@1claw/sdk 0.55.0 → 0.57.0

package/dist/generated/api-types.d.ts

@@ -535,10 +535,36 @@ export interface paths {
          * @description Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`
          *     (purpose `security.vault_passkey.disable`) with a passkey or TOTP
          *     when either is enrolled.
+         *
+         *     Disabling `require_passkey_for_mfa` requires `X-Auth-Confirm`
+         *     (purpose `security.mfa_passkey.disable`) with a passkey or TOTP
+         *     when either is enrolled.
          */
         patch: operations["updateSecuritySettings"];
         trace?: never;
     };
+    "/v1/auth/human-factor-auth": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get effective human factor auth policy
+         * @description Returns the resolved HFA policy for treasury wallet send, swap, and export.
+         *     Precedence: user override → spend policy → platform defaults.
+         */
+        get: operations["getHumanFactorAuth"];
+        /** Set user human factor auth policy */
+        put: operations["upsertHumanFactorAuth"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/mfa/status": {
         parameters: {
             query?: never;
@@ -607,6 +633,40 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/mfa/passkey/begin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Begin passkey MFA verification during login */
+        post: operations["mfaPasskeyBegin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/mfa/passkey/complete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Complete passkey MFA verification during login */
+        post: operations["mfaPasskeyComplete"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/mfa": {
         parameters: {
             query?: never;
@@ -1674,6 +1734,229 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/accounts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List agent on-chain accounts */
+        get: operations["listAgentAccounts"];
+        put?: never;
+        /**
+         * Provision an agent account record
+         * @description Human-only. Creates a DB record for an EOA or Safe account (Safe onchain sync is stubbed).
+         */
+        post: operations["provisionAgentAccount"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/accounts/migrate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * EOA to Safe migration wizard
+         * @description Human-only. Provisions counterfactual Safe and returns sweep plan. Onchain module broadcast stubbed pre-audit.
+         */
+        post: operations["migrateAgentToSafe"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/accounts/{chain}/deprecate-eoa": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Mark agent EOA account deprecated */
+        post: operations["deprecateAgentEoa"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/accounts/{chain}/deploy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Lazy-deploy counterfactual Safe (stub)
+         * @description Human-only. Broadcasts Safe deployment when Guard audit completes. Returns 501 pre-audit.
+         */
+        post: operations["deployAgentSafeAccount"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/org/safe/sync-allowances": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reconcile Safe allowance targets (org admin)
+         * @description Compiles tx_daily_limit targets for Safe agents. Onchain read/write stubbed pre-audit.
+         */
+        post: operations["syncOrgSafeAllowances"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/treasury/{treasury_id}/safe/roles-sync": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Sync treasury Safe Roles module (stub)
+         * @description Human-only. Reconciles on-chain Roles config with agent guardrails. Returns 501 pre-audit.
+         */
+        post: operations["treasurySafeRolesSync"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/cosign": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Enable Vault co-signer (stub) */
+        post: operations["enableSafeCosign"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/passkey-enroll": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Enroll passkey Safe owner (stub) */
+        post: operations["enrollSafePasskeyOwner"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/timelock": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Configure Zodiac timelock (stub) */
+        post: operations["configureSafeTimelock"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/safe/erc4337": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Enable ERC-4337 Safe lane (stub) */
+        post: operations["enableSafeErc4337"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/{agent_id}/guardrails/replay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Dry-run guardrail changes against recent transactions
+         * @description Human-only. Compares draft guardrails against recent agent transactions.
+         */
+        post: operations["replayAgentGuardrails"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/safe/module-registry/{chain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List Safe module registry entries for a chain */
+        get: operations["getSafeModuleRegistry"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{agent_id}/delegations": {
         parameters: {
             query?: never;
@@ -2077,6 +2360,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/org/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Organization operational status
+         * @description Returns whether the org is emergency-frozen (blocks agent tx/execution).
+         */
+        get: operations["getOrgStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/org/freeze": {
         parameters: {
             query?: never;
@@ -2984,7 +3287,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/treasury/wallets/spend-policy": {
+    "/v1/treasury/wallets/auth-policy": {
         parameters: {
             query?: never;
             header?: never;
@@ -2992,12 +3295,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get effective spend policy for current user
-         * @description Returns the effective spend policy governing the authenticated user's
-         *     wallet transactions. Resolves from per-user override (if set) or the
-         *     app-wide default. Returns null if no policy is configured.
+         * Get effective human factor auth policy for embedded clients
+         * @description Returns the resolved human factor auth (HFA) policy governing treasury
+         *     wallet send, swap, and export, plus the number of passkeys registered
+         *     for the calling user. Intended for embedded wallet clients; equivalent
+         *     to GET /v1/auth/human-factor-auth with an additional passkey count.
+         *     Precedence: user override → platform app → spend policy → defaults.
          */
-        get: operations["getEffectiveSpendPolicy"];
+        get: operations["getTreasuryAuthPolicy"];
         put?: never;
         post?: never;
         delete?: never;
@@ -3006,21 +3311,64 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/webhooks": {
+    "/v1/treasury/wallets/spend-policy": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** List webhooks */
-        get: operations["listWebhooks"];
-        put?: never;
-        /** Register a webhook */
-        post: operations["createWebhook"];
-        delete?: never;
-        options?: never;
-        head?: never;
+        /**
+         * Get effective spend policy for current user
+         * @description Returns the effective spend policy governing the authenticated user's
+         *     wallet transactions. Resolves from per-user override (if set) or the
+         *     app-wide default. Returns null if no policy is configured.
+         */
+        get: operations["getEffectiveSpendPolicy"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/treasury/wallets/inference-budget": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get inference budget for current user
+         * @description Returns the user's remaining LLM inference allowance when connected via a platform app.
+         *     Includes allowance, spent, remaining USD, per-request cap, and billing period end.
+         */
+        get: operations["getUserInferenceBudget"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/webhooks": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List webhooks */
+        get: operations["listWebhooks"];
+        put?: never;
+        /** Register a webhook */
+        post: operations["createWebhook"];
+        delete?: never;
+        options?: never;
+        head?: never;
         patch?: never;
         trace?: never;
     };
@@ -3788,6 +4136,54 @@ export interface paths {
         patch: operations["updatePlatformTemplate"];
         trace?: never;
     };
+    "/v1/platform/apps/{appId}/templates/{template_id}/preview": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Preview resolved template spec
+         * @description Resolves `{{params.*}}` and `{{subject.*}}` placeholders in a template spec
+         *     without provisioning resources. Useful for validating parameterized bootstrap templates.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    appId: string;
+                    template_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["TemplatePreviewRequest"];
+                };
+            };
+            responses: {
+                /** @description Resolved template spec */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["TemplatePreviewResponse"];
+                    };
+                };
+                404: components["responses"]["NotFound"];
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/platform/users/upsert": {
         parameters: {
             query?: never;
@@ -3849,6 +4245,57 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/platform/siwe/challenge": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Issue SIWE nonce
+         * @description Creates a one-time nonce for Sign-In With Ethereum user provisioning.
+         *     Requires platform (`plt_`) authentication. The nonce expires in 5 minutes.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["SiweChallengeRequest"];
+                };
+            };
+            responses: {
+                /** @description Nonce issued */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SiweChallengeResponse"];
+                    };
+                };
+                /** @description SIWE domain not configured */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/platform/apps/{appId}/users": {
         parameters: {
             query?: never;
@@ -4004,7 +4451,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/platform/apps/{appId}/audit": {
+    "/v1/platform/connections/{connectionId}": {
         parameters: {
             query?: never;
             header?: never;
@@ -4012,34 +4459,31 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Platform audit log
-         * @description Returns audit events related to this platform app.
+         * Get connection details
+         * @description Returns connection status, claim state, wallet address, and provisioned resource IDs.
+         *     Use for polling the claim loop after bootstrap.
          */
         get: {
             parameters: {
-                query?: {
-                    limit?: number;
-                    offset?: number;
-                };
+                query?: never;
                 header?: never;
                 path: {
-                    appId: string;
+                    connectionId: string;
                 };
                 cookie?: never;
             };
             requestBody?: never;
             responses: {
-                /** @description Audit events */
+                /** @description Connection details */
                 200: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
-                        "application/json": {
-                            events?: Record<string, never>[];
-                        };
+                        "application/json": components["schemas"]["ConnectionDetailResponse"];
                     };
                 };
+                404: components["responses"]["NotFound"];
             };
         };
         put?: never;
@@ -4050,7 +4494,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/platform/connected-apps": {
+    "/v1/platform/connections/{connectionId}/usage": {
         parameters: {
             query?: never;
             header?: never;
@@ -4058,29 +4502,30 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List connected apps (user side)
-         * @description Returns platform apps connected to the calling user's account.
+         * Get per-connection usage
+         * @description Returns inference spend for the current UTC month for this connection.
          */
         get: {
             parameters: {
                 query?: never;
                 header?: never;
-                path?: never;
+                path: {
+                    connectionId: string;
+                };
                 cookie?: never;
             };
             requestBody?: never;
             responses: {
-                /** @description Connected apps */
+                /** @description Usage summary */
                 200: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
-                        "application/json": {
-                            connected_apps?: components["schemas"]["ConnectedAppResponse"][];
-                        };
+                        "application/json": components["schemas"]["ConnectionUsageResponse"];
                     };
                 };
+                404: components["responses"]["NotFound"];
             };
         };
         put?: never;
@@ -4091,21 +4536,18 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/platform/connected-apps/{connectionId}": {
+    "/v1/platform/connections/{connectionId}/entitlements": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
-        put?: never;
-        post?: never;
         /**
-         * Disconnect a platform app
-         * @description Disconnect the calling user from a platform app.
+         * List entitlement evaluations
+         * @description Returns on-chain entitlement watch status for the connection.
          */
-        delete: {
+        get: {
             parameters: {
                 query?: never;
                 header?: never;
@@ -4116,43 +4558,18 @@ export interface paths {
             };
             requestBody?: never;
             responses: {
-                /** @description Disconnected */
-                204: {
+                /** @description Entitlement watches */
+                200: {
                     headers: {
                         [name: string]: unknown;
                     };
-                    content?: never;
-                };
-                /** @description Connection not found */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
+                    content: {
+                        "application/json": components["schemas"]["EntitlementsListResponse"];
                     };
-                    content?: never;
                 };
+                404: components["responses"]["NotFound"];
             };
         };
-        options?: never;
-        head?: never;
-        /**
-         * Update connection delegation
-         * @description Toggle delegation and update delegation scopes for a connected platform app. User-only.
-         */
-        patch: operations["updateConnectionDelegation"];
-        trace?: never;
-    };
-    "/v1/platform/connections/{connectionId}/delegation-log": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Delegation audit log
-         * @description List delegated actions performed by a platform app on behalf of this user.
-         */
-        get: operations["getDelegationLog"];
         put?: never;
         post?: never;
         delete?: never;
@@ -4161,7 +4578,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/platform/connections/{connectionId}/grant": {
+    "/v1/platform/connections/{connectionId}/entitlements/refresh": {
         parameters: {
             query?: never;
             header?: never;
@@ -4171,10 +4588,8 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Grant platform app access to vaults/agents
-         * @description User-authenticated. Grant the platform app access to selected vaults and agents.
-         *     Validates user ownership of all requested resources. Creates platform_user_grants
-         *     entries and merges resource IDs into the connection record.
+         * Refresh entitlement evaluations
+         * @description Triggers an immediate entitlement monitor cycle for this connection's org.
