@1claw/sdk 0.31.0 → 0.32.1

package/README.md

@@ -101,6 +101,7 @@ await client.auth.verifyEmailChange({ code: "123456" });
 | `client.internalAccounts` | `create`, `list`, `get`, `transfer`, `getLedger` |
 | `client.fiat` | `createOnrampSession`, `initiateOfframp` |
 | `client.signingKeys` | `create`, `list`, `rotate`, `deactivate`, `export`                                                               |
+| `client.agents` (Bankr) | `leaseBankrKey`, `listBankrKeys`, `revokeBankrKey` — dynamic short-lived Bankr wallet keys from partner key |
 | `client.platform`  | `createApp`, `listApps`, `getApp`, `updateApp`, `deleteApp`, `rotateKey`, `createTemplate`, `listTemplates`, `upsertUser`, `listUsers`, `bootstrapUser`, `reissueClaim`, `claimPreview`, `claimRedeem`, `listConnectedApps`, `disconnectApp` |
 | `client.devices`   | `register`, `list`, `delete`, `challenge`, `attest`, `setPushToken`                                                 |
 | `client.passkeys`  | `list`, `registerBegin`, `registerComplete`, `assertBegin`, `assertComplete`, `delete`                               |

package/dist/generated/api-types.d.ts

@@ -1453,6 +1453,68 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/bankr-keys/lease": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Lease a short-lived Bankr wallet API key
+         * @description Provision a scoped, time-limited Bankr wallet API key for an agent.
+         *     **Privileged, deny-by-default:** agent callers need an explicit access policy
+         *     on `agents/{agent_id}/bankr/*` in the `__agent-keys` vault (JWT scope
+         *     `agents/{agent_id}/bankr/lease`). Agents may only lease for their own ID.
+         *     The `bk_usr_` key is **omitted** from the JSON response for agent JWTs —
+         *     stored server-side for Shroud resolution. Human callers receive `api_key` once.
+         *     Requires `BANKR_PARTNER_KEY` on Vault. Agent default TTL 15 min when omitted;
+         *     human/org default 1 hour (`BANKR_DEFAULT_LEASE_TTL_SECS`). Recommend 5–15 min
+         *     for autonomous agents. Max TTL 24 hours. Max 5 concurrent leases per agent.
+         */
+        post: operations["leaseBankrKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/bankr-keys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List active Bankr key leases for an agent */
+        get: operations["listBankrKeys"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/bankr-keys/{lease_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Revoke an active Bankr key lease */
+        delete: operations["revokeBankrKey"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{agent_id}/sign": {
         parameters: {
             query?: never;
@@ -3733,7 +3795,12 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Begin passkey transaction authorization */
+        /**
+         * Begin passkey transaction authorization
+         * @description Requires `tx_digest` — SHA-256 hex of canonical `chain|to|value_wei|data`
+         *     for the treasury send being authorized. The server recomputes this digest
+         *     on send and rejects passkey tokens that do not match.
+         */
         post: operations["passkeyTxAssertBegin"];
         delete?: never;
         options?: never;
@@ -4833,6 +4900,44 @@ export interface components {
         SigningKeyListResponse: {
             keys?: components["schemas"]["SigningKeyResponse"][];
         };
+        LeaseBankrKeyRequest: {
+            /** @description Bankr wallet ID (wlt_...). Uses org default if omitted. */
+            wallet_id?: string;
+            /** @description Lease TTL in seconds (default 3600, max 86400). */
+            ttl_seconds?: number;
+            permissions?: components["schemas"]["LeaseBankrPermissions"];
+        };
+        LeaseBankrPermissions: {
+            /** @default true */
+            llm_gateway_enabled: boolean;
+            /** @default false */
+            agent_api_enabled: boolean;
+            /** @default true */
+            read_only: boolean;
+        };
+        LeaseBankrKeyResponse: {
+            /** Format: uuid */
+            lease_id?: string;
+            /** @description Ephemeral bk_usr_ key. Present for human callers only; omitted for agent JWTs. */
+            api_key?: string;
+            wallet_id?: string;
+            /** Format: date-time */
+            expires_at?: string;
+        };
+        BankrKeyLeaseResponse: {
+            /** Format: uuid */
+            id?: string;
+            wallet_id?: string;
+            bankr_key_id?: string;
+            permissions?: Record<string, never>;
+            /** Format: date-time */
+            expires_at?: string;
+            /** Format: date-time */
+            created_at?: string;
+        };
+        BankrKeyLeaseListResponse: {
+            leases?: components["schemas"]["BankrKeyLeaseResponse"][];
+        };
         SignIntentRequest: {
             /** @enum {string} */
             intent_type: "personal_sign" | "typed_data" | "transaction";
@@ -8483,6 +8588,79 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    leaseBankrKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["LeaseBankrKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Bankr key leased */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LeaseBankrKeyResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    listBankrKeys: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Active leases (no secret values) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BankrKeyLeaseListResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    revokeBankrKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                lease_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Lease revoked */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
     signIntent: {
         parameters: {
             query?: never;
@@ -10763,7 +10941,14 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description 64-char hex SHA-256 of canonical send params */
+                    tx_digest: string;
+                };
+            };
+        };
         responses: {
             /** @description WebAuthn challenge */
             200: {
@@ -10772,6 +10957,13 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Missing or invalid tx_digest */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     passkeyTxAssertComplete: {