@1claw/sdk 0.61.13 → 0.61.14

package/README.md

@@ -419,7 +419,7 @@ Key properties:
 
 ### TEE Enforcement (Pro+)
 
-Lock down agents so signing and execution requests **must** route through the hardware enclave (Shroud TEE). Direct Vault API calls are rejected with 403.
+Lock down agents so signing and execution **must** happen in the hardware enclave (Shroud TEE). The vault enforces it by forwarding to Shroud, not by rejecting you.
 
 ```typescript
 await client.agents.update(agentId, {
@@ -429,13 +429,12 @@ await client.agents.update(agentId, {
 ```
 
 When `intents_require_tee` is true:
-- Transaction submit/sign requests to `api.1claw.co` are rejected (403)
-- Agents must route through `shroud.1claw.co` where signing happens inside TEE memory
+- Transaction submit/sign requests are signed inside Shroud's TEE whichever host you call — the vault forwards a request that arrives at `api.1claw.co` to Shroud on the agent's behalf (vault ≥ 0.61.19), so the SDK needs no special `baseUrl`
+- Direct calls to `shroud.1claw.co` still work and are required for DPoP-bound tokens
 
 When `execution_require_tee` is true:
-- Execute requests to `api.1claw.co` are rejected (403)
+- Execute requests run on Shroud's TEE execution surface — forced by the vault, no client routing needed
 - All direct secret reads by the agent are blocked — forces use of Execution Intent bindings
-- Agents must route through `shroud.1claw.co`
 
 Both require `intents_api_enabled` / `execution_intents_enabled` to be on first.
 

