@terminal3/t3n-sdk 5.25.0 → 5.27.0

package/dist/index.d.ts

@@ -1122,6 +1122,140 @@ declare class ContractResponseError extends T3nError {
  */
 declare function parseContractResponse<T = unknown>(raw: string, schema?: ContractResponseSchema<T>): T;
 
+/**
+ * Delegated agents and the T3N OAuth connections that act as them. Wire types
+ * and strict decoders for the `tee:organisation` functions the `T3nClient`
+ * wrappers dispatch.
+ */
+
+/**
+ * Create a harness agent: one the customer's IdP authenticates. The contract
+ * verifies `harnessIdToken` against `provider` and keys the agent on
+ * `(iss, user_id, clientId)`.
+ */
+interface CreateHarnessAgentParams {
+    /**
+     * Label of the node's configured OIDC provider (`Configs[provider:oidc]`)
+     * the token is verified against. Its configured `client_id` is the audience,
+     * so it must be the harness's client.
+     */
+    provider: string;
+    /** The caller's own ID token, issued by `provider` to the harness's client. */
+    harnessIdToken: string;
+    /** OAuth client the agent will authenticate as: the `azp` its tokens carry. */
+    clientId: string;
+    /** Display name, e.g. "Maria's Claude Agent". */
+    name: string;
+}
+/**
+ * Create a T3N agent: one a person picks for an MCP connection through the
+ * T3N authorization server. The caller's session is the proof of identity, so
+ * there is no token, and the session must be a person acting for themselves.
+ */
+interface CreateT3nAgentParams {
+    /** Label of the node's T3N provider row, the one whose keys the enclave holds. */
+    provider: string;
+    name: string;
+    harnessIdToken?: never;
+    clientId?: never;
+}
+/** Input to `T3nClient.createDelegatedAgent`. The provider row picks the arm. */
+type CreateDelegatedAgentParams = CreateHarnessAgentParams | CreateT3nAgentParams;
+/** A delegated per-user agent, as `create-delegated-agent` reports it. */
+interface DelegatedAgent {
+    agentDid: Did;
+    ownerDid: Did;
+    /** The name as stored, which the contract may have truncated. */
+    name: string;
+}
+/**
+ * `t3n` agents are pickable for an MCP connection; `harness` agents belong to
+ * a customer IdP's client and are not.
+ */
+type DelegatedAgentKind = "t3n" | "harness";
+/** One of the caller's delegated agents, from `list-delegated-agents`. */
+interface ListedDelegatedAgent {
+    agentDid: Did;
+    name: string;
+    createdSecs: number;
+    revokedAtSecs?: number;
+    kind: DelegatedAgentKind;
+    /** The harness's OAuth client, for a `harness` agent only. */
+    harnessClientId?: string;
+}
+/** Input to `T3nClient.describeOAuthClient`: the OAuth request's own fields. */
+interface DescribeOAuthClientParams {
+    clientId: string;
+    redirectUri: string;
+}
+/** How the client is identified: a fetched metadata document, a DCR id, or an operator row. */
+type OAuthClientKind = "cimd" | "dcr" | "registered";
+/** RFC 8252 class of the redirect URI, which sets the consent wording. */
+type OAuthRedirectClass = "loopback" | "private_scheme" | "https";
+/** What the consent page shows about a client, from `oauth-describe-client`. */
+interface OAuthClientDescription {
+    clientId: string;
+    kind: OAuthClientKind;
+    /**
+     * The `client_id` host for CIMD, the redirect origin or scheme for DCR, the
+     * operator's display name for a registered client.
+     */
+    identity: string;
+    /** Self-asserted by the client, so shown quoted and never trusted. */
+    clientName?: string;
+    redirectClass: OAuthRedirectClass;
+    redirectDisplay: string;
+    /**
+     * The authorization server's issuer, byte-exact: the RFC 9207 `iss` to put on
+     * every redirect back to the client, Deny and error redirects included.
