@terminal3/t3n-sdk 5.9.0 → 5.11.0

package/dist/index.d.ts

@@ -1179,22 +1179,60 @@ interface OrgWriters {
 }
 /** Shallow runtime guard for {@link OrgWriters}. */
 declare function isOrgWriters(value: unknown): value is OrgWriters;
+/**
+ * What kind of entity a DID names — the values of
+ * {@link OrgContractDelegation.grantee_kinds}, and the same discriminator the
+ * rosters classify from. It is decided by the transaction that mints the DID
+ * and stored, not inferred at read time from which identity map holds a row.
+ *
+ * There is no "unclassified" value: a DID carrying no kind is simply absent
+ * from the map. Every DID minted before the discriminator existed is in that
+ * population until the backfill converges.
+ */
+type DidKind = "agent" | "human" | "org";
 /**
  * Response type alias for org-delegation-get.
  *
- * The wire body echoes the `contract_id` alongside the grant list.
+ * The wire body echoes the `contract_id` alongside the grant list and, beside
+ * it, one {@link DidKind} per classified grantee — so one read partitions a
+ * contract's grantees into agents and humans without also enumerating the org's
+ * rosters.
+ *
+ * The kinds sit BESIDE the grants rather than on them because `grants` doubles
+ * as write input: {@link OrgDataClient.setDelegation} is a full replacement, so
+ * a caller reads this list, edits it and sends it back, and the contract's write
+ * boundary rejects a grant object carrying any key it does not know.
  */
 interface OrgContractDelegation {
     contract_id: string;
     grants: BoundGrant[];
+    /**
+     * Grantee DID → kind, one entry per grantee in `grants` that carries a kind
+     * row. A grantee with no row is absent from the map: that DID is
+     * unclassified, not of some fourth kind.
+     *
+     * The FIELD being absent is a different fact again — the environment
+     * answering the read predates the classification and cannot say anything
+     * about any grantee. Check the field before reading a DID out of it, or the
+     * two collapse into the same lookup miss.
+     */
+    grantee_kinds?: Record<string, DidKind>;
 }
 /**
  * Shallow runtime guard for {@link OrgContractDelegation}.
  *
- * Validates the immediate envelope (`contract_id: string`, `grants:
- * array`) without recursing into each `BoundGrant`. The Rust contract
- * is the source of truth for grant element shape; widening the predicate
- * here would create maintenance churn against benign field additions.
+ * Validates the immediate envelope (`contract_id: string`, `grants: array`) and,
+ * when present, that `grantee_kinds` maps DIDs to strings. An ABSENT
+ * `grantee_kinds` passes: an environment that predates the classification sends
+ * no such field.
+ *
+ * The kind values are checked as strings, not against the closed
+ * {@link DidKind} domain. A value this SDK version has never heard of is a
+ * benign server-side addition, and failing the guard over it would discard the
+ * whole grant list — the payload — for the sake of one advisory field. A caller
+ * branching on `=== "agent"` degrades on its own. Grant elements are not
+ * recursed into for the same reason: the Rust contract is the source of truth
+ * for their shape.
  */
 declare function isOrgContractDelegation(value: unknown): value is OrgContractDelegation;
 /**
@@ -1337,6 +1375,86 @@ interface ListAgentsResponse {
      */
     unclassified?: number;
 }
+/**
+ * Input for `countAgentsByContract` — the org plus optional pagination. Omit
+ * both `cursor` and `limit` for the first page at the default limit; pass a
+ * previous response's `next_cursor` back as `cursor` to fetch the following
+ * page. `limit` bounds AGENTS examined per page, exactly as it does for
+ * {@link ListAgentsInput}.
+ */
+interface ContractAgentCountsInput {
+    orgDid: string;
+    /** Opaque cursor from a previous response's `next_cursor`. */
+    cursor?: string;
+    /** Maximum agents to examine in this page. */
+    limit?: number;
+}
+/**
+ * Input for {@link OrgDataClient.countAllAgentsByContract} — the drain-to-the-end
+ * form, which owns the cursor itself and therefore takes none.
