID (which would discard whatever the server actually said). Returns
-     * the session {@link Did}.
+     * the session {@link Did}, and records the reply's `proven_email` — absent on
+     * the workload reply and on any node older than the field — for
+     * {@link getProvenEmail}.
      */
     private parseFinishDid;
     /**
@@ -4100,68 +3911,6 @@ declare class T3nClient {
      *   too many delegatees/grants).
      */
     memberDelegationUpdate(input: MemberDelegationDoc): Promise<void>;
-    /**
-     * Revoke the caller's own agent delegations scoped to one org (detach-cascade
-     * `agent_auth` half). Dispatches `agent-auth-revoke-org` on
-     * `tee:user/contracts` (**SelfOnly**): every grant targeting a `z:<orgTid>:*`
-     * contract is removed from the caller's own delegation document.
-     *
-     * @param orgTid - the org's z-space tenant id (`did:t3n:<hex>` or bare
-     *   40-hex) — i.e. the `<tid>` in the org's `z:<tid>:…` contract names
-     * @deprecated Use {@link T3nClient.revokeMemberDelegationForOrg}.
-     */
-    revokeAgentAuthForOrg(orgTid: string): Promise<void>;
-    /**
-     * Read the authenticated user's own agent-auth policy — the standing grants
-     * delegated to agents — in the legacy camelCase shape. Dispatches
-     * `agent-auth-get` on `tee:authorisations/contracts` (**SelfOnly**), so this
-     * always returns the caller's own policy document.
-     *
-     * @returns the full policy document normalised to the camelCase write shape:
-     *   the per-agent `agents` entries plus the document-level `discoverDids`
-     *   discovery grants
-     * @throws if the session is not authenticated, or the contract refuses
-     * @deprecated Use {@link T3nClient.getMemberDelegation}.
-     */
-    getAgentAuth(): Promise<AgentAuthPolicy>;
-    /**
-     * Authorise an agent for one contract on the caller's own behalf, in the
-     * legacy camelCase shape. Read-merge-writes the caller's policy document via
-     * `agent-auth-update` (**SelfOnly**) with script-level union semantics, so
-     * other contracts' grants for this or any agent survive untouched.
-     *
-     * @param agentDid - the agent DID being authorised
-     * @param grant - the single script grant to set (contract, functions,
-     *   scopes, validity, egress hosts)
-     * @param options - optional `discoverDids` to union into the document's
-     *   discovery grants
-     * @returns the script rows preserved from the existing policy (audit aid)
-     * @throws if the session is not authenticated, or the contract refuses
-     * @deprecated Use {@link T3nClient.updateMemberDelegation} (note it drops the
-     *   leading `agentDid` argument — the `grantee` lives on the grant).
-     */
-    updateAgentAuth(agentDid: string, grant: AgentAuthScriptGrant, options?: {
-        discoverDids?: string[];
-    }): Promise<{
-        preservedRows: string[];
-    }>;
-    /**
-     * Replace this user's agent-authorisation policy in the legacy camelCase
-     * shape (`tee:authorisations/contracts` → `agent-auth-update`). The supplied
-     * document IS the new state: an empty `agents` array revokes all agent
-     * access, and an omitted `discoverDids` persists an empty discovery-grant
-     * list. Use {@link T3nClient.updateAgentAuth} for the single-grant
-     * read-merge-write.
-     *
-     * The SDK emits the canonical snake_case wire via {@link toAgentAuthUpdateWire}
-     * (carrying `scopes` / `read_scopes` / validity alongside `functions` /
-     * `allowed_hosts`, plus the document-level `discover_dids`).
-     *
-     * @throws {RpcError} if the contract rejects the policy (validation failure,
-     *   too many agents/grants).
-     * @deprecated Use {@link T3nClient.memberDelegationUpdate}.
-     */
-    agentAuthUpdate(input: AgentAuthUpdateInput): Promise<void>;
     /**
      * Add a batch of grants to the caller's own delegation edges
      * (`tee:authorisations/contracts` → `member-delegation-add-grants`,
@@ -4290,6 +4039,14 @@ declare class T3nClient {
     getSessionId(): SessionId | null;
     getStatus(): SessionStatus;
     getDid(): Did | null;
+    /**
+     * The address the last OIDC login proved, or `null` if it proved none.
