@1claw/sdk 0.61.12 → 0.61.14

package/dist/generated/api-types.d.ts

@@ -510,6 +510,28 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/feature-quota/consume": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Count one call against a per-user feature quota
+         * @description Atomic fixed-window counter for metered dashboard features (currently
+         *     `voice_brief`, 30 calls per hour). The limit and window are defined
+         *     server-side; the caller only names the feature. Users only.
+         */
+        post: operations["consumeFeatureQuota"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/me": {
         parameters: {
             query?: never;
@@ -2197,6 +2219,66 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/admin/agents/{agent_id}/reports/dismiss": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Dismiss every open report on a directory listing
+         * @description Platform admins only. Clears the listing's report flag and recounts. The review queue is a platform function — an org dismissing reports against its own agent is the abuse the queue exists to catch.
+         */
+        post: operations["adminDismissAgentReports"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/agents/{agent_id}/verification-tier": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set a directory listing's verification tier
+         * @description Platform admins only. Unknown tiers are refused rather than demoted to `unverified`.
+         */
+        put: operations["adminSetAgentVerificationTier"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/admin/kms/relevel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Move orgs onto the KEK protection level their tier and payment call for
+         * @description Platform admins only. Examines up to `limit` orgs whose stored KEK level disagrees with the target (Pro earns HSM only with an active subscription; Team, Business and Enterprise keep HSM; the platform org is always software) and starts a migration for each: a new key at the right level, every secret and every org-scoped row re-wrapped, the old key released from the keep set 30 days after completion. The nightly consolidation job runs the same pass, 25 orgs at a time.
+         */
+        post: operations["adminKmsRelevel"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/admin/chains": {
         parameters: {
             query?: never;
@@ -3159,6 +3241,92 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/keys/{key_id}/client-share": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description A treasury wallet id or an agent signing key id owned by the caller's org */
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * List the caller's wrapped shares for a key
+         * @description Returns every wrap on file for this key, unopened, to the user who
+         *     stored them. `custody` tells you whether the key is `server` (1claw
+         *     holds the whole private key) or `client_tss` (threshold; neither party
+         *     can sign alone). Funding a `client_tss` wallet needs at least two wraps.
+         */
+        get: operations["listClientKeyShares"];
+        /**
+         * Store the customer's wrapped share of a threshold key
+         * @description Stores ciphertext the vault cannot open: the customer's share of a
+         *     2-party threshold signing key, wrapped in the browser under the
+         *     passkey's WebAuthn PRF output (`passkey_prf`, one wrap per credential)
+         *     or under a recovery code (`recovery_code`, one per key). The vault
+         *     keeps the blob and its salt and returns them only to the owning user.
+         *     Human users only; the passkey must have reported PRF support at
+         *     registration. Idempotent per (key, credential).
+         */
+        put: operations["putClientKeyShare"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/keys/{key_id}/client-share/rewrap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add a wrap for another credential or the recovery code
+         * @description Same write as `PUT …/client-share`, for a key that already has at
+         *     least one wrap: the browser, holding the share in memory during a
+         *     passkey session, re-wraps it under a newly added passkey's PRF
+         *     output or under the recovery code. 409 if no wrap exists yet.
+         */
+        post: operations["rewrapClientKeyShare"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/keys/{key_id}/client-share/{share_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+                share_id: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove one wrap
+         * @description Deletes a single wrap. Wraps tied to a passkey are also removed when
+         *     that passkey is deleted. Removing the last wrap of a `client_tss` key
+         *     makes the key unrecoverable — the vault holds only its own share.
+         */
+        delete: operations["deleteClientKeyShare"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/treasury/wallets/generate": {
         parameters: {
             query?: never;
@@ -5677,7 +5845,16 @@ export interface paths {
         get: operations["getConnectionRuntime"];
         put?: never;
         post?: never;
-        delete?: never;
+        /**
+         * Delete a connection runtime (plt_ scoped)
+         * @description Removes a runtime the app provisioned on this connection. A running
+         *     runtime is stopped at the provider first and any runtime add-on
+         *     subscription is cancelled before the record is removed. Scoped like
+         *     the GET: the connection must belong to the app and list the runtime.
+         *     This is the cleanup path for a mis-provisioned runtime;
+         *     `DELETE /v1/runtimes/{id}` does not accept a plt_ key.
+         */
+        delete: operations["deleteConnectionRuntime"];
         options?: never;
         head?: never;
         patch?: never;
@@ -6557,6 +6734,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/agents/{agent_id}/pay/grants/prepare": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Prepare a spending grant (step one of two)
+         * @description Fixes the grant terms and a server-side nonce and returns the `grant_digest` the person must assert over with a passkey (`action=x402_grant`). Then call `POST .../pay/grants` with the same terms, the digest, and the passkey token. Preparations are single-use, bound to the caller and agent, and expire after ten minutes. The nonce never leaves the server, so the digest cannot be recomputed for different terms. Human callers only; terms are validated against the agent's maximum cap and window here as well.
