@1claw/sdk 0.23.0 → 0.24.1

package/README.md

@@ -79,7 +79,7 @@ await client.auth.resetPassword({ token: "...", new_password: "..." });
 | `client.vault`     | `create`, `get`, `list`, `delete`, `enableMpc`, `disableMpc`                                                        |
 | `client.secrets`   | `set`, `get`, `delete`, `list`, `rotate`                                                                            |
 | `client.access`    | `grantHuman`, `grantAgent`, `update`, `revoke`, `listGrants`                                                        |
-| `client.agents`    | `enroll` (also `AgentsResource.enroll(baseUrl, …)` static), `create`, `getSelf`, `get`, `list`, `update`, `delete`, `rotateKey`, `rotateIdentityKeys`, `submitTransaction`, `signTransaction`, `getTransaction`, `listTransactions`, `simulateTransaction`, `simulateBundle`, `sign` |
+| `client.agents`    | `enroll` (also `AgentsResource.enroll(baseUrl, …)` static), `create`, `getSelf`, `get`, `list`, `update`, `delete`, `rotateKey`, `submitTransaction`, `signTransaction`, `getTransaction`, `listTransactions`, `simulateTransaction`, `simulateBundle`, `sign` |
 | `client.chains`    | `list`, `get`, `adminList`, `create`, `update`, `delete`                                                            |
 | `client.sharing`   | `create`, `access`, `listOutbound`, `listInbound`, `accept`, `decline`, `revoke`                                    |
 | `client.approvals` | `request`, `list`, `approve`, `deny`, `check`, `subscribe`                                                          |
@@ -90,8 +90,8 @@ await client.auth.resetPassword({ token: "...", new_password: "..." });
 | `client.apiKeys`   | `create`, `list`, `revoke`                                                                                          |
 | `client.treasury`  | `create`, `list`, `get`, `update`, `delete`, `addSigner`, `removeSigner`, `requestAccess`, `listAccessRequests`, `approveAccess`, `denyAccess` |
 | `client.treasuryWallets` | `generateWallets`, `listWallets`, `getWallet`, `exportWallet`, `rotateWallet`, `deactivateWallet`               |
-| `client.signingKeys` | `create`, `list`, `rotate`, `deactivate`                                                                          |
-| `client.platform`  | `createApp`, `listApps`, `getApp`, `updateApp`, `deleteApp`, `createTemplate`, `listTemplates`, `upsertUser`, `bootstrapUser`, `listConnectedApps` |
+| `client.signingKeys` | `create`, `list`, `rotate`, `deactivate`, `export`                                                               |
+| `client.platform`  | `createApp`, `listApps`, `getApp`, `updateApp`, `deleteApp`, `createTemplate`, `listTemplates`, `upsertUser`, `listUsers`, `bootstrapUser`, `listConnectedApps`, `disconnectApp` |
 | `client.x402`      | `getPaymentRequirement`, `pay`, `verifyReceipt`, `withPayment`                                                      |
 
 **Agent create response:** `agents.create()` returns `{ agent: AgentResponse, api_key?: string }`. The `api_key` is only present for `auth_method: "api_key"` and is shown once — use `data.agent.id` and `data.api_key` from the response.
@@ -249,7 +249,7 @@ const oidcJwt = tokenRes.data?.access_token; // RS256-signed; ~15 min default TT
 
 The acting agent must have `federation_enabled: true` and the `audience` must be on its `federation_audiences` allowlist (set via dashboard or `client.agents.update`). Every active KMS key version is published in JWKS, so verifiers reject unknown `kid`s automatically when 1claw rotates keys.
 
-End-to-end Anthropic WIF demo: [`examples/anthropic-wif`](https://github.com/1clawAI/1claw-examples/tree/main/anthropic-wif).
+End-to-end Anthropic WIF demo: see the [`examples/anthropic-wif`](https://github.com/1clawAI/1claw-examples/tree/main/anthropic-wif) repo and [`internal-docs/runbooks/oidc-federation.md`](../../internal-docs/runbooks/oidc-federation.md).
 