+     */
+    iss: string;
+    /** Present only when the operator's `verified_clients` matches. Display only. */
+    verified?: {
+        displayName: string;
+    };
+}
+/** Input to `T3nClient.authoriseOAuthConnection`. */
+interface AuthoriseOAuthConnectionParams {
+    /** One of the caller's own, unrevoked T3N agents. */
+    agentDid: string;
+    clientId: string;
+    redirectUri: string;
+    /** Required unless the operator registered the client with `pkce: "if_sent"`. */
+    codeChallenge?: string;
+    /** Must be `S256` when a challenge is sent. */
+    codeChallengeMethod?: string;
+    /** Omitted means the one MCP resource this authorization server serves. */
+    resource?: string;
+    /** Space-separated; unknown scopes and `offline_access` are dropped, not refused. */
+    scope?: string;
+}
+/**
+ * The one-time code to hand back to the client. The caller redirects to
+ * `redirectUri` with `code`, the client's `state` and `iss`.
+ */
+interface OAuthAuthorisation {
+    code: string;
+    redirectUri: string;
+    /** The authorization server's issuer, sent as the RFC 9207 `iss` parameter. */
+    iss: string;
+}
+/** `expired` is a pending or active connection that time has ended, not yet swept. */
+type OAuthConnectionState = "pending" | "active" | "expired" | "revoked";
+/** One of the caller's OAuth connections, from `list-oauth-connections`. */
+interface OAuthConnection {
+    connectionId: string;
+    agentDid: Did;
+    agentName: string;
+    clientId: string;
+    /** The same identity the consent page showed for the client. */
+    clientDisplayHost: string;
+    createdSecs: number;
+    refreshedSecs?: number;
+    state: OAuthConnectionState;
+    revokedAtSecs?: number;
+}
+
 /**
  * Org-data wire types mirroring the org-data contract wire shapes.
  *
@@ -2399,8 +2533,20 @@ interface AuditBatch {
      * commit? `false` means the call rolled back or trapped, so an event's
      * `outcome: "success"` in this batch is the contract's *claim*, not a
      * committed fact — filter on this when you need only durable events.
+     * This holds for approval events too (`details.event_type` is
+     * `action.escalated`, `action.reviewed` or `action.executed`): a
+     * rolled-back approver batch can list `action.reviewed` as `success` next
+     * to a failed `action.executed`, so always check `committed`. Events in a
+     * batch share one timestamp and are ordered by their position in `events`.
      */
     committed: boolean;
+    /**
+     * Present when the platform, not a client, started this dispatch, for
+     * example `"hitl-resume:<run id>"` for a call resumed after a human
+     * approval. Absent for a client call. The id after the prefix may itself
+     * contain colons, so do not split on them.
+     */
+    origin?: string;
     events: AuditEvent[];
 }
 /**
@@ -2500,6 +2646,14 @@ interface ActivityEntry {
      * validated one.
      */
     roles?: string[];
+    /**
+     * Present when the node, not the caller, started the call, for example
+     * `"hitl-resume:<run id>"` for the call the node ran as the requester
+     * once an approval was granted. Stamped by the node, never by a contract.
+     * Absent when the caller started the call. The id after the prefix may
+     * itself contain colons, so do not split on them.
+     */
+    origin?: string;
     /**
      * Labels the contract chose for this call — the `custom` object it returned
      * in its response, which the node removes from the response and stores on
@@ -2841,28 +2995,6 @@ interface DescribeFunctionResult {
  * All cryptographic complexity is handled in WASM components.
  */
 
-/** Input to {@link T3nClient.createDelegatedAgent}. */
-interface CreateDelegatedAgentParams {
-    /**
-     * Label of the node's configured OIDC provider (`Configs[provider:oidc]`)
-     * the token is verified against. Its configured `client_id` is the audience,
-     * so it must be the harness's client.
-     */
-    provider: string;
-    /** The caller's own ID token, issued by `provider` to the harness's client. */
-    harnessIdToken: string;
-    /** OAuth client the agent will authenticate as: the `azp` its tokens carry. */
-    clientId: string;
-    /** Display name, e.g. "Maria's Claude Agent". */
-    name: string;
-}
-/** A delegated per-user agent, as `create-delegated-agent` reports it. */
-interface DelegatedAgent {
-    agentDid: Did;
-    ownerDid: Did;
-    /** The name as stored, which the contract may have truncated. */
-    name: string;
-}
 declare class T3nClient {
     private readonly config;
     private readonly transport;
@@ -3333,24 +3465,44 @@ declare class T3nClient {
         privateCardDeleted: boolean;
     }>;
     /**
-     * Create the caller's own delegated agent for an AI harness (AI-261).