          */
         post: {
             parameters: {
@@ -4185,42 +4600,16 @@ export interface paths {
                 };
                 cookie?: never;
             };
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["GrantResourcesRequest"];
-                };
-            };
+            requestBody?: never;
             responses: {
-                /** @description Grants created */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["GrantResourcesResponse"];
-                    };
-                };
-                /** @description No vault_ids or agent_ids provided */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Resource not owned by caller */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Connection not found */
-                404: {
+                /** @description Refresh accepted */
+                202: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content?: never;
                 };
+                404: components["responses"]["NotFound"];
             };
         };
         delete?: never;
@@ -4229,7 +4618,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/platform/connections/{connectionId}/grants": {
+    "/v1/platform/apps/{appId}/audit": {
         parameters: {
             query?: never;
             header?: never;
@@ -4237,35 +4626,33 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List active resource grants for a connection
-         * @description User-authenticated. Returns active (non-revoked) grants for the connection.
+         * Platform audit log
+         * @description Returns audit events related to this platform app.
          */
         get: {
             parameters: {
-                query?: never;
+                query?: {
+                    limit?: number;
+                    offset?: number;
+                };
                 header?: never;
                 path: {
-                    connectionId: string;
+                    appId: string;
                 };
                 cookie?: never;
             };
             requestBody?: never;
             responses: {
-                /** @description Grant list */
+                /** @description Audit events */
                 200: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
-                        "application/json": components["schemas"]["GrantListResponse"];
-                    };
-                };
-                /** @description Connection not found */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
+                        "application/json": {
+                            events?: Record<string, never>[];
+                        };
                     };
-                    content?: never;
                 };
             };
         };
@@ -4277,7 +4664,234 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/platform/connections/{connectionId}/grants/{grantId}": {
+    "/v1/platform/connected-apps": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List connected apps (user side)
+         * @description Returns platform apps connected to the calling user's account.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Connected apps */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            connected_apps?: components["schemas"]["ConnectedAppResponse"][];
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connected-apps/{connectionId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Disconnect a platform app
+         * @description Disconnect the calling user from a platform app.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    connectionId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Disconnected */
+                204: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Connection not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        /**
+         * Update connection delegation
+         * @description Toggle delegation and update delegation scopes for a connected platform app. User-only.
+         */
+        patch: operations["updateConnectionDelegation"];
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/delegation-log": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Delegation audit log
+         * @description List delegated actions performed by a platform app on behalf of this user.
+         */
+        get: operations["getDelegationLog"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/grant": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Grant platform app access to vaults/agents
+         * @description User-authenticated. Grant the platform app access to selected vaults and agents.
+         *     Validates user ownership of all requested resources. Creates platform_user_grants
+         *     entries and merges resource IDs into the connection record.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    connectionId: string;
+                };
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": components["schemas"]["GrantResourcesRequest"];
+                };
+            };
+            responses: {
+                /** @description Grants created */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GrantResourcesResponse"];
+                    };
+                };
+                /** @description No vault_ids or agent_ids provided */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Resource not owned by caller */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Connection not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/grants": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List active resource grants for a connection
+         * @description User-authenticated. Returns active (non-revoked) grants for the connection.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    connectionId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Grant list */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GrantListResponse"];
+                    };
+                };
+                /** @description Connection not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/grants/{grantId}": {
         parameters: {
             query?: never;
             header?: never;
@@ -4767,9 +5381,10 @@ export interface paths {
         put?: never;
         /**
          * Begin passkey transaction authorization
-         * @description Requires `tx_digest` — SHA-256 hex of canonical `chain|to|value_wei|data`
-         *     for the treasury send being authorized. The server recomputes this digest
-         *     on send and rejects passkey tokens that do not match.
+         * @description Requires `tx_digest` — SHA-256 hex of the canonical digest for the
+         *     treasury action being authorized (`send` or `swap`). The server
+         *     recomputes this digest on send/swap and rejects passkey tokens that
+         *     do not match.
          */
         post: operations["passkeyTxAssertBegin"];
         delete?: never;
@@ -6406,7 +7021,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/org/contract-abis": {
+    "/v1/org/guardrail-shadow-report": {
         parameters: {
             query?: never;
             header?: never;
@@ -6414,55 +7029,96 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List contract ABIs
-         * @description List org contract ABIs, optionally filtered by chain. Owner/admin only.
+         * Get guardrail shadow divergence report
+         * @description Returns Convention 6 shadow-mode violations (`guardrail_shadow.would_deny` audit events)
+         *     grouped by reason code. Owner/admin only.
          */
-        get: operations["listContractAbis"];
+        get: operations["getGuardrailShadowReport"];
         put?: never;
-        /**
-         * Register a contract ABI
-         * @description Upload an org-scoped ABI for transaction decoding. Owner/admin only.
-         */
-        post: operations["createContractAbi"];
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/org/contract-abis/{id}": {
+    "/v1/org/guardrail-revisions": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** Get a contract ABI */
-        get: operations["getContractAbi"];
+        /**
+         * List guardrail revision history
+         * @description Audit trail of agent and binding guardrail changes. Owner/admin only.
+         */
+        get: operations["listGuardrailRevisions"];
         put?: never;
         post?: never;
-        /** Delete a contract ABI */
-        delete: operations["deleteContractAbi"];
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/pending-approvals": {
+    "/v1/org/contract-abis": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** List pending approvals */
-        get: operations["listPendingApprovals"];
-        put?: never;
         /**
-         * Submit action for approval
-         * @description Submit a signing or transaction action that matches a consensus policy trigger.
+         * List contract ABIs
+         * @description List org contract ABIs, optionally filtered by chain. Owner/admin only.
          */
-        post: operations["submitPendingApproval"];
+        get: operations["listContractAbis"];
+        put?: never;
+        /**
+         * Register a contract ABI
+         * @description Upload an org-scoped ABI for transaction decoding. Owner/admin only.
+         */
+        post: operations["createContractAbi"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/org/contract-abis/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a contract ABI */
+        get: operations["getContractAbi"];
+        put?: never;
+        post?: never;
+        /** Delete a contract ABI */
+        delete: operations["deleteContractAbi"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/pending-approvals": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List pending approvals */
+        get: operations["listPendingApprovals"];
+        put?: never;
+        /**
+         * Submit action for approval
+         * @description Submit a signing or transaction action that matches a consensus policy trigger.