+ */
+interface DrainContractAgentCountsInput {
+    orgDid: string;
+    /**
+     * Page size passed to each underlying call. It bounds the whole walk, not
+     * just one page: the drain abandons a walk that has not finished within
+     * `MAX_AGENT_COUNT_PAGES`, so a `limit` small enough that the org needs more
+     * pages than that throws rather than returning a histogram. Leave it unset
+     * unless you have a reason to shrink the page — the contract's default page
+     * size is sized to cover whole orgs.
+     */
+    limit?: number;
+}
+/**
+ * Response for `org-data-count-agents-by-contract`: ONE PAGE of the per-contract
+ * tally of the org's org-owned agents holding a direct grant.
+ *
+ * The transpose of the per-agent `contract_count` that {@link AgentSummary}
+ * carries, over the same population and the same direct-grant rule. Role-derived
+ * authority is not counted on either side.
+ */
+interface ContractAgentCountsResponse {
+    /**
+     * Contract id → how many org-owned agents hold a direct grant on it, over the
+     * members THIS PAGE examined. A contract with no counted agents has no key.
+     *
+     * Optional because absence is a different answer from `{}`: absent means the
+     * environment cannot say, `{}` means the walk ran and found no agent holding
+     * anything. Reading absence as `{}` turns "cannot say" into a confident zero
+     * for every contract.
+     */
+    agent_counts?: Record<string, number>;
+    /**
+     * Opaque cursor for the next page; absent on the last page. While it is
+     * present the tally is PARTIAL — see
+     * {@link OrgDataClient.countAgentsByContract}.
+     */
+    next_cursor?: string;
+    /**
+     * Members on THIS page that carry no kind row. They are not counted as
+     * agents, so their grants raise no contract's tally: a non-zero count is why
+     * a number can be lower than the grants on the edges would suggest.
+     *
+     * Absent when the environment runs a contract that predates the field; that
+     * is "not reported", not "none".
+     */
+    unclassified?: number;
+}
+/**
+ * Shallow runtime guard for {@link ContractAgentCountsResponse}.
+ *
+ * An ABSENT `agent_counts` passes: absence is itself an answer the caller has to
+ * act on, and failing the guard would reach them as a shape error
+ * indistinguishable from a transport fault. When present, its values are
+ * checked as non-negative safe integers — callers do arithmetic on them, so a
+ * string or a float there is a type lie that only surfaces once a total is
+ * already wrong.
+ *
+ * Keys are not validated against any contract inventory. The map is keyed by
+ * whatever contract ids the org's grants name, and the guard is not the place to
+ * decide which of those a caller recognises.
+ */
+declare function isContractAgentCountsResponse(value: unknown): value is ContractAgentCountsResponse;
 /** A human member's org role. The closed wire domain of {@link HumanMember}. */
 type MemberRole = "admin" | "member";
 /**
@@ -4431,6 +4549,12 @@ interface SetWritersInput {
  * `contract_id` is injected by the SDK from the request `contractId` (the
  * contract sets it server-side regardless), so callers omit it — a read-back
  * {@link BoundGrant}, which carries `contract_id`, is still assignable.
+ *
+ * A full replacement makes that round trip the normal path: read the current
+ * grants, edit the list, send it back. The contract's write boundary rejects a
+ * grant object carrying any key it does not know, so anything the read adds
+ * about a grantee belongs beside the grants, not on them (see
+ * {@link OrgContractDelegation}).
  */
 type SetGrantInput = Omit<BoundGrant, "contract_id">;
 interface OrgDelegationSetInput {
@@ -4921,6 +5045,56 @@ declare class OrgDataClient {
      * back as `cursor` until it is absent.
      */
     listHumanMembers(input: ListHumanMembersInput): Promise<ListHumanMembersResponse>;
+    /**
+     * Count, per contract, how many of the org's org-owned agents hold a direct
+     * grant on it — ONE PAGE (org-admin only).