+     * Create the caller's own delegated agent.
      *
      * Dispatches `create-delegated-agent` on `tee:organisation/contracts`. The
-     * contract verifies `harnessIdToken` in-enclave against `provider`, requires
-     * its identity to belong to the session's DID, and keys the agent on
-     * `(iss, user_id, clientId)`. So the session must be the person's own human
-     * DID, signed in through an OIDC provider, not an agent's or a stray key's.
+     * provider row that `params.provider` names picks the arm:
      *
-     * Not idempotent: a second call for the same identity and `clientId` is
-     * refused, and {@link revokeDelegatedAgent} is the only way to retire one.
+     * - **Harness agent** (`harnessIdToken` and `clientId` set): the contract
+     *   verifies the token in-enclave against `provider`, requires its identity
+     *   to belong to the session's DID, and keys the agent on
+     *   `(iss, user_id, clientId)`.
+     * - **T3N agent** (neither set, `provider` names the T3N row): the session is
+     *   the proof of identity, and the person can pick the agent for an MCP
+     *   connection.
+     *
+     * Either way the session must be the person's own human DID, acting for
+     * themselves. The contract refuses the harness fields on the T3N row, and
+     * their absence on a harness row.
      *
      * @throws {RpcError} when the contract refuses (token verification, a token
-     *   belonging to another DID, an existing agent, the per-owner cap)
+     *   belonging to another DID, a caller that is not a person, the per-owner cap)
      * @throws {ContractResponseError} when the response does not name the agent
+     * @throws {Error} before dispatch when only one of `harnessIdToken` and
+     *   `clientId` is set
      */
     createDelegatedAgent(params: CreateDelegatedAgentParams): Promise<DelegatedAgent>;
     /**
-     * Stop one of the caller's own delegated agents authenticating.
+     * The caller's own delegated agents, T3N and harness, revoked ones included.
+     *
+     * Dispatches `list-delegated-agents` on `tee:organisation/contracts`. Self
+     * only: an agent acting for its owner is refused. A harness agent's IdP user
+     * id is never returned.
+     *
+     * @throws {RpcError} when the contract refuses
+     * @throws {ContractResponseError} when the response does not match its shape
+     */
+    listDelegatedAgents(): Promise<ListedDelegatedAgent[]>;
+    /**
+     * Stop one of the caller's own delegated agents authenticating, T3N or
+     * harness. A T3N agent's OAuth connections are refused from their next call.
      *
      * Dispatches `revoke-delegated-agent` on `tee:organisation/contracts`.
      * Revocation marks the agent's record; its DID and registry record remain.
@@ -3362,6 +3514,58 @@ declare class T3nClient {
     revokeDelegatedAgent(agentDid: string): Promise<{
         agentDid: Did;
     }>;
+    /**
+     * What the consent page shows about an OAuth client, before any
+     * authorisation. Read only.
+     *
+     * Dispatches `oauth-describe-client` on `tee:organisation/contracts`. The
+     * enclave fetches a CIMD client's metadata document itself and checks
+     * `redirectUri` against the client's registration and the operator's
+     * policy. On a refusal the page shows the error and does not redirect.
+     *
+     * @throws {RpcError} on an invalid client or redirect URI, carrying the
+     *   contract's typed code (`invalid_client_id`, `redirect_uri_not_registered`, …)
+     * @throws {ContractResponseError} when the response does not match its shape
+     */
+    describeOAuthClient(params: DescribeOAuthClientParams): Promise<OAuthClientDescription>;
+    /**
+     * Let an OAuth client act as one of the caller's own T3N agents, and get the
+     * one-time code to send back to it.
+     *
+     * Dispatches `oauth-authorise` on `tee:organisation/contracts`. The session
+     * must be a person acting for themselves. The code is bound to the client,
+     * the redirect URI, the resource and the PKCE challenge; the client redeems
+     * it at the node's token endpoint.
