@cubist-labs/cubesigner-sdk 0.4.279 → 0.4.281

package/src/schema.ts

@@ -5289,6 +5289,11 @@ export interface components {
      */
     ContactLabel: "cubist:erc20_token" | "cubist:spl_token";
     CreateAndUpdateKeyProperties: {
+      /**
+       * @description Set this key's access-control entries.
+       * For an existing key, this overwrites the current acl, if any.
+       */
+      acl?: unknown;
       edit_policy?: components["schemas"]["EditPolicy"] | null;
       /**
        * @description Set this key's metadata. If this value is `null`, the metadata is erased. If the field is
@@ -6183,7 +6188,7 @@ export interface components {
     /** @default null */
     Empty: unknown;
     EmptyImpl: {
-      status: string;
+      status: components["schemas"]["StatusOk"];
     };
     /**
      * @description Request to create a set of EOTS nonces for a specified chain-id, starting
@@ -6742,6 +6747,7 @@ export interface components {
       | "manage:key:update:*"
       | "manage:key:update:owner"
       | "manage:key:update:policy"
+      | "manage:key:update:acl"
       | "manage:key:update:enabled"
       | "manage:key:update:region"
       | "manage:key:update:metadata"
@@ -6945,6 +6951,19 @@ export interface components {
     };
     /** @description Declares intent to register a new FIDO key */
     FidoCreateRequest: {
+      /**
+       * @description If set, the attestation answering this registration challenge additionally counts as an
+       * approving vote on pending MFA request `mfa_id`.
+       *
+       * This exists so that a user who must register their first second factor in order to complete
+       * an operation (most commonly logging in) does not have to perform two authenticator
+       * ceremonies back to back: one to enroll the credential and another to immediately prove
+       * possession of it. The attestation is a full WebAuthn ceremony over a server-issued
+       * challenge, so it is no weaker than the separate assertion it replaces.
+       *
+       * Requires the 'manage:mfa:vote:fido' scope in addition to 'manage:mfa:register:fido'.
+       */
+      approve_mfa?: string | null;
       /** @description Whether this key can be used for passwordless login */
       discoverable?: boolean;
       /**
@@ -6961,6 +6980,11 @@ export interface components {
        */
       request_device_identifier?: boolean;
     };
+    /** @description Result of registering a FIDO key */
+    FidoRegisterResponse: {
+      mfa?: components["schemas"]["MfaRequestInfo"];
+      status: components["schemas"]["StatusOk"];
+    };
     /** @enum {string} */
     ForbiddenErrorCode:
       | "AlienKeyCreate"
@@ -7696,6 +7720,20 @@ export interface components {
       role_id: string;
     };
     KeyInfo: components["schemas"]["CommonFields"] & {
+      /**
+       * @description Key access-control entries
+       * @example [
+       *   {
+       *     "actions": [
+       *       "manage:key:properties"
+       *     ],
+       *     "subjects": [
+       *       "User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f"
+       *     ]
+       *   }
+       * ]
+       */
+      acl?: unknown[] | null;
       derivation_info?: components["schemas"]["KeyDerivationInfo"] | null;
       /** @description Whether the key is enabled (only enabled keys may be used for signing) */
       enabled: boolean;
@@ -10717,6 +10755,16 @@ export interface components {
         };
       };
     };
+    /**
+     * @description The `status` field carried by [`Empty`] responses. Always serializes as `"ok"`.
+     *
+     * Endpoints that used to return [`Empty`] and now return something richer must keep emitting
+     * this field, because generated clients bind [`Empty`] to a struct with a *required* `status`
+     * and would otherwise fail to deserialize a successful response. Use this type rather than a
+     * bare `String` so the one acceptable value is not something anyone has to remember.
+     * @enum {string}
+     */
+    StatusOk: "ok";
     /**
      * @description A single asset balance entry returned by [`SubAccountAssetsResponse`].
      *
@@ -11137,8 +11185,25 @@ export interface components {
        */
       totp_url: string;
     };
+    /** @description Result of registering (resetting) TOTP */
+    TotpRegisterResponse: {
+      mfa?: components["schemas"]["MfaRequestInfo"];
+      status: components["schemas"]["StatusOk"];
+    };
     /** @description Request to reset TOTP. */
     TotpResetRequest: {
+      /**