+     *
+     * The transpose of {@link listAgents}' `contract_count`: same population, same
+     * direct-grant rule, inverted contract-side so a per-contract column costs one
+     * call rather than a roster drain plus an inversion.
+     *
+     * **This is a page, not an answer.** A present `next_cursor` means the tally
+     * covers only the members examined so far: every value is a lower bound and a
+     * missing key means nothing. Reading a number off such a page yields an
+     * under-count shaped exactly like a complete one. Prefer
+     * {@link countAllAgentsByContract}, which owns the walk and refuses to return
+     * anything partial; reach for this method only when you are driving the cursor
+     * yourself.
+     *
+     * On a walk that ended with no cursor, a missing key IS a zero — the tally is
+     * derived from the agents' grants, so a contract no agent holds never gets a
+     * key. Seed your own contract inventory at 0 and fill it from the result.
+     *
+     * A member of no known kind is not counted as an agent, so its grants raise no
+     * contract's tally. `unclassified` reports that population per page, for the
+     * same reason {@link listAgents} does: it says a number could be low because a
+     * grant-holder is unclassified rather than because the grants are absent.
+     */
+    countAgentsByContract(input: ContractAgentCountsInput): Promise<ContractAgentCountsResponse>;
+    /**
+     * Drain {@link countAgentsByContract} to the end and return the complete
+     * per-contract histogram (org-admin only).
+     *
+     * Drain-or-throw: a mid-walk failure rejects rather than resolving with a
+     * partial tally, so the result is either the whole histogram or nothing. That
+     * is the point of the helper — a partial histogram is indistinguishable from a
+     * complete one, and rendering it shows a confidently low number where "unknown"
+     * belongs.
+     *
+     * ```ts
+     * const counts = await orgData.countAllAgentsByContract({ orgDid });
+     * const perContract = new Map(contractIds.map((id) => [id, counts[id] ?? 0]));
+     * ```
+     *
+     * Seed from your own contract list, as above: a contract with no agents has no
+     * key, and an environment that cannot answer throws instead of returning `{}`.
+     *
+     * The histogram is the whole return value; the per-page `unclassified` counts
+     * are not aggregated into it. Where an environment may still hold unclassified
+     * DIDs, read that count from {@link listAgents} — one walk, same population —
+     * before presenting these numbers as final.
+     */
+    countAllAgentsByContract(input: DrainContractAgentCountsInput): Promise<Record<string, number>>;
     /**
      * Write a data entry to the org's scope.
      *
@@ -4986,7 +5160,37 @@ declare class OrgDataClient {
     amIAdmin(input: PolicyGetInput): Promise<boolean>;
     /** Read the writer list for a scope (admin-only). */
     writersGet(input: WritersGetInput): Promise<OrgWriters>;
-    /** Read the grant list for a contract (admin-only). */
+    /**
+     * Read the grant list for a contract (admin-only), plus a `grantee_kinds` map
+     * naming each grantee's principal kind.
+     *
+     * Partitioning a contract's grantees into agents and humans — or counting
+     * either — therefore takes this one call, with no roster enumeration and no DID
+     * intersection by the caller:
+     *
+     * ```ts
+     * const { grants, grantee_kinds } = await orgData.getDelegation({ orgDid, contractId });
+     * if (grantee_kinds === undefined) {
+     *   // This environment cannot classify — fall back, or show the count as unknown.
+     * } else {
+     *   const agents = grants.filter((g) => grantee_kinds[g.grantee] === "agent");
+     * }
+     * ```
+     *
+     * A kind is the grantee's stored discriminator, read beside `grants` so the
+     * grant objects stay valid input to {@link OrgDataClient.setDelegation}. Two
+     * different absences meet here. A grantee missing from a PRESENT map carries
+     * no kind row — unclassified, and not counted as an agent. A map that is
+     * absent ENTIRELY is an environment that predates the classification and can
+     * say nothing about any grantee, which is why the check above comes before any
+     * per-DID lookup: collapsing the two with a `grantee_kinds = {}` default
+     * counts every grantee as not-an-agent, giving a zero no caller can tell from
+     * a true zero.
+     *
+     * Direct grants AS RECORDED: role-derived authority is not listed, and no
+     * validity window is applied, so a grant that is recorded but not currently
+     * live is still returned.
+     */
     getDelegation(input: OrgDelegationGetInput): Promise<OrgContractDelegation>;
     /**
      * Read the grant list for a contract (admin-only) in the legacy `UserGrant`
@@ -5159,6 +5363,12 @@ declare class SessionOrgDataClient {
     listAgents(input: ListAgentsInput): Promise<ListAgentsResponse>;
     /** Mirrors {@link OrgDataClient.listHumanMembers}. */
     listHumanMembers(input: ListHumanMembersInput): Promise<ListHumanMembersResponse>;
+    /** Mirrors {@link OrgDataClient.countAgentsByContract} — one PAGE, so a
+     *  present `next_cursor` means the tally is still partial. */
+    countAgentsByContract(input: ContractAgentCountsInput): Promise<ContractAgentCountsResponse>;
+    /** Mirrors {@link OrgDataClient.countAllAgentsByContract} — drain-or-throw,
+     *  never a partial histogram. */
+    countAllAgentsByContract(input: DrainContractAgentCountsInput): Promise<Record<string, number>>;
     /** Mirrors {@link OrgDataClient.writeData}. */
     writeData(input: WriteDataInput): Promise<MutationResponse>;
     /** Mirrors {@link OrgDataClient.deleteData}. */
@@ -5428,6 +5638,28 @@ declare class SessionUsageReportClient {
      * the partial count the node reports. The year forms cannot reach that.
      */
     getOrgCallCountForWindow(orgDid: string, fromMs: number, toMs: number): Promise<number>;
+    /**
+     * How many calls the organisation's agents made over `[fromMs, toMs)` in
+     * milliseconds — **including the ones that were refused or failed**, since
+     * reviewing agents means seeing what they attempted.
+     *
+     * That makes this figure independent of {@link getOrgCallCountForWindow}
+     * rather than a share of it: a window of nothing but refused agent calls
+     * reads non-zero here and zero there, so do not render one as a percentage
+     * of the other. The node keeps them as two contract exports for that reason,
+     * and each reply carries only its own number — asking for both is two reads.
+     * Both do exclude administrative dispatches, this read included.
+     *
+     * Agent or person comes from the actor classification stamped on each call
+     * when it happened — a call an agent made before its DID was classified as
+     * one stays in the human share for ever.
+     *
+     * Same window rules, same `not_org_admin: ...` refusal, and the same throw
+     * on a window too wide to read in one call as
+     * {@link getOrgCallCountForWindow}. There is no calendar-year form: pass the
+     * window you want, on whole UTC days.
+     */
+    getOrgAgentCallCountForWindow(orgDid: string, fromMs: number, toMs: number): Promise<number>;
 }
 /**
  * Construct a {@link SessionUsageReportClient} from a caller-owned
@@ -6381,5 +6613,5 @@ declare function tenantDidHex(tenantDid: string): string;
 declare function validateTail(tail: string): string;
 declare function canonicalTenantName(tenantDid: string, tail: string): string;
 
-export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
-export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };
+export { AGENT_CARDS_SCOPE, AuthMethod, AuthenticationError, BASE_UNITS_PER_TOKEN, ContractResponseError, DEFAULT_ENVIRONMENT, DEFAULT_INDIVIDUAL_THRESHOLD_CENTS, DEFAULT_KYC_POLL_CADENCE, HandshakeError, HttpTransport, InvokeError, KycStatusTimeoutError, LogLevel, MockTransport, NODE_URLS, OrgDataClient, OtpRateLimitedError, RpcError, SessionExpiredError, SessionOrgDataClient, SessionStateError, SessionStatus, SessionUsageReportClient, T3nClient, T3nConfigError, T3nError, TERMINAL_KYC_STATUSES, TOKEN_DECIMALS, TenantClient, TenantContractsNamespace, TenantMapsNamespace, TenantNamespace, TenantSdkValidationError, TenantTokenNamespace, UnsupportedTenantSdkOperationError, UserUpsertError, WasmError, WireEncodingError, Z_PAYROLL_AUDIT_READ_FUNCTIONS, Z_PAYROLL_RUN_FUNCTIONS, _b64uEncode, assertShape, b64uDecodeStrict, b64uEncodeBytes, buildSecretWriteArgs, bytesToString, canonicalTenantName, clearKeyCache, clearManifestVersionFloor, compactDidFromBytes, createDefaultHandlers, createEmailOtpAuthInput, createEthAuthInput, createLogger, createMlKemPublicKeyHandler, createOidcAuthInput, createOrgDataClientFromSession, createRandomHandler, createUsageReportClientFromSession, createWorkloadAuthInput, decodeWasmErrorMessage, deriveAgentCardEntryId, discoverCheckDelegation, discoverDescribeContract, discoverDescribeFunction, discoverListContracts, discoverWhoami, eth_get_address, extractWasmError, fetchDkgAttestation, fetchMlKemPublicKey, fetchTrustedManifest, formatTokens, generateRandomString, generateUUID, getContractVersion, getEnvironment, getEnvironmentName, getGlobalLogLevel, getLogger, getNodeUrl, invoke, isAgentCardResponse, isAgentEgressGetResponse, isContractAgentCountsResponse, isDataGetResponse, isDataListResponse, isListAgentsResponse, isListHumanMembersResponse, isMutationResponse, isObject, isOrgAdminStatus, isOrgContractDelegation, isOrgContractGrants, isOrgPolicyMeta, isOrgPolicyView, isOrgUsageReport, isOrgWriters, isRoleAssignmentsResponse, isRoleGetResponse, isSecretListResponse, isSecretRecord, isSecretView, isUnsafeTrustServer, loadConfig, loadWasmComponent, manifestToTrustAnchor, maskKeyMaterial, mergeAgentAuthEntries, mergeDiscoverDids, mergeGrants, metamask_get_address, metamask_sign, parseAgentAuthGet, parseAgentAuthPolicy, parseContractResponse, parseMemberDelegationDoc, redactSecrets, redactSecretsFromJson, requestToWire, resolveTrustAnchor, setEnvironment, setGlobalLogLevel, setNodeUrl, stringToBytes, tenantDidHex, toAgentAuthUpdateWire, toBaseUnits, validateConfig, validateTail, verifyDkgAttestation, verifyManifestSignature, verifyTdxQuote };
+export type { ActivityCallerType, ActivityEntry, ActivityExportFile, ActivityExportStatus, ActivityOutcome, ActivityReport, AdminActionAuth, AdmitForOrgOptions, AgentAuthEntry, AgentAuthMergeResult, AgentAuthPolicy, AgentAuthScriptGrant, AgentAuthUpdateInput, AgentCardRefInput, AgentCardResponse, AgentCardSetInput, AgentEgressEntry, AgentEgressGetResponse, AgentEgressRefInput, AgentSummary, AssignRolesInput, AuthInput, BalanceRow, BoundGrant, ChargeReason, ClientAuth, ClientHandshake, ConfigValidationResult, ContractAgentCountsInput, ContractAgentCountsResponse, ContractDescriptorDocument, ContractDescriptorFacets, ContractExecuteInput, ContractKind, ContractLifecycleStatus, ContractListDetailedOptions, ContractListDetailedPage, ContractPublishInput, ContractRegisterResult, ContractResponseSchema, ContractSetDescriptorInput, ContractUnsetDescriptorInput, ContractUnsetDescriptorResult, CreatePolicyInput, DataGetInput, DataGetResponse, DataListInput, DataListResponse, DelegationGrantKind, DelegationGrantRef, DeleteDataInput, DeleteGrantsInput, DeleteScopeInput, DescribeContractParams, DescribeContractResult, DescribeFunctionParams, DescribeFunctionResult, DetailedContract, Did, DidKind, Direction, DiscoverOptions, DkgAttestation, DkgVerifyResult, DrainContractAgentCountsInput, EmailOtpAuthInput, EmailOtpCredentials, Environment, EthAuthInput, ExecuteBusinessContractOptions, ExecuteOrgDataActionOptions, ExportActivityLogOptions, FetchTrustedManifestOptions, FunctionDescriptorEntry, GetActivityLogOptions, GetUsageOptions, GrantCheckParams, GrantCheckResult, GranteeInput, GrantsGetInput, GrantsMergeResult, GuestToHostHandler, GuestToHostHandlers, HandshakeResult, HumanMember, InvokeOptions, InvokeRequest, JsonRpcRequest, JsonRpcResponse, KycPollCadence, KycPollOptions, KycStatus, KycStatusKind, ListAgentsInput, ListAgentsResponse, ListContractsParams, ListContractsResult, ListContractsScope, ListHumanMembersInput, ListHumanMembersResponse, ListedContract, Logger, MapCreateInput, MapLifecycleStatus, MapResponse, MapUpdateInput, MapVisibility, MemberDelegationDoc, MemberRole, MutationResponse, OidcAuthInput, OidcCredentials, OrgAdminStatus, OrgContractDelegation, OrgContractGrants, OrgDataActionWire, OrgDataClientOptions, OrgDelegationAddGrantsInput, OrgDelegationDeleteInput, OrgDelegationGetInput, OrgDelegationRemoveGrantsInput, OrgDelegationSetInput, OrgPolicyMeta, OrgPolicyView, OrgRemoveGrantTarget, OrgRemoveMemberDelegationInput, OrgUsageReport, OrgUsageReportInput, OrgWriters, OtpChannel, OtpMergeSuggestion, OtpRequestInput, OtpRequestResult, OtpVerifyInput, OtpVerifyResult, PayrollRunRequest, PeerQuoteResult, PolicyGetInput, PurgeOrgInput, QuoteVerifyResult, ReaderSet, RemoveMemberGrantsInput, RemoveTarget, RoleAssignments, RoleAssignmentsResponse, RoleDefinition, RoleGetResponse, RoleGrant, RoleIdInput, SdkConfig, SecretKind, SecretListInput, SecretListResponse, SecretNameInput, SecretRecord, SecretSetValueInput, SecretView, SecretWriteInput, SessionCrypto, SessionId, SetAgentEgressInput, SetDefaultQuotasOptions, SetGrantsInput, SetRoleInput, SetWritersInput, SignedTrustManifest, StringEncoding, SubmitUserInputArgs, SubmitUserInputResult, T3nClientConfig, TenantAdmitProjection, TenantAdmitStatus, TenantBaseClient, TenantClientConfig, TenantContractExecuteInput, TenantContractPublishInput, TenantContractSetDescriptorInput, TenantContractUnsetDescriptorInput, TenantExecutionSession, TenantMapCreateInput, TenantMapUpdatePatch, TenantMeResponse, TenantSdkEnvironment, TenantSelfAdmitResult, TenantStatus, TenantTargetOptions, TokenTxKind, Transport, TrustAnchor, TrustAnchorOrUnsafe, TrustAnchorSource, TrustManifestPayload, UnassignRolesInput, UnsafeTrustServer, UpdateMetaInput, UpdateQuotasOptions, UsageEntry, UsagePage, UsageReportSignature, UserGrant, UserInputProfile, UserUpsertErrorKind, Validity, WasmComponent, WasmNextResult, WhoamiResult, WireBlock, WorkloadAuthInput, WriteDataInput, WriterSet, WritersGetInput };