+     *
+     * @throws {RpcError} when the contract refuses (client or redirect checks,
+     *   PKCE, resource, an agent the caller does not own or has revoked, the
+     *   per-person connection cap)
+     * @throws {ContractResponseError} when the response does not match its shape
+     */
+    authoriseOAuthConnection(params: AuthoriseOAuthConnectionParams): Promise<OAuthAuthorisation>;
+    /**
+     * The caller's own OAuth connections, including revoked and expired ones
+     * not yet swept. Self only.
+     *
+     * Dispatches `list-oauth-connections` on `tee:organisation/contracts`.
+     *
+     * @throws {RpcError} when the contract refuses
+     * @throws {ContractResponseError} when the response does not match its shape
+     */
+    listOAuthConnections(): Promise<OAuthConnection[]>;
+    /**
+     * Revoke one of the caller's own OAuth connections. Its refresh token stops
+     * working at once; an access token already issued runs to its expiry. The
+     * agent is untouched. Idempotent.
+     *
+     * Dispatches `revoke-oauth-connection` on `tee:organisation/contracts`.
+     *
+     * @throws {RpcError} when the caller owns no connection with that id
+     * @throws {ContractResponseError} when the response does not name the connection
+     */
+    revokeOAuthConnection(connectionId: string): Promise<{
+        connectionId: string;
+    }>;
     /**
      * Provision a fresh org-owned agent.
      *
@@ -3498,8 +3702,6 @@ declare class T3nClient {
      * `did:t3n:<40 hex>` or bare 40 hex.
      */
     private static didToWire;
-    /** Read a DID field (`did:t3n:<40 hex>` or bare hex) from a contract response. */
-    private static didFromResponse;
     /**
      * Resolve the deployed version of `contractId`, refusing before any dispatch
      * when it is older than the caller needs, with a message naming the version the
@@ -4314,11 +4516,13 @@ declare function createRandomHandler(): GuestToHostHandler;
 declare function createDefaultHandlers(baseUrl: string, trustAnchor: TrustAnchorOrUnsafe): GuestToHostHandlers;
 
 /**
- * Stateless `api_key` agent auth.
+ * Stateless agent auth: an API key or an OAuth bearer.
  *
  * `invoke` posts once to `POST /api/invoke` — an HTTPS-only
- * endpoint (see the HTTPS-guard note below) that authenticates an org agent
- * by an opaque API key (`X-T3N-Api-Key: t3n_key_<...>`) and executes a
+ * endpoint (see the HTTPS-guard note below) that authenticates an agent by
+ * one {@link StatelessCredential}: an org agent's opaque API key
+ * (`X-T3N-Api-Key: t3n_key_<...>`) or a delegated agent's OAuth access token
+ * (`Authorization: Bearer <token>`), and executes a
  * `z:` contract as that agent in the SAME request. Unlike
  * {@link T3nClient.execute}, there is **no** ML-KEM handshake, **no**
  * `Session-Id`, and **no** session state: the node derives the acting agent
@@ -4390,26 +4594,38 @@ interface InvokeRequest {
     pii_did?: string;
     input?: unknown;
 }
+/**
+ * The credential `/api/invoke` and `/api/discover` resolve, exactly one of:
+ *
+ * - `apiKey`: an org agent's opaque API key (`t3n_key_<...>`), sent as
+ *   `X-T3N-Api-Key`;
+ * - `bearer`: a delegated agent's OAuth access token, sent as
+ *   `Authorization: Bearer <token>`.
+ *
+ * The node resolves either on the same routes (its `stateless_credential`
+ * action tries the bearer first). Relayed verbatim, never logged and never
+ * interpolated into any error this module throws.
+ */
+type StatelessCredential = {
+    apiKey: string;
+    bearer?: never;
+} | {
+    bearer: string;
+    apiKey?: never;
+};
 /** Options for {@link invoke}. */
-interface InvokeOptions {
+type InvokeOptions = StatelessCredential & {
     /**
      * RPC base URL of the T3n node, e.g. `https://node.example.com`. Must be
      * `https:` unless the host is a local-dev loopback (`localhost` /
      * `127.0.0.1` / `[::1]`) — see the module doc comment's HTTPS-guard note.