+         */
+        post: operations["submitPendingApproval"];
         delete?: never;
         options?: never;
         head?: never;
@@ -7111,12 +7767,21 @@ export interface components {
             refresh_token?: string;
             mfa_required?: boolean;
             mfa_token?: string;
+            /**
+             * @description When MFA is required, which second factor to collect
+             * @enum {string}
+             */
+            mfa_method?: "totp" | "passkey";
         };
         TokenResponse: {
             access_token: string;
             token_type: string;
             expires_in?: number;
             refresh_token?: string;
+            mfa_required?: boolean;
+            mfa_token?: string;
+            /** @enum {string} */
+            mfa_method?: "totp" | "passkey";
         };
         AgentTokenRequest: {
             /**
@@ -7206,6 +7871,9 @@ export interface components {
         };
         MfaStatusResponse: {
             enabled?: boolean;
+            eligible?: boolean;
+            totp_enabled?: boolean;
+            passkey_mfa_enabled?: boolean;
         };
         MfaSetupResponse: {
             otpauth_uri?: string;
@@ -7652,7 +8320,9 @@ export interface components {
             xrpl_allowed_tx_types?: string[];
             /**
              * @description Per-chain guardrail overrides. Keys are signing chains (ethereum, bitcoin, solana, xrp, cardano, tron).
-             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist, max_per_day, overhead_budget, max_ata_creates_per_day.
+             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist, max_per_day,
+             *     overhead_budget, max_ata_creates_per_day, max_fee_per_gas_gwei, max_gas_limit,
+             *     gas_daily_budget_native (UTC-day cumulative EVM gas estimate in native units).
              *     Strictest of global and per-chain limits wins. Daily limits apply per chain family spend, not cross-chain totals.
              */
             per_chain_guardrails?: {
@@ -7881,7 +8551,8 @@ export interface components {
             xrpl_allowed_tx_types?: string[];
             /**
              * @description Per-chain guardrail overrides. Keys are signing chains (ethereum, bitcoin, solana, xrp, cardano, tron).
-             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist (legacy *_eth keys accepted).
+             *     Each value may include max_value, daily_limit, to_allowlist, token_allowlist (legacy *_eth keys accepted),
+             *     max_fee_per_gas_gwei, max_gas_limit, gas_daily_budget_native (UTC-day cumulative EVM gas in native units).
              *     Strictest of global and per-chain limits wins. Daily limits apply per chain family spend, not cross-chain totals.
              */
             per_chain_guardrails?: {
@@ -7902,6 +8573,15 @@ export interface components {
             per_environment_guardrails?: {
                 [key: string]: unknown;
             };
+            /** @description Recipient address screening policy. `mode` may be `off`, `deny`, or `approve`. */
+            address_screening_policy?: {
+                [key: string]: unknown;
+            };
+            /**
+             * Format: uuid
+             * @description Approved policy_change id when applying a queued guardrail widening. Resubmit PATCH with this field after the approval has been approved via POST /v1/approvals/{approval_id}/decide.
+             */
+            approval_id?: string;
         };
         AgentResponse: {
             /** Format: uuid */
@@ -8072,6 +8752,10 @@ export interface components {
             per_environment_guardrails?: {
                 [key: string]: unknown;
             };
+            /** @description Recipient address screening policy. `mode` may be `off`, `deny`, or `approve`. */
+            address_screening_policy?: {
+                [key: string]: unknown;
+            };
         };
         KnownToken: {
             /** Format: uuid */
@@ -9855,7 +10539,11 @@ export interface components {
         UpsertPlatformUserRequest: {
             /** @description OIDC JWT from the platform's IdP (verified against JWKS) */
             subject_token?: string;
-            /** @default urn:ietf:params:oauth:token-type:jwt */
+            /**
+             * @description Token type for subject_token. Use `urn:1claw:params:oauth:token-type:siwe`
+             *     with `siwe_message` and `siwe_signature` for wallet-based provisioning.
+             * @default urn:ietf:params:oauth:token-type:jwt
+             */
             subject_token_type: string;
             /**
              * Format: email
@@ -9863,6 +10551,20 @@ export interface components {
              */
             email?: string;
             display_name?: string;
+            /** @description EIP-4361 Sign-In With Ethereum message (required for SIWE upsert) */
+            siwe_message?: string;
+            /** @description Hex-encoded SIWE signature (required for SIWE upsert) */
+            siwe_signature?: string;
+            /**
+             * Format: uri
+             * @description Redirect URL after cross-org link consent
+             */
+            return_to?: string;
+            /**
+             * @description When true, creates a sub-org under the platform app's org
+             * @default false
+             */
+            create_sub_org: boolean;
         };
         PlatformUserResponse: {
             /** Format: uuid */
@@ -9916,6 +10618,13 @@ export interface components {
              * @description URL to redirect the user to after claiming resources.
              */
             return_to?: string;
+            /**
+             * @description Template parameters substituted as `{{params.*}}` during bootstrap.
+             *     Combined with `Idempotency-Key` header for params-aware idempotent replay.
+             */
+            parameters?: {
+                [key: string]: unknown;
+            };
         };
         BootstrapResponse: {
             /** Format: uri */
@@ -10160,11 +10869,19 @@ export interface components {
             /** Format: date-time */
             expires_at?: string | null;
         };
+        /**
+         * @description Stable snake_case reason codes for guardrail violations (Convention 1).
+         *     Shadow-mode `"log"` emits the same codes in `guardrail_shadow.would_deny`
+         *     audit events with `enforced: false`. 202 HITL responses use
+         *     `approval_available: true` instead of a deny reason_code.