package/dist/generated/api-types.d.ts

@@ -3241,6 +3241,92 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/keys/{key_id}/client-share": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description A treasury wallet id or an agent signing key id owned by the caller's org */
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * List the caller's wrapped shares for a key
+         * @description Returns every wrap on file for this key, unopened, to the user who
+         *     stored them. `custody` tells you whether the key is `server` (1claw
+         *     holds the whole private key) or `client_tss` (threshold; neither party
+         *     can sign alone). Funding a `client_tss` wallet needs at least two wraps.
+         */
+        get: operations["listClientKeyShares"];
+        /**
+         * Store the customer's wrapped share of a threshold key
+         * @description Stores ciphertext the vault cannot open: the customer's share of a
+         *     2-party threshold signing key, wrapped in the browser under the
+         *     passkey's WebAuthn PRF output (`passkey_prf`, one wrap per credential)
+         *     or under a recovery code (`recovery_code`, one per key). The vault
+         *     keeps the blob and its salt and returns them only to the owning user.
+         *     Human users only; the passkey must have reported PRF support at
+         *     registration. Idempotent per (key, credential).
+         */
+        put: operations["putClientKeyShare"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/keys/{key_id}/client-share/rewrap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add a wrap for another credential or the recovery code
+         * @description Same write as `PUT …/client-share`, for a key that already has at
+         *     least one wrap: the browser, holding the share in memory during a
+         *     passkey session, re-wraps it under a newly added passkey's PRF
+         *     output or under the recovery code. 409 if no wrap exists yet.
+         */
+        post: operations["rewrapClientKeyShare"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/keys/{key_id}/client-share/{share_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+                share_id: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove one wrap
+         * @description Deletes a single wrap. Wraps tied to a passkey are also removed when
+         *     that passkey is deleted. Removing the last wrap of a `client_tss` key
+         *     makes the key unrecoverable — the vault holds only its own share.
+         */
+        delete: operations["deleteClientKeyShare"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/treasury/wallets/generate": {
         parameters: {
             query?: never;
@@ -13087,6 +13173,12 @@ export interface components {
             created_at?: string;
             /** Format: date-time */
             rotated_at?: string | null;
+            /**
+             * @description `server` — 1claw holds the whole private key and can sign alone.
+             *     `client_tss` — 2-party threshold key; the customer's passkey share is required.
+             * @enum {string}
+             */
+            custody?: "server" | "client_tss";
         };
         SigningKeyListResponse: {
             keys?: components["schemas"]["SigningKeyResponse"][];
@@ -14025,6 +14117,12 @@ export interface components {
             is_active?: boolean;
             /** Format: date-time */
             created_at?: string;
+            /**
+             * @description `server` — 1claw holds the whole private key and can sign alone.
+             *     `client_tss` — 2-party threshold key; the customer's passkey share is required.
+             * @enum {string}
+             */
+            custody?: "server" | "client_tss";
         };
         TreasuryWalletListResponse: {
             wallets?: components["schemas"]["TreasuryWalletResponse"][];
@@ -15357,6 +15455,58 @@ export interface components {
             client_data_json: string;
             transports?: string[];
             name?: string;
+            /**
+             * @description `prf.enabled` from `credential.getClientExtensionResults()` —
+             *     whether this authenticator can derive the secret that wraps a
+             *     wallet share. Omit if the client did not request the extension.
+             */
+            prf_supported?: boolean | null;
+        };
+        PutClientShareRequest: {
+            /** @enum {string} */
+            wrap_kind: "passkey_prf" | "recovery_code";
+            /**
+             * Format: uuid
+             * @description Required for `passkey_prf`; the passkey id from `GET /v1/auth/passkeys`.
+             */
+            credential_id?: string | null;
+            /** @description Base64 ciphertext (≤ 4 KiB). Opaque to the vault. */
+            wrapped_share: string;
+            /** @description Base64 PRF salt, 16–64 random bytes, one per key. */
+            salt: string;
+        };
+        ClientShareResponse: {
+            /** Format: uuid */
+            id?: string;
+            /** Format: uuid */
+            key_id?: string;
+            /** @enum {string} */
+            key_kind?: "agent_signing_key" | "treasury_wallet";
+            /** @enum {string} */
+            wrap_kind?: "passkey_prf" | "recovery_code";
+            /** Format: uuid */
+            credential_id?: string | null;
+            /** @description Base64, exactly as stored. */
+            wrapped_share?: string;
+            /** @description Base64. */
+            salt?: string;
+            /** Format: date-time */
+            created_at?: string;
+            /** Format: date-time */
+            updated_at?: string;
+        };
+        ClientShareListResponse: {
+            /** Format: uuid */
+            key_id?: string;
+            /** @enum {string} */
+            key_kind?: "agent_signing_key" | "treasury_wallet";
+            /**
+             * @description `server` — 1claw holds the whole private key and can sign alone.
+             *     `client_tss` — 2-party threshold key; the customer's share is required.
+             * @enum {string}
+             */
+            custody?: "server" | "client_tss";
+            shares?: components["schemas"]["ClientShareResponse"][];
         };
         PasskeyRegisterCompleteResponse: {
             /** Format: uuid */
@@ -18108,6 +18258,12 @@ export interface operations {
                             name?: string;
                             last_used_at?: string;
                             created_at?: string;
+                            /**
+                             * @description `true` — can hold a wallet share (WebAuthn PRF).
+                             *     `false` — cannot. `null` — registered before this
+                             *     was captured.
+                             */
+                            prf_supported?: boolean | null;
                         }[];
                     };
                 };
@@ -23023,6 +23179,118 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    listClientKeyShares: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description A treasury wallet id or an agent signing key id owned by the caller's org */
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Wraps on file */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ClientShareListResponse"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    putClientKeyShare: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description A treasury wallet id or an agent signing key id owned by the caller's org */
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PutClientShareRequest"];
+            };
+        };
+        responses: {
+            /** @description Share stored */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ClientShareResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    rewrapClientKeyShare: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PutClientShareRequest"];
+            };
+        };
+        responses: {
+            /** @description Wrap added */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ClientShareResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+        };
+    };
+    deleteClientKeyShare: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                key_id: string;
+                share_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Wrap removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     generateTreasuryWallets: {
         parameters: {
             query?: never;