@1claw/mcp 0.60.0 → 0.63.0

package/README.md

@@ -64,6 +64,7 @@ pnpm run build
 | `ONECLAW_VAULT_ID`        | No             | —                       | UUID of the vault. Auto-discovered when using `ONECLAW_AGENT_API_KEY`.     |
 | `ONECLAW_DPOP`            | No             | `false`                 | Set to `true` to enable DPoP (RFC 9449) proof-of-possession. Binds agent tokens to the MCP client's ephemeral P-256 keypair so stolen tokens are unusable without the matching private key. |
 | `ONECLAW_BASE_URL`        | No             | `https://api.1claw.co` | Vault API base URL. Intents tools (`simulate_transaction`, `submit_transaction`, etc.) call this host; for TEE signing, point it at **Shroud** or **Intents** (e.g. `https://shroud.1claw.co` or `https://intents.1claw.co`) if your deployment routes signing there. **Required when the agent has `intents_require_tee` or `execution_require_tee` enabled** — those flags reject direct Vault calls (403), so `ONECLAW_BASE_URL` must point to Shroud. Self-hosted: your Vault/Shroud URL. |
+| `ONECLAW_MCP_TOOLSETS`    | No             | entitlement defaults    | Comma list of toolsets to expose (or `all`). Narrows or opts in; never widens past the agent's entitlements. See **Toolsets**. Hosted: send `X-1Claw-Toolsets` instead. |
 | `MCP_TRANSPORT`           | No             | `stdio`                 | Transport mode: `stdio` or `httpStream`.                                   |
 | `PORT`                    | No             | `8080`                  | HTTP port (httpStream mode only).                                          |
 
@@ -71,7 +72,45 @@ pnpm run build
 
 ## Tools
 
-The server exposes **138 tools** when vault credentials are configured (add `proxy_request` in local daemon mode). **`inspect_content`** also runs in **`ONECLAW_LOCAL_ONLY=true`** mode without vault credentials. Also includes the `vault://secrets` resource.
+The server ships **155 tools** (add `proxy_request` in local daemon mode) but a session only ever sees the **toolsets it is entitled to** — a vault-only agent is offered ~24 tools, not 155. **`inspect_content`** also runs in **`ONECLAW_LOCAL_ONLY=true`** mode without vault credentials. Also includes the `vault://secrets` resource.
+
+### Split packages
+
+Two narrower builds of this same tree are published in lockstep, for stdio deployments where the claim has to be true of the code on disk:
+
+| Package | Contains | Claim |
+| --- | --- | --- |
+| `@1claw/mcp-vault` | `vault` + `approvals` toolsets, `inspect_content`, `vault://secrets` (24 tools) | no signing, execute, cards, memory, platform or admin code in the package |
+| `@1claw/mcp-guard` | `inspect_content` only | no account, no credentials, no vault client in the package |
+
+Same env vars and behaviour; see `packages/vault/README.md` and `packages/guard/README.md`. The hosted server at `mcp.1claw.co` is always the umbrella.
+
+### Toolsets
+
+Every tool belongs to one toolset (`src/toolsets.ts`). Which toolsets a session gets is decided from the agent's own flags, once at admission, and re-checked every 15 minutes and after any `403` from the vault (hosted sessions then receive `notifications/tools/list_changed`).
+
+| Toolset | On when | Tools |
+| --- | --- | --- |
+| `inspect` | always | `inspect_content` |
+| `vault` | any agent | secrets, versions, rotation, env bundles, vaults, sharing, connected accounts (~18) |
+| `approvals` | any agent | `request_approval`, `get_approval_status`, `get_approval`, `list_approvals`, `list_pending_approvals` |
+| `intents` | `intents_api_enabled` | signing, simulation, submission, signing keys, portfolio, Safe accounts, Bankr lease (~18) |
+| `execute` | `execution_intents_enabled` | bindings, `execute_http`, `execute_intent`, executions, connectors (7) |
+| `cards` | `cards_enabled` | cards and gift cards (5) |
+| `memory` | `memory_enabled` | memory + `get_peer_context` (6) |
+| `channels` | `shroud_enabled` | Telegram / WhatsApp / Discord channels (3) |
+| `directory` | `discoverable` | agent directory + job board (4) |
+| `treasury`, `delegation`, `chat`, `automations`, `runtimes`, `notification` | opt-in only | the vault has no per-agent flag for these; ask for them explicitly |
+| `admin` | never on an agent | human-only endpoints (policies, sub-orgs, approval votes, Safe migration…) — only a user JWT over stdio sees them |
+| `platform` | never | `plt_` endpoints; the server rejects platform keys |
+
+**Choosing toolsets explicitly.** Set `ONECLAW_MCP_TOOLSETS` (stdio) or send `X-1Claw-Toolsets` (hosted) with a comma list, e.g. `vault,intents,automations`, or `all`. A selection can narrow the defaults or opt into the opt-in sets; it can never add a toolset the agent is not entitled to, and `all` still excludes `admin` and `platform`. `inspect` is always included.
+
+**When `execution_require_tee` is set** the vault refuses to hand this agent secret *values* outside a TEE, so `get_secret`, `get_env_bundle` and `resolve_env` are hidden; `put_secret`, `rotate_*`, `describe_secret`, `list_secrets` and `list_versions` stay.
+
+**Degraded lookups.** The server logs one line per session: `toolsets=… lookup=full|jwt_only|failed`. `jwt_only` means the agent profile could not be read and only the flags carried in the signed JWT (`intents`, `execute`, `shroud`) were honoured — `cards`, `memory` and `directory` are withheld until the next refresh. `failed` means not even a token was obtained; the session falls back to the agent defaults. Neither state ever widens a toolset.
+
+**stdio.** The toolset is fixed when the process starts; restart the MCP server after changing an agent's flags.
 
