@terminal3/t3n-sdk 5.7.0 → 5.8.0

package/dist/index.d.ts

@@ -1464,7 +1464,7 @@ interface DataGetResponse {
 declare function isDataGetResponse(value: unknown): value is DataGetResponse;
 /**
  * Return shape of `agentCardGet` — composed client-side from the generic
- * `org-data-get` read of the card's entry (there is no card-specific read
+ * `org-data-get` read of the card's entry (reads have no card-specific
  * operation on the contract). To check whether a public copy exists, probe
  * the anonymous `GET /api/agent-card/{did}` endpoint.
  */
@@ -2724,9 +2724,6 @@ interface DescribeFunctionResult {
  * All cryptographic complexity is handled in WASM components.
  */
 
-/**
- * Main T3n SDK Client
- */
 declare class T3nClient {
     private readonly config;
     private readonly transport;
@@ -3095,6 +3092,97 @@ declare class T3nClient {
      *   empty / too long)
      */
     createOrganisation(name: string): Promise<Did>;
+    /**
+     * Tear down an org-owned agent, credentials and all.
+     *
+     * A single `delete-agent` dispatch on `tee:organisation/contracts`: the
+     * contract removes the agent's `public:agent_registry` row and its membership
+     * edges, and invokes `tee:org-data.org-agent-footprint-delete` in the same
+     * consensus tx for every organisation the agent belongs to — that org's
+     * authority edges, every member's delegation edge to the agent, the
+     * reverse-index rows they name, the agent's self-egress edge, and both copies
+     * of its card. Everything commits or rolls back together, so a refusal leaves
+     * the agent intact with working credentials rather than half deleted.
+     *
+     * The contract gates on the caller being an admin of `orgDid`, on the agent
+     * carrying that org's membership row, and on the agent classifying positively
+     * as an agent — a DID it cannot classify is refused rather than deleted.
+     *
+     * The agent's API keys are not enumerated and not revoked one by one: they
+     * stop working because API-key authentication requires the key's principal to
+     * still exist (its `did_kinds` classification row), and this delete removes
+     * that row.
+     *
+     * @param orgDid - an organisation the caller administers and the agent belongs
+     *   to (`did:t3n:<hex>` or bare hex)
+     * @param agentDid - the agent to tear down
+     * @returns what the teardown swept: organisations, authority edges, and
+     *   whether a registry row existed
+     * @throws if the session is not authenticated, if the deployed contract
+     *   predates `delete-agent`, or if the contract refuses (including a refused
+     *   footprint sweep)
+     */
+    deleteAgent(orgDid: string, agentDid: string): Promise<{
+        orgsSwept: number;
+        edgesPurged: number;
+        registryRecordDeleted: boolean;
+    }>;
+    /**
+     * Edit an org-owned agent's registry record — the admin-side counterpart to
+     * the agent's own `agentSetCard`, which only the agent's own session can call.
+     *
+     * Dispatches `update-agent` on `tee:organisation/contracts`; the contract
+     * gates on the caller being an admin of `orgDid` and on the agent carrying that
+     * org's membership row. At least one field must be given.
+     *
+     * Three-way per field: omitting it preserves the stored value, an empty string
+     * clears it, a value sets it. `ownerDid` is the publish-consent link
+     * `agentCardPublish` checks.
+     *
+     * The agent's display NAME is not here — it lives in the card, edited with
+     * {@link agentCardSet}.
+     *
+     * @param orgDid - an organisation the caller administers and the agent belongs to
+     * @param agentDid - the agent whose record is being edited
+     * @param updates - `agentUri` and/or `ownerDid`
+     * @returns the URI and owner link now stored (absent when the record carries none)
+     * @throws if the session is not authenticated, if the deployed contract
+     *   predates `update-agent`, if neither field is given, or if the contract refuses
+     */
+    updateAgent(orgDid: string, agentDid: string, updates: {
+        agentUri?: string;
+        ownerDid?: string;
+    }): Promise<{
+        agentUri?: string;
+        ownerDid?: string;
+    }>;
+    /**
+     * Remove an agent's own registry footprint: its `AGENT_REGISTRY_MAP` record,
+     * the world-readable card, and the private card `tee:agent-registry` hosts in
+     * the agent's own data space.
+     *
+     * Dispatches `agent-registry-deregister` on `tee:agent-registry/contracts`,
+     * NOT on the organisation contract: this is the self-service half of an agent
+     * teardown and needs no org.
+     *
+     * Only an agent with no recorded owner may deregister, and only itself. A
+     * record naming an `ownerDid` is refused for everyone, the owner included: an
+     * org-owned agent is torn down by its org through {@link deleteAgent}, which
+     * also stops its API keys and clears the rows this contract cannot write, and a
+     * delegated agent is retired by its owner through `revoke-delegated-agent`.