 ## Customer-Managed Encryption Keys (CMEK)
 

package/dist/generated/api-types.d.ts

@@ -1119,6 +1119,28 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/signing-keys/{chain}/export": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Export a signing key (private key included)
+         * @description Export the private key for an agent's signing key. Requires re-authentication
+         *     via the X-Auth-Confirm header containing the user's account password.
+         *     Human users only — agents cannot export keys.
+         */
+        post: operations["exportSigningKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{agent_id}/sign": {
         parameters: {
             query?: never;
@@ -1856,7 +1878,8 @@ export interface paths {
         /**
          * Export the private key for a treasury wallet
          * @description Returns the raw private key hex for the user's active wallet on
-         *     the given chain. Audit-logged as `treasury_wallet.export`.
+         *     the given chain. Requires re-authentication via the `X-Auth-Confirm`
+         *     header (account password). Audit-logged as `treasury_wallet.export`.
          *     Human users only.
          */
         post: operations["exportTreasuryWallet"];
@@ -2756,6 +2779,104 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/platform/claim/{token}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Preview a claim token
+         * @description Verify a claim token and preview what was provisioned (app name, vaults, agents, policies).
+         *     Public endpoint — the token itself is the authentication.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description The `ct_` prefixed claim token from the bootstrap response */
+                    token: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Claim preview */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ClaimPreviewResponse"];
+                    };
+                };
+                /** @description Invalid or expired claim token */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Redeem a claim token
+         * @description Redeem a one-time claim token, marking the connection as claimed.
+         *     Public endpoint — the token itself is the authentication. Returns 409 if already claimed, 410 if expired.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description The `ct_` prefixed claim token from the bootstrap response */
+                    token: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Claim redeemed */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ClaimRedeemResponse"];
+                    };
+                };
+                /** @description Invalid claim token */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Claim token already used */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Claim token has expired */
+                410: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -4491,6 +4612,8 @@ export interface components {
             oidc_jwks_url?: string;
             /** Format: uri */
             oidc_issuer?: string;
+            /** @description Expected audience claim for OIDC token validation */
+            oidc_audience?: string;
             redirect_uris?: string[];
             /**
              * @default platform_pays
@@ -4510,6 +4633,8 @@ export interface components {
             logo_url?: string;
             oidc_jwks_url?: string;
             oidc_issuer?: string;
+            /** @description Expected audience claim for OIDC token validation */
+            oidc_audience?: string;
             redirect_uris?: string[];
             webhook_url?: string;
             /** @enum {string} */
@@ -4529,6 +4654,8 @@ export interface components {
             api_key_prefix?: string;
             oidc_jwks_url?: string | null;
             oidc_issuer?: string | null;
+            /** @description Expected audience claim for OIDC token validation */
+            oidc_audience?: string | null;
             redirect_uris?: string[];
             webhook_url?: string | null;
             is_active?: boolean;
@@ -4548,7 +4675,15 @@ export interface components {
         CreateTemplateRequest: {
             name: string;
             description?: string;
-            /** @description Template specification defining vault, agents, and policies to bootstrap. */
+            /**
+             * @description Template specification defining vault, agents, policies, and signing keys to bootstrap.
+             *     Top-level fields: `vault` (object with name, description), `agents` (array of agent specs
+             *     with name, description, shroud_enabled, intents, shroud_config), `policies` (array with
+             *     vault_ref, principal_ref, paths, permissions, conditions), and `signing_keys` (array of
+             *     `{ chain }` objects — supported chains: ethereum, bitcoin, solana, xrp, cardano, tron).
+             *     When `signing_keys` is present, HSM-backed signing keys are auto-provisioned for the
+             *     bootstrapped agent.
+             */
             spec: Record<string, never>;
         };
         PlatformTemplateResponse: {
@@ -4639,6 +4774,28 @@ export interface components {
             /** Format: date-time */
             created_at?: string;
         };
+        ClaimPreviewResponse: {
+            app_name?: string;
+            app_slug?: string;
+            app_logo_url?: string | null;
+            auth_mode?: string;
+            vault_ids?: string[];
+            agent_ids?: string[];
+            policy_count?: number;
+            status?: string;
+            already_claimed?: boolean;
+            expired?: boolean;
+            return_to?: string | null;
+        };
+        ClaimRedeemResponse: {
+            status?: string;
+            /** Format: uuid */
+            connection_id?: string;
+            vault_ids?: string[];
+            agent_ids?: string[];
+            return_to?: string | null;
+            dashboard_url?: string;
+        };
     };
     responses: {
         /** @description Invalid request */
@@ -6598,6 +6755,43 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    exportSigningKey: {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Account password for re-authentication */
+                "X-Auth-Confirm": string;
+            };
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing key exported successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        chain: string;
+                        curve: string;
+                        public_key: string;
+                        address?: string;
+                        private_key: string;
+                        key_version: number;
+                        /** Format: uuid */
+                        agent_id: string;
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     signIntent: {
         parameters: {
             query?: never;
@@ -7756,7 +7950,10 @@ export interface operations {
     exportTreasuryWallet: {
         parameters: {
             query?: never;
-            header?: never;
+            header: {
+                /** @description Account password for re-authentication */
+                "X-Auth-Confirm": string;
+            };
             path: {
                 chain: string;
             };