+         */
+        post: operations["preparePayGrant"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/agents/{agent_id}/pay/grants": {
         parameters: {
             query?: never;
@@ -11281,6 +11478,27 @@ export interface components {
             mfa_token?: string;
             /** @enum {string} */
             mfa_method?: "totp" | "passkey";
+            /**
+             * Format: uuid
+             * @description Agent token exchange only — the resolved agent id.
+             */
+            agent_id?: string;
+            /** @description Agent token exchange only — vaults the agent is bound to. */
+            vault_ids?: string[];
+            entitlements?: components["schemas"]["AgentEntitlements"];
+        };
+        /** @description Returned on agent token exchange. The flags a client needs to decide which tools to offer, as of the moment the token was minted. treasury_signer and has_delegations are derived from the agent's treasury signer rows and active delegations and are not present on the agent profile. */
+        AgentEntitlements: {
+            intents_api: boolean;
+            execution_intents: boolean;
+            execution_require_tee: boolean;
+            intents_require_tee: boolean;
+            cards: boolean;
+            memory: boolean;
+            shroud: boolean;
+            discoverable: boolean;
+            treasury_signer: boolean;
+            has_delegations: boolean;
         };
         /** @description Exactly one credential, decided by the agent's auth_method: api_key for api_key agents, oidc_token for oidc_client_credentials agents. mTLS agents send neither and present a client certificate through the TLS terminator. */
         AgentTokenRequest: {
@@ -12955,6 +13173,12 @@ export interface components {
             created_at?: string;
             /** Format: date-time */
             rotated_at?: string | null;
+            /**
+             * @description `server` — 1claw holds the whole private key and can sign alone.
+             *     `client_tss` — 2-party threshold key; the customer's passkey share is required.
+             * @enum {string}
+             */
+            custody?: "server" | "client_tss";
         };
         SigningKeyListResponse: {
             keys?: components["schemas"]["SigningKeyResponse"][];
@@ -13512,6 +13736,15 @@ export interface components {
         };
         LlmTokenBillingStatus: {
             enabled: boolean;
+            /**
+             * @description Usage accrues on the Stripe subscription and is invoiced at the end of the
+             *     billing period. `credit_balance` is Stripe's prepaid credit-grant balance,
+             *     which is 0 unless a credit grant was issued; a 0 there does not block inference.
+             * @enum {string}
+             */
+            billing_model: "postpaid_metered";
+            /** @description Enabled and the subscription is not canceled/unpaid/expired. */
+            inference_allowed: boolean;
             /** @enum {string} */
             subscription_status?: "active" | "inactive";
             credit_balance?: components["schemas"]["LlmCreditBalance"];
@@ -13884,6 +14117,12 @@ export interface components {
             is_active?: boolean;
             /** Format: date-time */
             created_at?: string;
+            /**
+             * @description `server` — 1claw holds the whole private key and can sign alone.
+             *     `client_tss` — 2-party threshold key; the customer's passkey share is required.
+             * @enum {string}
+             */
+            custody?: "server" | "client_tss";
         };
         TreasuryWalletListResponse: {
             wallets?: components["schemas"]["TreasuryWalletResponse"][];
@@ -15053,6 +15292,9 @@ export interface components {
             connection_id: string;
             /** Format: uuid */
             user_id: string;
+            /** @description The connected user's email, as returned by the upsert. Use it to recognise a returning user and begin a passkey ceremony from the connection alone. */
+            email?: string;
+            display_name?: string;
             status: string;
             entitlement_status: string;
             /**
@@ -15213,6 +15455,58 @@ export interface components {
             client_data_json: string;
             transports?: string[];
             name?: string;
+            /**
+             * @description `prf.enabled` from `credential.getClientExtensionResults()` —
+             *     whether this authenticator can derive the secret that wraps a
+             *     wallet share. Omit if the client did not request the extension.
+             */
+            prf_supported?: boolean | null;
+        };
+        PutClientShareRequest: {
+            /** @enum {string} */
+            wrap_kind: "passkey_prf" | "recovery_code";
+            /**
+             * Format: uuid
+             * @description Required for `passkey_prf`; the passkey id from `GET /v1/auth/passkeys`.