      */
     baseUrl: string;
-    /**
-     * The agent's opaque API key (`t3n_key_<...>`), relayed verbatim in the
-     * `X-T3N-Api-Key` header. Never logged and never interpolated into any
-     * error this module throws — see the module doc comment and
-     * {@link InvokeError}.
-     */
-    apiKey: string;
     /** The wire request to execute, built to the {@link InvokeRequest} shape. */
     request: InvokeRequest;
     /** Fetch timeout in ms. Defaults to 30s, matching {@link HttpTransport}. */
     timeoutMs?: number;
-}
+};
 /**
  * Thrown when `POST /api/invoke` fails at the transport or HTTP
  * layer (network failure, timeout, non-2xx status). Contract-level errors
@@ -4429,8 +4645,9 @@ declare class InvokeError extends T3nError {
     constructor(message: string, status?: number | undefined);
 }
 /**
- * Execute a `z:` contract as an org agent, authenticating with an opaque
- * API key — one request, no handshake, no session.
+ * Execute a `z:` contract as an agent, authenticating with an API key or an
+ * OAuth bearer ({@link StatelessCredential}) — one request, no handshake, no
+ * session.
  *
  * @param opts - baseUrl, apiKey, and the wire request to execute
  * @param schema - optional validator applied to the decoded result (e.g. a
@@ -4448,24 +4665,18 @@ declare function invoke<T = unknown>(opts: InvokeOptions, schema?: ContractRespo
  * half of {@link InvokeOptions} (no `request`; the operation params are the
  * second argument of each read). Same HTTPS + secret-hygiene rules as `invoke`.
  */
-interface DiscoverOptions {
+type DiscoverOptions = StatelessCredential & {
     /**
      * RPC base URL of the T3n node, e.g. `https://node.example.com`. Must be
      * `https:` unless the host is a local-dev loopback — see
      * {@link InvokeOptions.baseUrl}.
      */
     baseUrl: string;
-    /**
-     * The agent's opaque API key (`t3n_key_<...>`), relayed verbatim in the
-     * `X-T3N-Api-Key` header. Never logged and never interpolated into any
-     * error this module throws.
-     */
-    apiKey: string;
     /** Fetch timeout in ms. Defaults to 30s, matching {@link invoke}. */
     timeoutMs?: number;
-}
+};
 /**
- * `whoami` — resolve the DID the relayed key maps to. The node never
+ * `whoami` — resolve the DID the relayed credential maps to. The node never
  * trusts a caller-supplied DID; this is the relay's sole DID source.
  *
  * @throws {InvokeError} if `baseUrl` is insecure, on a network failure/timeout,
@@ -6624,4 +6835,4 @@ declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
 export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, detectQuoteVendor, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fanOutGrant, fetchDkgAttestation, fetchMlKemPublicKey, fetchSevSnpCollateral, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isContractAgentCountsResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseContractResponse, parseMemberDelegationDoc, readOnlyScopes, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, sevSnpVcekUrl, stringToBytes, tenantDidHex, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifySevSnpReport, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreateDelegatedAgentParams, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegatedAgent, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, ScopeAccessVerb, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetRoleInput, SetWritersInput, SevSnpCollateral, SevSnpVerifyResult, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserInputProfile, UserUpsertErrorKind, Validity, VcekUrlResult, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WireScope, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, AuthoriseOAuthConnectionParams, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ComputePayrollRequest, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreateDelegatedAgentParams, CreateHarnessAgentParams, CreatePolicyInput, CreateT3nAgentParams, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegatedAgent, DelegatedAgentKind, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DescribeOAuthClientParams, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, ListedDelegatedAgent, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OAuthAuthorisation, OAuthClientDescription, OAuthClientKind, OAuthConnection, OAuthConnectionState, OAuthRedirectClass, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, ScopeAccessVerb, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetRoleInput, SetWritersInput, SevSnpCollateral, SevSnpVerifyResult, SignedTrustManifest, StatelessCredential, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserInputProfile, UserUpsertErrorKind, Validity, VcekUrlResult, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WireScope, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };