@1claw/sdk 0.25.0 → 0.26.0

package/dist/generated/api-types.d.ts

@@ -304,6 +304,188 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/set-password": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Set initial password for platform users
+         * @description Only allowed when the user has no password set (platform_oidc users after claiming).
+         */
+        post: operations["setPassword"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/change-email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Request email change
+         * @description Sends a 6-digit verification code to the new email address. Code expires in 10 minutes.
+         */
+        post: operations["changeEmail"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/verify-email-change": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Verify email change with code */
+        post: operations["verifyEmailChange"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/passkeys/register/begin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Begin passkey registration
+         * @description Returns a WebAuthn challenge for creating a new passkey credential.
+         */
+        post: operations["passkeyRegisterBegin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/passkeys/register/complete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Complete passkey registration */
+        post: operations["passkeyRegisterComplete"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/passkeys/assert/begin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Begin passkey authentication */
+        post: operations["passkeyAssertBegin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/passkeys/assert/complete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Complete passkey authentication */
+        post: operations["passkeyAssertComplete"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/passkeys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List registered passkeys */
+        get: operations["listPasskeys"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/passkeys/{passkey_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Delete a passkey */
+        delete: operations["deletePasskey"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/approvals/request": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Request human approval (agent-only)
+         * @description Agents can request policy changes or other sensitive actions that require human approval.
+         */
+        post: operations["requestApproval"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/me": {
         parameters: {
             query?: never;
@@ -551,6 +733,115 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/devices": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List devices for current user
+         * @description Returns all registered mobile devices for the authenticated user.
+         */
+        get: operations["listDevices"];
+        put?: never;
+        /**
+         * Register a mobile device
+         * @description Register a new mobile device for the authenticated user. Human-only.
+         *     The device public key is used for step-up authentication challenges.
+         */
+        post: operations["registerDevice"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/devices/{device_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a device
+         * @description Removes a registered device, invalidating its keys and push tokens.
+         */
+        delete: operations["revokeDevice"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/devices/{device_id}/challenge": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create step-up auth challenge
+         * @description Creates a cryptographic challenge bound to a specific action (e.g. approving
+         *     a high-risk transaction). The device signs the challenge nonce to prove
+         *     possession of the private key.
+         */
+        post: operations["createDeviceChallenge"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/devices/{device_id}/attest": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Attest device challenge
+         * @description Submit a signed challenge nonce to complete step-up authentication.
+         *     Returns a short-lived step-up token that can be used for the bound action.
+         */
+        post: operations["attestDeviceChallenge"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/devices/{device_id}/push-token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Register push notification token
+         * @description Associates a push notification token (APNs or FCM) with a registered device
+         *     so the server can send approval requests and alerts.
+         */
+        post: operations["registerPushToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/vaults": {
         parameters: {
             query?: never;
@@ -2877,29 +3168,91 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-}
-export type webhooks = Record<string, never>;
-export interface components {
-    schemas: {
-        /** @description RFC 7807 error envelope */
-        ProblemDetails: {
-            type?: string;
-            title?: string;
-            status?: number;
-            detail?: string;
-        };
-        ResetUsageEventsResponse: {
-            /**
-             * Format: int64
-             * @description Number of usage_events rows removed
-             */
-            deleted_events: number;
-        };
-        ResetUsageForUserEmailRequest: {
-            /** Format: email */
-            email: string;
+    "/v1/approvals": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
         };
-        ResetUsageForUserEmailResponse: {
+        /**
+         * List pending approvals
+         * @description Returns approvals for the authenticated user's organization.
+         *     Human-only. Supports filtering by status and pagination.
+         */
+        get: operations["listApprovals"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/approvals/{approval_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get approval details
+         * @description Returns details for a single approval by ID.
+         */
+        get: operations["getApproval"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/approvals/{approval_id}/decide": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Approve or reject
+         * @description Submit a decision (approve or reject) for a pending approval.
+         *     Human-only. The approval must be in `pending` status.
+         */
+        post: operations["decideApproval"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /** @description RFC 7807 error envelope */
+        ProblemDetails: {
+            type?: string;
+            title?: string;
+            status?: number;
+            detail?: string;
+        };
+        ResetUsageEventsResponse: {
+            /**
+             * Format: int64
+             * @description Number of usage_events rows removed
+             */
+            deleted_events: number;
+        };
+        ResetUsageForUserEmailRequest: {
+            /** Format: email */
+            email: string;
+        };
+        ResetUsageForUserEmailResponse: {
             /** Format: int64 */
             deleted_events: number;
             /** Format: uuid */
@@ -4807,6 +5160,102 @@ export interface components {
             return_to?: string | null;
             dashboard_url?: string;
         };
+        RegisterDeviceRequest: {
+            /**
+             * @description Human-readable device name (e.g. "Kevin's iPhone")
+             * @example My iPhone
+             */
+            name: string;
+            /** @enum {string} */
+            platform: "ios" | "android";
+            /** @description PEM-encoded public key for step-up challenge signing */
+            public_key_pem: string;
+            /** @description Optional platform attestation (Apple DeviceCheck / Android SafetyNet) */
+            attestation_blob?: string;
+        };
+        RegisterDeviceResponse: {
+            /** Format: uuid */
+            device_id: string;
+            attestation_verified: boolean;
+        };
+        DeviceListResponse: {
+            devices: components["schemas"]["DeviceResponse"][];
+        };
+        DeviceResponse: {
+            /** Format: uuid */
+            id: string;
+            name: string;
+            platform: string;
+            attestation_verified: boolean;
+            /** Format: date-time */
+            last_used_at?: string | null;
+            /** Format: date-time */
+            created_at: string;
+        };
+        CreateDeviceChallengeRequest: {
+            /** @description The action this challenge authorizes (e.g. "approve_transaction") */
+            action: string;
+            /** @description ID of the resource the action targets */
+            target_id: string;
+        };
+        DeviceChallengeResponse: {
+            challenge_nonce: string;
+            /** Format: date-time */
+            expires_at: string;
+            /** @description SHA-256 binding the challenge to the requested action and target */
+            action_bound_hash: string;
+        };
+        AttestDeviceChallengeRequest: {
+            challenge_nonce: string;
+            /** @description Signature over the challenge nonce using the device's private key */
+            signature: string;
+        };
+        AttestDeviceChallengeResponse: {
+            /** @description Short-lived token authorizing the bound action */
+            step_up_token: string;
+            /** Format: date-time */
+            expires_at: string;
+        };
+        RegisterPushTokenRequest: {
+            /** @description Push notification token from APNs or FCM */
+            token: string;
+            /** @enum {string} */
+            platform: "apns" | "fcm";
+        };
+        DecideApprovalRequest: {
+            /** @enum {string} */
+            decision: "approve" | "reject";
+            /** @description Optional human-readable reason for the decision */
+            reason?: string;
+        };
+        ApprovalResponse: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            org_id: string;
+            /** Format: uuid */
+            user_id: string;
+            /** Format: uuid */
+            agent_id?: string | null;
+            action: string;
+            target_type: string;
+            target_id: string;
+            risk_tier: number;
+            /** @enum {string} */
+            status: "pending" | "approved" | "rejected" | "expired";
+            /** @description Structured summary of the action requiring approval */
+            summary: Record<string, never>;
+            reason?: string | null;
+            decision_reason?: string | null;
+            /** Format: uuid */
+            decided_by?: string | null;
+            /** Format: date-time */
+            decided_at?: string | null;
+            /** Format: date-time */
+            expires_at?: string | null;
+            /** Format: date-time */
+            created_at: string;
+        };
     };
     responses: {
         /** @description Invalid request */
@@ -5115,19 +5564,305 @@ export interface operations {
             };
         };
         responses: {
-            /** @description Account created (pending verification or auto-login) */
-            200: {
+            /** @description Account created (pending verification or auto-login) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignupResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    verifyEmail: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    token: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Email verified */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    forgotPassword: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ForgotPasswordRequest"];
+            };
+        };
+        responses: {
+            /** @description Acknowledgement (check email if account exists) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ForgotPasswordResponse"];
+                };
+            };
+        };
+    };
+    resetPassword: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ResetPasswordRequest"];
+            };
+        };
+        responses: {
+            /** @description Password updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ResetPasswordResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    googleAuth: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["GoogleAuthRequest"];
+            };
+        };
+        responses: {
+            /** @description Authenticated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    changePassword: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ChangePasswordRequest"];
+            };
+        };
+        responses: {
+            /** @description Password changed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    setPassword: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    password: string;
+                    password_confirm: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Password set successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        message?: string;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    changeEmail: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** Format: email */
+                    new_email: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Verification code sent */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        message?: string;
+                        new_email?: string;
+                        expires_in_seconds?: number;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Email already in use */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    verifyEmailChange: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    code: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Email updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        message?: string;
+                        email?: string;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    passkeyRegisterBegin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Registration options */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        challenge?: string;
+                        rp_id?: string;
+                        rp_name?: string;
+                        user_id?: string;
+                        user_name?: string;
+                        user_display_name?: string;
+                        attestation?: string;
+                        authenticator_selection?: Record<string, never>;
+                    };
+                };
+            };
+        };
+    };
+    passkeyRegisterComplete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    credential_id: string;
+                    attestation_object: string;
+                    client_data_json: string;