+     *
+     * Lets a caller prompt for an address at the point of entry rather than
+     * discovering it is missing from an `email_not_verified` refusal on
+     * `submitUserInput`. A node older than this field always reports `null`.
+     */
+    getProvenEmail(): string | null;
     getLastSetCookie(): string | null;
     getLastResponseHeaders(): Record<string, string>;
     isAuthenticated(): boolean;
@@ -4812,26 +4569,6 @@ interface OrgDelegationDeleteInput {
     orgDid: string;
     contractId: string;
 }
-/**
- * Legacy input for {@link OrgDataClient.setGrants}. Carries the full
- * {@link UserGrant} list verbatim (grantee as `user_did`).
- *
- * @deprecated Use {@link OrgDelegationSetInput}.
- */
-interface SetGrantsInput {
-    orgDid: string;
-    contractId: string;
-    grants: UserGrant[];
-}
-/**
- * Legacy input for {@link OrgDataClient.deleteGrants}.
- *
- * @deprecated Use {@link OrgDelegationDeleteInput}.
- */
-interface DeleteGrantsInput {
-    orgDid: string;
-    contractId: string;
-}
 /**
  * Add a batch of org→grantee grants via {@link OrgDataClient.addDelegationGrants}.
  *
@@ -5014,16 +4751,6 @@ interface OrgRemoveMemberDelegationInput {
     /** DID (`did:t3n:<40-hex>` or bare hex) to drop from every grant list. */
     memberDid: string;
 }
-/**
- * Legacy input for {@link OrgDataClient.removeMemberGrants}.
- *
- * @deprecated Use {@link OrgRemoveMemberDelegationInput}.
- */
-interface RemoveMemberGrantsInput {
-    orgDid: string;
-    /** DID (`did:t3n:<40-hex>` or bare hex) to drop from every grant list. */
-    memberDid: string;
-}
 interface PolicyGetInput {
     orgDid: string;
 }
@@ -5035,15 +4762,6 @@ interface OrgDelegationGetInput {
     orgDid: string;
     contractId: string;
 }
-/**
- * Legacy input for {@link OrgDataClient.grantsGet}.
- *
- * @deprecated Use {@link OrgDelegationGetInput}.
- */
-interface GrantsGetInput {
-    orgDid: string;
-    contractId: string;
-}
 interface DataListInput {
     orgDid: string;
     scope: string;
@@ -5186,15 +4904,6 @@ declare class OrgDataClient {
      * Delete the grant entry for a contract entirely.
      */
     deleteDelegation(input: OrgDelegationDeleteInput): Promise<MutationResponse>;
-    /**
-     * Full replacement of the user-grant list for a contract, in the legacy
-     * `UserGrant` wire shape (grantee as `user_did`). Passing an empty list
-     * removes the entry. Dispatches the legacy `org-policy-set-grants` function
-     * the contract still accepts during the deprecation window.
-     *
-     * @deprecated Use {@link OrgDataClient.setDelegation}.
-     */
-    setGrants(input: SetGrantsInput): Promise<MutationResponse>;
     /**
      * Add a batch of org→grantee grants (org-admin only).
      *
@@ -5211,13 +4920,6 @@ declare class OrgDataClient {
      * verbatim (each already carries its `contract_id`).
      */
     addDelegationGrants(input: OrgDelegationAddGrantsInput): Promise<MutationResponse>;
-    /**
-     * Delete the grant entry for a contract entirely, via the legacy
-     * `org-policy-delete-grants` function.
-     *
-     * @deprecated Use {@link OrgDataClient.deleteDelegation}.
-     */
-    deleteGrants(input: DeleteGrantsInput): Promise<MutationResponse>;
     /**
      * Remove a batch of `(grantee, contract_id)` org grants (org-admin only).
      *
@@ -5374,13 +5076,6 @@ declare class OrgDataClient {
      * `deleted_entries` reports how many contract grant lists were rewritten.
      */
     removeMemberDelegation(input: OrgRemoveMemberDelegationInput): Promise<MutationResponse>;
-    /**
-     * Detach-cascade grant sweep via the legacy `org-remove-member-grants`
-     * function.
-     *
-     * @deprecated Use {@link OrgDataClient.removeMemberDelegation}.