 | Tool                   | Description                                                                  |
 | ---------------------- | ---------------------------------------------------------------------------- |
@@ -437,4 +476,4 @@ Configure these via the agent's `shroud_config` JSON in the dashboard, SDK (`Cre
 
 This package is registered as `io.github.1clawAI/1claw-mcp` on the [MCP Registry](https://registry.modelcontextprotocol.io). Publishing uses the "Publish to MCP Registry" workflow on `1clawAI/1claw-mcp` (GitHub OIDC).
 
-npm: `@1claw/mcp` v0.60.0 — MCP Registry: `io.github.1clawAI/1claw-mcp` @ **0.60.0**
+npm: `@1claw/mcp` v0.61.0 — MCP Registry: `io.github.1clawAI/1claw-mcp` @ **0.61.0**

package/dist/client/admin.d.ts

@@ -0,0 +1,96 @@
+import { ClientCore } from "./core.js";
+/** admin domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class AdminApi extends ClientCore {
+    listCedarPolicies(): Promise<{
+        policies: Array<{
+            id: string;
+            policy_text: string;
+            description?: string;
+            created_at: string;
+        }>;
+    }>;
+    testCedarPolicy(principal: string, action: string, resource: string, context?: Record<string, unknown>): Promise<{
+        decision: string;
+        reasons: string[];
+    }>;
+    listOpaPolicies(): Promise<{
+        policies: Array<{
+            id: string;
+            rego_module: string;
+            description?: string;
+            created_at: string;
+        }>;
+    }>;
+    testOpaPolicy(input: Record<string, unknown>, data?: Record<string, unknown>): Promise<{
+        decision: string;
+        result: unknown;
+    }>;
+    listSubOrgs(): Promise<{
+        sub_orgs: Array<{
+            id: string;
+            name: string;
+            status: string;
+            created_at: string;
+        }>;
+    }>;
+    createSubOrg(name: string, description?: string, billingModel?: string): Promise<{
+        id: string;
+        name: string;
+    }>;
+    getPolicyBackendSettings(): Promise<{
+        backend: string;
+        mode: string;
+        scope: string[];
+        breaker_behavior: string;
+    }>;
+    updatePolicyBackendSettings(body: Record<string, unknown>): Promise<{
+        backend: string;
+        mode: string;
+        scope: string[];
+        breaker_behavior: string;
+    }>;
+    getShadowReport(): Promise<{
+        concordance_rate: number;
+        total_evaluated: number;
+        divergent_count: number;
+        sample_events: unknown[];
+    }>;
+    getGuardrailShadowReport(params?: {
+        since?: string;
+        until?: string;
+    }): Promise<{
+        org_id: string;
+        since: string;
+        until: string;
+        total_would_deny: number;
+        by_reason: Array<{
+            reason_code: string;
+            would_deny_count: number;
+            enforced_count: number;
+        }>;
+    }>;
+    listGuardrailRevisions(): Promise<{
+        revisions: unknown[];
+    }>;
+    replayAgentGuardrails(agentId: string, body?: {
+        days?: number;
+        draft_guardrails?: Record<string, unknown>;
+        draft_approval_policy?: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    uploadContractAbi(body: Record<string, unknown>): Promise<{
+        id: string;
+        chain: string;
+        contract_address: string;
+        name?: string;
+    }>;
+    listContractAbis(chain?: string): Promise<{
+        abis: Array<{
+            id: string;
+            chain: string;
+            contract_address: string;
+            name?: string;
+            created_at: string;
+        }>;
+    }>;
+}
+//# sourceMappingURL=admin.d.ts.map

