@totalis/hip4-client 0.0.0-stage → 0.73.0

package/dist/generated/api-keys.d.ts

@@ -0,0 +1,1303 @@
+export type paths = {
+    readonly "/v1/me/api-keys": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /**
+         * List your API keys
+         * @description Lists every key of the session's account, oldest first, as metadata without secrets.
+         */
+        readonly get: operations["listPersonalApiKeys"];
+        readonly put?: never;
+        /**
+         * Create an API key
+         * @description Issues a scoped `ttk_` key for the session's account from a request your account wallet signed, and returns its secret this once.
+         */
+        readonly post: operations["createPersonalApiKey"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/me/api-keys/{key_id}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        readonly post?: never;
+        /**
+         * Revoke an API key
+         * @description Revokes a key of the session's account at once, with any key it is rotating to or from, and answers 204 again for a key already revoked.
+         */
+        readonly delete: operations["revokePersonalApiKey"];
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/me/api-keys/{key_id}/rotations": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Rotate an API key
+         * @description Issues a replacement with the same label and scopes from a freshly signed `ROTATE` challenge, while the old key keeps working until its `overlap_until`.
+         */
+        readonly post: operations["rotatePersonalApiKey"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/me/api-key-challenges": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Create an API-key challenge
+         * @description Returns the EIP-4361 message your account wallet signs with `personal_sign` to create or rotate one key, bound to that exact request and usable once within 5 minutes.
+         */
+        readonly post: operations["createPersonalApiKeyChallenge"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/makers/{maker_id}/api-keys": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /**
+         * List a maker's API keys
+         * @description Lists every key of the maker, oldest first, as metadata without secrets.
+         */
+        readonly get: operations["listMakerApiKeys"];
+        readonly put?: never;
+        /**
+         * Create a maker API key
+         * @description Issues a scoped `ttk_` key for the maker from a request its controller signed, and returns its secret this once.
+         */
+        readonly post: operations["createMakerApiKey"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/makers/{maker_id}/api-keys/{key_id}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        readonly post?: never;
+        /**
+         * Revoke a maker API key
+         * @description Revokes a key of the maker at once, with any key it is rotating to or from, and answers 204 again for a key already revoked.
+         */
+        readonly delete: operations["revokeMakerApiKey"];
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/makers/{maker_id}/api-keys/{key_id}/rotations": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Rotate a maker API key
+         * @description Issues a replacement with the same label and scopes from a freshly signed `ROTATE` challenge, while the old key keeps working until its `overlap_until`.
+         */
+        readonly post: operations["rotateMakerApiKey"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/operator/api-keys": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get: operations["listOperatorApiKeys"];
+        readonly put?: never;
+        readonly post: operations["createOperatorApiKey"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/operator/api-keys/{key_id}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete: operations["revokeOperatorApiKey"];
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/operator/api-keys/{key_id}/rotations": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        readonly post: operations["rotateOperatorApiKey"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/makers/{maker_id}/api-key-challenges": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Create a maker API-key challenge
+         * @description Returns the EIP-4361 message the maker's controller signs with `personal_sign` to create or rotate one maker key, bound to that exact request and usable once within 5 minutes.
+         */
+        readonly post: operations["createMakerApiKeyChallenge"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/me/api-key-capabilities": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /**
+         * List issuable scopes
+         * @description Returns the scopes a new key for the session's account may hold now and the wallet that must sign it, as advice that issuance checks again.
+         */
+        readonly get: operations["getPersonalApiKeyCapabilities"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/v1/makers/{maker_id}/api-key-capabilities": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /**
+         * List a maker's issuable scopes
+         * @description Returns the scopes a new key for the maker may hold now and the controller that must sign it, as advice that issuance checks again.
+         */
+        readonly get: operations["getMakerApiKeyCapabilities"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+};
+export type webhooks = Record<string, never>;
+export type components = {
+    schemas: {
+        /**
+         * @description Maximum items in one page. A page may hold fewer, even none, while has_more is true.