+     * Deregistration removes what the DID published, not its classification.
+     *
+     * @param agentDid - the subject; omitted means the caller's own DID, and a
+     *   value may only restate it
+     * @returns which of the three rows existed and were removed
+     * @throws if the session is not authenticated, if the deployed contract
+     *   predates the export, or if the caller is not the record's authority
+     */
+    deregisterAgent(agentDid?: string): Promise<{
+        registryDeleted: boolean;
+        publicCardDeleted: boolean;
+        privateCardDeleted: boolean;
+    }>;
     /**
      * Provision a fresh org-owned agent.
      *
@@ -3156,11 +3244,33 @@ declare class T3nClient {
     }>;
     /**
      * Normalise an organisation / user DID to the bare 40-hex form the
-     * `tee:organisation` contract's `organisation_did` / `user_did` fields
-     * expect (those take a hex string, not the `did:t3n:` display form).
-     * Accepts `did:t3n:<40 hex>` or bare 40 hex.
+     * `tee:organisation` contract's organisation-lifecycle exports
+     * (`organisation-update`, `organisation-delete`, the attribution pair)
+     * expect in `organisation_did` / `user_did`. The agent-lifecycle exports
+     * (`create-agent`, `delete-agent`, `update-agent`) take the `did:t3n:` wire
+     * form instead — see {@link didToWire}. Accepts `did:t3n:<40 hex>` or bare
+     * 40 hex.
      */
     private static didToCompactHex;
+    /**
+     * Normalise a DID to the `did:t3n:<40 hex>` wire form the agent-lifecycle
+     * exports parse (`CompactDid::from_str`, which requires the prefix). Accepts
+     * `did:t3n:<40 hex>` or bare 40 hex.
+     */
+    private static didToWire;
+    /**
+     * Resolve the deployed version of `contractId`, refusing before any dispatch
+     * when it is older than the caller needs, with a message naming the version the
+     * node runs and the one required.
+     *
+     * `remedy` completes the refusal for a caller that has a second option beyond
+     * upgrading — dropping the argument that raised the requirement.
+     *
+     * Returns the resolved version so a caller can pass it straight to the
+     * dispatch; the lookup is cached per (node, contract), so asking twice for two
+     * different thresholds costs one fetch.
+     */
+    private requireContractVersion;
     /**
      * Dispatch a `tee:organisation/contracts` function over the authenticated
      * `action.execute` path (org-scoped writes are gated in-contract on the
@@ -3184,15 +3294,18 @@ declare class T3nClient {
      * Delete an organisation the caller administers, footprint and all.
      *
      * A single `organisation-delete` dispatch tears down both stores the org
-     * spans: the contract removes the `OrganisationRecord`, memberships, and
-     * `OrgPolicyMeta`, and purges the org's `tee:org-data` footprint (every
-     * grant, writer list, data entry, and index row keyed under the org DID)
-     * in-contract, in the same consensus tx. Purge and delete therefore commit
-     * or roll back together — a purge failure aborts the whole delete, so a
-     * successful call never strands org-data.
-     *
-     * The org record's emptiness guards still apply (the org must have no
-     * non-admin members and no children).
+     * spans: the contract tears down the org's own agents (their keys stop
+     * working), removes the `OrganisationRecord`, memberships, and
+     * `OrgPolicyMeta`, and purges the org's `tee:org-data` footprint — every
+     * grant, writer list, data entry, index row, role definition and SECRET keyed
+     * under the org DID — in-contract, in the same consensus tx. The secrets are
+     * destroyed irreversibly with the org. Purge and delete commit or roll back
+     * together — a purge failure aborts the whole delete, so a successful call
+     * never strands org-data.
+     *
+     * The org must have no child organisations. Membership is not a blocker:
+     * every member edge, human and org-owned agent alike, is cascade-removed by
+     * the in-contract purge.
      *
      * @param orgDid - the target organisation (`did:t3n:<hex>` or bare hex)
      * @throws if the session is not authenticated, or if `organisation-delete`
@@ -4260,9 +4373,10 @@ declare function toBaseUnits(tokens: number): number;
 
 /**
  * Org-data scope agent cards are stored under. The private card body is
- * ordinary org-data — written / read / deleted with the generic
- * `org-data-*` operations under this scope; only publication has dedicated
- * contract operations.
+ * ordinary org-data — read and deleted with the generic `org-data-*` operations
+ * under this scope. Writing it, and publishing it, are card-specific contract
+ * operations (`agent-card-set` / `agent-card-publish`) so the whole card surface
+ * answers to one authority rule.