+             */
+            credential_id?: string | null;
+            /** @description Base64 ciphertext (≤ 4 KiB). Opaque to the vault. */
+            wrapped_share: string;
+            /** @description Base64 PRF salt, 16–64 random bytes, one per key. */
+            salt: string;
+        };
+        ClientShareResponse: {
+            /** Format: uuid */
+            id?: string;
+            /** Format: uuid */
+            key_id?: string;
+            /** @enum {string} */
+            key_kind?: "agent_signing_key" | "treasury_wallet";
+            /** @enum {string} */
+            wrap_kind?: "passkey_prf" | "recovery_code";
+            /** Format: uuid */
+            credential_id?: string | null;
+            /** @description Base64, exactly as stored. */
+            wrapped_share?: string;
+            /** @description Base64. */
+            salt?: string;
+            /** Format: date-time */
+            created_at?: string;
+            /** Format: date-time */
+            updated_at?: string;
+        };
+        ClientShareListResponse: {
+            /** Format: uuid */
+            key_id?: string;
+            /** @enum {string} */
+            key_kind?: "agent_signing_key" | "treasury_wallet";
+            /**
+             * @description `server` — 1claw holds the whole private key and can sign alone.
+             *     `client_tss` — 2-party threshold key; the customer's share is required.
+             * @enum {string}
+             */
+            custody?: "server" | "client_tss";
+            shares?: components["schemas"]["ClientShareResponse"][];
         };
         PasskeyRegisterCompleteResponse: {
             /** Format: uuid */
@@ -17964,6 +18258,12 @@ export interface operations {
                             name?: string;
                             last_used_at?: string;
                             created_at?: string;
+                            /**
+                             * @description `true` — can hold a wallet share (WebAuthn PRF).
+                             *     `false` — cannot. `null` — registered before this
+                             *     was captured.
+                             */
+                            prf_supported?: boolean | null;
                         }[];
                     };
                 };
@@ -18061,6 +18361,41 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    consumeFeatureQuota: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    feature: "voice_brief";
+                };
+            };
+        };
+        responses: {
+            /** @description Whether this call is within the window's limit */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        allowed: boolean;
+                        limit: number;
+                        remaining: number;
+                        /** Format: date-time */
+                        reset_at: string;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
     getMe: {
         parameters: {
             query?: never;
@@ -21171,6 +21506,135 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    adminDismissAgentReports: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Reports dismissed */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** Format: uuid */
+                        agent_id?: string;
+                        dismissed?: number;
+                    };
+                };
+            };
+            /** @description Not a platform admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Agent not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminSetAgentVerificationTier: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    tier: "unverified" | "platform_reviewed" | "identity_verified" | "enterprise";
+                    /** @description Internal review notes */
+                    notes?: string | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Tier set */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** Format: uuid */
+                        agent_id?: string;
+                        tier?: string;
+                    };
+                };
+            };
+            /** @description Unknown tier */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not a platform admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Agent not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    adminKmsRelevel: {
+        parameters: {
+            query?: {
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Orgs examined and migrations started */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        examined?: number;
+                        migrations_started?: number;
+                        limit?: number;
+                    };
+                };
+            };
+            /** @description Not a platform admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     adminListChains: {
         parameters: {
             query?: never;
@@ -22715,6 +23179,118 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    listClientKeyShares: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description A treasury wallet id or an agent signing key id owned by the caller's org */
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Wraps on file */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ClientShareListResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    putClientKeyShare: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description A treasury wallet id or an agent signing key id owned by the caller's org */
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PutClientShareRequest"];
+            };
+        };
+        responses: {
+            /** @description Share stored */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ClientShareResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    rewrapClientKeyShare: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PutClientShareRequest"];
+            };
+        };
+        responses: {
+            /** @description Wrap added */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ClientShareResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+        };
+    };
+    deleteClientKeyShare: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+                share_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Wrap removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     generateTreasuryWallets: {
         parameters: {
             query?: never;
@@ -24790,6 +25366,28 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    deleteConnectionRuntime: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                connectionId: string;
+                runtimeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Runtime deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            404: components["responses"]["NotFound"];
+        };
+    };
     connectionPasskeyEnrollBegin: {
         parameters: {
             query?: never;
@@ -26201,6 +26799,55 @@ export interface operations {
             };
         };
     };
+    preparePayGrant: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                agent_id: components["parameters"]["AgentId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    cap_usd: string;
+                    ttl_secs: number;
+                    allowed_paytos?: string[] | null;
+                };
+            };
+        };
+        responses: {
+            /** @description The digest to assert over */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        grant_digest: string;
+                        /** @enum {string} */
+                        action: "x402_grant";
+                        expires_in_secs: number;
+                    };
+                };
+            };
+            /** @description Invalid terms */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not a human caller */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     createPayGrant: {
         parameters: {
             query?: never;