+         * @default 50
+         */
+        readonly PageLimit: number;
+        /** @description Opaque list cursor. Send a previous response's next_cursor back unchanged; never build or parse one. */
+        readonly PageCursor: string;
+        /** Format: date-time */
+        readonly Timestamp: string;
+        /** Format: uuid */
+        readonly Uuid: string;
+        /** Format: uint64-decimal */
+        readonly UInt64String: string;
+        readonly NonZeroUInt64String: components["schemas"]["UInt64String"] & unknown;
+        readonly LowercaseNonZeroAddress: string;
+        /** @description The one account a key acts for: a personal account or a maker vault. A key never spans accounts. */
+        readonly Account: {
+            /**
+             * @description The account kind: `PARTICIPANT` for a personal account.
+             * @constant
+             */
+            readonly kind: "PARTICIPANT";
+            /** @description The personal account's ID. */
+            readonly id: components["schemas"]["Uuid"];
+        } | {
+            /**
+             * @description The account kind: `MAKER` for a maker vault.
+             * @constant
+             */
+            readonly kind: "MAKER";
+            /** @description The on-chain maker ID, as a decimal string. */
+            readonly id: components["schemas"]["NonZeroUInt64String"];
+            /**
+             * @description The HyperEVM chain of the maker's vault: 999 mainnet, 998 testnet.
+             * @enum {string}
+             */
+            readonly chain_id: "998" | "999";
+            /** @description The Totalis vault contract the maker is registered in. */
+            readonly vault_address: components["schemas"]["LowercaseNonZeroAddress"];
+        } | {
+            /**
+             * @description The account kind: `OPERATOR`, never issued.
+             * @constant
+             */
+            readonly kind: "OPERATOR";
+            /** @description The operator's ID. */
+            readonly id: components["schemas"]["Uuid"];
+        };
+        readonly KeyLabel: string;
+        /**
+         * @description One permission a key can hold. Each operation lists the scopes it requires, and a key holds only scopes that apply to its account, as the capabilities routes list. `operations:read` is reserved and never issued; `maker:access:read` is no longer issued and has no effect on a key that still carries it.
+         * @enum {string}
+         */
+        readonly Scope: "identity:read" | "account:read" | "account:stream" | "rfq:read" | "rfq:write" | "quote:write" | "quote:read" | "replay:read" | "vault:read" | "vault:write" | "quote:accept" | "position:cashout" | "funding:deposit" | "funding:withdraw" | "sponsorship:use" | "maker:access:read" | "operations:read" | "operations:submit";
+        /** @description Replay needs a feed the key can read: account:stream or rfq:read for a personal account, vault:read, quote:read or rfq:read for a maker. */
+        readonly ScopeList: readonly components["schemas"]["Scope"][] & unknown & unknown & unknown;
+        readonly KeyMetadata: {
+            /** @description Key ID; the secret embeds it, and the key routes take it as `key_id`. */
+            readonly id: components["schemas"]["Uuid"];
+            /** @description The one account the key acts for. */
+            readonly account: components["schemas"]["Account"];
+            /**
+             * @description The deployment the key works in; a key never works in another.
+             * @enum {unknown}
+             */
+            readonly environment: "development" | "staging" | "production";
+            /** @description Your name for the key, 1 to 80 characters. */
+            readonly label: components["schemas"]["KeyLabel"];
+            /** @description Permissions the key holds; each operation lists the scopes it requires. */
+            readonly scopes: components["schemas"]["ScopeList"];
+            /**
+             * @description `ACTIVE`; `ROTATING` once a rotation replaced it, until `overlap_until`; `EXPIRED` past its deadline; or `REVOKED`.
