@1claw/sdk 0.56.3 → 0.58.0

package/dist/generated/api-types.d.ts

@@ -535,6 +535,10 @@ export interface paths {
          * @description Disabling `require_passkey_for_vaults` requires `X-Auth-Confirm`
          *     (purpose `security.vault_passkey.disable`) with a passkey or TOTP
          *     when either is enrolled.
+         *
+         *     Disabling `require_passkey_for_mfa` requires `X-Auth-Confirm`
+         *     (purpose `security.mfa_passkey.disable`) with a passkey or TOTP
+         *     when either is enrolled.
          */
         patch: operations["updateSecuritySettings"];
         trace?: never;
@@ -629,6 +633,40 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/mfa/passkey/begin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Begin passkey MFA verification during login */
+        post: operations["mfaPasskeyBegin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/mfa/passkey/complete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Complete passkey MFA verification during login */
+        post: operations["mfaPasskeyComplete"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/mfa": {
         parameters: {
             query?: never;
@@ -3295,6 +3333,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/treasury/wallets/inference-budget": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get inference budget for current user
+         * @description Returns the user's remaining LLM inference allowance when connected via a platform app.
+         *     Includes allowance, spent, remaining USD, per-request cap, and billing period end.
+         */
+        get: operations["getUserInferenceBudget"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/webhooks": {
         parameters: {
             query?: never;
@@ -3838,12 +3897,14 @@ export interface paths {
             };
             requestBody?: never;
             responses: {
-                /** @description Deleted */
-                204: {
+                /** @description Soft-deleted; slug released for reuse within the org */
+                200: {
                     headers: {
                         [name: string]: unknown;
                     };
-                    content?: never;
+                    content: {
+                        "application/json": components["schemas"]["PlatformAppDeleteResponse"];
+                    };
                 };
                 /** @description Only human users can delete platform apps */
                 403: {
@@ -3885,6 +3946,29 @@ export interface paths {
         };
         trace?: never;
     };
+    "/v1/platform/apps/{appId}/transfer-ownership": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Transfer platform app to another organization
+         * @description Moves the platform app record to another organization. Requires org
+         *     owner/admin in the source org and step-up auth (`X-Auth-Confirm`,
+         *     purpose `platform.app.transfer`). End-user connections and provisioned
+         *     resources remain in their original organizations.
+         */
+        post: operations["transferPlatformAppOwnership"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/platform/apps/{appId}/rotate-key": {
         parameters: {
             query?: never;
@@ -4077,6 +4161,54 @@ export interface paths {
         patch: operations["updatePlatformTemplate"];
         trace?: never;
     };
+    "/v1/platform/apps/{appId}/templates/{template_id}/preview": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Preview resolved template spec
+         * @description Resolves `{{params.*}}` and `{{subject.*}}` placeholders in a template spec
+         *     without provisioning resources. Useful for validating parameterized bootstrap templates.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    appId: string;
+                    template_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["TemplatePreviewRequest"];
+                };
+            };
+            responses: {
+                /** @description Resolved template spec */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["TemplatePreviewResponse"];
+                    };
+                };
+                404: components["responses"]["NotFound"];
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/platform/users/upsert": {
         parameters: {
             query?: never;
@@ -4138,6 +4270,57 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/platform/siwe/challenge": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Issue SIWE nonce
+         * @description Creates a one-time nonce for Sign-In With Ethereum user provisioning.
+         *     Requires platform (`plt_`) authentication. The nonce expires in 5 minutes.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["SiweChallengeRequest"];
+                };
+            };
+            responses: {
+                /** @description Nonce issued */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SiweChallengeResponse"];
+                    };
+                };
+                /** @description SIWE domain not configured */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/platform/apps/{appId}/users": {
         parameters: {
             query?: never;
@@ -4293,6 +4476,173 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/platform/connections/{connectionId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get connection details
+         * @description Returns connection status, claim state, wallet address, and provisioned resource IDs.
+         *     Use for polling the claim loop after bootstrap.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    connectionId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Connection details */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ConnectionDetailResponse"];
+                    };
+                };
+                404: components["responses"]["NotFound"];
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/usage": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get per-connection usage
+         * @description Returns inference spend for the current UTC month for this connection.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    connectionId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Usage summary */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ConnectionUsageResponse"];
+                    };
+                };
+                404: components["responses"]["NotFound"];
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/entitlements": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List entitlement evaluations
+         * @description Returns on-chain entitlement watch status for the connection.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    connectionId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Entitlement watches */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["EntitlementsListResponse"];
+                    };
+                };
+                404: components["responses"]["NotFound"];
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/entitlements/refresh": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Refresh entitlement evaluations
+         * @description Triggers an immediate entitlement monitor cycle for this connection's org.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    connectionId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Refresh accepted */
+                202: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                404: components["responses"]["NotFound"];
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/platform/apps/{appId}/audit": {
         parameters: {
             query?: never;
@@ -4744,7 +5094,8 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        get?: never;
+        /** Get a spend policy by ID */
+        get: operations["getSpendPolicy"];
         put?: never;
         post?: never;
         /** Delete a spend policy */
@@ -4761,7 +5112,12 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        get?: never;
+        /**
+         * Get effective spend policy for a connection
+         * @description Returns the effective spend policy for the connected user, resolving
+         *     per-user overrides before app-level defaults. Requires plt_ platform auth.
