@1claw/openapi-spec 0.61.53 → 0.61.55

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "1Claw API",
-    "version": "0.61.53",
+    "version": "0.61.55",
     "description": "Secure secret management for AI agents. Provides vaults, secrets,\npolicy-based access control, agent identity, Intents API,\nsharing, billing, and audit logging. Automations (workflow_spec,\nwebhook tokens, event triggers, Assist), cloud runtimes with\ninteractive shell sessions, agent memory, and discovery.\n\n## Domains\n\n`api.1claw.co` is canonical: it is the OIDC issuer, the `aud` the API\nmints, and the first entry in `servers` — a generated client takes its\nbase URL from there, and the previous ordering pointed every SDK at the\ndomain the issuer had already left. `api.1claw.xyz` still answers and is\nstill accepted on token validation, because tokens minted before the\nmove carry it; it is never minted now.\n\nOne deliberate exception: the Shroud attestation identity token is\nrequested from GCP with `audience: https://api.1claw.xyz`, so\n`/v1/shroud/attestation` reports that as its `expected_audience`. That\nis accurate rather than stale — the audience is a verification contract\nwith anyone already checking the token, and moving it is a breaking\nchange for them, not a rename.\n\nAll endpoints require JWT Bearer authentication unless marked with\n`security: []`.\n",
     "contact": {
       "email": "ops@1claw.co"
@@ -48511,10 +48511,18 @@
             "type": "array",
             "items": {
               "type": "string"
-            }
+            },
+            "description": "External sender IDs permitted to trigger the agent and to run admin slash commands. An empty array clears it; omitting the field leaves it unchanged."
           },
           "auto_respond_enabled": {
             "type": "boolean"
+          },
+          "owner_sender_id": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "External sender ID treated as the channel owner for admin slash commands. Merged into channel metadata, which is where the slash-command authorizer reads it from. Set this or `sender_allowlist` to authorize admin commands. An explicit `null` revokes admin by removing the key; omitting the field leaves the current admin unchanged. Revoking is durable on a channel that has already received a message — the first-contact claim fires only when a channel has no prior inbound message."
           }
         }
       },

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
     title: 1Claw API
-    version: "0.61.53"
+    version: "0.61.55"
     description: |
         Secure secret management for AI agents. Provides vaults, secrets,
         policy-based access control, agent identity, Intents API,
@@ -30748,8 +30748,30 @@ components:
                     type: array
                     items:
                         type: string
+                    description: >-
+                        External sender IDs permitted to trigger the agent and to
+                        run admin slash commands. An empty array clears it;
+                        omitting the field leaves it unchanged.
                 auto_respond_enabled:
                     type: boolean
+                owner_sender_id:
+                    # `type: [string, "null"]`, not `nullable: true`: this is a
+                    # 3.1.0 document, where `nullable` was removed and is
+                    # ignored by generators — a client built from it would
+                    # reject the null that revokes admin. 374 other fields here
+                    # use the union form; the 19 remaining `nullable: true`
+                    # are legacy and have the same latent problem.
+                    type: [string, "null"]
+                    description: >-
+                        External sender ID treated as the channel owner for admin
+                        slash commands. Merged into channel metadata, which is
+                        where the slash-command authorizer reads it from. Set this
+                        or `sender_allowlist` to authorize admin commands.
+                        An explicit `null` revokes admin by removing the key;
+                        omitting the field leaves the current admin unchanged.
+                        Revoking is durable on a channel that has already
+                        received a message — the first-contact claim fires only
+                        when a channel has no prior inbound message.
 
         ChannelResponse:
             type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1claw/openapi-spec",
-  "version": "0.61.53",
+  "version": "0.61.55",
   "description": "OpenAPI 3.1.0 specification for the 1Claw Vault API \u2014 generate clients in any language",
   "license": "MIT",
   "repository": {