@1claw/sdk 0.61.12 → 0.61.13

package/README.md

@@ -636,6 +636,17 @@ const client = createClient({
 // Tokens refresh transparently — just make API calls
 ```
 
+The exchange response also says what the agent is entitled to (vault ≥ 0.61.17), so a tool host can shape its surface without a second call:
+
+```typescript
+const res = await client.auth.agentToken({ api_key: "ocv_..." });
+res.data?.entitlements;
+// { intents_api: true, execution_intents: false, execution_require_tee: false, intents_require_tee: false,
+//   cards: false, memory: true, shroud: false, discoverable: false, treasury_signer: false, has_delegations: false }
+```
+
+Changing a claim-bearing agent field (`scopes`, `vault_ids`, `is_active`, `intents_api_enabled`, `shroud_enabled`, `execution_intents_enabled`, `*_require_tee`, `environment`) via `client.agents.update()` revokes the agent's outstanding JWTs; the SDK's next request re-exchanges automatically.
+
 ## DPoP (Proof-of-Possession)
 
 Enable [DPoP (RFC 9449)](https://datatracker.ietf.org/doc/html/rfc9449) to bind tokens to the client's ephemeral keypair. When enabled, the SDK generates a P-256 ECDSA keypair at startup and attaches a `DPoP` proof JWT to every request — stolen tokens are unusable without the matching private key.

package/dist/generated/api-types.d.ts

@@ -510,6 +510,28 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/feature-quota/consume": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Count one call against a per-user feature quota
+         * @description Atomic fixed-window counter for metered dashboard features (currently
+         *     `voice_brief`, 30 calls per hour). The limit and window are defined
+         *     server-side; the caller only names the feature. Users only.
+         */
+        post: operations["consumeFeatureQuota"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/me": {
         parameters: {
             query?: never;
@@ -2197,6 +2219,66 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/admin/agents/{agent_id}/reports/dismiss": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Dismiss every open report on a directory listing
+         * @description Platform admins only. Clears the listing's report flag and recounts. The review queue is a platform function — an org dismissing reports against its own agent is the abuse the queue exists to catch.
+         */
+        post: operations["adminDismissAgentReports"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/agents/{agent_id}/verification-tier": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set a directory listing's verification tier
+         * @description Platform admins only. Unknown tiers are refused rather than demoted to `unverified`.
+         */
+        put: operations["adminSetAgentVerificationTier"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/kms/relevel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Move orgs onto the KEK protection level their tier and payment call for
+         * @description Platform admins only. Examines up to `limit` orgs whose stored KEK level disagrees with the target (Pro earns HSM only with an active subscription; Team, Business and Enterprise keep HSM; the platform org is always software) and starts a migration for each: a new key at the right level, every secret and every org-scoped row re-wrapped, the old key released from the keep set 30 days after completion. The nightly consolidation job runs the same pass, 25 orgs at a time.
+         */
+        post: operations["adminKmsRelevel"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/admin/chains": {
         parameters: {
             query?: never;
@@ -5677,7 +5759,16 @@ export interface paths {
         get: operations["getConnectionRuntime"];
         put?: never;
         post?: never;
-        delete?: never;
+        /**
+         * Delete a connection runtime (plt_ scoped)
+         * @description Removes a runtime the app provisioned on this connection. A running
+         *     runtime is stopped at the provider first and any runtime add-on
+         *     subscription is cancelled before the record is removed. Scoped like
+         *     the GET: the connection must belong to the app and list the runtime.
+         *     This is the cleanup path for a mis-provisioned runtime;
+         *     `DELETE /v1/runtimes/{id}` does not accept a plt_ key.
+         */
+        delete: operations["deleteConnectionRuntime"];
         options?: never;
         head?: never;
         patch?: never;
@@ -6557,6 +6648,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/pay/grants/prepare": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Prepare a spending grant (step one of two)
+         * @description Fixes the grant terms and a server-side nonce and returns the `grant_digest` the person must assert over with a passkey (`action=x402_grant`). Then call `POST .../pay/grants` with the same terms, the digest, and the passkey token. Preparations are single-use, bound to the caller and agent, and expire after ten minutes. The nonce never leaves the server, so the digest cannot be recomputed for different terms. Human callers only; terms are validated against the agent's maximum cap and window here as well.
