@1claw/sdk 0.24.0 → 0.24.1

package/README.md

@@ -79,7 +79,7 @@ await client.auth.resetPassword({ token: "...", new_password: "..." });
 | `client.vault`     | `create`, `get`, `list`, `delete`, `enableMpc`, `disableMpc`                                                        |
 | `client.secrets`   | `set`, `get`, `delete`, `list`, `rotate`                                                                            |
 | `client.access`    | `grantHuman`, `grantAgent`, `update`, `revoke`, `listGrants`                                                        |
-| `client.agents`    | `enroll` (also `AgentsResource.enroll(baseUrl, …)` static), `create`, `getSelf`, `get`, `list`, `update`, `delete`, `rotateKey`, `rotateIdentityKeys`, `submitTransaction`, `signTransaction`, `getTransaction`, `listTransactions`, `simulateTransaction`, `simulateBundle`, `sign` |
+| `client.agents`    | `enroll` (also `AgentsResource.enroll(baseUrl, …)` static), `create`, `getSelf`, `get`, `list`, `update`, `delete`, `rotateKey`, `submitTransaction`, `signTransaction`, `getTransaction`, `listTransactions`, `simulateTransaction`, `simulateBundle`, `sign` |
 | `client.chains`    | `list`, `get`, `adminList`, `create`, `update`, `delete`                                                            |
 | `client.sharing`   | `create`, `access`, `listOutbound`, `listInbound`, `accept`, `decline`, `revoke`                                    |
 | `client.approvals` | `request`, `list`, `approve`, `deny`, `check`, `subscribe`                                                          |
@@ -91,7 +91,7 @@ await client.auth.resetPassword({ token: "...", new_password: "..." });
 | `client.treasury`  | `create`, `list`, `get`, `update`, `delete`, `addSigner`, `removeSigner`, `requestAccess`, `listAccessRequests`, `approveAccess`, `denyAccess` |
 | `client.treasuryWallets` | `generateWallets`, `listWallets`, `getWallet`, `exportWallet`, `rotateWallet`, `deactivateWallet`               |
 | `client.signingKeys` | `create`, `list`, `rotate`, `deactivate`, `export`                                                               |
-| `client.platform`  | `createApp`, `listApps`, `getApp`, `updateApp`, `deleteApp`, `createTemplate`, `listTemplates`, `upsertUser`, `bootstrapUser`, `listConnectedApps` |
+| `client.platform`  | `createApp`, `listApps`, `getApp`, `updateApp`, `deleteApp`, `createTemplate`, `listTemplates`, `upsertUser`, `listUsers`, `bootstrapUser`, `listConnectedApps`, `disconnectApp` |
 | `client.x402`      | `getPaymentRequirement`, `pay`, `verifyReceipt`, `withPayment`                                                      |
 
 **Agent create response:** `agents.create()` returns `{ agent: AgentResponse, api_key?: string }`. The `api_key` is only present for `auth_method: "api_key"` and is shown once — use `data.agent.id` and `data.api_key` from the response.
@@ -249,7 +249,7 @@ const oidcJwt = tokenRes.data?.access_token; // RS256-signed; ~15 min default TT
 
 The acting agent must have `federation_enabled: true` and the `audience` must be on its `federation_audiences` allowlist (set via dashboard or `client.agents.update`). Every active KMS key version is published in JWKS, so verifiers reject unknown `kid`s automatically when 1claw rotates keys.
 
-End-to-end Anthropic WIF demo: [`examples/anthropic-wif`](https://github.com/1clawAI/1claw-examples/tree/main/anthropic-wif).
+End-to-end Anthropic WIF demo: see the [`examples/anthropic-wif`](https://github.com/1clawAI/1claw-examples/tree/main/anthropic-wif) repo and [`internal-docs/runbooks/oidc-federation.md`](../../internal-docs/runbooks/oidc-federation.md).
 
 ## Customer-Managed Encryption Keys (CMEK)
 

package/dist/generated/api-types.d.ts

@@ -2779,6 +2779,104 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/platform/claim/{token}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Preview a claim token
+         * @description Verify a claim token and preview what was provisioned (app name, vaults, agents, policies).
+         *     Public endpoint — the token itself is the authentication.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description The `ct_` prefixed claim token from the bootstrap response */
+                    token: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Claim preview */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ClaimPreviewResponse"];
+                    };
+                };
+                /** @description Invalid or expired claim token */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Redeem a claim token
+         * @description Redeem a one-time claim token, marking the connection as claimed.
+         *     Public endpoint — the token itself is the authentication. Returns 409 if already claimed, 410 if expired.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description The `ct_` prefixed claim token from the bootstrap response */
+                    token: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Claim redeemed */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ClaimRedeemResponse"];
+                    };
+                };
+                /** @description Invalid claim token */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Claim token already used */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Claim token has expired */
+                410: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -4676,6 +4774,28 @@ export interface components {
             /** Format: date-time */
             created_at?: string;
         };
+        ClaimPreviewResponse: {
+            app_name?: string;
+            app_slug?: string;
+            app_logo_url?: string | null;
+            auth_mode?: string;
+            vault_ids?: string[];
+            agent_ids?: string[];
+            policy_count?: number;
+            status?: string;
+            already_claimed?: boolean;
+            expired?: boolean;
+            return_to?: string | null;
+        };
+        ClaimRedeemResponse: {
+            status?: string;
+            /** Format: uuid */
+            connection_id?: string;
+            vault_ids?: string[];
+            agent_ids?: string[];
+            return_to?: string | null;
+            dashboard_url?: string;
+        };
     };
     responses: {
         /** @description Invalid request */