package/dist/client/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/client/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,8FAA8F;AAC9F,qBAAa,QAAS,SAAQ,UAAU;IAG9B,iBAAiB,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAMhI,eAAe,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAU7C,eAAe,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAM9H,aAAa,CACf,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IAU3C,WAAW,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAM7G,YAAY,CACd,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAalC,wBAAwB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IAMjH,2BAA2B,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IAOlF,eAAe,IAAI,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAMpI,wBAAwB,CAAC,MAAM,CAAC,EAAE;QACpC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC;QACR,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,KAAK,CAAC;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,gBAAgB,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IAQI,sBAAsB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAI3D,qBAAqB,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnD,GACF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAU7B,iBAAiB,CACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO5E,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,gBAAgB,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAO/J"}

package/dist/client/admin.js

@@ -0,0 +1,67 @@
+import { ClientCore } from "./core.js";
+/** admin domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class AdminApi extends ClientCore {
+    // ── Cedar Policies ──────────────────────────────────────────────────
+    async listCedarPolicies() {
+        return this.request(`${this.baseUrl}/v1/org/cedar-policies`);
+    }
+    async testCedarPolicy(principal, action, resource, context) {
+        return this.request(`${this.baseUrl}/v1/org/cedar-policies/test`, { method: "POST", body: JSON.stringify({ principal, action, resource, context }) });
+    }
+    // ── OPA Policies ────────────────────────────────────────────────────
+    async listOpaPolicies() {
+        return this.request(`${this.baseUrl}/v1/org/opa-policies`);
+    }
+    async testOpaPolicy(input, data) {
+        return this.request(`${this.baseUrl}/v1/org/opa-policies/test`, { method: "POST", body: JSON.stringify({ input, data }) });
+    }
+    // ── Sub-Organizations ───────────────────────────────────────────────
+    async listSubOrgs() {
+        return this.request(`${this.baseUrl}/v1/org/sub-orgs`);
+    }
+    async createSubOrg(name, description, billingModel) {
+        const body = { name };
+        if (description)
+            body.description = description;
+        if (billingModel)
+            body.billing_model = billingModel;
+        return this.request(`${this.baseUrl}/v1/org/sub-orgs`, { method: "POST", body: JSON.stringify(body) });
+    }
+    // ── Policy Backend Settings ──────────────────────────────────────────
+    async getPolicyBackendSettings() {
+        return this.request(`${this.baseUrl}/v1/org/settings/policy-backend`);
+    }
+    async updatePolicyBackendSettings(body) {
+        return this.request(`${this.baseUrl}/v1/org/settings/policy-backend`, { method: "PATCH", body: JSON.stringify(body) });
+    }
+    async getShadowReport() {
+        return this.request(`${this.baseUrl}/v1/org/policy-shadow-report`);
+    }
+    async getGuardrailShadowReport(params) {
+        const query = new URLSearchParams();
+        if (params?.since)
+            query.set("since", params.since);
+        if (params?.until)
+            query.set("until", params.until);
+        const qs = query.toString();
+        return this.request(`${this.baseUrl}/v1/org/guardrail-shadow-report${qs ? `?${qs}` : ""}`);
+    }
+    async listGuardrailRevisions() {
+        return this.request(`${this.baseUrl}/v1/org/guardrail-revisions`);
+    }
+    async replayAgentGuardrails(agentId, body) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/guardrails/replay`, {
+            method: "POST",
+            body: JSON.stringify(body ?? {}),
+        });
+    }
+    // ── Contract ABI Registry ────────────────────────────────────────────
+    async uploadContractAbi(body) {
+        return this.request(`${this.baseUrl}/v1/org/contract-abis`, { method: "POST", body: JSON.stringify(body) });
+    }
+    async listContractAbis(chain) {
+        const qs = chain ? `?chain=${encodeURIComponent(chain)}` : "";
+        return this.request(`${this.baseUrl}/v1/org/contract-abis${qs}`);
+    }
+}
+//# sourceMappingURL=admin.js.map

package/dist/client/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/client/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,8FAA8F;AAC9F,MAAM,OAAO,QAAS,SAAQ,UAAU;IACpC,uEAAuE;IAEvE,KAAK,CAAC,iBAAiB;QACnB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,wBAAwB,CAC1C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,eAAe,CACjB,SAAiB,EACjB,MAAc,EACd,QAAgB,EAChB,OAAiC;QAEjC,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,6BAA6B,EAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CACrF,CAAC;IACN,CAAC;IAGD,uEAAuE;IAEvE,KAAK,CAAC,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,sBAAsB,CACxC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,aAAa,CACf,KAA8B,EAC9B,IAA8B;QAE9B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAC5D,CAAC;IACN,CAAC;IAGD,uEAAuE;IAEvE,KAAK,CAAC,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,kBAAkB,CACpC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,YAAY,CACd,IAAY,EACZ,WAAoB,EACpB,YAAqB;QAErB,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAC;QAC/C,IAAI,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAChD,IAAI,YAAY;YAAE,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QACpD,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,kBAAkB,EACjC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAGD,wEAAwE;IAExE,KAAK,CAAC,wBAAwB;QAC1B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,iCAAiC,CACnD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC7B,IAA6B;QAE7B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,iCAAiC,EAChD,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,8BAA8B,CAChD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAG9B;QAOG,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,MAAM,EAAE,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,kCAAkC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,sBAAsB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,6BAA6B,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACvB,OAAe,EACf,IAIC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,oBAAoB,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACP,CAAC;IAGD,wEAAwE;IAExE,KAAK,CAAC,iBAAiB,CACnB,IAA6B;QAE7B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,uBAAuB,EACtC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAc;QACjC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,wBAAwB,EAAE,EAAE,CAC9C,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/approvals.d.ts

@@ -0,0 +1,52 @@
+import { ClientCore } from "./core.js";
+import type { ApprovalResponse } from "../types.js";
+/** approvals domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class ApprovalsApi extends ClientCore {
+    listApprovals(opts?: {
+        status?: string;
+        limit?: number;
+    }): Promise<{
+        approvals: ApprovalResponse[];
+    }>;
+    getApproval(approvalId: string): Promise<ApprovalResponse>;
+    getApprovalStatus(approvalId: string): Promise<{
+        status: string;
+        expires_at?: string | null;
+    }>;
+    requestApproval(data: {
+        action: string;
+        target_type: string;
+        target_id: string;
+        summary: Record<string, unknown>;
+        /** What the action will do; the enforced risk tier is derived from it. */
+        payload?: Record<string, unknown>;
+        reason?: string;
+        /** Advisory — the server takes the higher of this and its own floor. */
+        declared_risk_tier?: number;
+        /** @deprecated Renamed to `declared_risk_tier`. Still accepted. */
+        risk_tier?: number;
+    }): Promise<ApprovalResponse>;
+    listPendingApprovals(params?: {
+        status?: string;
+        agent_id?: string;
+    }): Promise<{
+        pending_approvals: Array<{
+            id: string;
+            action: string;
+            status: string;
+            current_approvals: number;
+            required_approvals: number;
+            submitted_by: string;
+            submitted_by_type: string;
+            expires_at?: string;
+        }>;
+    }>;
+    approvePendingApproval(id: string, body: {
+        decision: string;
+        payload_hash: string;
+        reason?: string;
+        credential_type?: string;
+    }): Promise<unknown>;
+    executePendingApproval(id: string): Promise<unknown>;
+}
+//# sourceMappingURL=approvals.d.ts.map

package/dist/client/approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../src/client/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACR,gBAAgB,EACnB,MAAM,aAAa,CAAC;AAErB,kGAAkG;AAClG,qBAAa,YAAa,SAAQ,UAAU;IAGlC,aAAa,CACf,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC;QAAE,SAAS,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAUvC,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM1D,iBAAiB,CACnB,UAAU,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAMpD,eAAe,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,0EAA0E;QAC1E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,wEAAwE;QACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,mEAAmE;QACnE,SAAS,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAUvB,oBAAoB,CACtB,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC;QAAE,iBAAiB,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,iBAAiB,EAAE,MAAM,CAAC;YAAC,kBAAkB,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,iBAAiB,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAU/M,sBAAsB,CACxB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QACF,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC5B,GACF,OAAO,CAAC,OAAO,CAAC;IAOb,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAO7D"}

package/dist/client/approvals.js

@@ -0,0 +1,40 @@
+import { ClientCore } from "./core.js";
+/** approvals domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class ApprovalsApi extends ClientCore {
+    // ── Approvals ─────────────────────────────────────────
+    async listApprovals(opts) {
+        const params = new URLSearchParams();
+        if (opts?.status)
+            params.set("status", opts.status);
+        if (opts?.limit != null)
+            params.set("limit", String(opts.limit));
+        const qs = params.toString() ? `?${params.toString()}` : "";
+        return this.request(`${this.baseUrl}/v1/approvals${qs}`);
+    }
+    async getApproval(approvalId) {
+        return this.request(`${this.baseUrl}/v1/approvals/${approvalId}`);
+    }
+    async getApprovalStatus(approvalId) {
+        return this.request(`${this.baseUrl}/v1/approvals/${approvalId}/status`);
+    }
+    async requestApproval(data) {
+        return this.request(`${this.baseUrl}/v1/approvals/request`, { method: "POST", body: JSON.stringify(data) });
+    }
+    // ── Pending Approvals (Consensus) ────────────────────────────────────
+    async listPendingApprovals(params) {
+        const qs = new URLSearchParams();
+        if (params?.status)
+            qs.set("status", params.status);
+        if (params?.agent_id)
+            qs.set("agent_id", params.agent_id);
+        const q = qs.toString();
+        return this.request(`${this.baseUrl}/v1/pending-approvals${q ? `?${q}` : ""}`);
+    }
+    async approvePendingApproval(id, body) {
+        return this.request(`${this.baseUrl}/v1/pending-approvals/${id}/approve`, { method: "POST", body: JSON.stringify(body) });
+    }
+    async executePendingApproval(id) {
+        return this.request(`${this.baseUrl}/v1/pending-approvals/${id}/execute`, { method: "POST" });
+    }
+}
+//# sourceMappingURL=approvals.js.map

package/dist/client/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../src/client/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAKvC,kGAAkG;AAClG,MAAM,OAAO,YAAa,SAAQ,UAAU;IACxC,yDAAyD;IAEzD,KAAK,CAAC,aAAa,CACf,IAA0C;QAE1C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,EAAE,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,gBAAgB,EAAE,EAAE,CACtC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,iBAAiB,UAAU,EAAE,CAC/C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,iBAAiB,CACnB,UAAkB;QAElB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,iBAAiB,UAAU,SAAS,CACtD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAYrB;QACG,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,uBAAuB,EACtC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAGD,wEAAwE;IAExE,KAAK,CAAC,oBAAoB,CACtB,MAA+C;QAE/C,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,EAAE,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,QAAQ;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,CAAC;IACN,CAAC;IAED,KAAK,CAAC,sBAAsB,CACxB,EAAU,EACV,IAKC;QAED,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE,UAAU,EACpD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,EAAU;QACnC,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE,UAAU,EACpD,EAAE,MAAM,EAAE,MAAM,EAAE,CACrB,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/automations.d.ts

@@ -0,0 +1,15 @@
+import { ClientCore } from "./core.js";
+/** automations domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class AutomationsApi extends ClientCore {
+    listAutomations(): Promise<Record<string, unknown>>;
+    listAutomationPresets(): Promise<Record<string, unknown>>;
+    triggerAutomation(automationId: string, input?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    createAgentAutomation(agentId: string, body: {
+        name: string;
+        trigger_type?: "manual" | "webhook";
+        workflow_spec: unknown;
+        auto_trigger?: boolean;
+    }): Promise<Record<string, unknown>>;
+    cancelAutomationRun(automationId: string, runId: string): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=automations.d.ts.map

package/dist/client/automations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automations.d.ts","sourceRoot":"","sources":["../../src/client/automations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,oGAAoG;AACpG,qBAAa,cAAe,SAAQ,UAAU;IAGpC,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAMnD,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAMzD,iBAAiB,CACnB,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAO7B,qBAAqB,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;QACF,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;QACpC,aAAa,EAAE,OAAO,CAAC;QACvB,YAAY,CAAC,EAAE,OAAO,CAAC;KAC1B,GACF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAO7B,mBAAmB,CACrB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAOtC"}