+             * @enum {unknown}
+             */
+            readonly status: "ACTIVE" | "ROTATING" | "EXPIRED" | "REVOKED";
+            /** @description When the key was issued. */
+            readonly created_at: components["schemas"]["Timestamp"];
+            /** @description Null means no scheduled expiry. Revocation, overlap deadlines and current authority still apply. */
+            readonly expires_at: components["schemas"]["Timestamp"] | null;
+            /** @description When the key last authenticated a request, or null if never. */
+            readonly last_used_at: components["schemas"]["Timestamp"] | null;
+            /** @description When the key was revoked, or null. */
+            readonly revoked_at: components["schemas"]["Timestamp"] | null;
+            /** @description The key this one replaced in a rotation, or null for a newly created key. */
+            readonly rotated_from: components["schemas"]["Uuid"] | null;
+            /** @description While `ROTATING`, when this replaced key stops working; otherwise null. */
+            readonly overlap_until: components["schemas"]["Timestamp"] | null;
+        } & (unknown & unknown & unknown & unknown & unknown & unknown);
+        /** @description Opaque cursor for the next page, or null when has_more is false. */
+        readonly NextCursor: string | null;
+        readonly KeyList: {
+            /** @description Keys of the account, oldest first, revoked and expired ones included. */
+            readonly items: readonly components["schemas"]["KeyMetadata"][];
+            /** @description Send as `cursor` for the next page; null on the last page. */
+            readonly next_cursor: components["schemas"]["NextCursor"];
+            /** @description Whether another page follows. */
+            readonly has_more: boolean;
+        };
+        readonly PersonalKeyMetadata: components["schemas"]["KeyMetadata"] & {
+            /** @description The account the key acts for. */
+            readonly account?: {
+                /**
+                 * @description The account kind: `PARTICIPANT` for a personal account.
+                 * @constant
+                 */
+                readonly kind?: "PARTICIPANT";
+            };
+        };
+        readonly PersonalKeyList: components["schemas"]["KeyList"] & {
+            /** @description Keys of the account, oldest first. */
+            readonly items?: unknown;
+        };
+        /**
+         * @description Stable HTTP error code. Each code has one HTTP status and one retry value.
+         * @enum {string}
+         */
+        readonly ErrorCode: "INVALID_REQUEST" | "INVALID_QUERY" | "INVALID_CURSOR" | "INVALID_IDEMPOTENCY_KEY" | "ORIGIN_REQUIRED" | "SUBPROTOCOL_REQUIRED" | "UNSUPPORTED_BROWSE_CONTRACT" | "UNAUTHENTICATED" | "FORBIDDEN" | "ORIGIN_NOT_ALLOWED" | "ACCESS_REQUIRED" | "SIGN_IN_REQUIRED" | "NOT_FOUND" | "IDENTITY_NOT_FOUND" | "QUOTE_NOT_FOUND" | "INVITE_CODE_NOT_FOUND" | "IDEMPOTENCY_KEY_REUSED" | "STATE_CONFLICT" | "INVITE_CODE_EXHAUSTED" | "STALE_CURSOR" | "CURSOR_EXPIRED" | "CURSOR_RESET" | "RECURRING_DEFINITION_CONFLICT" | "EMBEDDED_WALLET_CONFLICT" | "SECRET_UNAVAILABLE" | "ROTATION_IN_PROGRESS" | "TELEMETRY_CONFLICT" | "RFQ_NOT_CANCELLABLE" | "RFQ_NOT_OPEN" | "RFQ_GENERATION_STALE" | "RFQ_GENERATION_IN_FLIGHT" | "QUOTE_EXPIRED" | "QUOTE_CANCELLED" | "QUOTE_REPLACED" | "QUOTE_SIGNER_CHANGED" | "QUOTE_CAPACITY_EXCEEDED" | "CORE_ACCOUNT_NOT_READY" | "CORE_ACCOUNT_ACTIVATION_REQUIRED" | "CORE_EXIT_ABANDONED" | "CORE_MOVE_IN_FLIGHT" | "ACCEPTANCE_IN_FLIGHT" | "USERNAME_TAKEN" | "USERNAME_ALREADY_SET" | "USERNAME_REQUIRED" | "INVALID_SIGNATURE" | "WALLET_CONTRACT_UNSUPPORTED" | "WRONG_AUTHORITY" | "KEY_LIMIT_REACHED" | "USERNAME_NOT_ALLOWED" | "FOLLOW_SELF" | "FOLLOW_LIMIT_REACHED" | "RATE_LIMITED" | "CONNECTION_LIMIT" | "RFQ_INTENT_LIMIT" | "QUOTE_EXPOSURE_LIMIT" | "DEPENDENCY_STALE" | "AUTHORIZATION_UNAVAILABLE" | "SOURCE_UNAVAILABLE" | "CONTRACT_UNAVAILABLE" | "MARKET_DATA_UNAVAILABLE" | "BROWSE_UNAVAILABLE" | "FINANCIAL_ACTIONS_DISABLED" | "CORE_EXIT_UNAVAILABLE" | "COLLATERAL_REDUCTION_UNAVAILABLE" | "SPONSORSHIP_UNAVAILABLE" | "CONTRACT_SIGNATURE_OVERLOADED" | "QUOTE_EXPOSURE_STALE" | "COMBO_AUTOMATIC_DISABLED" | "GAS_PRICE_ABOVE_CEILING" | "EMBEDDED_WALLET_UNAVAILABLE" | "CONNECTION_DRAIN";
+        readonly FieldViolation: {
+            /**
+             * @description REQUIRED: the input is missing. INVALID: it is present but malformed or out of range. UNEXPECTED: the input is not accepted here.
+             * @enum {string}
+             */
+            readonly code: "REQUIRED" | "INVALID" | "UNEXPECTED";
+            /** @description JSON pointer into the body, or into the query parameters as one flat object for requests without a body, for example /legs/0/stake or /limit. */
+            readonly field: string;
+        };
+        /**
+         * @description NEVER: stop. BACKOFF: resend the same request with the same Idempotency-Key after Retry-After. REFRESH: re-read state, then send a new request with a new Idempotency-Key.
+         * @enum {string}
+         */
+        readonly Retry: "NEVER" | "BACKOFF" | "REFRESH";
+        readonly ErrorDetail: {
+            /** @description Stable registered code; branch on this, not on message or status. */
+            readonly code: components["schemas"]["ErrorCode"];
+            /** @description Each invalid input by JSON pointer; empty when the error is not about a specific input. */
+            readonly field_violations: readonly components["schemas"]["FieldViolation"][];
+            /** @description Human-readable; may change without notice. */
+            readonly message: string;
+            /**
+             * Format: uuid
+             * @description UUIDv7 of this request, also returned in the X-Request-ID header. Quote it when reporting a problem.
+             */
+            readonly request_id: string;
+            /** @description What the caller should do next; fixed by the registry for each code. */
+            readonly retry: components["schemas"]["Retry"];
+        };
+        readonly Error: {
+            /** @description The one error this request failed with. */
+            readonly error: components["schemas"]["ErrorDetail"];
+        };
+        /**
+         * @description 0 means Forever (no expiry); 1–90 sets a finite lifetime in days. Omission defaults to 30.
+         * @default 30
+         */
+        readonly KeyExpiryDays: number;
+        readonly ContractSignature: string;
+        /** @description The account owner's personal_sign or ERC-1271 signature over the exact challenge message. For a maker the owner is its controller; for a personal account, its account wallet. */
+        readonly OwnerProof: {
+            /** @description The `challenge_id` of the challenge that was signed. */
+            readonly challenge_id: components["schemas"]["Uuid"];
+            /** @description The owner's signature over the challenge's `message`, exactly as returned. */
+            readonly signature: components["schemas"]["ContractSignature"];
+        };
+        /** @description The same shape for a personal account and a maker. proof is the owner's signature over the issue_key challenge for exactly this request without proof. */
+        readonly CreateKeyRequest: {
+            /** @description Your name for the key, 1 to 80 characters. */
+            readonly label: components["schemas"]["KeyLabel"];
+            /** @description Permissions the key holds; each must apply to the account, as the capabilities route lists. */
+            readonly scopes: components["schemas"]["ScopeList"];
+            /** @description Lifetime in days, 1 to 90, or 0 for no expiry; 30 when omitted. */
+            readonly expires_in_days?: components["schemas"]["KeyExpiryDays"];
+            /** @description The account owner's signature over the challenge for exactly this request without `proof`. */
+            readonly proof: components["schemas"]["OwnerProof"];
+        };
+        readonly IssuedKey: {
+            /** @description The new key's metadata. */
+            readonly key: components["schemas"]["KeyMetadata"] & {
+                /**
+                 * @description Always `ACTIVE` for a new key.