+         * @enum {string}
+         */
+        GuardrailReasonCode: "binding_rpm_exceeded" | "agent_rpm_exceeded" | "graphql_mutation_blocked" | "graphql_depth_exceeded" | "graphql_parse_failed" | "graphql_introspection_blocked" | "response_too_large" | "request_too_large" | "method_not_allowed" | "header_not_allowed" | "dns_private_ip_blocked" | "agent_suspended" | "outside_time_window" | "secret_in_request" | "concurrency_exceeded" | "org_frozen" | "price_unavailable" | "gas_fee_exceeded" | "unlimited_approval_blocked" | "tx_per_recipient_limit_exceeded" | "tx_max_value_exceeded" | "tx_daily_limit_exceeded" | "delegation_signing_blocked" | "recipient_screening_failed" | "screening_provider_unavailable" | "human_factor_auth_required" | "register_passkey_required";
+        /** @description Convention 1 machine-readable guardrail denial JSON body. */
         GuardrailViolation: {
             /** @enum {string} */
             error: "guardrail_violation";
-            /** @enum {string} */
-            reason_code: "binding_rpm_exceeded" | "agent_rpm_exceeded" | "graphql_mutation_blocked" | "graphql_depth_exceeded" | "graphql_parse_failed" | "graphql_introspection_blocked" | "response_too_large" | "request_too_large" | "method_not_allowed" | "header_not_allowed" | "dns_private_ip_blocked" | "agent_suspended" | "outside_time_window" | "secret_in_request" | "concurrency_exceeded" | "org_frozen";
+            reason_code: components["schemas"]["GuardrailReasonCode"];
             limit?: string | null;
             current?: string | null;
             attempted?: string | null;
@@ -10173,6 +10890,8 @@ export interface components {
             retry_after_seconds?: number | null;
             detail?: string | null;
         };
+        /** @description Alias of GuardrailViolation (Convention 1 JSON shape). */
+        GuardrailDenial: components["schemas"]["GuardrailViolation"];
         EmailOtpVerifyResponse: {
             /** @description JWT access token */
             token: string;
@@ -10236,6 +10955,115 @@ export interface components {
             allowed_tokens?: string[];
             /** @description Maximum number of transactions per 24h window */
             max_transactions_per_day?: number;
+            /** @description Monthly LLM inference allowance in USD (decimal string) */
+            inference_allowance_usd?: string;
+            /**
+             * @description Percent of allowance held in reserve (not spendable)
+             * @default 25
+             */
+            inference_reserved_pct: number;
+            /**
+             * @description When true, block inference when allowance is exhausted
+             * @default true
+             */
+            inference_hard_stop: boolean;
+            /**
+             * @default policy
+             * @enum {string}
+             */
+            inference_allowance_mode: "policy" | "credits";
+            /** @description Maximum estimated cost per LLM request in USD */
+            max_request_cost_usd?: string;
+            /**
+             * @description Human factor auth requirements for send/swap/export.
+             *     Fields: send, swap, export (password_or_passkey | passkey_only | passkey_required | password_only | reauth_token_only),
+             *     conditional.require_passkey_above_usd, conditional.require_passkey_for_new_recipient.
+             */
+            human_factor_auth?: {
+                [key: string]: unknown;
+            };
+        };
+        SiweChallengeRequest: {
+            /** @description Optional SIWE domain override (defaults to platform app's siwe_domain) */
+            domain?: string;
+        };
+        SiweChallengeResponse: {
+            nonce: string;
+            /** @description Seconds until nonce expiry */
+            expires_in: number;
+            domain: string;
+        };
+        ConnectionDetailResponse: {
+            /** Format: uuid */
+            connection_id: string;
+            /** Format: uuid */
+            user_id: string;
+            status: string;
+            entitlement_status: string;
+            wallet_address?: string | null;
+            vault_ids: string[];
+            agent_ids: string[];
+            /** Format: date-time */
+            claimed_at?: string | null;
+            claim: components["schemas"]["ClaimStatusResponse"];
+        };
+        ClaimStatusResponse: {
+            /** @enum {string} */
+            status: "pending" | "active" | "claimed";
+            /** Format: date-time */
+            redeemed_at?: string | null;
+        };
+        ConnectionUsageResponse: {
+            /** Format: uuid */
+            connection_id: string;
+            /** @description UTC month (YYYY-MM) */
+            period: string;
+            inference_spent_usd: string;
+        };
+        EntitlementsListResponse: {
+            evaluations: components["schemas"]["EntitlementEvaluationResponse"][];
+        };
+        EntitlementEvaluationResponse: {
+            id: string;
+            status: string;
+            watch_kind: string;
+            chain: string;
+            holder_address: string;
+            last_value_raw?: string | null;
+            /** Format: date-time */
+            last_checked_at?: string | null;
+        };
+        TemplatePreviewRequest: {
+            parameters?: {
+                [key: string]: unknown;
+            };
+            subject?: {
+                user_id?: string;
+                external_subject?: string;
+                wallet_address?: string;
+                email?: string;
+            };
+        };
+        TemplatePreviewResponse: {
+            resolved_spec: {
+                [key: string]: unknown;
+            };
+        };
+        InferenceBudgetResponse: {
+            allowance_usd: string;
+            spent_usd: string;
+            remaining_usd: string;
+            reserved_pct: number;
+            max_request_cost_usd: string;
+            /** Format: date-time */
+            period_end: string;
+            /** Format: uuid */
+            connection_id?: string | null;
+        };
+        InferenceBudgetUnconfiguredResponse: {
+            allowance_usd?: string | null;
+            remaining_usd?: unknown;
+            message?: string;
         };
         SpendPolicyResponse: {
             /** Format: uuid */
@@ -10251,9 +11079,84 @@ export interface components {
             allowed_chains?: string[];
             allowed_tokens?: string[];
             max_transactions_per_day?: number | null;
+            inference_allowance_usd?: string | null;
+            inference_reserved_pct?: number | null;
+            inference_hard_stop?: boolean | null;
+            inference_allowance_mode?: string | null;
+            max_request_cost_usd?: string | null;
+            human_factor_auth?: {
+                [key: string]: unknown;
+            } | null;
             /** Format: date-time */
             created_at: string;
         };
+        HumanFactorAuthPolicy: {
+            /** @enum {string} */
+            send?: "password_or_passkey" | "passkey_only" | "passkey_required" | "password_only" | "reauth_token_only";
+            /** @enum {string} */
+            swap?: "password_or_passkey" | "passkey_only" | "passkey_required" | "password_only" | "reauth_token_only";
+            /** @enum {string} */
+            export?: "password_or_passkey" | "passkey_only" | "passkey_required" | "password_only" | "reauth_token_only";
+            conditional?: {
+                require_passkey_above_usd?: string | null;
+                require_passkey_for_new_recipient?: boolean;
+            };
+        };
+        UpsertHumanFactorAuthRequest: {
+            policy: components["schemas"]["HumanFactorAuthPolicy"];
+        };
+        HumanFactorAuthResponse: {
+            policy: components["schemas"]["HumanFactorAuthPolicy"];
+            /** @description user | platform_app | spend_policy | default */
+            source: string;
+        };
+        TreasuryAuthPolicyResponse: {
+            policy: components["schemas"]["HumanFactorAuthPolicy"];
+            /** @description user | platform_app | spend_policy | default */
+            source: string;
+            /** @description Number of WebAuthn passkeys registered for the calling user. */
+            registered_passkeys: number;
+        };
+        PasskeyTxAssertBeginRequest: {
+            /** @description 64-char hex SHA-256 of canonical send or swap params */
+            tx_digest: string;
+            /**
+             * @description Treasury action being authorized. Defaults to `send`.
+             * @default send
+             * @enum {string}
+             */
+            action: "send" | "swap";
+        };
+        PasskeyAssertBeginResponse: {
+            challenge: string;
+            rp_id: string;
+            timeout: number;
+            user_verification: string;
+            allow_credentials: components["schemas"]["AllowCredential"][];
+        };
+        AllowCredential: {
+            id: string;
+            /** @enum {string} */
+            type: "public-key";
+            transports?: string[];
+        };
+        MfaPasskeyCompleteRequest: {
+            mfa_token: string;
+            credential_id: string;
+            authenticator_data: string;
+            client_data_json: string;
+            signature: string;
+        };
+        GuardrailWideningQueuedResponse: {
+            /** @enum {string} */
+            status: "awaiting_approval";
+            /** Format: uuid */
+            approval_id: string;
+            /** Format: uuid */
+            revision_id: string;
+            /** @description Human-readable explanation of the queued change. */
+            message: string;
+        };
         RiskEvent: {
             /** Format: uuid */
             id: string;
@@ -10383,6 +11286,11 @@ export interface components {
                 [key: string]: unknown;
             };
             credential_source?: components["schemas"]["CredentialSource"];
+            /**
+             * Format: uuid
+             * @description Approved policy_change id when applying a queued binding guardrail widening. Resubmit PATCH with this field after approval via POST /v1/approvals/{approval_id}/decide.
+             */
+            approval_id?: string;
         };
         /** @description Per-binding execution guardrails enforced at execute time. */
         BindingGuardrails: {
@@ -11339,6 +12247,149 @@ export interface components {
             /** Format: date-time */
             created_at?: string;
         };
+        GuardrailShadowReportResponse: {
+            /** Format: uuid */
+            org_id?: string;
+            /** Format: date-time */
+            since?: string;
+            /** Format: date-time */
+            until?: string;
+            /** Format: int64 */
+            total_would_deny?: number;
+            by_reason?: components["schemas"]["GuardrailShadowReasonRow"][];
+        };
+        GuardrailShadowReasonRow: {
+            reason_code?: string;
+            /** Format: int64 */
+            would_deny_count?: number;
+            /** Format: int64 */
+            enforced_count?: number;
+        };
+        GuardrailRevisionListResponse: {
+            revisions?: components["schemas"]["GuardrailRevisionRow"][];
+        };
+        GuardrailRevisionRow: {
+            /** Format: uuid */
+            id?: string;
+            /** Format: uuid */
+            org_id?: string;
+            /** @enum {string} */
+            resource_type?: "agent" | "binding";
+            /** Format: uuid */
+            resource_id?: string;
+            /** Format: uuid */
+            actor_id?: string;
+            before_json?: {
+                [key: string]: unknown;
+            };
+            after_json?: {
+                [key: string]: unknown;
+            };
+            /** @enum {string} */
+            change_kind?: "narrowing" | "widening" | "neutral";
+            /** Format: uuid */
+            approval_id?: string | null;
+            /** Format: date-time */
+            created_at?: string;
+        };
+        GuardrailReplayRequest: {
+            days?: number;
+            draft_guardrails?: {
+                [key: string]: unknown;
+            };
+            draft_approval_policy?: {
+                [key: string]: unknown;
+            };
+        };
+        GuardrailReplayResponse: {
+            /** Format: uuid */
+            agent_id?: string;
+            /** Format: int64 */
+            window_days?: number;
+            /** Format: int64 */
+            allowed?: number;
+            /** Format: int64 */
+            denied?: number;
+            /** Format: int64 */
+            would_require_approval?: number;
+            samples?: {
+                [key: string]: unknown;
+            }[];
+        };
+        AgentAccountListResponse: {
+            accounts?: components["schemas"]["AgentAccountResponse"][];
+        };
+        AgentAccountResponse: {
+            /** Format: uuid */
+            id?: string;
+            /** Format: uuid */
+            org_id?: string;
+            /** Format: uuid */
+            agent_id?: string;
+            chain?: string;
+            account_type?: string;
+            address?: string;
+            safe_version?: string;
+            modules_enabled?: string[];
+            deploy_status?: string;
+            cosign_enabled?: boolean;
+            metadata?: Record<string, never>;
+            /** Format: date-time */
+            created_at?: string;
+            /** Format: date-time */
+            updated_at?: string;
+        };
+        MigrationPlanResponse: {
+            /** Format: uuid */
+            agent_id?: string;
+            chain?: string;
+            safe_address?: string;
+            safe_version?: string;
+            modules?: string[];
+            eoa_address?: string;
+            sweep_instructions?: {
+                asset?: string;
+                action?: string;
+                note?: string;
+            }[];
+            roles_config_hash?: string;
+            allowance_config_hash?: string;
+            warnings?: string[];
+            deploy_status?: string;
+        };
+        ProvisionAgentAccountRequest: {
+            chain: string;
+            /** @default eoa */
+            account_type: string;
+            address?: string;
+        };
+        SafeModuleRegistryResponse: {
+            chain?: string;
+            modules?: components["schemas"]["SafeModuleInfo"][];
+        };
+        SafeModuleInfo: {
+            name?: string;
+            address?: string;
+            version?: string;
+        };
+        AllowanceReconcileReport: {
+            /** Format: uuid */
+            org_id?: string;
+            agents_checked?: number;
+            compiled?: {
+                [key: string]: unknown;
+            }[];
+            drift_detected?: {
+                [key: string]: unknown;
+            }[];
+            /** @description counterfactual when on-chain broadcast is stubbed pre-audit */
+            onchain_sync?: string;
+        };
+        NotImplementedResponse: {
+            error: string;
+            phase: string;
+            message: string;
+        };
         CreateContractAbiRequest: {
             chain: string;
             /** @description Contract address, or Solana program id when interface_kind is solana_idl */
@@ -12861,6 +13912,7 @@ export interface operations {
                 content: {
                     "application/json": {
                         require_passkey_for_vaults?: boolean;
+                        require_passkey_for_mfa?: boolean;
                         passkey_count?: number;
                     };
                 };
@@ -12880,6 +13932,7 @@ export interface operations {
             content: {
                 "application/json": {
                     require_passkey_for_vaults?: boolean;
+                    require_passkey_for_mfa?: boolean;
                 };
             };
         };
@@ -12894,7 +13947,7 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
-    mfaStatus: {
+    getHumanFactorAuth: {
         parameters: {
             query?: never;
             header?: never;
@@ -12903,51 +13956,97 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description MFA status */
+            /** @description Effective HFA policy */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["MfaStatusResponse"];
+                    "application/json": components["schemas"]["HumanFactorAuthResponse"];
                 };
             };
+            403: components["responses"]["Forbidden"];
         };
     };
-    mfaSetup: {
+    upsertHumanFactorAuth: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpsertHumanFactorAuthRequest"];
+            };
+        };
         responses: {
-            /** @description TOTP setup details */
+            /** @description Updated policy */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["MfaSetupResponse"];