  */
 declare const AGENT_CARDS_SCOPE = "agent-cards";
 /**
@@ -4824,12 +4938,13 @@ declare class OrgDataClient {
      */
     deleteScope(input: DeleteScopeInput): Promise<MutationResponse>;
     /**
-     * Full teardown of an org's org-data footprint — every
-     * grant, writer list, data entry, and index row keyed under the org DID.
-     * Org-admin-gated. Run this **before** `T3nClient.deleteOrganisation`,
-     * which removes the `OrgPolicyMeta` this call authorises against — together
-     * they leave the org with no org-data residue. `deleted_entries` reports the
-     * row count cleared.
+     * Full teardown of an org's org-data footprint — every grant, writer list,
+     * data entry, index row, role definition and SECRET keyed under the org DID,
+     * plus every membership edge. The secrets are destroyed irreversibly: no
+     * contract can be injected with or read them afterwards. Org-admin-gated.
+     * `T3nClient.deleteOrganisation` runs this in-contract as part of the delete;
+     * called standalone it clears the footprint while keeping the org.
+     * `deleted_entries` reports the row count cleared.
      */
     purgeOrg(input: PurgeOrgInput): Promise<MutationResponse>;
     /**
@@ -4890,10 +5005,20 @@ declare class OrgDataClient {
     /** Retrieve a single data entry by entry ID (admin-only). */
     dataGet(input: DataGetInput): Promise<DataGetResponse>;
     /**
-     * Create or overwrite an agent's private card (org scope-writer, or the
-     * owner itself for a self-owned space). Validates locally with the same
-     * gate the contract applies at publish. The card stays private until
+     * Create or overwrite an agent's private card. The card stays private until
      * {@link agentCardPublish}.
+     *
+     * On `tee:org-data/contracts` >= 2.10.0 this dispatches the card-specific
+     * `agent-card-set`, which admits an org ADMIN as well as an `agent-cards`
+     * scope writer — the same principals `agentCardPublish` admits, and the card
+     * is the only home of an agent's display name. Below that version the write
+     * is the generic `org-data-write` at the canonical card entry ID, so it
+     * succeeds for an `agent-cards` scope writer only. The stored bytes and the
+     * entry ID are the same either way, so {@link agentCardGet} reads back
+     * identically.
+     *
+     * Validated locally first so a malformed body is refused before the round
+     * trip; the contract enforces the same invariant.
      */
     agentCardSet(input: AgentCardSetInput): Promise<MutationResponse>;
     /**
@@ -5823,6 +5948,23 @@ interface ContractSetDescriptorInput {
      */
     descriptor: unknown;
 }
+/**
+ * Input for `TenantContractsNamespace.unsetDescriptor`: withdraw a published
+ * descriptor via `tee:tenant/contracts.unset-descriptor`.
+ */
+interface ContractUnsetDescriptorInput {
+    tail: string;
+    /** Semver whose published descriptor is withdrawn. */
+    version: string;
+}
+/**
+ * Result of {@link TenantContractsNamespace.unsetDescriptor}. `deleted` is
+ * `false` when no descriptor was published, so an idempotent repeat is
+ * distinguishable from a real withdrawal.
+ */
+interface ContractUnsetDescriptorResult {
+    deleted: boolean;
+}
 interface ContractExecuteInput {
     version: string;
     functionName: string;
@@ -5897,6 +6039,7 @@ type TenantMapCreateInput = MapCreateInput;
 type TenantMapUpdatePatch = MapUpdateInput;
 type TenantContractPublishInput = ContractPublishInput;
 type TenantContractSetDescriptorInput = ContractSetDescriptorInput;
+type TenantContractUnsetDescriptorInput = ContractUnsetDescriptorInput;
 type TenantContractExecuteInput = ContractExecuteInput;
 /**
  * Coarse lifecycle state of a tenant map, mirroring the contract's
@@ -6028,6 +6171,18 @@ declare class TenantContractsNamespace {
      * without one is not dispatchable through it.
      */
     setDescriptor(input: ContractSetDescriptorInput, opts?: TenantTargetOptions): Promise<unknown>;
+    /**
+     * Withdraw the published descriptor for a `name@version` via
+     * `unset-descriptor`, returning the contract to the undescribed state
+     * `listDetailed` reports as `descriptor: null`. The contract itself stays
+     * registered.
+     *
+     * Same owner gate as {@link setDescriptor}. Idempotent: `deleted: false` when
+     * no descriptor was published. A withdrawn descriptor makes the contract
+     * undispatchable through the MCP funnel, which reads the stored document as
+     * its sole source.
+     */
+    unsetDescriptor(input: ContractUnsetDescriptorInput, opts?: TenantTargetOptions): Promise<ContractUnsetDescriptorResult>;
     /**
      * List the canonical names of every contract registered under the resolved
      * tenant — the org-admin inventory view.
@@ -6175,4 +6330,4 @@ declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
 export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };