@1claw/openapi-spec 0.40.1 → 0.41.1

package/openapi.json

@@ -11373,6 +11373,16 @@
             "additionalProperties": true,
             "description": "Guardrails applied to all execution intents for this agent"
           },
+          "intents_require_tee": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true, transaction/sign requests must arrive via a TEE host (Pro+ only)"
+          },
+          "execution_require_tee": {
+            "type": "boolean",
+            "default": false,
+            "description": "When true, execute requests must arrive via TEE and all direct secret reads are blocked (Pro+ only)"
+          },
           "tx_token_allowlist": {
             "type": "array",
             "items": {
@@ -11484,6 +11494,14 @@
             "additionalProperties": true,
             "description": "Guardrails applied to all execution intents for this agent"
           },
+          "intents_require_tee": {
+            "type": "boolean",
+            "description": "When true, transaction/sign requests must arrive via a TEE host (Pro+ only)"
+          },
+          "execution_require_tee": {
+            "type": "boolean",
+            "description": "When true, execute requests must arrive via TEE and all direct secret reads are blocked (Pro+ only)"
+          },
           "federation_enabled": {
             "type": "boolean",
             "description": "Enable OIDC federation (RFC 8693 token-exchange) for this agent.\nWhen true, the agent may call POST /v1/auth/federated-token to mint\nfederation tokens for the audiences listed in `federation_audiences`.\n"
@@ -11663,6 +11681,14 @@
             "additionalProperties": true,
             "description": "Guardrails applied to all execution intents for this agent"
           },
+          "intents_require_tee": {
+            "type": "boolean",
+            "description": "When true, transaction/sign requests must arrive via a TEE host (Pro+ only)"
+          },
+          "execution_require_tee": {
+            "type": "boolean",
+            "description": "When true, execute requests must arrive via TEE and all direct secret reads are blocked (Pro+ only)"
+          },
           "federation_enabled": {
             "type": "boolean",
             "description": "Whether this agent may mint OIDC federation tokens via\nPOST /v1/auth/federated-token. False by default.\n"
@@ -17098,6 +17124,39 @@
           }
         }
       },
+      "CredentialSource": {
+        "type": "object",
+        "required": [
+          "type"
+        ],
+        "description": "Credential source — inline value (stored in __agent-keys) or live pointer to a vault secret (resolved at execution time).",
+        "discriminator": {
+          "propertyName": "type"
+        },
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "inline",
+              "vault_ref"
+            ]
+          },
+          "value": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "For inline — the credential value object."
+          },
+          "vault_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "For vault_ref — the vault containing the referenced secret."
+          },
+          "path": {
+            "type": "string",
+            "description": "For vault_ref — the secret path in the vault."
+          }
+        }
+      },
       "CreateBindingRequest": {
         "type": "object",
         "required": [
@@ -17133,7 +17192,11 @@
           },
           "credential": {
             "type": "object",
-            "additionalProperties": true
+            "additionalProperties": true,
+            "description": "Legacy: inline credential value. Use credential_source for new integrations."
+          },
+          "credential_source": {
+            "$ref": "#/components/schemas/CredentialSource"
           }
         }
       },
@@ -17153,7 +17216,11 @@
           },
           "credential": {
             "type": "object",
-            "additionalProperties": true
+            "additionalProperties": true,
+            "description": "Legacy: inline credential value."
+          },
+          "credential_source": {
+            "$ref": "#/components/schemas/CredentialSource"
           }
         }
       },
@@ -17210,6 +17277,26 @@
             "type": "boolean",
             "description": "Whether a credential is stored for this binding. The value itself is never returned."
           },
+          "credential_source_type": {
+            "type": "string",
+            "enum": [
+              "inline",
+              "vault_ref"
+            ],
+            "nullable": true,
+            "description": "How the credential is sourced — inline (HSM-encrypted copy) or vault_ref (live pointer)."
+          },
+          "credential_vault_id": {
+            "type": "string",
+            "format": "uuid",
+            "nullable": true,
+            "description": "For vault_ref credentials — the vault containing the referenced secret."
+          },
+          "credential_path": {
+            "type": "string",
+            "nullable": true,
+            "description": "For vault_ref credentials — the secret path in the referenced vault."
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"

package/openapi.yaml

@@ -7332,6 +7332,14 @@ components:
                     type: object
                     additionalProperties: true
                     description: Guardrails applied to all execution intents for this agent
+                intents_require_tee:
+                    type: boolean
+                    default: false
+                    description: When true, transaction/sign requests must arrive via a TEE host (Pro+ only)
+                execution_require_tee:
+                    type: boolean
+                    default: false
+                    description: When true, execute requests must arrive via TEE and all direct secret reads are blocked (Pro+ only)
                 tx_token_allowlist:
                     type: array
                     items:
@@ -7417,6 +7425,12 @@ components:
                     type: object
                     additionalProperties: true
                     description: Guardrails applied to all execution intents for this agent
+                intents_require_tee:
+                    type: boolean
+                    description: When true, transaction/sign requests must arrive via a TEE host (Pro+ only)
+                execution_require_tee:
+                    type: boolean
+                    description: When true, execute requests must arrive via TEE and all direct secret reads are blocked (Pro+ only)
                 federation_enabled:
                     type: boolean
                     description: |
@@ -7563,6 +7577,12 @@ components:
                     type: object
                     additionalProperties: true
                     description: Guardrails applied to all execution intents for this agent
+                intents_require_tee:
+                    type: boolean
+                    description: When true, transaction/sign requests must arrive via a TEE host (Pro+ only)
+                execution_require_tee:
+                    type: boolean
+                    description: When true, execute requests must arrive via TEE and all direct secret reads are blocked (Pro+ only)
                 federation_enabled:
                     type: boolean
                     description: |
@@ -11300,6 +11320,28 @@ components:
 
         # --- Execution Intents ---
 
+        CredentialSource:
+            type: object
+            required: [type]
+            description: Credential source — inline value (stored in __agent-keys) or live pointer to a vault secret (resolved at execution time).
+            discriminator:
+                propertyName: type
+            properties:
+                type:
+                    type: string
+                    enum: [inline, vault_ref]
+                value:
+                    type: object
+                    additionalProperties: true
+                    description: For inline — the credential value object.
+                vault_id:
+                    type: string
+                    format: uuid
+                    description: For vault_ref — the vault containing the referenced secret.
+                path:
+                    type: string
+                    description: For vault_ref — the secret path in the vault.
+
         CreateBindingRequest:
             type: object
             required: [name, binding_type]
@@ -11318,6 +11360,9 @@ components:
                 credential:
                     type: object
                     additionalProperties: true
+                    description: "Legacy: inline credential value. Use credential_source for new integrations."
+                credential_source:
+                    $ref: "#/components/schemas/CredentialSource"
 
         UpdateBindingRequest:
             type: object
@@ -11333,6 +11378,9 @@ components:
                 credential:
                     type: object
                     additionalProperties: true
+                    description: "Legacy: inline credential value."
+                credential_source:
+                    $ref: "#/components/schemas/CredentialSource"
 
         BindingResponse:
             type: object
@@ -11360,6 +11408,20 @@ components:
                 credential_set:
                     type: boolean
                     description: Whether a credential is stored for this binding. The value itself is never returned.
+                credential_source_type:
+                    type: string
+                    enum: [inline, vault_ref]
+                    nullable: true
+                    description: How the credential is sourced — inline (HSM-encrypted copy) or vault_ref (live pointer).
+                credential_vault_id:
+                    type: string
+                    format: uuid
+                    nullable: true
+                    description: For vault_ref credentials — the vault containing the referenced secret.
+                credential_path:
+                    type: string
+                    nullable: true
+                    description: For vault_ref credentials — the secret path in the referenced vault.
                 created_at:
                     type: string
                     format: date-time

package/package.json

@@ -1,40 +1,40 @@
 {
-  "name": "@1claw/openapi-spec",
-  "version": "0.40.1",
-  "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/1clawAI/1claw.git",
-    "directory": "packages/openapi-spec"
-  },
-  "files": [
-    "openapi.yaml",
-    "openapi.json",
-    "README.md"
-  ],
-  "exports": {
-    "./openapi.yaml": "./openapi.yaml",
-    "./openapi.json": "./openapi.json"
-  },
-  "scripts": {
-    "build": "node scripts/yaml-to-json.mjs",
-    "prepublishOnly": "npm run build"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "1claw",
-    "openapi",
-    "api-spec",
-    "codegen",
-    "swagger",
-    "secrets",
-    "vault",
-    "ai-agents"
-  ],
-  "devDependencies": {
-    "js-yaml": "^4.1.1"
-  }
+    "name": "@1claw/openapi-spec",
+    "version": "0.41.1",
+    "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API — generate clients in any language",
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/1clawAI/1claw.git",
+        "directory": "packages/openapi-spec"
+    },
+    "files": [
+        "openapi.yaml",
+        "openapi.json",
+        "README.md"
+    ],
+    "exports": {
+        "./openapi.yaml": "./openapi.yaml",
+        "./openapi.json": "./openapi.json"
+    },
+    "scripts": {
+        "build": "node scripts/yaml-to-json.mjs",
+        "prepublishOnly": "npm run build"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "keywords": [
+        "1claw",
+        "openapi",
+        "api-spec",
+        "codegen",
+        "swagger",
+        "secrets",
+        "vault",
+        "ai-agents"
+    ],
+    "devDependencies": {
+        "js-yaml": "^4.1.1"
+    }
 }