@1claw/sdk 0.55.0 → 0.56.3

package/dist/generated/api-types.d.ts

@@ -539,6 +539,28 @@ export interface paths {
         patch: operations["updateSecuritySettings"];
         trace?: never;
     };
+    "/v1/auth/human-factor-auth": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get effective human factor auth policy
+         * @description Returns the resolved HFA policy for treasury wallet send, swap, and export.
+         *     Precedence: user override → spend policy → platform defaults.
+         */
+        get: operations["getHumanFactorAuth"];
+        /** Set user human factor auth policy */
+        put: operations["upsertHumanFactorAuth"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/mfa/status": {
         parameters: {
             query?: never;
@@ -1674,6 +1696,229 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/accounts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List agent on-chain accounts */
+        get: operations["listAgentAccounts"];
+        put?: never;
+        /**
+         * Provision an agent account record
+         * @description Human-only. Creates a DB record for an EOA or Safe account (Safe onchain sync is stubbed).
+         */
+        post: operations["provisionAgentAccount"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/accounts/migrate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * EOA to Safe migration wizard
+         * @description Human-only. Provisions counterfactual Safe and returns sweep plan. Onchain module broadcast stubbed pre-audit.
+         */
+        post: operations["migrateAgentToSafe"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/accounts/{chain}/deprecate-eoa": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Mark agent EOA account deprecated */
+        post: operations["deprecateAgentEoa"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/accounts/{chain}/deploy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Lazy-deploy counterfactual Safe (stub)
+         * @description Human-only. Broadcasts Safe deployment when Guard audit completes. Returns 501 pre-audit.
+         */
+        post: operations["deployAgentSafeAccount"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/org/safe/sync-allowances": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reconcile Safe allowance targets (org admin)
+         * @description Compiles tx_daily_limit targets for Safe agents. Onchain read/write stubbed pre-audit.
+         */
+        post: operations["syncOrgSafeAllowances"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/treasury/{treasury_id}/safe/roles-sync": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Sync treasury Safe Roles module (stub)
+         * @description Human-only. Reconciles on-chain Roles config with agent guardrails. Returns 501 pre-audit.
+         */
+        post: operations["treasurySafeRolesSync"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/cosign": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Enable Vault co-signer (stub) */
+        post: operations["enableSafeCosign"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/passkey-enroll": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Enroll passkey Safe owner (stub) */
+        post: operations["enrollSafePasskeyOwner"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/timelock": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Configure Zodiac timelock (stub) */
+        post: operations["configureSafeTimelock"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/erc4337": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Enable ERC-4337 Safe lane (stub) */
+        post: operations["enableSafeErc4337"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/guardrails/replay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Dry-run guardrail changes against recent transactions
+         * @description Human-only. Compares draft guardrails against recent agent transactions.
+         */
+        post: operations["replayAgentGuardrails"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/safe/module-registry/{chain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List Safe module registry entries for a chain */
+        get: operations["getSafeModuleRegistry"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{agent_id}/delegations": {
         parameters: {
             query?: never;
@@ -2077,6 +2322,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/org/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Organization operational status
+         * @description Returns whether the org is emergency-frozen (blocks agent tx/execution).
+         */
+        get: operations["getOrgStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/org/freeze": {
         parameters: {
             query?: never;
@@ -2984,6 +3249,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/treasury/wallets/auth-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get effective human factor auth policy for embedded clients
+         * @description Returns the resolved human factor auth (HFA) policy governing treasury
+         *     wallet send, swap, and export, plus the number of passkeys registered
+         *     for the calling user. Intended for embedded wallet clients; equivalent
+         *     to GET /v1/auth/human-factor-auth with an additional passkey count.
+         *     Precedence: user override → platform app → spend policy → defaults.
+         */
+        get: operations["getTreasuryAuthPolicy"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/treasury/wallets/spend-policy": {
         parameters: {
             query?: never;
@@ -4767,9 +5056,10 @@ export interface paths {
         put?: never;
         /**
          * Begin passkey transaction authorization
-         * @description Requires `tx_digest` — SHA-256 hex of canonical `chain|to|value_wei|data`
-         *     for the treasury send being authorized. The server recomputes this digest
-         *     on send and rejects passkey tokens that do not match.
+         * @description Requires `tx_digest` — SHA-256 hex of the canonical digest for the
+         *     treasury action being authorized (`send` or `swap`). The server
+         *     recomputes this digest on send/swap and rejects passkey tokens that
+         *     do not match.
          */
         post: operations["passkeyTxAssertBegin"];
         delete?: never;
@@ -6406,7 +6696,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/org/contract-abis": {
+    "/v1/org/guardrail-shadow-report": {
         parameters: {
             query?: never;
             header?: never;
@@ -6414,57 +6704,98 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List contract ABIs
-         * @description List org contract ABIs, optionally filtered by chain. Owner/admin only.
+         * Get guardrail shadow divergence report
+         * @description Returns Convention 6 shadow-mode violations (`guardrail_shadow.would_deny` audit events)
+         *     grouped by reason code. Owner/admin only.
          */
-        get: operations["listContractAbis"];
+        get: operations["getGuardrailShadowReport"];
         put?: never;
-        /**
-         * Register a contract ABI
-         * @description Upload an org-scoped ABI for transaction decoding. Owner/admin only.
-         */
-        post: operations["createContractAbi"];
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/org/contract-abis/{id}": {
+    "/v1/org/guardrail-revisions": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** Get a contract ABI */
-        get: operations["getContractAbi"];
+        /**
+         * List guardrail revision history
+         * @description Audit trail of agent and binding guardrail changes. Owner/admin only.
+         */
+        get: operations["listGuardrailRevisions"];
         put?: never;
         post?: never;
-        /** Delete a contract ABI */
-        delete: operations["deleteContractAbi"];
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/pending-approvals": {
+    "/v1/org/contract-abis": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** List pending approvals */
-        get: operations["listPendingApprovals"];
-        put?: never;
         /**
-         * Submit action for approval
-         * @description Submit a signing or transaction action that matches a consensus policy trigger.
+         * List contract ABIs
+         * @description List org contract ABIs, optionally filtered by chain. Owner/admin only.
          */
-        post: operations["submitPendingApproval"];
-        delete?: never;
-        options?: never;
+        get: operations["listContractAbis"];
+        put?: never;
+        /**
+         * Register a contract ABI
+         * @description Upload an org-scoped ABI for transaction decoding. Owner/admin only.
+         */
+        post: operations["createContractAbi"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/org/contract-abis/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a contract ABI */
+        get: operations["getContractAbi"];
+        put?: never;
+        post?: never;
+        /** Delete a contract ABI */
+        delete: operations["deleteContractAbi"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/pending-approvals": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List pending approvals */
+        get: operations["listPendingApprovals"];
+        put?: never;
+        /**
+         * Submit action for approval
+         * @description Submit a signing or transaction action that matches a consensus policy trigger.
+         */
+        post: operations["submitPendingApproval"];
+        delete?: never;
+        options?: never;
         head?: never;
         patch?: never;
         trace?: never;
@@ -7652,7 +7983,9 @@ export interface components {
             xrpl_allowed_tx_types?: string[];
             /**
              * @description Per-chain guardrail overrides. Keys are signing chains (ethereum, bitcoin, solana, xrp, cardano, tron).
-             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist, max_per_day, overhead_budget, max_ata_creates_per_day.
+             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist, max_per_day,
+             *     overhead_budget, max_ata_creates_per_day, max_fee_per_gas_gwei, max_gas_limit,
+             *     gas_daily_budget_native (UTC-day cumulative EVM gas estimate in native units).
              *     Strictest of global and per-chain limits wins. Daily limits apply per chain family spend, not cross-chain totals.
              */
             per_chain_guardrails?: {
@@ -7881,7 +8214,8 @@ export interface components {
             xrpl_allowed_tx_types?: string[];
             /**
              * @description Per-chain guardrail overrides. Keys are signing chains (ethereum, bitcoin, solana, xrp, cardano, tron).
-             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist (legacy *_eth keys accepted).
+             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist (legacy *_eth keys accepted),
+             *     max_fee_per_gas_gwei, max_gas_limit, gas_daily_budget_native (UTC-day cumulative EVM gas in native units).