+                    "application/json": components["schemas"]["HumanFactorAuthResponse"];
                 };
             };
+            403: components["responses"]["Forbidden"];
         };
     };
-    mfaVerifySetup: {
+    mfaStatus: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["MfaVerifySetupRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description MFA enabled, recovery codes returned */
+            /** @description MFA status */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MfaStatusResponse"];
+                };
+            };
+        };
+    };
+    mfaSetup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description TOTP setup details */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MfaSetupResponse"];
+                };
+            };
+        };
+    };
+    mfaVerifySetup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["MfaVerifySetupRequest"];
+            };
+        };
+        responses: {
+            /** @description MFA enabled, recovery codes returned */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -12984,6 +14083,58 @@ export interface operations {
             401: components["responses"]["Unauthorized"];
         };
     };
+    mfaPasskeyBegin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    mfa_token: string;
+                };
+            };
+        };
+        responses: {
+            /** @description WebAuthn challenge */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PasskeyAssertBeginResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    mfaPasskeyComplete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["MfaPasskeyCompleteRequest"];
+            };
+        };
+        responses: {
+            /** @description MFA verified, JWT issued */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
     mfaDisable: {
         parameters: {
             query?: never;
@@ -14354,6 +15505,20 @@ export interface operations {
                     "application/json": components["schemas"]["AgentResponse"];
                 };
             };
+            /**
+             * @description Guardrail widening queued for human approval. The change is not
+             *     applied until approved via POST /v1/approvals/{approval_id}/decide.
+             *     Resubmit this PATCH with `approval_id` set to the returned value
+             *     after approval to apply the widening.
+             */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailWideningQueuedResponse"];
+                };
+            };
             404: components["responses"]["NotFound"];
         };
     };
@@ -14638,195 +15803,533 @@ export interface operations {
             402: components["responses"]["PaymentRequired"];
         };
     };
-    listSigningKeys: {
+    listSigningKeys: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing keys list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyListResponse"];
+                };
+            };
+        };
+    };
+    createSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSigningKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Signing key created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            409: components["responses"]["Conflict"];
+        };
+    };
+    rotateSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Rotated signing key */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deactivateSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Key deactivated */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    exportSigningKey: {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Account password for re-authentication */
+                "X-Auth-Confirm": string;
+            };
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing key exported successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        chain: string;
+                        curve: string;
+                        public_key: string;
+                        address?: string;
+                        private_key: string;
+                        key_version: number;
+                        /** Format: uuid */
+                        agent_id: string;
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getSigningKeyBalance: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signing key balance */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyBalanceResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    importSigningKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ImportKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Signing key imported */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SigningKeyResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    leaseBankrKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["LeaseBankrKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description Bankr key leased */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LeaseBankrKeyResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    listBankrKeys: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Active leases (no secret values) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BankrKeyLeaseListResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    revokeBankrKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                lease_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Lease revoked */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    listAgentAccounts: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Agent accounts */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AgentAccountListResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    provisionAgentAccount: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ProvisionAgentAccountRequest"];
+            };
+        };
+        responses: {
+            /** @description Account provisioned */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AgentAccountResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    migrateAgentToSafe: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    chain: string;
+                    deprecate_eoa?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Migration plan */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MigrationPlanResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deprecateAgentEoa: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+                chain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Updated account */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AgentAccountResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deployAgentSafeAccount: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
+                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Signing keys list */
-            200: {
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description Not implemented (Phase 5.1) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SigningKeyListResponse"];
+                    "application/json": components["schemas"]["NotImplementedResponse"];
                 };
             };
         };
     };
-    createSigningKey: {
+    syncOrgSafeAllowances: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                agent_id: components["parameters"]["AgentId"];
-            };
+            path?: never;
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateSigningKeyRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Signing key created */
-            201: {
+            /** @description Reconciliation report */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SigningKeyResponse"];
+                    "application/json": components["schemas"]["AllowanceReconcileReport"];
                 };
             };
-            400: components["responses"]["BadRequest"];
-            409: components["responses"]["Conflict"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
         };
     };
-    rotateSigningKey: {
+    treasurySafeRolesSync: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                agent_id: components["parameters"]["AgentId"];
-                chain: string;
+                treasury_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Rotated signing key */
-            200: {
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description Not implemented (Phase 5.9) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SigningKeyResponse"];
+                    "application/json": components["schemas"]["NotImplementedResponse"];
                 };
             };
