@1claw/sdk 0.48.2 → 0.50.0

package/README.md

@@ -825,8 +825,18 @@ await client.access.createPolicy(vaultId, {
     principal_id: agentId,
     permissions: ["read"],
     consensus_trigger: {
-        conditions: [{ type: "always" }],
-        approval: { min_approvals: 2 },
+        conditions: [{ type: "value_above", threshold_wei: "1000000000000000000" }],
+        approval: {
+            min_approvals: 2,
+            required_roles: ["owner", "admin"],
+            per_role_minimums: { owner: 1 },
+            require_credential_types: ["passkey"],
+        },
+    },
+    tx_conditions: {
+        eip712_primary_type_in: ["Permit", "Permit2"],
+        eip712_verifying_contract_in: ["0x000000000022D473030F116dDEE9F6B43aC78BA3"],
+        eip7702_authorized_addresses_in: ["0xKnownSafeDelegate"],
     },
 });
 ```

package/dist/generated/api-types.d.ts

@@ -390,7 +390,11 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Complete passkey registration */
+        /**
+         * Complete passkey registration
+         * @description When the account already has a password, passkey, or TOTP,
+         *     `X-Auth-Confirm` is required (purpose `security.passkey.register`).
+         */
         post: operations["passkeyRegisterComplete"];
         delete?: never;
         options?: never;
@@ -459,7 +463,14 @@ export interface paths {
         get?: never;
         put?: never;
         post?: never;
-        /** Delete a passkey */
+        /**
+         * Delete a passkey
+         * @description Removes a registered passkey. Requires recent re-authentication
+         *     (`X-Auth-Confirm` with a `rat_` token from `POST /v1/auth/reauth`
+         *     using purpose `security.passkey.delete`). Passkey or TOTP is
+         *     required when either is enrolled. Deleting the last passkey is
+         *     refused while vault passkey unlock is enabled.
+         */
         delete: operations["deletePasskey"];
         options?: never;
         head?: never;
@@ -505,6 +516,29 @@ export interface paths {
         patch: operations["updateMe"];
         trace?: never;
     };
+    "/v1/auth/settings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get user security settings */
+        get: operations["getSecuritySettings"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update user security settings
+         * @description Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`
+         *     (purpose `security.vault_passkey.disable`) with a passkey or TOTP
+         *     when either is enrolled.
+         */
+        patch: operations["updateSecuritySettings"];
+        trace?: never;
+    };
     "/v1/auth/mfa/status": {
         parameters: {
             query?: never;
@@ -583,7 +617,12 @@ export interface paths {
         get?: never;
         put?: never;
         post?: never;
-        /** Disable MFA */
+        /**
+         * Disable MFA
+         * @description Requires a valid TOTP or recovery code in the body, or a passkey
+         *     re-auth token in `X-Auth-Confirm` (purpose `security.mfa.disable`).
+         *     Account password alone is not accepted while TOTP is enabled.
+         */
         delete: operations["mfaDisable"];
         options?: never;
         head?: never;
@@ -724,7 +763,8 @@ export interface paths {
          * @description Returns a full export of the authenticated user's data including
          *     profile, vaults, agents, secrets metadata, and policies. Intended
          *     for GDPR data-portability requests. Only available to human users
-         *     (not agents).
+         *     (not agents). Requires `X-Auth-Confirm` (purpose `account.export`);
+         *     passkey or TOTP when either is enrolled.
          */
         post: operations["exportUserData"];
         delete?: never;
@@ -6630,7 +6670,12 @@ export interface components {
             mfa_token: string;
         };
         MfaDisableRequest: {
+            /** @description TOTP or recovery code */
             code?: string;
+            /**
+             * @deprecated
+             * @description Deprecated. Password is no longer sufficient to disable MFA.
+             */
             password?: string;
         };
         DeviceCodeRequest: {
@@ -10451,20 +10496,46 @@ export interface components {
             abis?: components["schemas"]["ContractAbiResponse"][];
         };
         /**
-         * @description Signing-time AND conditions on access policies (all tiers).
+         * @description Signing-time conditions on access policies (all tiers).
          *     Ignored on secret reads. Evaluated when a TransactionContext is present.
+         *     Fields are combined according to `match_mode` (default AND).
          */
         TxConditions: {
+            /**
+             * @description How individual condition fields are combined.
+             *     "all" (default): every present field must match (AND).
+             *     "any": at least one present field must match (OR).
+             * @default all
+             * @enum {string}
+             */
+            match_mode: "all" | "any";
             function_name_in?: string[];
             function_selector_in?: string[];
             erc20_amount_above?: string;
-            /** @description Native value threshold in gwei */
+            /** @description Native value threshold in wei (arbitrary-precision string) */
             value_above?: string;
+            /** @description Match EIP-712 typed_data primaryType (case-sensitive) */
+            eip712_primary_type_in?: string[];
+            /** @description Match EIP-712 domain.verifyingContract (case-insensitive) */
+            eip712_verifying_contract_in?: string[];
+            /** @description Match EIP-712 domain.name */
+            eip712_domain_name_in?: string[];
+            /** @description Match EIP-712 domain.chainId */
+            eip712_domain_chain_id_in?: number[];
+            /** @description Match EIP-7702 authorization_list delegate addresses (case-insensitive) */
+            eip7702_authorized_addresses_in?: string[];
             to_address_in?: string[];
             chain_in?: string[];
             intent_type_in?: string[];
             decode_failed?: boolean;
             program_id_in?: string[];
+            /**
+             * @description When true, conditions are also evaluated against inner calls
+             *     extracted from wrapper transactions (multicall, Safe execTransaction,
+             *     ERC-4337 handleOps). A match on any inner call counts as an overall match.
+             * @default false
+             */
+            deep_inspect: boolean;
         } & {
             [key: string]: unknown;
         };
@@ -10478,12 +10549,66 @@ export interface components {
             expiry_secs: number;
             /** @default false */
             self_approval_allowed: boolean;
+            /**
+             * @description When ALL conditions in ANY entry match, consensus is bypassed.
+             *     Useful for exempting known-safe recipients or low-value transfers.
+             */
+            skip_when?: components["schemas"]["FlatConditionSet"][];
+            /**
+             * @description Consensus is ONLY required when at least one entry matches.
+             *     If set and none match, consensus is skipped entirely.
+             */
+            require_when?: components["schemas"]["FlatConditionSet"][];
+            /**
+             * @description When true, also evaluate conditions against inner calls extracted
+             *     from wrapper transactions (multicall, Safe execTransaction,
+             *     ERC-4337 handleOps).
+             * @default false
+             */
+            deep_inspect: boolean;
+        };
+        /**
+         * @description Flat condition set used by consensus composability. Each present field
+         *     is AND-combined within the set. At least one field must be specified
+         *     (unless `always` is true).
+         */
+        FlatConditionSet: {
+            /** @description Native value threshold in gwei (numeric string) */
+            value_above?: string;
+            chain_in?: string[];
+            to_address_in?: string[];
+            function_selector_in?: string[];
+            /** @description ERC-20 raw token amount threshold (numeric string) */
+            erc20_amount_above?: string;
+            intent_type_in?: string[];
+            /** @description When true, this entry always matches regardless of other fields */
+            always?: boolean;
+        };
+        /**
+         * @description Time window condition for policy evaluation. Used inside the policy
+         *     `conditions` JSON to restrict when the policy is active.
+         */
+        TimeWindow: {
+            start_hour?: number;
+            end_hour?: number;
+            /** @description Days when policy is active (0=Sunday, 6=Saturday) */
+            days_of_week?: number[];
+            /** @description IANA timezone identifier (e.g. "America/New_York"). Defaults to UTC. */
+            timezone?: string;
+            /** @description Cron expression (6-field with seconds) for fine-grained scheduling. */
+            cron_expr?: string;
         };
         ConsensusCondition: {
             /** @enum {string} */
             type: "value_above";
-            /** Format: int64 */
-            threshold_gwei: number;
+            /** @description Value threshold in wei (arbitrary-precision string). Preferred over threshold_gwei. */
+            threshold_wei?: string;
+            /**
+             * Format: int64
+             * @deprecated
+             * @description Deprecated — use threshold_wei for arbitrary precision
+             */
+            threshold_gwei?: number;
         } | {
             /** @enum {string} */
             type: "chain_in";
@@ -10507,6 +10632,14 @@ export interface components {
         } | {
             /** @enum {string} */
             type: "always";
+        } | {
+            /** @enum {string} */
+            type: "action_in";
+            /**
+             * @description Control-plane actions to match, e.g. policy.create, policy.update,
+             *     policy.delete, signing_key.export, member.role_change, member.remove
+             */
+            actions: string[];
         };
         ApprovalRequirement: {
             min_approvals: number;
@@ -10514,6 +10647,8 @@ export interface components {
             per_role_minimums?: {
                 [key: string]: number;
             };
+            /** @description At least one approval must use one of these credential types */
+            require_credential_types?: ("password" | "passkey" | "totp" | "biometric" | "api_key")[];
         };
         SubmitPendingApprovalRequest: {
             /** Format: uuid */
@@ -10536,6 +10671,11 @@ export interface components {
             decision: "approve" | "reject";
             payload_hash: string;
             reason?: string;
+            /**
+             * @description Authentication method used for this approval vote
+             * @enum {string}
+             */
+            credential_type?: "password" | "passkey" | "totp" | "biometric" | "api_key";
         };
         PendingApprovalResponse: {
             /** Format: uuid */
@@ -11248,7 +11388,10 @@ export interface operations {
     passkeyRegisterComplete: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Re-auth token (`rat_`) or account password */
+                "X-Auth-Confirm"?: string;
+            };
             path?: never;
             cookie?: never;
         };
@@ -11377,7 +11520,10 @@ export interface operations {
     deletePasskey: {
         parameters: {
             query?: never;
-            header?: never;
+            header: {
+                /** @description Re-auth token (`rat_`) or account password */
+                "X-Auth-Confirm": string;
+            };
             path: {
                 passkey_id: string;
             };
@@ -11392,6 +11538,7 @@ export interface operations {
                 };
                 content?: never;
             };
+            403: components["responses"]["Forbidden"];
         };
     };
     requestApproval: {
@@ -11453,7 +11600,10 @@ export interface operations {
     deleteMe: {
         parameters: {
             query?: never;
-            header?: never;
+            header: {
+                /** @description Re-auth token (`rat_`, purpose `account.delete`) or password */
+                "X-Auth-Confirm": string;
+            };
             path?: never;
             cookie?: never;
         };
@@ -11501,6 +11651,56 @@ export interface operations {
             400: components["responses"]["BadRequest"];
         };
     };
+    getSecuritySettings: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Security settings */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        require_passkey_for_vaults?: boolean;
+                        passkey_count?: number;
+                    };
+                };
+            };
+        };
+    };
+    updateSecuritySettings: {
+        parameters: {
+            query?: never;
+            header?: {
+                "X-Auth-Confirm"?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    require_passkey_for_vaults?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Updated settings */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
     mfaStatus: {
         parameters: {
             query?: never;
@@ -11594,7 +11794,10 @@ export interface operations {
     mfaDisable: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Passkey or TOTP re-auth token (`rat_`) */
+                "X-Auth-Confirm"?: string;
+            };
             path?: never;
             cookie?: never;
         };
@@ -11796,7 +11999,9 @@ export interface operations {
     exportUserData: {
         parameters: {
             query?: never;
-            header?: never;
+            header: {
+                "X-Auth-Confirm": string;
+            };
             path?: never;
             cookie?: never;
         };