+       * @description If set, the code answering this challenge additionally counts as an approving vote on
+       * pending MFA request `mfa_id`.
+       *
+       * This exists so that a user who must register their first second factor in order to complete
+       * an operation (most commonly logging in) does not have to enter two TOTP codes back to back:
+       * one to confirm enrollment and another to immediately approve the pending request. Answering
+       * the challenge already proves possession of the new secret.
+       *
+       * Requires the 'manage:mfa:vote:totp' scope in addition to 'manage:mfa:register:totp'.
+       */
+      approve_mfa?: string | null;
       /** @description The name of the issuer; defaults to "Cubist". */
       issuer?: string | null;
     };
@@ -12774,7 +12839,7 @@ export interface components {
     EmptyImpl: {
       content: {
         "application/json": {
-          status: string;
+          status: components["schemas"]["StatusOk"];
         };
       };
     };
@@ -12840,6 +12905,15 @@ export interface components {
         };
       };
     };
+    /** @description Result of registering a FIDO key */
+    FidoRegisterResponse: {
+      content: {
+        "application/json": {
+          mfa?: components["schemas"]["MfaRequestInfo"];
+          status: components["schemas"]["StatusOk"];
+        };
+      };
+    };
     /** @description The email sender configuration (without sensitive auth details) */
     GetEmailConfigResponse: {
       content: {
@@ -13012,6 +13086,20 @@ export interface components {
     KeyInfo: {
       content: {
         "application/json": components["schemas"]["CommonFields"] & {
+          /**
+           * @description Key access-control entries
+           * @example [
+           *   {
+           *     "actions": [
+           *       "manage:key:properties"
+           *     ],
+           *     "subjects": [
+           *       "User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f"
+           *     ]
+           *   }
+           * ]
+           */
+          acl?: unknown[] | null;
           derivation_info?: components["schemas"]["KeyDerivationInfo"] | null;
           /** @description Whether the key is enabled (only enabled keys may be used for signing) */
           enabled: boolean;
@@ -14030,6 +14118,15 @@ export interface components {
         };
       };
     };
+    /** @description Result of registering (resetting) TOTP */
+    TotpRegisterResponse: {
+      content: {
+        "application/json": {
+          mfa?: components["schemas"]["MfaRequestInfo"];
+          status: components["schemas"]["StatusOk"];
+        };
+      };
+    };
     /** @description A response to sign an eth2 unstake request. */
     UnstakeResponse: {
       content: {
@@ -19500,7 +19597,7 @@ export interface operations {
       };
     };
     responses: {
-      200: components["responses"]["EmptyImpl"];
+      200: components["responses"]["FidoRegisterResponse"];
       default: {
         content: {
           "application/json": components["schemas"]["ErrorResponse"];
@@ -19647,7 +19744,7 @@ export interface operations {
       };
     };
     responses: {
-      200: components["responses"]["EmptyImpl"];
+      200: components["responses"]["TotpRegisterResponse"];
       default: {
         content: {
           "application/json": components["schemas"]["ErrorResponse"];

package/src/scopes.ts

@@ -123,6 +123,7 @@ export const AllScopes: Record<ExplicitScope, string> =
   "manage:key:update:owner"                     : "Allows access only to the key 'update' endpoint, but restricting updates to the key 'owner' property",
   "manage:key:update:region"                    : "Allows access only to the key 'update' endpoint, but restricting updates to the key 'region' property",
   "manage:key:update:policy"                    : "Allows access only to the key 'update' endpoint, but restricting updates to the key 'policy' property",
+  "manage:key:update:acl"                       : "Allows access only to the key 'update' endpoint, but restricting updates to the key 'acl' property",
   "manage:key:update:enabled"                   : "Allows access only to the key 'update' endpoint, but restricting updates to the key 'enabled' property",
   "manage:key:update:metadata"                  : "Allows access only to the key 'update' endpoint and restricts updates to the key 'metadata' property",
   "manage:key:update:properties"                : "Allows access only to the key 'update' endpoint and restricts updates to the key 'properties' property",