-            404: components["responses"]["NotFound"];
         };
     };
-    deactivateSigningKey: {
+    enableSafeCosign: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
-                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Key deactivated */
-            204: {
+            /** @description Not implemented (Phase 5.2) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
-            404: components["responses"]["NotFound"];
         };
     };
-    exportSigningKey: {
+    enrollSafePasskeyOwner: {
         parameters: {
             query?: never;
-            header: {
-                /** @description Account password for re-authentication */
-                "X-Auth-Confirm": string;
-            };
+            header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
-                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Signing key exported successfully */
-            200: {
+            /** @description Not implemented (Phase 5.5) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        chain: string;
-                        curve: string;
-                        public_key: string;
-                        address?: string;
-                        private_key: string;
-                        key_version: number;
-                        /** Format: uuid */
-                        agent_id: string;
-                    };
-                };
+                content?: never;
             };
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    getSigningKeyBalance: {
+    configureSafeTimelock: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
-                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Signing key balance */
-            200: {
+            /** @description Not implemented (Phase 5.6) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["SigningKeyBalanceResponse"];
-                };
+                content?: never;
             };
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    importSigningKey: {
+    enableSafeErc4337: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 agent_id: components["parameters"]["AgentId"];
-                chain: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ImportKeyRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Signing key imported */
-            201: {
+            /** @description Not implemented (Phase 5.8) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["SigningKeyResponse"];
-                };
+                content?: never;
             };
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
         };
     };
-    leaseBankrKey: {
+    replayAgentGuardrails: {
         parameters: {
             query?: never;
             header?: never;
@@ -14837,66 +16340,44 @@ export interface operations {
         };
         requestBody?: {
             content: {
-                "application/json": components["schemas"]["LeaseBankrKeyRequest"];
+                "application/json": components["schemas"]["GuardrailReplayRequest"];
             };
         };
         responses: {
-            /** @description Bankr key leased */
-            201: {
+            /** @description Replay report */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["LeaseBankrKeyResponse"];
+                    "application/json": components["schemas"]["GuardrailReplayResponse"];
                 };
             };
-            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
             403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
         };
     };
-    listBankrKeys: {
+    getSafeModuleRegistry: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                agent_id: components["parameters"]["AgentId"];
+                chain: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Active leases (no secret values) */
+            /** @description Module registry */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["BankrKeyLeaseListResponse"];
-                };
-            };
-            404: components["responses"]["NotFound"];
-        };
-    };
-    revokeBankrKey: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                agent_id: components["parameters"]["AgentId"];
-                lease_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Lease revoked */
-            204: {
-                headers: {
-                    [name: string]: unknown;
+                    "application/json": components["schemas"]["SafeModuleRegistryResponse"];
                 };
-                content?: never;
             };
-            404: components["responses"]["NotFound"];
         };
     };
     listDelegations: {
@@ -15210,6 +16691,19 @@ export interface operations {
                     "application/json": components["schemas"]["BindingResponse"];
                 };
             };
+            /**
+             * @description Binding guardrail widening queued for human approval. Resubmit
+             *     PATCH with `approval_id` after approval via
+             *     POST /v1/approvals/{approval_id}/decide.
+             */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailWideningQueuedResponse"];
+                };
+            };
             400: components["responses"]["BadRequest"];
             404: components["responses"]["NotFound"];
         };
@@ -15701,6 +17195,40 @@ export interface operations {
             };
         };
     };
+    getOrgStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Current org status */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** Format: uuid */
+                        org_id: string;
+                        /** @enum {string} */
+                        status: "active" | "frozen";
+                        /** Format: date-time */
+                        frozen_at?: string | null;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     freezeOrg: {
         parameters: {
             query?: never;
@@ -17151,6 +18679,27 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    getTreasuryAuthPolicy: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Effective HFA policy with passkey registration count */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TreasuryAuthPolicyResponse"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
     getEffectiveSpendPolicy: {
         parameters: {
             query?: never;
@@ -17174,6 +18723,27 @@ export interface operations {
             401: components["responses"]["Unauthorized"];
         };
     };
+    getUserInferenceBudget: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Inference budget (or unconfigured message) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InferenceBudgetResponse"] | components["schemas"]["InferenceBudgetUnconfiguredResponse"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
     listWebhooks: {
         parameters: {
             query?: never;
@@ -18349,10 +19919,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": {
-                    /** @description 64-char hex SHA-256 of canonical send params */
-                    tx_digest: string;
-                };
+                "application/json": components["schemas"]["PasskeyTxAssertBeginRequest"];
             };
         };
         responses: {
@@ -18361,15 +19928,25 @@ export interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["PasskeyAssertBeginResponse"];
+                };
             };
-            /** @description Missing or invalid tx_digest */
+            /** @description Missing or invalid tx_digest, or invalid action */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
+            403: components["responses"]["Forbidden"];
+            /** @description No passkeys registered for the user */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     passkeyTxAssertComplete: {
@@ -21067,6 +22644,53 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    getGuardrailShadowReport: {
+        parameters: {
+            query?: {
+                since?: string;
+                until?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Guardrail shadow report */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailShadowReportResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
+    listGuardrailRevisions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Guardrail revisions */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GuardrailRevisionListResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
     listContractAbis: {
         parameters: {
             query?: {