package/dist/client/automations.js

@@ -0,0 +1,21 @@
+import { ClientCore } from "./core.js";
+/** automations domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class AutomationsApi extends ClientCore {
+    // ── Automations ─────────────────────────────────────────────────
+    async listAutomations() {
+        return this.request(`${this.baseUrl}/v1/automations`);
+    }
+    async listAutomationPresets() {
+        return this.request(`${this.baseUrl}/v1/automations/presets`);
+    }
+    async triggerAutomation(automationId, input) {
+        return this.request(`${this.baseUrl}/v1/automations/${automationId}/trigger`, { method: "POST", body: JSON.stringify(input ?? {}) });
+    }
+    async createAgentAutomation(agentId, body) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/automations`, { method: "POST", body: JSON.stringify(body) });
+    }
+    async cancelAutomationRun(automationId, runId) {
+        return this.request(`${this.baseUrl}/v1/automations/${automationId}/runs/${runId}/cancel`, { method: "POST" });
+    }
+}
+//# sourceMappingURL=automations.js.map

package/dist/client/automations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automations.js","sourceRoot":"","sources":["../../src/client/automations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,oGAAoG;AACpG,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC1C,mEAAmE;IAEnE,KAAK,CAAC,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,iBAAiB,CACnC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,qBAAqB;QACvB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,yBAAyB,CAC3C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,iBAAiB,CACnB,YAAoB,EACpB,KAA+B;QAE/B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,mBAAmB,YAAY,UAAU,EACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CACxD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,qBAAqB,CACvB,OAAe,EACf,IAKC;QAED,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,cAAc,EAClD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,mBAAmB,CACrB,YAAoB,EACpB,KAAa;QAEb,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,mBAAmB,YAAY,SAAS,KAAK,SAAS,EACrE,EAAE,MAAM,EAAE,MAAM,EAAE,CACrB,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/cards.d.ts

@@ -0,0 +1,20 @@
+import { ClientCore } from "./core.js";
+import type { CardResponse } from "../types.js";
+/** cards domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class CardsApi extends ClientCore {
+    orderCard(agentId: string, body: {
+        kind: "prepaid" | "gift_card";
+        amount_usd: string;
+        laso_server_id?: string;
+        country?: string;
+    }, idempotencyKey?: string): Promise<CardResponse>;
+    listCards(): Promise<{
+        cards: CardResponse[];
+    }>;
+    getCard(cardId: string): Promise<CardResponse>;
+    searchGiftCards(body: {
+        query?: string;
+        country?: string;
+    }): Promise<unknown>;
+}
+//# sourceMappingURL=cards.d.ts.map

package/dist/client/cards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cards.d.ts","sourceRoot":"","sources":["../../src/client/cards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACR,YAAY,EACf,MAAM,aAAa,CAAC;AAErB,8FAA8F;AAC9F,qBAAa,QAAS,SAAQ,UAAU;IAG9B,SAAS,CACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;QACF,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;KACpB,EACD,cAAc,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,YAAY,CAAC;IAYlB,SAAS,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IAM/C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAI9C,eAAe,CAAC,IAAI,EAAE;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;CAOvB"}

package/dist/client/cards.js

@@ -0,0 +1,23 @@
+import { ClientCore } from "./core.js";
+/** cards domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class CardsApi extends ClientCore {
+    // ── Payment Cards ─────────────────────────────────────
+    async orderCard(agentId, body, idempotencyKey) {
+        const key = idempotencyKey ?? crypto.randomUUID();
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/cards/order`, {
+            method: "POST",
+            body: JSON.stringify(body),
+            headers: { "Idempotency-Key": key },
+        });
+    }
+    async listCards() {
+        return this.request(`${this.baseUrl}/v1/cards`);
+    }
+    async getCard(cardId) {
+        return this.request(`${this.baseUrl}/v1/cards/${cardId}`);
+    }
+    async searchGiftCards(body) {
+        return this.request(`${this.baseUrl}/v1/cards/gift-cards/search`, { method: "POST", body: JSON.stringify(body) });
+    }
+}
+//# sourceMappingURL=cards.js.map

package/dist/client/cards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cards.js","sourceRoot":"","sources":["../../src/client/cards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAKvC,8FAA8F;AAC9F,MAAM,OAAO,QAAS,SAAQ,UAAU;IACpC,yDAAyD;IAEzD,KAAK,CAAC,SAAS,CACX,OAAe,EACf,IAKC,EACD,cAAuB;QAEvB,MAAM,GAAG,GAAG,cAAc,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,cAAc,EAClD;YACI,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE;SACtC,CACJ,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,WAAW,CAC7B,CAAC;IACN,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,OAAO,CAAe,GAAG,IAAI,CAAC,OAAO,aAAa,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAGrB;QACG,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,6BAA6B,EAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/chat.d.ts

@@ -0,0 +1,26 @@
+import { ClientCore } from "./core.js";
+/** chat domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class ChatApi extends ClientCore {
+    sendChatMessage(agentId: string, data: {
+        message: string;
+        conversation_id?: string;
+        model?: string;
+        provider?: string;
+    }): Promise<Record<string, unknown>>;
+    listChatConversations(agentId: string): Promise<Record<string, unknown>>;
+    createChannel(agentId: string, data: {
+        channel_type: string;
+        channel_name?: string;
+        config: Record<string, string>;
+        slash_commands_enabled?: boolean;
+        voice_transcription_enabled?: boolean;
+        sender_allowlist?: string[];
+        auto_respond_enabled?: boolean;
+    }): Promise<Record<string, unknown>>;
+    listChannels(agentId: string): Promise<Record<string, unknown>>;
+    sendChannelMessage(agentId: string, channelId: string, data: {
+        external_chat_id: string;
+        content: string;
+    }): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=chat.d.ts.map

package/dist/client/chat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/client/chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,6FAA6F;AAC7F,qBAAa,OAAQ,SAAQ,UAAU;IAG7B,eAAe,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;QACF,OAAO,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACrB,GACF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAU7B,qBAAqB,CACvB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAS7B,aAAa,CACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;QACF,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC,2BAA2B,CAAC,EAAE,OAAO,CAAC;QACtC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAClC,GACF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAU7B,YAAY,CACd,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM7B,kBAAkB,CACpB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;QACF,gBAAgB,EAAE,MAAM,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC;KACnB,GACF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAUtC"}

package/dist/client/chat.js

@@ -0,0 +1,31 @@
+import { ClientCore } from "./core.js";
+/** chat domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class ChatApi extends ClientCore {
+    // ── Chat ─────────────────────────────────────────────────────────
+    async sendChatMessage(agentId, data) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/chat`, {
+            method: "POST",
+            body: JSON.stringify(data),
+        });
+    }
+    async listChatConversations(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/chat/conversations`);
+    }
+    // ── Channels ─────────────────────────────────────────────────────
+    async createChannel(agentId, data) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/channels`, {
+            method: "POST",
+            body: JSON.stringify(data),
+        });
+    }
+    async listChannels(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/channels`);
+    }
+    async sendChannelMessage(agentId, channelId, data) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/channels/${channelId}/send`, {
+            method: "POST",
+            body: JSON.stringify(data),
+        });
+    }
+}
+//# sourceMappingURL=chat.js.map

package/dist/client/chat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.js","sourceRoot":"","sources":["../../src/client/chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,6FAA6F;AAC7F,MAAM,OAAO,OAAQ,SAAQ,UAAU;IACnC,oEAAoE;IAEpE,KAAK,CAAC,eAAe,CACjB,OAAe,EACf,IAKC;QAED,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,OAAO,EAC3C;YACI,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B,CACJ,CAAC;IACN,CAAC;IAED,KAAK,CAAC,qBAAqB,CACvB,OAAe;QAEf,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,qBAAqB,CAC5D,CAAC;IACN,CAAC;IAGD,oEAAoE;IAEpE,KAAK,CAAC,aAAa,CACf,OAAe,EACf,IAQC;QAED,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,WAAW,EAC/C;YACI,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B,CACJ,CAAC;IACN,CAAC;IAED,KAAK,CAAC,YAAY,CACd,OAAe;QAEf,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,WAAW,CAClD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,kBAAkB,CACpB,OAAe,EACf,SAAiB,EACjB,IAGC;QAED,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,aAAa,SAAS,OAAO,EACjE;YACI,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B,CACJ,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/core.d.ts

@@ -0,0 +1,96 @@
+import { DPoPManager } from "../auth/dpop.js";
+import { OneClawApiError } from "./error.js";
+export { OneClawApiError };
+export interface ClientConfig {
+    baseUrl: string;
+    token: string;
+    vaultId: string;
+    /** Runtime-bound agent JWTs require this on every Vault API call. */
+    runtimeId?: string;
+}
+export interface AgentCredentials {
+    baseUrl: string;
+    agentId?: string;
+    apiKey: string;
+    vaultId?: string;
+    runtimeId?: string;
+}
+/** `entitlements` on the agent token exchange (vault ≥ 0.61.17). */
+export interface AgentEntitlementsResponse {
+    intents_api: boolean;
+    execution_intents: boolean;
+    execution_require_tee: boolean;
+    intents_require_tee: boolean;
+    cards: boolean;
+    memory: boolean;
+    shroud: boolean;
+    discoverable: boolean;
+    treasury_signer: boolean;
+    has_delegations: boolean;
+}
+/** Subset of `AgentResponse` the MCP server reads for toolset gating. */
+export interface AgentProfileResponse {
+    id: string;
+    is_active?: boolean;
+    intents_api_enabled?: boolean;
+    execution_intents_enabled?: boolean;
+    execution_require_tee?: boolean;
+    intents_require_tee?: boolean;
+    cards_enabled?: boolean;
+    memory_enabled?: boolean;
+    shroud_enabled?: boolean;
+    discoverable?: boolean;
+    platform_app_id?: string | null;
+}
+export declare function encodePath(path: string): string;
+/**
+ * Auth, token exchange and the request primitive. Every domain API class
+ * extends this and is mixed into `OneClawClient` (see ./index.ts).
+ */
+export declare class ClientCore {
+    protected baseUrl: string;
+    protected token: string;
+    protected _vaultId: string;
+    protected _resolvedAgentId?: string;
+    protected _runtimeId?: string;
+    protected agentCredentials?: {
+        agentId?: string;
+        apiKey: string;
+    };
+    protected tokenExpiresAt: number;
+    protected _entitlements?: AgentEntitlementsResponse;
+    protected dpopManager?: DPoPManager;
+    protected dpopReady: Promise<void> | null;
+    constructor(config: ClientConfig | AgentCredentials);
+    /**
+     * Drops the in-memory JWT so the next request re-exchanges the API key.
+     * Used after 401 (revoked) or 403 stale scopes; also safe to call after
+     * dashboard policy changes if you need a fresh token immediately.
+     */
+    invalidateCachedAgentToken(): void;
+    protected ensureDPoP(): Promise<void>;
+    protected ensureToken(): Promise<void>;
+    protected autoDiscoverVault(): Promise<void>;
+    protected headers(method?: string, url?: string): Promise<Record<string, string>>;
+    protected resolveVaultUrl(suffix?: string): Promise<string>;
+    /** True when a fresh JWT from /v1/auth/agent-token should fix the error (stale cache). */
+    protected shouldReexchangeAgentToken(status: number, detail: string): boolean;
+    protected request<T>(url: string, init?: RequestInit, isRetry?: boolean): Promise<T>;
+    get agentId(): string | undefined;
+    /**
+     * Decoded (not verified — the vault verifies) claims of the JWT this
+     * client is presenting. Performs the API-key exchange first if needed,
+     * so a fresh client can answer. Used to derive session entitlements.
+     */
+    tokenClaims(): Promise<Record<string, unknown> | undefined>;
+    /**
+     * Entitlements the vault returned with the last key exchange, if it is
+     * new enough to send them. Undefined on the static-token path and
+     * against older vaults — callers then fall back to the profile GET.
+     */
+    tokenEntitlements(): Promise<AgentEntitlementsResponse | undefined>;
+    /** `GET /v1/agents/{id}` — the agent's own profile, including its feature flags. */
+    getAgent(agentId: string): Promise<AgentProfileResponse>;
+    get vaultId(): string;
+}
+//# sourceMappingURL=core.d.ts.map

package/dist/client/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/client/core.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,oEAAoE;AACpE,MAAM,WAAW,yBAAyB;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;CAC5B;AAUD,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK/C;AAiDD;;;GAGG;AACH,qBAAa,UAAU;IACnB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACpC,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE9B,SAAS,CAAC,gBAAgB,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,SAAS,CAAC,cAAc,SAAK;IAC7B,SAAS,CAAC,aAAa,CAAC,EAAE,yBAAyB,CAAC;IACpD,SAAS,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACpC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAQ;gBAErC,MAAM,EAAE,YAAY,GAAG,gBAAgB;IA8BnD;;;;OAIG;IACH,0BAA0B,IAAI,IAAI;cAMlB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAQ3B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;cAiE5B,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;cAWlC,OAAO,CAAC,MAAM,GAAE,MAAc,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;cAgB9E,eAAe,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAa7D,0FAA0F;IAC1F,SAAS,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;cAY7D,OAAO,CAAC,CAAC,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,WAAW,EAClB,OAAO,UAAQ,GAChB,OAAO,CAAC,CAAC,CAAC;IAoDb,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED;;;;OAIG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAKjE;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAKzE,oFAAoF;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAM9D,IAAI,OAAO,IAAI,MAAM,CAEpB;CAEJ"}