+         */
+        post: operations["preparePayGrant"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{agent_id}/pay/grants": {
         parameters: {
             query?: never;
@@ -11281,6 +11392,27 @@ export interface components {
             mfa_token?: string;
             /** @enum {string} */
             mfa_method?: "totp" | "passkey";
+            /**
+             * Format: uuid
+             * @description Agent token exchange only — the resolved agent id.
+             */
+            agent_id?: string;
+            /** @description Agent token exchange only — vaults the agent is bound to. */
+            vault_ids?: string[];
+            entitlements?: components["schemas"]["AgentEntitlements"];
+        };
+        /** @description Returned on agent token exchange. The flags a client needs to decide which tools to offer, as of the moment the token was minted. treasury_signer and has_delegations are derived from the agent's treasury signer rows and active delegations and are not present on the agent profile. */
+        AgentEntitlements: {
+            intents_api: boolean;
+            execution_intents: boolean;
+            execution_require_tee: boolean;
+            intents_require_tee: boolean;
+            cards: boolean;
+            memory: boolean;
+            shroud: boolean;
+            discoverable: boolean;
+            treasury_signer: boolean;
+            has_delegations: boolean;
         };
         /** @description Exactly one credential, decided by the agent's auth_method: api_key for api_key agents, oidc_token for oidc_client_credentials agents. mTLS agents send neither and present a client certificate through the TLS terminator. */
         AgentTokenRequest: {
@@ -13512,6 +13644,15 @@ export interface components {
         };
         LlmTokenBillingStatus: {
             enabled: boolean;
+            /**
+             * @description Usage accrues on the Stripe subscription and is invoiced at the end of the
+             *     billing period. `credit_balance` is Stripe's prepaid credit-grant balance,
+             *     which is 0 unless a credit grant was issued; a 0 there does not block inference.
+             * @enum {string}
+             */
+            billing_model: "postpaid_metered";
+            /** @description Enabled and the subscription is not canceled/unpaid/expired. */
+            inference_allowed: boolean;
             /** @enum {string} */
             subscription_status?: "active" | "inactive";
             credit_balance?: components["schemas"]["LlmCreditBalance"];
@@ -15053,6 +15194,9 @@ export interface components {
             connection_id: string;
             /** Format: uuid */
             user_id: string;
+            /** @description The connected user's email, as returned by the upsert. Use it to recognise a returning user and begin a passkey ceremony from the connection alone. */
+            email?: string;
+            display_name?: string;
             status: string;
             entitlement_status: string;
             /**
@@ -18061,6 +18205,41 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    consumeFeatureQuota: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    feature: "voice_brief";
+                };
+            };
+        };
+        responses: {
+            /** @description Whether this call is within the window's limit */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        allowed: boolean;
+                        limit: number;
+                        remaining: number;
+                        /** Format: date-time */
+                        reset_at: string;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
     getMe: {
         parameters: {
             query?: never;
@@ -21171,6 +21350,135 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    adminDismissAgentReports: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Reports dismissed */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** Format: uuid */
+                        agent_id?: string;
+                        dismissed?: number;
+                    };
+                };
+            };
+            /** @description Not a platform admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Agent not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminSetAgentVerificationTier: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    tier: "unverified" | "platform_reviewed" | "identity_verified" | "enterprise";
+                    /** @description Internal review notes */
+                    notes?: string | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Tier set */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** Format: uuid */
+                        agent_id?: string;
+                        tier?: string;
+                    };
+                };
+            };
+            /** @description Unknown tier */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not a platform admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Agent not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminKmsRelevel: {
+        parameters: {
+            query?: {
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Orgs examined and migrations started */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        examined?: number;
+                        migrations_started?: number;
+                        limit?: number;
+                    };
+                };
+            };
+            /** @description Not a platform admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     adminListChains: {
         parameters: {
             query?: never;
@@ -24790,6 +25098,28 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    deleteConnectionRuntime: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                connectionId: string;
+                runtimeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Runtime deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
     connectionPasskeyEnrollBegin: {
         parameters: {
             query?: never;
@@ -26201,6 +26531,55 @@ export interface operations {
             };
         };
     };
+    preparePayGrant: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    cap_usd: string;
+                    ttl_secs: number;
+                    allowed_paytos?: string[] | null;
+                };
+            };
+        };
+        responses: {
+            /** @description The digest to assert over */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        grant_digest: string;
+                        /** @enum {string} */
+                        action: "x402_grant";
+                        expires_in_secs: number;
+                    };
+                };
+            };
+            /** @description Invalid terms */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not a human caller */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     createPayGrant: {
         parameters: {
             query?: never;