@1claw/sdk 0.55.0 → 0.57.0

package/README.md

@@ -106,7 +106,8 @@ await client.auth.verifyEmailChange({ code: "123456" });
 | `client.fiat` | `createOnrampSession`, `initiateOfframp` |
 | `client.signingKeys` | `create`, `list`, `rotate`, `deactivate`, `export`                                                               |
 | `client.agents` (Bankr) | `leaseBankrKey`, `listBankrKeys`, `revokeBankrKey` — privileged; `api_key` omitted for agent JWTs (use Shroud) |
-| `client.platform`  | `createApp`, `listApps`, `getApp`, `updateApp`, `deleteApp`, `rotateKey`, `rotateWebhookSecret`, `getAppStats`, `marketplace`, `createTemplate`, `listTemplates`, `upsertUser`, `listUsers`, `bootstrapUser`, `reissueClaim`, `claimPreview`, `claimRedeem`, `listConnectedApps`, `disconnectApp`, `grantAccess`, `listGrants`, `revokeGrant`, `createSpendPolicy`, `listSpendPolicies`, `setUserSpendPolicy`, `deleteSpendPolicy`, `updateConnectionDelegation` |
+| `client.platform`  | `createApp`, `listApps`, `getApp`, `updateApp`, `deleteApp`, `rotateKey`, `rotateWebhookSecret`, `getAppStats`, `marketplace`, `createTemplate`, `listTemplates`, `upsertUser`, `listUsers`, `bootstrapUser`, `reissueClaim`, `claimPreview`, `claimRedeem`, `listConnectedApps`, `disconnectApp`, `grantAccess`, `listGrants`, `revokeGrant`, `createSpendPolicy`, `listSpendPolicies`, `setUserSpendPolicy`, `deleteSpendPolicy`, `updateConnectionDelegation`, **`siweChallenge`**, **`getConnection`**, **`getConnectionUsage`**, **`listEntitlements`**, **`refreshEntitlements`**, **`previewTemplate`** |
+| `client.treasuryWallets` | … **`getInferenceBudget`** (platform-connected users) |
 | `client.devices`   | `register`, `list`, `delete`, `challenge`, `attest`, `setPushToken`                                                 |
 | `client.passkeys`  | `list`, `registerBegin`, `registerComplete`, `assertBegin`, `assertComplete`, `delete`                               |
 | `client.risk`      | `listEvents`, `getVerdict`, `listVerdicts`, `createHoneytoken`, `listHoneytokens`, `deleteHoneytoken`                |
@@ -306,6 +307,31 @@ console.log(signRes.data?.from);      // derived sender address
 
 All agent guardrails (allowlists, value caps, daily limits) are enforced exactly as for submit. The transaction is recorded for audit and daily-limit tracking with `status: "sign_only"`.
 
+### Graduated HITL & v0.55 guardrails
+
+Configure graduated human-in-the-loop thresholds on agents with Intents API enabled:
+
+```typescript
+await client.agents.update(agentId, {
+  tx_approval_policy: {
+    require_above_native: { ethereum: "0.1", base: "0.05" },
+    require_for_new_recipients: true,
+    require_for_unlimited_approvals: true,
+  },
+  typed_data_policy: "approve",           // EIP-712 → 202 awaiting_approval
+  simulation_failure_policy: "approve",   // Tenderly revert → HITL
+  raw_signing_policy: "approve",          // allow | deny | approve
+  tx_block_unlimited_approvals: true,
+  tx_max_value_usd: "1000",
+  tx_daily_limit_usd: "5000",
+  allow_erc4337: true,
+  allow_eip7702: false,
+  clear_auto_suspended: true,             // owner/admin — clear circuit breaker
+});
+```
+
+Org emergency freeze (owner/admin): `POST /v1/org/freeze` and `POST /v1/org/unfreeze`.
+
 ### Non-EVM transactions (Bitcoin, Solana, XRP, Cardano, Tron)
 
 The same `submitTransaction` / `signTransaction` methods accept chain-specific fields. Values are in the chain's native unit (BTC, SOL, XRP, ADA, TRX):
@@ -936,6 +962,44 @@ await client.signingKeys.import(agentId, "ethereum", {
 }, { authConfirm: "your-password" });
 ```
 
+## v0.56 — Safe accounts, guardrail governance, HFA
+
+Phase 5 Safe foundation and v0.56 guardrail governance APIs:
+
+```typescript
+// Agent on-chain accounts (EOA + counterfactual Safe)
+const { data: accounts } = await client.agents.listAccounts(agentId);
+await client.agents.migrateToSafe(agentId, { chain: "ethereum", deprecate_eoa: true });
+await client.agents.deprecateEoaAccount(agentId, "ethereum");
+await client.agents.syncOrgSafeAllowances(); // owner/admin
+
+// Public Safe module registry (Guard + Zodiac addresses per chain)
+const registry = await client.agents.getSafeModuleRegistry("ethereum");
+
+// Guardrail widening returns 202 — resubmit PATCH with approval_id after decide
+await client.agents.update(agentId, {
+    tx_to_allowlist: ["0xNewRecipient..."],
+    approval_id: "uuid-from-202-response",
+});
+
+// Guardrail governance (owner/admin)
+await client.org.getGuardrailShadowReport({ since: "2026-01-01T00:00:00Z" });
+await client.org.listGuardrailRevisions();
+await client.agents.replayGuardrails(agentId, {
+    days: 7,
+    draft_guardrails: { tx_max_value_eth: "0.1" },
+});
+
+// Human Factor Auth — treasury send/swap step-up policies
+await client.auth.getHumanFactorAuth();
+await client.auth.setHumanFactorAuth({ require_passkey: true, require_totp: false });
+const embedded = await client.treasuryWallets.getAuthPolicy(); // wallet-react / embedded clients
+
+// Passkey tx-assert for treasury send/swap (alternative to X-Auth-Confirm password)
+const begin = await client.auth.beginPasskeyTxAssert({ tx_digest: "abc123...", action: "swap" });
+// ... complete ceremony, then send with X-Passkey-Token header
+```
+
 ## OpenAPI Types
 
 The SDK's request types are generated from the **OpenAPI 3.1** spec, published as [@1claw/openapi-spec](https://www.npmjs.com/package/@1claw/openapi-spec). Advanced users can access the raw generated types: