@1claw/sdk 0.40.0 → 0.41.0

package/dist/generated/api-types.d.ts

@@ -1586,6 +1586,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/bindings/{binding_id}/rotate-credential": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate a binding credential
+         * @description Overwrite the stored credential for a binding without touching its config or guardrails. Human-only. The credential value is never returned.
+         */
+        post: operations["rotateBindingCredential"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{agent_id}/execute": {
         parameters: {
             query?: never;
@@ -7223,6 +7243,22 @@ export interface components {
         HoneytokenListResponse: {
             honeytokens: components["schemas"]["Honeytoken"][];
         };
+        /** @description Credential source — inline value (stored in __agent-keys) or live pointer to a vault secret (resolved at execution time). */
+        CredentialSource: {
+            /** @enum {string} */
+            type: "inline" | "vault_ref";
+            /** @description For inline — the credential value object. */
+            value?: {
+                [key: string]: unknown;
+            };
+            /**
+             * Format: uuid
+             * @description For vault_ref — the vault containing the referenced secret.
+             */
+            vault_id?: string;
+            /** @description For vault_ref — the secret path in the vault. */
+            path?: string;
+        };
         CreateBindingRequest: {
             name: string;
             /** @enum {string} */
@@ -7233,9 +7269,11 @@ export interface components {
             guardrails?: {
                 [key: string]: unknown;
             };
+            /** @description Legacy: inline credential value. Use credential_source for new integrations. */
             credential?: {
                 [key: string]: unknown;
             };
+            credential_source?: components["schemas"]["CredentialSource"];
         };
         UpdateBindingRequest: {
             config?: {
@@ -7245,9 +7283,11 @@ export interface components {
                 [key: string]: unknown;
             };
             is_active?: boolean;
+            /** @description Legacy: inline credential value. */
             credential?: {
                 [key: string]: unknown;
             };
+            credential_source?: components["schemas"]["CredentialSource"];
         };
         BindingResponse: {
             /** Format: uuid */
@@ -7264,6 +7304,20 @@ export interface components {
                 [key: string]: unknown;
             };
             is_active: boolean;
+            /** @description Whether a credential is stored for this binding. The value itself is never returned. */
+            credential_set?: boolean;
+            /**
+             * @description How the credential is sourced — inline (HSM-encrypted copy) or vault_ref (live pointer).
+             * @enum {string|null}
+             */
+            credential_source_type?: "inline" | "vault_ref" | null;
+            /**
+             * Format: uuid
+             * @description For vault_ref credentials — the vault containing the referenced secret.
+             */
+            credential_vault_id?: string | null;
+            /** @description For vault_ref credentials — the secret path in the referenced vault. */
+            credential_path?: string | null;
             /** Format: date-time */
             created_at: string;
             /** Format: date-time */
@@ -7300,6 +7354,11 @@ export interface components {
             error?: string | null;
             duration_ms: number;
             redactions_applied: number;
+            /**
+             * @description Where the intent actually ran. Reported truthfully — never claims TEE when it ran in the Vault.
+             * @enum {string}
+             */
+            execution_surface?: "vault" | "tee";
         };
         ExecutionEventResponse: {
             /** Format: uuid */
@@ -10069,6 +10128,38 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    rotateBindingCredential: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                binding_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New credential material (object or string). Stored server-side. */
+                    credential: unknown;
+                };
+            };
+        };
+        responses: {
+            /** @description Updated binding */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BindingResponse"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     executeIntent: {
         parameters: {
             query?: never;