+                 * @constant
+                 */
+                readonly status?: "ACTIVE";
+                /** @description Always null for a new key. */
+                readonly last_used_at?: null;
+                /** @description Always null for a new key. */
+                readonly revoked_at?: null;
+                /** @description Always null for a new key. */
+                readonly overlap_until?: null;
+            };
+            /** @description The `ttk_` secret, shown only in this response; a retry of the same request answers `SECRET_UNAVAILABLE`, so store it now. */
+            readonly secret: string;
+        };
+        readonly PersonalIssuedKey: components["schemas"]["IssuedKey"] & {
+            /** @description The new key's metadata. */
+            readonly key?: components["schemas"]["PersonalKeyMetadata"];
+        };
+        readonly CreatedKey: components["schemas"]["IssuedKey"] & {
+            /** @description The new key's metadata. */
+            readonly key?: {
+                /** @description Always null for a created key. */
+                readonly rotated_from?: null;
+            };
+        };
+        readonly PersonalCreatedKey: components["schemas"]["PersonalIssuedKey"] & components["schemas"]["CreatedKey"];
+        /** @default 3600 */
+        readonly RotationOverlapSeconds: number;
+        /** @description Every rotation needs a fresh owner proof over exactly this request without proof. The replacement inherits the predecessor's account, label and scopes. */
+        readonly RotateKeyRequest: {
+            /** @description How long the old key keeps working after the rotation, 0 to 86400 seconds; 3600 when omitted. */
+            readonly overlap_seconds?: components["schemas"]["RotationOverlapSeconds"];
+            /** @description The replacement's lifetime in days, 1 to 90, or 0 for no expiry; 30 when omitted. */
+            readonly expires_in_days?: components["schemas"]["KeyExpiryDays"];
+            /** @description The account owner's signature over the challenge for exactly this request without `proof`. */
+            readonly proof: components["schemas"]["OwnerProof"];
+        };
+        readonly RotatedKey: components["schemas"]["IssuedKey"] & {
+            /** @description The replacement key's metadata. */
+            readonly key?: {
+                /** @description The rotated key, the `key_id` in the path. */
+                readonly rotated_from?: components["schemas"]["Uuid"];
+            };
+        };
+        readonly PersonalRotatedKey: components["schemas"]["PersonalIssuedKey"] & components["schemas"]["RotatedKey"];
+        /** @description The exact key request the account owner signs. Scopes must apply to the account. */
+        readonly UnsignedCreateKeyRequest: {
+            /** @description Your name for the key, 1 to 80 characters. */
+            readonly label: components["schemas"]["KeyLabel"];
+            /** @description Permissions the key holds; each must apply to the account, as the capabilities route lists. */
+            readonly scopes: components["schemas"]["ScopeList"];
+            /** @description Lifetime in days, 1 to 90, or 0 for no expiry; 30 when omitted. */
+            readonly expires_in_days?: components["schemas"]["KeyExpiryDays"];
+        };
+        /** @description The exact rotation request the account owner signs; the replacement inherits the old key's account, label and scopes. */
+        readonly UnsignedRotateKeyRequest: {
+            /** @description How long the old key keeps working after the rotation, 0 to 86400 seconds; 3600 when omitted. */
+            readonly overlap_seconds?: components["schemas"]["RotationOverlapSeconds"];
+            /** @description The replacement's lifetime in days, 1 to 90, or 0 for no expiry; 30 when omitted. */
+            readonly expires_in_days?: components["schemas"]["KeyExpiryDays"];
+        };
+        readonly KeyChallengeRequest: {
+            /**
+             * @description `CREATE` for a new key.
+             * @constant
+             */
+            readonly action: "CREATE";
+            /** @description The exact create request, without `proof`, that the owner signs. */
+            readonly request: components["schemas"]["UnsignedCreateKeyRequest"];
+        } | {
+            /**
+             * @description `ROTATE` to replace a key.