              *     Strictest of global and per-chain limits wins. Daily limits apply per chain family spend, not cross-chain totals.
              */
             per_chain_guardrails?: {
@@ -7902,6 +8236,15 @@ export interface components {
             per_environment_guardrails?: {
                 [key: string]: unknown;
             };
+            /** @description Recipient address screening policy. `mode` may be `off`, `deny`, or `approve`. */
+            address_screening_policy?: {
+                [key: string]: unknown;
+            };
+            /**
+             * Format: uuid
+             * @description Approved policy_change id when applying a queued guardrail widening. Resubmit PATCH with this field after the approval has been approved via POST /v1/approvals/{approval_id}/decide.
+             */
+            approval_id?: string;
         };
         AgentResponse: {
             /** Format: uuid */
@@ -8072,6 +8415,10 @@ export interface components {
             per_environment_guardrails?: {
                 [key: string]: unknown;
             };
+            /** @description Recipient address screening policy. `mode` may be `off`, `deny`, or `approve`. */
+            address_screening_policy?: {
+                [key: string]: unknown;
+            };
         };
         KnownToken: {
             /** Format: uuid */
@@ -10160,11 +10507,19 @@ export interface components {
             /** Format: date-time */
             expires_at?: string | null;
         };
+        /**
+         * @description Stable snake_case reason codes for guardrail violations (Convention 1).
+         *     Shadow-mode `"log"` emits the same codes in `guardrail_shadow.would_deny`
+         *     audit events with `enforced: false`. 202 HITL responses use
+         *     `approval_available: true` instead of a deny reason_code.
+         * @enum {string}
+         */
+        GuardrailReasonCode: "binding_rpm_exceeded" | "agent_rpm_exceeded" | "graphql_mutation_blocked" | "graphql_depth_exceeded" | "graphql_parse_failed" | "graphql_introspection_blocked" | "response_too_large" | "request_too_large" | "method_not_allowed" | "header_not_allowed" | "dns_private_ip_blocked" | "agent_suspended" | "outside_time_window" | "secret_in_request" | "concurrency_exceeded" | "org_frozen" | "price_unavailable" | "gas_fee_exceeded" | "unlimited_approval_blocked" | "tx_per_recipient_limit_exceeded" | "tx_max_value_exceeded" | "tx_daily_limit_exceeded" | "delegation_signing_blocked" | "recipient_screening_failed" | "screening_provider_unavailable" | "human_factor_auth_required" | "register_passkey_required";
+        /** @description Convention 1 machine-readable guardrail denial JSON body. */
         GuardrailViolation: {
             /** @enum {string} */
             error: "guardrail_violation";
-            /** @enum {string} */
-            reason_code: "binding_rpm_exceeded" | "agent_rpm_exceeded" | "graphql_mutation_blocked" | "graphql_depth_exceeded" | "graphql_parse_failed" | "graphql_introspection_blocked" | "response_too_large" | "request_too_large" | "method_not_allowed" | "header_not_allowed" | "dns_private_ip_blocked" | "agent_suspended" | "outside_time_window" | "secret_in_request" | "concurrency_exceeded" | "org_frozen";
+            reason_code: components["schemas"]["GuardrailReasonCode"];
             limit?: string | null;
             current?: string | null;
             attempted?: string | null;
@@ -10173,6 +10528,8 @@ export interface components {
             retry_after_seconds?: number | null;
             detail?: string | null;
         };
+        /** @description Alias of GuardrailViolation (Convention 1 JSON shape). */
+        GuardrailDenial: components["schemas"]["GuardrailViolation"];
         EmailOtpVerifyResponse: {
             /** @description JWT access token */
             token: string;
@@ -10236,6 +10593,14 @@ export interface components {
             allowed_tokens?: string[];
             /** @description Maximum number of transactions per 24h window */
             max_transactions_per_day?: number;
+            /**
+             * @description Human factor auth requirements for send/swap/export.
+             *     Fields: send, swap, export (password_or_passkey | passkey_only | passkey_required | password_only | reauth_token_only),
+             *     conditional.require_passkey_above_usd, conditional.require_passkey_for_new_recipient.
+             */
+            human_factor_auth?: {
+                [key: string]: unknown;
+            };
         };
         SpendPolicyResponse: {
             /** Format: uuid */
@@ -10251,9 +10616,72 @@ export interface components {
             allowed_chains?: string[];
             allowed_tokens?: string[];
             max_transactions_per_day?: number | null;
+            human_factor_auth?: {
+                [key: string]: unknown;
+            } | null;
             /** Format: date-time */
             created_at: string;
         };
+        HumanFactorAuthPolicy: {
+            /** @enum {string} */
+            send?: "password_or_passkey" | "passkey_only" | "passkey_required" | "password_only" | "reauth_token_only";
+            /** @enum {string} */
+            swap?: "password_or_passkey" | "passkey_only" | "passkey_required" | "password_only" | "reauth_token_only";
+            /** @enum {string} */
+            export?: "password_or_passkey" | "passkey_only" | "passkey_required" | "password_only" | "reauth_token_only";
+            conditional?: {
+                require_passkey_above_usd?: string | null;
+                require_passkey_for_new_recipient?: boolean;
+            };
+        };
+        UpsertHumanFactorAuthRequest: {
+            policy: components["schemas"]["HumanFactorAuthPolicy"];
+        };
+        HumanFactorAuthResponse: {
+            policy: components["schemas"]["HumanFactorAuthPolicy"];
+            /** @description user | platform_app | spend_policy | default */
+            source: string;
+        };
+        TreasuryAuthPolicyResponse: {
+            policy: components["schemas"]["HumanFactorAuthPolicy"];
+            /** @description user | platform_app | spend_policy | default */
+            source: string;
+            /** @description Number of WebAuthn passkeys registered for the calling user. */
+            registered_passkeys: number;
+        };
+        PasskeyTxAssertBeginRequest: {
+            /** @description 64-char hex SHA-256 of canonical send or swap params */
+            tx_digest: string;
+            /**
+             * @description Treasury action being authorized. Defaults to `send`.
+             * @default send
+             * @enum {string}
+             */
+            action: "send" | "swap";
+        };
+        PasskeyAssertBeginResponse: {
+            challenge: string;
+            rp_id: string;
+            timeout: number;
+            user_verification: string;
+            allow_credentials: components["schemas"]["AllowCredential"][];
+        };
+        AllowCredential: {
+            id: string;
+            /** @enum {string} */
+            type: "public-key";
+            transports?: string[];
+        };
+        GuardrailWideningQueuedResponse: {
+            /** @enum {string} */
+            status: "awaiting_approval";
+            /** Format: uuid */
+            approval_id: string;
+            /** Format: uuid */
+            revision_id: string;
+            /** @description Human-readable explanation of the queued change. */
+            message: string;
+        };
         RiskEvent: {
             /** Format: uuid */
             id: string;
@@ -10383,6 +10811,11 @@ export interface components {
                 [key: string]: unknown;
             };
             credential_source?: components["schemas"]["CredentialSource"];
+            /**
+             * Format: uuid
+             * @description Approved policy_change id when applying a queued binding guardrail widening. Resubmit PATCH with this field after approval via POST /v1/approvals/{approval_id}/decide.
+             */
+            approval_id?: string;
         };
         /** @description Per-binding execution guardrails enforced at execute time. */
         BindingGuardrails: {
@@ -11339,6 +11772,149 @@ export interface components {
             /** Format: date-time */
             created_at?: string;
         };
+        GuardrailShadowReportResponse: {
+            /** Format: uuid */
+            org_id?: string;
+            /** Format: date-time */
+            since?: string;
+            /** Format: date-time */
+            until?: string;
+            /** Format: int64 */
+            total_would_deny?: number;
+            by_reason?: components["schemas"]["GuardrailShadowReasonRow"][];
+        };
+        GuardrailShadowReasonRow: {
+            reason_code?: string;
+            /** Format: int64 */
+            would_deny_count?: number;
+            /** Format: int64 */
+            enforced_count?: number;
+        };
+        GuardrailRevisionListResponse: {
+            revisions?: components["schemas"]["GuardrailRevisionRow"][];
+        };
+        GuardrailRevisionRow: {
+            /** Format: uuid */
+            id?: string;
+            /** Format: uuid */
+            org_id?: string;
+            /** @enum {string} */
+            resource_type?: "agent" | "binding";
+            /** Format: uuid */
+            resource_id?: string;
+            /** Format: uuid */
+            actor_id?: string;
+            before_json?: {
+                [key: string]: unknown;
+            };
+            after_json?: {
+                [key: string]: unknown;
+            };
+            /** @enum {string} */
+            change_kind?: "narrowing" | "widening" | "neutral";
+            /** Format: uuid */
+            approval_id?: string | null;
+            /** Format: date-time */
+            created_at?: string;
+        };
+        GuardrailReplayRequest: {
+            days?: number;
+            draft_guardrails?: {
+                [key: string]: unknown;
+            };
+            draft_approval_policy?: {
+                [key: string]: unknown;
+            };
+        };
+        GuardrailReplayResponse: {
+            /** Format: uuid */
+            agent_id?: string;
+            /** Format: int64 */
+            window_days?: number;
+            /** Format: int64 */
+            allowed?: number;
+            /** Format: int64 */
+            denied?: number;
+            /** Format: int64 */
+            would_require_approval?: number;
+            samples?: {
+                [key: string]: unknown;
+            }[];
+        };
+        AgentAccountListResponse: {
+            accounts?: components["schemas"]["AgentAccountResponse"][];
+        };
+        AgentAccountResponse: {
+            /** Format: uuid */
+            id?: string;
+            /** Format: uuid */
+            org_id?: string;
+            /** Format: uuid */
+            agent_id?: string;
+            chain?: string;
+            account_type?: string;
+            address?: string;
+            safe_version?: string;
+            modules_enabled?: string[];
+            deploy_status?: string;
+            cosign_enabled?: boolean;
+            metadata?: Record<string, never>;
+            /** Format: date-time */
+            created_at?: string;
+            /** Format: date-time */
+            updated_at?: string;
+        };
+        MigrationPlanResponse: {
+            /** Format: uuid */
+            agent_id?: string;
+            chain?: string;
+            safe_address?: string;
+            safe_version?: string;
+            modules?: string[];
+            eoa_address?: string;
+            sweep_instructions?: {
+                asset?: string;
+                action?: string;
+                note?: string;
+            }[];
+            roles_config_hash?: string;
+            allowance_config_hash?: string;
+            warnings?: string[];
+            deploy_status?: string;
+        };
+        ProvisionAgentAccountRequest: {
+            chain: string;
+            /** @default eoa */
+            account_type: string;
+            address?: string;
+        };
+        SafeModuleRegistryResponse: {
+            chain?: string;
+            modules?: components["schemas"]["SafeModuleInfo"][];
+        };
+        SafeModuleInfo: {
+            name?: string;
+            address?: string;
+            version?: string;
+        };
+        AllowanceReconcileReport: {
+            /** Format: uuid */
+            org_id?: string;
+            agents_checked?: number;
+            compiled?: {
+                [key: string]: unknown;
+            }[];
+            drift_detected?: {
+                [key: string]: unknown;
+            }[];
+            /** @description counterfactual when on-chain broadcast is stubbed pre-audit */
+            onchain_sync?: string;
+        };
+        NotImplementedResponse: {
+            error: string;
+            phase: string;
+            message: string;
+        };
         CreateContractAbiRequest: {
             chain: string;
             /** @description Contract address, or Solana program id when interface_kind is solana_idl */
@@ -12894,6 +13470,52 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    getHumanFactorAuth: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Effective HFA policy */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HumanFactorAuthResponse"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    upsertHumanFactorAuth: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpsertHumanFactorAuthRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated policy */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HumanFactorAuthResponse"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
     mfaStatus: {
         parameters: {
             query?: never;
@@ -14354,6 +14976,20 @@ export interface operations {
                     "application/json": components["schemas"]["AgentResponse"];
                 };
             };
+            /**
+             * @description Guardrail widening queued for human approval. The change is not
+             *     applied until approved via POST /v1/approvals/{approval_id}/decide.
+             *     Resubmit this PATCH with `approval_id` set to the returned value
+             *     after approval to apply the widening.
+             */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailWideningQueuedResponse"];
+                };
+            };
             404: components["responses"]["NotFound"];
         };
     };
@@ -14610,7 +15246,350 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
-    simulateBundle: {
+    simulateBundle: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SimulateBundleRequest"];
+            };
+        };
+        responses: {
+            /** @description Bundle simulation results */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BundleSimulationResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            402: components["responses"]["PaymentRequired"];
+        };
+    };
+    listSigningKeys: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing keys list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyListResponse"];
+                };
+            };
+        };
+    };
+    createSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSigningKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Signing key created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            409: components["responses"]["Conflict"];
+        };
+    };
+    rotateSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Rotated signing key */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deactivateSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Key deactivated */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    exportSigningKey: {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Account password for re-authentication */
+                "X-Auth-Confirm": string;
+            };
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing key exported successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        chain: string;
+                        curve: string;
+                        public_key: string;
+                        address?: string;
+                        private_key: string;
+                        key_version: number;
+                        /** Format: uuid */
+                        agent_id: string;
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getSigningKeyBalance: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing key balance */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyBalanceResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    importSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ImportKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Signing key imported */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    leaseBankrKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["LeaseBankrKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Bankr key leased */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LeaseBankrKeyResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    listBankrKeys: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Active leases (no secret values) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BankrKeyLeaseListResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    revokeBankrKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                lease_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Lease revoked */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    listAgentAccounts: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Agent accounts */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AgentAccountListResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    provisionAgentAccount: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ProvisionAgentAccountRequest"];
+            };
+        };
+        responses: {
+            /** @description Account provisioned */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AgentAccountResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    migrateAgentToSafe: {
         parameters: {
             query?: never;
             header?: never;
@@ -14621,212 +15600,187 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["SimulateBundleRequest"];
+                "application/json": {
+                    chain: string;
+                    deprecate_eoa?: boolean;
+                };
             };
         };
         responses: {
-            /** @description Bundle simulation results */
+            /** @description Migration plan */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["BundleSimulationResponse"];
+                    "application/json": components["schemas"]["MigrationPlanResponse"];
                 };
             };
-            400: components["responses"]["BadRequest"];
-            402: components["responses"]["PaymentRequired"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
         };
     };
-    listSigningKeys: {
+    deprecateAgentEoa: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
+                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Signing keys list */
+            /** @description Updated account */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SigningKeyListResponse"];
+                    "application/json": components["schemas"]["AgentAccountResponse"];
                 };
             };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
         };
     };
-    createSigningKey: {
+    deployAgentSafeAccount: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
+                chain: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateSigningKeyRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Signing key created */
-            201: {
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description Not implemented (Phase 5.1) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SigningKeyResponse"];
+                    "application/json": components["schemas"]["NotImplementedResponse"];
                 };
             };
-            400: components["responses"]["BadRequest"];
-            409: components["responses"]["Conflict"];
         };
     };
-    rotateSigningKey: {
+    syncOrgSafeAllowances: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                agent_id: components["parameters"]["AgentId"];
-                chain: string;
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Rotated signing key */
+            /** @description Reconciliation report */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SigningKeyResponse"];
+                    "application/json": components["schemas"]["AllowanceReconcileReport"];
                 };
             };
-            404: components["responses"]["NotFound"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
         };
     };
-    deactivateSigningKey: {
+    treasurySafeRolesSync: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                agent_id: components["parameters"]["AgentId"];
-                chain: string;
+                treasury_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Key deactivated */
-            204: {
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description Not implemented (Phase 5.9) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["NotImplementedResponse"];
+                };
             };
-            404: components["responses"]["NotFound"];
         };
     };
-    exportSigningKey: {
+    enableSafeCosign: {
         parameters: {
             query?: never;
-            header: {
-                /** @description Account password for re-authentication */
-                "X-Auth-Confirm": string;
-            };
+            header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
-                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Signing key exported successfully */
-            200: {
+            /** @description Not implemented (Phase 5.2) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        chain: string;
-                        curve: string;
-                        public_key: string;
-                        address?: string;
-                        private_key: string;
-                        key_version: number;
-                        /** Format: uuid */
-                        agent_id: string;
-                    };
-                };
+                content?: never;
             };
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    getSigningKeyBalance: {
+    enrollSafePasskeyOwner: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
-                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Signing key balance */
-            200: {
+            /** @description Not implemented (Phase 5.5) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["SigningKeyBalanceResponse"];
-                };
+                content?: never;
             };
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    importSigningKey: {
+    configureSafeTimelock: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
-                chain: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ImportKeyRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Signing key imported */
-            201: {
+            /** @description Not implemented (Phase 5.6) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["SigningKeyResponse"];
-                };
+                content?: never;
             };
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
         };
     };
-    leaseBankrKey: {
+    enableSafeErc4337: {
         parameters: {
             query?: never;
             header?: never;
@@ -14835,26 +15789,18 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: {
-            content: {
-                "application/json": components["schemas"]["LeaseBankrKeyRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Bankr key leased */
-            201: {
+            /** @description Not implemented (Phase 5.8) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["LeaseBankrKeyResponse"];
-                };
+                content?: never;
             };
-            400: components["responses"]["BadRequest"];
-            403: components["responses"]["Forbidden"];
         };
     };
-    listBankrKeys: {
+    replayAgentGuardrails: {
         parameters: {
             query?: never;
             header?: never;
@@ -14863,40 +15809,46 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["GuardrailReplayRequest"];
+            };
+        };
         responses: {
-            /** @description Active leases (no secret values) */
+            /** @description Replay report */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["BankrKeyLeaseListResponse"];
+                    "application/json": components["schemas"]["GuardrailReplayResponse"];
                 };
             };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    revokeBankrKey: {
+    getSafeModuleRegistry: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                agent_id: components["parameters"]["AgentId"];
-                lease_id: string;
+                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Lease revoked */
-            204: {
+            /** @description Module registry */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["SafeModuleRegistryResponse"];
+                };
             };
-            404: components["responses"]["NotFound"];
         };
     };
     listDelegations: {
@@ -15210,6 +16162,19 @@ export interface operations {
                     "application/json": components["schemas"]["BindingResponse"];
                 };
             };
+            /**
+             * @description Binding guardrail widening queued for human approval. Resubmit
+             *     PATCH with `approval_id` after approval via
+             *     POST /v1/approvals/{approval_id}/decide.
+             */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailWideningQueuedResponse"];
+                };
+            };
             400: components["responses"]["BadRequest"];
             404: components["responses"]["NotFound"];
         };
@@ -15701,6 +16666,40 @@ export interface operations {
             };
         };
     };
+    getOrgStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Current org status */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** Format: uuid */
+                        org_id: string;
+                        /** @enum {string} */
+                        status: "active" | "frozen";
+                        /** Format: date-time */
+                        frozen_at?: string | null;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     freezeOrg: {
         parameters: {
             query?: never;
@@ -17151,6 +18150,27 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    getTreasuryAuthPolicy: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Effective HFA policy with passkey registration count */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TreasuryAuthPolicyResponse"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
     getEffectiveSpendPolicy: {
         parameters: {
             query?: never;
@@ -18349,10 +19369,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": {
-                    /** @description 64-char hex SHA-256 of canonical send params */
-                    tx_digest: string;
-                };
+                "application/json": components["schemas"]["PasskeyTxAssertBeginRequest"];
             };
         };
         responses: {
@@ -18361,15 +19378,25 @@ export interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["PasskeyAssertBeginResponse"];
+                };
             };
-            /** @description Missing or invalid tx_digest */
+            /** @description Missing or invalid tx_digest, or invalid action */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
+            403: components["responses"]["Forbidden"];
+            /** @description No passkeys registered for the user */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     passkeyTxAssertComplete: {
@@ -21067,6 +22094,53 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    getGuardrailShadowReport: {
+        parameters: {
+            query?: {
+                since?: string;
+                until?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Guardrail shadow report */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailShadowReportResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    listGuardrailRevisions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Guardrail revisions */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailRevisionListResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
     listContractAbis: {
         parameters: {
             query?: {