+         */
+        get: operations["getConnectionSpendPolicy"];
         /**
          * Set per-user spend policy override
          * @description Override the app-wide spend policy for a specific connected user. This
@@ -4776,6 +5132,66 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/platform/connections/{connectionId}/approvals": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List approvals for a platform connection
+         * @description Returns approvals assigned to the connection's user, filtered to agents
+         *     provisioned on the connection. Requires plt_ platform auth.
+         */
+        get: operations["listConnectionApprovals"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/approvals/{approvalId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a connection-scoped approval */
+        get: operations["getConnectionApproval"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/platform/connections/{connectionId}/pending-approvals": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List pending consensus approvals for a connection
+         * @description Returns pending approvals for agents provisioned on the connection,
+         *     including `action_payload` and `payload_hash` for consensus UX.
+         *     Requires plt_ platform auth.
+         */
+        get: operations["listConnectionPendingApprovals"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/approvals": {
         parameters: {
             query?: never;
@@ -5938,7 +6354,7 @@ export interface paths {
         /**
          * Chat with a running runtime agent
          * @description Human-only. Proxies to the runtime container's OpenAI-compatible
-         *     `POST /v1/chat/completions` (hermes / openclaw / openclaude chat bridge).
+         *     `POST /v1/chat/completions` (hermes / openclaw / openclaude / opencode chat bridge).
          *     Starts the runtime if stopped. Streams SSE when `Accept: text/event-stream`
          *     or `stream: true`. Conversation history is ephemeral (pass `messages`).
          *     Requires a public URL (shell access, Shroud sidecar, or HTTP hosting).
@@ -7442,12 +7858,21 @@ export interface components {
             refresh_token?: string;
             mfa_required?: boolean;
             mfa_token?: string;
+            /**
+             * @description When MFA is required, which second factor to collect
+             * @enum {string}
+             */
+            mfa_method?: "totp" | "passkey";
         };
         TokenResponse: {
             access_token: string;
             token_type: string;
             expires_in?: number;
             refresh_token?: string;
+            mfa_required?: boolean;
+            mfa_token?: string;
+            /** @enum {string} */
+            mfa_method?: "totp" | "passkey";
         };
         AgentTokenRequest: {
             /**
@@ -7537,6 +7962,9 @@ export interface components {
         };
         MfaStatusResponse: {
             enabled?: boolean;
+            eligible?: boolean;
+            totp_enabled?: boolean;
+            passkey_mfa_enabled?: boolean;
         };
         MfaSetupResponse: {
             otpauth_uri?: string;
@@ -10132,6 +10560,28 @@ export interface components {
              */
             api_key_expires_at?: string | null;
         };
+        PlatformAppDeleteResponse: {
+            deleted: boolean;
+            soft_delete: boolean;
+            slug_released: boolean;
+            former_slug: string;
+        };
+        /** @description Provide `target_org_id` or `target_user_email` (owner/admin in destination org). */
+        TransferPlatformAppOwnershipRequest: {
+            /** Format: uuid */
+            target_org_id?: string;
+            /** Format: email */
+            target_user_email?: string;
+        };
+        TransferPlatformAppOwnershipResponse: {
+            /** Format: uuid */
+            app_id: string;
+            /** Format: uuid */
+            former_org_id: string;
+            /** Format: uuid */
+            new_org_id: string;
+            message: string;
+        };
         PlatformAppResponse: {
             /** Format: uuid */
             id?: string;
@@ -10202,7 +10652,11 @@ export interface components {
         UpsertPlatformUserRequest: {
             /** @description OIDC JWT from the platform's IdP (verified against JWKS) */
             subject_token?: string;
-            /** @default urn:ietf:params:oauth:token-type:jwt */
+            /**
+             * @description Token type for subject_token. Use `urn:1claw:params:oauth:token-type:siwe`
+             *     with `siwe_message` and `siwe_signature` for wallet-based provisioning.
+             * @default urn:ietf:params:oauth:token-type:jwt
+             */
             subject_token_type: string;
             /**
              * Format: email
@@ -10210,6 +10664,20 @@ export interface components {
              */
             email?: string;
             display_name?: string;
+            /** @description EIP-4361 Sign-In With Ethereum message (required for SIWE upsert) */
+            siwe_message?: string;
+            /** @description Hex-encoded SIWE signature (required for SIWE upsert) */
+            siwe_signature?: string;
+            /**
+             * Format: uri
+             * @description Redirect URL after cross-org link consent
+             */
+            return_to?: string;
+            /**
+             * @description When true, creates a sub-org under the platform app's org
+             * @default false
+             */
+            create_sub_org: boolean;
         };
         PlatformUserResponse: {
             /** Format: uuid */
@@ -10263,6 +10731,13 @@ export interface components {
              * @description URL to redirect the user to after claiming resources.
              */
             return_to?: string;
+            /**
+             * @description Template parameters substituted as `{{params.*}}` during bootstrap.
+             *     Combined with `Idempotency-Key` header for params-aware idempotent replay.
+             */
+            parameters?: {
+                [key: string]: unknown;
+            };
         };
         BootstrapResponse: {
             /** Format: uri */
@@ -10501,6 +10976,10 @@ export interface components {
             /** Format: date-time */
             created_at: string;
         };
+        ApprovalListResponse: {
+            approvals: components["schemas"]["ApprovalResponse"][];
+            total: number;
+        };
         ApprovalStatusResponse: {
             /** @enum {string} */
             status: "pending" | "approved" | "rejected" | "expired";
@@ -10593,6 +11072,25 @@ export interface components {
             allowed_tokens?: string[];
             /** @description Maximum number of transactions per 24h window */
             max_transactions_per_day?: number;
+            /** @description Monthly LLM inference allowance in USD (decimal string) */
+            inference_allowance_usd?: string;
+            /**
+             * @description Percent of allowance held in reserve (not spendable)
+             * @default 25
+             */
+            inference_reserved_pct: number;
+            /**
+             * @description When true, block inference when allowance is exhausted
+             * @default true
+             */
+            inference_hard_stop: boolean;
+            /**
+             * @default policy
+             * @enum {string}
+             */
+            inference_allowance_mode: "policy" | "credits";
+            /** @description Maximum estimated cost per LLM request in USD */
+            max_request_cost_usd?: string;
             /**
              * @description Human factor auth requirements for send/swap/export.
              *     Fields: send, swap, export (password_or_passkey | passkey_only | passkey_required | password_only | reauth_token_only),
@@ -10602,6 +11100,88 @@ export interface components {
                 [key: string]: unknown;
             };
         };
+        SiweChallengeRequest: {
+            /** @description Optional SIWE domain override (defaults to platform app's siwe_domain) */
+            domain?: string;
+        };
+        SiweChallengeResponse: {
+            nonce: string;
+            /** @description Seconds until nonce expiry */
+            expires_in: number;
+            domain: string;
+        };
+        ConnectionDetailResponse: {
+            /** Format: uuid */
+            connection_id: string;
+            /** Format: uuid */
+            user_id: string;
+            status: string;
+            entitlement_status: string;
+            wallet_address?: string | null;
+            vault_ids: string[];
+            agent_ids: string[];
+            /** Format: date-time */
+            claimed_at?: string | null;
+            claim: components["schemas"]["ClaimStatusResponse"];
+        };
+        ClaimStatusResponse: {
+            /** @enum {string} */
+            status: "pending" | "active" | "claimed";
+            /** Format: date-time */
+            redeemed_at?: string | null;
+        };
+        ConnectionUsageResponse: {
+            /** Format: uuid */
+            connection_id: string;
+            /** @description UTC month (YYYY-MM) */
+            period: string;
+            inference_spent_usd: string;
+        };
+        EntitlementsListResponse: {
+            evaluations: components["schemas"]["EntitlementEvaluationResponse"][];
+        };
+        EntitlementEvaluationResponse: {
+            id: string;
+            status: string;
+            watch_kind: string;
+            chain: string;
+            holder_address: string;
+            last_value_raw?: string | null;
+            /** Format: date-time */
+            last_checked_at?: string | null;
+        };
+        TemplatePreviewRequest: {
+            parameters?: {
+                [key: string]: unknown;
+            };
+            subject?: {
+                user_id?: string;
+                external_subject?: string;
+                wallet_address?: string;
+                email?: string;
+            };
+        };
+        TemplatePreviewResponse: {
+            resolved_spec: {
+                [key: string]: unknown;
+            };
+        };
+        InferenceBudgetResponse: {
+            allowance_usd: string;
+            spent_usd: string;
+            remaining_usd: string;
+            reserved_pct: number;
+            max_request_cost_usd: string;
+            /** Format: date-time */
+            period_end: string;
+            /** Format: uuid */
+            connection_id?: string | null;
+        };
+        InferenceBudgetUnconfiguredResponse: {
+            allowance_usd?: string | null;
+            remaining_usd?: unknown;
+            message?: string;
+        };
         SpendPolicyResponse: {
             /** Format: uuid */
             id: string;
@@ -10616,6 +11196,11 @@ export interface components {
             allowed_chains?: string[];
             allowed_tokens?: string[];
             max_transactions_per_day?: number | null;
+            inference_allowance_usd?: string | null;
+            inference_reserved_pct?: number | null;
+            inference_hard_stop?: boolean | null;
+            inference_allowance_mode?: string | null;
+            max_request_cost_usd?: string | null;
             human_factor_auth?: {
                 [key: string]: unknown;
             } | null;
@@ -10672,6 +11257,13 @@ export interface components {
             type: "public-key";
             transports?: string[];
         };
+        MfaPasskeyCompleteRequest: {
+            mfa_token: string;
+            credential_id: string;
+            authenticator_data: string;
+            client_data_json: string;
+            signature: string;
+        };
         GuardrailWideningQueuedResponse: {
             /** @enum {string} */
             status: "awaiting_approval";
@@ -13437,6 +14029,7 @@ export interface operations {
                 content: {
                     "application/json": {
                         require_passkey_for_vaults?: boolean;
+                        require_passkey_for_mfa?: boolean;
                         passkey_count?: number;
                     };
                 };
@@ -13456,6 +14049,7 @@ export interface operations {
             content: {
                 "application/json": {
                     require_passkey_for_vaults?: boolean;
+                    require_passkey_for_mfa?: boolean;
                 };
             };
         };
@@ -13606,6 +14200,58 @@ export interface operations {
             401: components["responses"]["Unauthorized"];
         };
     };
+    mfaPasskeyBegin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    mfa_token: string;
+                };
+            };
+        };
+        responses: {
+            /** @description WebAuthn challenge */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PasskeyAssertBeginResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    mfaPasskeyComplete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["MfaPasskeyCompleteRequest"];
+            };
+        };
+        responses: {
+            /** @description MFA verified, JWT issued */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
     mfaDisable: {
         parameters: {
             query?: never;
@@ -18194,6 +18840,27 @@ export interface operations {
             401: components["responses"]["Unauthorized"];
         };
     };
+    getUserInferenceBudget: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Inference budget (or unconfigured message) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InferenceBudgetResponse"] | components["schemas"]["InferenceBudgetUnconfiguredResponse"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+        };
+    };
     listWebhooks: {
         parameters: {
             query?: never;
@@ -18651,6 +19318,37 @@ export interface operations {
             };
         };
     };
+    transferPlatformAppOwnership: {
+        parameters: {
+            query?: never;
+            header: {
+                "X-Auth-Confirm": string;
+            };
+            path: {
+                appId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TransferPlatformAppOwnershipRequest"];
+            };
+        };
+        responses: {
+            /** @description Ownership transferred */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TransferPlatformAppOwnershipResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     getPlatformAppStats: {
         parameters: {
             query?: never;
@@ -18890,6 +19588,30 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    getSpendPolicy: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                appId: string;
+                policyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Spend policy */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SpendPolicyResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
     deleteSpendPolicy: {
         parameters: {
             query?: never;
@@ -18912,7 +19634,7 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
-    setUserSpendPolicy: {
+    getConnectionSpendPolicy: {
         parameters: {
             query?: never;
             header?: never;
@@ -18921,13 +19643,41 @@ export interface operations {
             };
             cookie?: never;
         };
+        requestBody?: never;
+        responses: {
+            /** @description Effective spend policy (or null) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        policy?: components["schemas"]["SpendPolicyResponse"] | null;
+                    };
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setUserSpendPolicy: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Optional replay protection; same key + body returns cached response (409 on body mismatch). */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                connectionId: string;
+            };
+            cookie?: never;
+        };
         requestBody: {
             content: {
                 "application/json": components["schemas"]["CreateSpendPolicyRequest"];
             };
         };
         responses: {
-            /** @description Spend policy set */
+            /** @description Spend policy set (or idempotent replay) */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -18936,8 +19686,104 @@ export interface operations {
                     "application/json": components["schemas"]["SpendPolicyResponse"];
                 };
             };
+            /** @description Spend policy created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SpendPolicyResponse"];
+                };
+            };
             400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description Idempotency-Key reused with different body */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    listConnectionApprovals: {
+        parameters: {
+            query?: {
+                status?: string;
+                risk_tier?: number;
+                limit?: number;
+                offset?: number;
+            };
+            header?: never;
+            path: {
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Connection-scoped approvals */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApprovalListResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getConnectionApproval: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                connectionId: string;
+                approvalId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Approval detail */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApprovalResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
+    listConnectionPendingApprovals: {
+        parameters: {
+            query?: {
+                status?: string;
+                limit?: number;
+                offset?: number;
+            };
+            header?: never;
+            path: {
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Pending approvals list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PendingApprovalListResponse"];
+                };
+            };
+            404: components["responses"]["NotFound"];
         };
     };
     listApprovals: {