-     */
-    removeMemberGrants(input: RemoveMemberGrantsInput): Promise<MutationResponse>;
     /** Read the policy metadata for an org (admin-only). */
     policyGet(input: PolicyGetInput): Promise<OrgPolicyMeta>;
     /**
@@ -5438,13 +5133,6 @@ declare class OrgDataClient {
      * live is still returned.
      */
     getDelegation(input: OrgDelegationGetInput): Promise<OrgContractDelegation>;
-    /**
-     * Read the grant list for a contract (admin-only) in the legacy `UserGrant`
-     * wire shape, via the legacy `org-grants-get` function.
-     *
-     * @deprecated Use {@link OrgDataClient.getDelegation}.
-     */
-    grantsGet(input: GrantsGetInput): Promise<OrgContractGrants>;
     /**
      * List entry IDs for a scope (admin-only), paginated.
      *
@@ -5553,20 +5241,8 @@ declare class SessionOrgDataClient {
     setDelegation(input: OrgDelegationSetInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.deleteDelegation}. */
     deleteDelegation(input: OrgDelegationDeleteInput): Promise<MutationResponse>;
-    /**
-     * Mirrors {@link OrgDataClient.setGrants}.
-     *
-     * @deprecated Use {@link SessionOrgDataClient.setDelegation}.
-     */
-    setGrants(input: SetGrantsInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.addDelegationGrants}. */
     addDelegationGrants(input: OrgDelegationAddGrantsInput): Promise<MutationResponse>;
-    /**
-     * Mirrors {@link OrgDataClient.deleteGrants}.
-     *
-     * @deprecated Use {@link SessionOrgDataClient.deleteDelegation}.
-     */
-    deleteGrants(input: DeleteGrantsInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.removeDelegationGrants}. */
     removeDelegationGrants(input: OrgDelegationRemoveGrantsInput): Promise<MutationResponse>;
     /**
@@ -5625,12 +5301,6 @@ declare class SessionOrgDataClient {
     purgeOrg(input: PurgeOrgInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.removeMemberDelegation}. */
     removeMemberDelegation(input: OrgRemoveMemberDelegationInput): Promise<MutationResponse>;
-    /**
-     * Mirrors {@link OrgDataClient.removeMemberGrants}.
-     *
-     * @deprecated Use {@link SessionOrgDataClient.removeMemberDelegation}.
-     */
-    removeMemberGrants(input: RemoveMemberGrantsInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.policyGet}. */
     policyGet(input: PolicyGetInput): Promise<OrgPolicyMeta>;
     /** Mirrors {@link OrgDataClient.policyView}. */
@@ -5641,12 +5311,6 @@ declare class SessionOrgDataClient {
     writersGet(input: WritersGetInput): Promise<OrgWriters>;
     /** Mirrors {@link OrgDataClient.getDelegation}. */
     getDelegation(input: OrgDelegationGetInput): Promise<OrgContractDelegation>;
-    /**
-     * Mirrors {@link OrgDataClient.grantsGet}.
-     *
-     * @deprecated Use {@link SessionOrgDataClient.getDelegation}.
-     */
-    grantsGet(input: GrantsGetInput): Promise<OrgContractGrants>;
     /** Mirrors {@link OrgDataClient.dataList}. */
     dataList(input: DataListInput): Promise<DataListResponse>;
     /** Mirrors {@link OrgDataClient.dataGet}. */
@@ -6886,5 +6550,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, detectQuoteVendor, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fanOutGrant, fetchDkgAttestation, fetchMlKemPublicKey, fetchSevSnpCollateral, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isContractAgentCountsResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, readOnlyScopes, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, sevSnpVcekUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifySevSnpReport, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, ScopeAccessVerb, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetGrantsInput, SetRoleInput, SetWritersInput, SevSnpCollateral, SevSnpVerifyResult, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, VcekUrlResult, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WireScope, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, detectQuoteVendor, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fanOutGrant, fetchDkgAttestation, fetchMlKemPublicKey, fetchSevSnpCollateral, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isContractAgentCountsResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseContractResponse, parseMemberDelegationDoc, readOnlyScopes, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, sevSnpVcekUrl, stringToBytes, tenantDidHex, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifySevSnpReport, verifyTdxQuote };
+export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, ScopeAccessVerb, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetRoleInput, SetWritersInput, SevSnpCollateral, SevSnpVerifyResult, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserInputProfile, UserUpsertErrorKind, Validity, VcekUrlResult, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WireScope, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };