@1claw/sdk 0.20.2 → 0.21.0

package/dist/generated/api-types.d.ts

@@ -98,6 +98,12 @@ export interface paths {
          * @description Returns the Ed25519 public key used to sign JWTs.
          *     Use this to verify tokens independently (e.g. in a TEE proxy or
          *     gateway). No authentication required.
+         *
+         *     For OIDC-compliant relying parties (Anthropic Workload Identity
+         *     Federation, etc.) prefer the JWKS endpoint at
+         *     `/.well-known/jwks.json` together with the discovery document
+         *     at `/.well-known/openid-configuration` — those advertise both
+         *     Ed25519 and RS256 keys keyed by `kid` and survive key rotation.
          */
         get: operations["getJwtPublicKey"];
         put?: never;
@@ -108,6 +114,90 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/federated-token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Exchange a 1claw token for an OIDC federation token (RFC 8693)
+         * @description Mints a short-lived RS256-signed JWT targeted at an external
+         *     relying party (e.g. Anthropic Workload Identity Federation).
+         *     The relying party validates the token via this issuer's JWKS
+         *     URL (`/.well-known/jwks.json`) and exchanges it for its own
+         *     short-lived service credentials.
+         *
+         *     Requirements:
+         *     - The agent that owns the `subject_token` must have
+         *       `federation_enabled = true` and the requested `audience`
+         *       must appear in `federation_audiences`.
+         *     - The `subject_token` must be a valid 1claw agent JWT or
+         *       `ocv_` API key.
+         *     - Optional `scope` narrows the agent's existing scopes — it
+         *       cannot escalate.
+         *
+         *     Returns 503 when `ONECLAW_JWT_RS256_SIGNING_KEY_ID` is not
+         *     configured on the server.
+         */
+        post: operations["exchangeFederatedToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/.well-known/openid-configuration": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * OIDC discovery document
+         * @description Standard OpenID Connect discovery document advertising the
+         *     issuer URL, JWKS URL, supported algorithms (`EdDSA`, `RS256`),
+         *     and the RFC 8693 token-exchange endpoint. External IdPs
+         *     (Anthropic WIF, Okta, Auth0, etc.) read this URL to learn
+         *     where 1claw publishes its JWKS.
+         */
+        get: operations["openidConfiguration"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/.well-known/jwks.json": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * JSON Web Key Set
+         * @description Public keys for every active version of every JWT signing
+         *     key (Ed25519 + RSA-2048). Each entry includes a `kid` so
+         *     consumers can validate tokens issued before the most recent
+         *     key rotation. Cached for 5 minutes via `Cache-Control` and
+         *     CORS-permissive for browser-based IdP consoles.
+         */
+        get: operations["jwks"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/signup": {
         parameters: {
             query?: never;
@@ -977,6 +1067,75 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/signing-keys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List signing keys for an agent */
+        get: operations["listSigningKeys"];
+        put?: never;
+        /** Provision a signing key for a chain */
+        post: operations["createSigningKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/signing-keys/{chain}/rotate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Rotate a signing key for a chain */
+        post: operations["rotateSigningKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/signing-keys/{chain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Deactivate a signing key for a chain */
+        delete: operations["deactivateSigningKey"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/sign": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Unified signing intent (EIP-191, EIP-712, EIP-2718 types 0-4) */
+        post: operations["signIntent"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/chains": {
         parameters: {
             query?: never;
@@ -2042,6 +2201,38 @@ export interface components {
         UserApiKeyTokenRequest: {
             api_key: string;
         };
+        /**
+         * @description RFC 8693 token-exchange request body. `subject_token_type`
+         *     accepts the standard JWT URI or 1claw's API-key URI:
+         *       - `urn:ietf:params:oauth:token-type:jwt`
+         *       - `urn:1claw:params:oauth:token-type:api-key`
+         */
+        TokenExchangeRequest: {
+            /** @enum {string} */
+            grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+            /** @description 1claw JWT or `ocv_` API key authorising the exchange. */
+            subject_token: string;
+            /** @enum {string} */
+            subject_token_type: "urn:ietf:params:oauth:token-type:jwt" | "urn:1claw:params:oauth:token-type:api-key";
+            /**
+             * Format: uri
+             * @description Required `aud` claim for the issued federation token (must be in agent's allowlist).
+             * @example https://api.anthropic.com
+             */
+            audience: string;
+            /** @description Optional space-separated subset of the agent's existing scopes. */
+            scope?: string;
+            /** @description Optional. Defaults to `urn:ietf:params:oauth:token-type:jwt`. */
+            requested_token_type?: string;
+        };
+        TokenExchangeResponse: {
+            /** @description RS256-signed federation JWT. */
+            access_token: string;
+            issued_token_type: string;
+            token_type: string;
+            expires_in: number;
+            scope?: string;
+        };
         SignupRequest: {
             /** Format: email */
             email: string;
@@ -2440,6 +2631,24 @@ export interface components {
             /** @description Enable/disable Shroud LLM Proxy */
             shroud_enabled?: boolean;
             shroud_config?: components["schemas"]["ShroudConfig"];
+            /**
+             * @description Enable OIDC federation (RFC 8693 token-exchange) for this agent.
+             *     When true, the agent may call POST /v1/auth/federated-token to mint
+             *     federation tokens for the audiences listed in `federation_audiences`.
+             */
+            federation_enabled?: boolean;
+            /**
+             * @description Allowlist of `aud` values the federation token-exchange may issue
+             *     tokens for (e.g. `["https://api.anthropic.com"]`). Empty array
+             *     blocks all federation requests (zero-trust default).
+             */
+            federation_audiences?: string[];
+            /**
+             * @description Per-agent TTL override for federation tokens (seconds). NULL falls
+             *     back to the global default (`ONECLAW_JWT_FEDERATED_TOKEN_EXPIRY_SECS`).
+             *     Hard-capped at 3600 seconds.
+             */
+            federated_token_ttl_seconds?: number | null;
         };
         AgentResponse: {
             /** Format: uuid */
@@ -2472,6 +2681,26 @@ export interface components {
             /** @description Whether this agent routes LLM traffic through the Shroud TEE proxy */
             shroud_enabled: boolean;
             shroud_config?: components["schemas"]["ShroudConfig"];
+            /**
+             * @description Whether this agent may mint OIDC federation tokens via
+             *     POST /v1/auth/federated-token. False by default.
+             */
+            federation_enabled?: boolean;
+            /** @description Allowlist of audience URIs the agent may federate to. */
+            federation_audiences?: string[];
+            /** @description Per-agent TTL override for federation tokens (60..=3600). */
+            federated_token_ttl_seconds?: number | null;
+            /** @description Chains for which this agent has provisioned signing keys. */
+            signing_chains?: string[];
+            /** @description JSON array of allowed EIP-712 domain entries. */
+            eip712_domain_allowlist?: Record<string, never>[];
+            /**
+             * @description Default EIP-712 policy (deny blocks all unless allowlisted).
+             * @enum {string}
+             */
+            eip712_default_policy?: "deny" | "allow";
+            /** @description Whether EIP-191 personal_sign is enabled. */
+            message_signing_enabled?: boolean;
             /** Format: date-time */
             created_at: string;
             /** Format: date-time */
@@ -2927,6 +3156,64 @@ export interface components {
         SimulateBundleRequest: {
             transactions: components["schemas"]["SimulateTransactionRequest"][];
         };
+        CreateSigningKeyRequest: {
+            /** @enum {string} */
+            chain: "ethereum" | "bitcoin" | "solana" | "xrp" | "cardano" | "tron";
+        };
+        SigningKeyResponse: {
+            /** Format: uuid */
+            id?: string;
+            /** Format: uuid */
+            agent_id?: string;
+            chain?: string;
+            curve?: string;
+            public_key?: string;
+            address?: string | null;
+            key_version?: number;
+            is_active?: boolean;
+            /** Format: date-time */
+            created_at?: string;
+            /** Format: date-time */
+            rotated_at?: string | null;
+        };
+        SigningKeyListResponse: {
+            keys?: components["schemas"]["SigningKeyResponse"][];
+        };
+        SignIntentRequest: {
+            /** @enum {string} */
+            intent_type: "personal_sign" | "typed_data" | "transaction";
+            chain: string;
+            signing_key_path?: string;
+            /** @description Hex-encoded message bytes (for personal_sign) */
+            message?: string;
+            /** @description EIP-712 typed data JSON (for typed_data) */
+            typed_data?: Record<string, never>;
+            /** @description EIP-2718 type: 0=legacy, 1=2930, 2=1559, 3=4844, 4=7702 */
+            tx_type?: number;
+            to?: string;
+            value?: string;
+            data?: string;
+            nonce?: number;
+            gas_limit?: number;
+            gas_price?: string;
+            max_fee_per_gas?: string;
+            max_priority_fee_per_gas?: string;
+            access_list?: Record<string, never>[];
+            max_fee_per_blob_gas?: string;
+            blob_versioned_hashes?: string[];
+            authorization_list?: Record<string, never>[];
+        };
+        SignIntentResponse: {
+            intent_type?: string;
+            chain?: string;
+            from?: string;
+            signature?: string | null;
+            signed_tx?: string | null;
+            tx_hash?: string | null;
+            message_hash?: string | null;
+            typed_data_hash?: string | null;
+            tx_type?: number | null;
+        };
         TransactionResponse: {
             /** Format: uuid */
             id?: string;
@@ -3450,6 +3737,18 @@ export interface components {
             had_pii_detected?: boolean;
             injection_score?: number;
             policy_violations?: string[];
+            /** @description Response-side prompt-injection score (0.0–1.0). */
+            response_injection_score?: number;
+            /** @description Response-side context-injection score (0.0–1.0). */
+            response_context_injection_score?: number;
+            /** @description Category tags emitted by the response-side filters (e.g. `markdown_image_exfil`, `data_uri_blob`, `echoed_instruction`). */
+            response_injection_categories?: string[];
+            /** @description URLs emitted by the model that were flagged as potential exfil / callback targets. */
+            external_urls_flagged?: string[];
+            /** @description Number of code fences in the response that were not expected for the agent's allowed task set. */
+            unexpected_code_blocks?: number;
+            /** @description True when Shroud rewrote or blocked response content before returning it to the agent. */
+            content_filtered?: boolean;
             metadata?: Record<string, never>;
             /** Format: date-time */
             timestamp?: string;
@@ -3472,6 +3771,16 @@ export interface components {
             injection_score: number;
             policy_violations?: string[];
             metadata?: Record<string, never>;
+            /** @default 0 */
+            response_injection_score: number;
+            /** @default 0 */
+            response_context_injection_score: number;
+            response_injection_categories?: string[];
+            external_urls_flagged?: string[];
+            /** @default 0 */
+            unexpected_code_blocks: number;
+            /** @default false */
+            content_filtered: boolean;
         };
         ShroudThreatSummary: {
             /** Format: int64 */
@@ -3565,6 +3874,15 @@ export interface components {
                 "application/json": components["schemas"]["PaymentRequirement"];
             };
         };
+        /** @description Resource already exists or conflict */
+        Conflict: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ProblemDetails"];
+            };
+        };
     };
     parameters: {
         VaultId: string;
@@ -3727,6 +4045,83 @@ export interface operations {
             };
         };
     };
+    exchangeFederatedToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TokenExchangeRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["TokenExchangeRequest"];
+            };
+        };
+        responses: {
+            /** @description Federation token issued */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenExchangeResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description RS256 signing key not configured */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    openidConfiguration: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Discovery document */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+        };
+    };
+    jwks: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description JWK Set */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/jwk-set+json": {
+                        keys?: Record<string, never>[];
+                    };
+                };
+            };
+        };
+    };
     signup: {
         parameters: {
             query?: never;
@@ -5295,6 +5690,130 @@ export interface operations {
             402: components["responses"]["PaymentRequired"];
         };
     };
+    listSigningKeys: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing keys list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyListResponse"];
+                };
+            };
+        };
+    };
+    createSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSigningKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Signing key created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            409: components["responses"]["Conflict"];
+        };
+    };
+    rotateSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Rotated signing key */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deactivateSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Key deactivated */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    signIntent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SignIntentRequest"];
+            };
+        };
+        responses: {
+            /** @description Signed result */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignIntentResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
     listChains: {
         parameters: {
             query?: never;