+                    transports?: string[];
+                    name?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Passkey registered */
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SignupResponse"];
+                    "application/json": {
+                        /** Format: uuid */
+                        passkey_id?: string;
+                        credential_id?: string;
+                    };
                 };
             };
-            400: components["responses"]["BadRequest"];
         };
     };
-    verifyEmail: {
+    passkeyAssertBegin: {
         parameters: {
             query?: never;
             header?: never;
@@ -5137,24 +5872,30 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    token: string;
+                    /** Format: email */
+                    email?: string;
                 };
             };
         };
         responses: {
-            /** @description Email verified */
+            /** @description Assertion options */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["TokenResponse"];
+                    "application/json": {
+                        challenge?: string;
+                        rp_id?: string;
+                        timeout?: number;
+                        user_verification?: string;
+                        allow_credentials?: Record<string, never>[];
+                    };
                 };
             };
-            400: components["responses"]["BadRequest"];
         };
     };
-    forgotPassword: {
+    passkeyAssertComplete: {
         parameters: {
             query?: never;
             header?: never;
@@ -5163,72 +5904,80 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["ForgotPasswordRequest"];
+                "application/json": {
+                    credential_id: string;
+                    authenticator_data: string;
+                    client_data_json: string;
+                    signature: string;
+                };
             };
         };
         responses: {
-            /** @description Acknowledgement (check email if account exists) */
+            /** @description Authentication successful */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ForgotPasswordResponse"];
+                    "application/json": {
+                        token?: string;
+                        refresh_token?: string;
+                        user?: Record<string, never>;
+                    };
                 };
             };
         };
     };
-    resetPassword: {
+    listPasskeys: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ResetPasswordRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Password updated */
+            /** @description List of passkeys */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ResetPasswordResponse"];
+                    "application/json": {
+                        passkeys?: {
+                            /** Format: uuid */
+                            id?: string;
+                            credential_id?: string;
+                            name?: string;
+                            last_used_at?: string;
+                            created_at?: string;
+                        }[];
+                    };
                 };
             };
-            400: components["responses"]["BadRequest"];
         };
     };
-    googleAuth: {
+    deletePasskey: {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["GoogleAuthRequest"];
+            path: {
+                passkey_id: string;
             };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
-            /** @description Authenticated */
+            /** @description Passkey deleted */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["TokenResponse"];
-                };
+                content?: never;
             };
-            401: components["responses"]["Unauthorized"];
         };
     };
-    changePassword: {
+    requestApproval: {
         parameters: {
             query?: never;
             header?: never;
@@ -5237,18 +5986,29 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["ChangePasswordRequest"];
+                "application/json": {
+                    /** @description Type of action (e.g. policy_change) */
+                    action: string;
+                    target_type: string;
+                    target_id: string;
+                    /** @description JSON payload describing the request */
+                    summary: Record<string, never>;
+                    reason?: string;
+                    risk_tier?: number;
+                };
             };
         };
         responses: {
-            /** @description Password changed */
-            204: {
+            /** @description Approval request created */
+            202: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ApprovalResponse"];
+                };
             };
-            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
         };
     };
     getMe: {
@@ -5686,6 +6446,154 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    listDevices: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Device list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DeviceListResponse"];
+                };
+            };
+        };
+    };
+    registerDevice: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RegisterDeviceRequest"];
+            };
+        };
+        responses: {
+            /** @description Device registered */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RegisterDeviceResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    revokeDevice: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                device_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Device revoked */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    createDeviceChallenge: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                device_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateDeviceChallengeRequest"];
+            };
+        };
+        responses: {
+            /** @description Challenge created */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DeviceChallengeResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    attestDeviceChallenge: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                device_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AttestDeviceChallengeRequest"];
+            };
+        };
+        responses: {
+            /** @description Attestation successful */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AttestDeviceChallengeResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    registerPushToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                device_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RegisterPushTokenRequest"];
+            };
+        };
+        responses: {
+            /** @description Push token registered */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     listVaults: {
         parameters: {
             query?: never;
@@ -8327,5 +9235,84 @@ export interface operations {
             };
         };
     };
+    listApprovals: {
+        parameters: {
+            query?: {
+                /** @description Filter by approval status */
+                status?: "pending" | "approved" | "rejected" | "expired";
+                limit?: number;
+                offset?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Approval list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        approvals: components["schemas"]["ApprovalResponse"][];
+                    };
+                };
+            };
+        };
+    };
+    getApproval: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                approval_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Approval details */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApprovalResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    decideApproval: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                approval_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DecideApprovalRequest"];
+            };
+        };
+        responses: {
+            /** @description Decision recorded */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApprovalResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+        };
+    };
 }
 //# sourceMappingURL=api-types.d.ts.map