+             * @constant
+             */
+            readonly action: "ROTATE";
+            /** @description The key to rotate. */
+            readonly key_id: components["schemas"]["Uuid"];
+            /** @description The exact rotation request, without `proof`, that the owner signs. */
+            readonly request: components["schemas"]["UnsignedRotateKeyRequest"];
+        };
+        /** @description An EIP-4361 (SIWE) message with purpose=issue_key. Its resources bind the environment, vault, account, owner version (makers), action, key (rotation) and the request digest. */
+        readonly KeyChallenge: {
+            /** @description Send back as `proof.challenge_id`. */
+            readonly challenge_id: components["schemas"]["Uuid"];
+            /** @description The address that must sign: the account wallet for a personal account, the controller for a maker. */
+            readonly owner: components["schemas"]["LowercaseNonZeroAddress"];
+            /** @description The EIP-4361 message to sign with `personal_sign`, exactly as returned; check its URI, account, action and key before signing. */
+            readonly message: string;
+            /** @description When the challenge stops being accepted, 5 minutes after issue. */
+            readonly expires_at: components["schemas"]["Timestamp"];
+        };
+        readonly MakerKeyMetadata: components["schemas"]["KeyMetadata"] & {
+            /** @description The account the key acts for. */
+            readonly account?: {
+                /**
+                 * @description The account kind: `MAKER` for a maker vault.
+                 * @constant
+                 */
+                readonly kind?: "MAKER";
+            };
+        };
+        readonly MakerKeyList: components["schemas"]["KeyList"] & {
+            /** @description Keys of the account, oldest first. */
+            readonly items?: unknown;
+        };
+        readonly MakerIssuedKey: components["schemas"]["IssuedKey"] & {
+            /** @description The new key's metadata. */
+            readonly key?: components["schemas"]["MakerKeyMetadata"];
+        };
+        readonly MakerCreatedKey: components["schemas"]["MakerIssuedKey"] & components["schemas"]["CreatedKey"];
+        readonly MakerRotatedKey: components["schemas"]["MakerIssuedKey"] & components["schemas"]["RotatedKey"];
+        readonly OperatorKeyMetadata: components["schemas"]["KeyMetadata"] & {
+            readonly account?: {
+                /** @constant */
+                readonly kind?: "OPERATOR";
+            };
+        };
+        readonly OperatorKeyList: components["schemas"]["KeyList"] & {
+            readonly items?: unknown;
+        };
+        /** @description Issuance disabled: no reviewed operator diagnostics route exists. A future contract must introduce an explicit operator scope allowlist before issuance. */
+        readonly OperatorCreateKeyRequest: unknown;
+        readonly OperatorIssuedKey: components["schemas"]["IssuedKey"] & {
+            readonly key?: components["schemas"]["OperatorKeyMetadata"];
+        };
+        readonly OperatorCreatedKey: components["schemas"]["OperatorIssuedKey"] & components["schemas"]["CreatedKey"];
+        readonly OperatorRotatedKey: components["schemas"]["OperatorIssuedKey"] & components["schemas"]["RotatedKey"];
+        /** @description Advisory, no-store snapshot of the scopes a new key for this account may hold and the owner whose signature issues it. Scope dependencies still apply. Issuance revalidates current authority and consumes the owner's proof; discovery is never an authorization lease. */
+        readonly KeyCapabilities: {
+            /** @description The account a new key would act for. */
+            readonly account: components["schemas"]["Account"];
+            /**
+             * @description The deployment a new key would work in.
+             * @enum {unknown}
+             */
+            readonly environment: "development" | "staging" | "production";
+            /** @description The address that signs issuance: the account wallet for a personal account, the controller for a maker. */
+            readonly owner: components["schemas"]["LowercaseNonZeroAddress"];
+            /** @description Scopes a new key for this account may hold now. */
+            readonly scopes: readonly components["schemas"]["Scope"][];
+            /** @description When this snapshot was taken. */
+            readonly as_of: components["schemas"]["Timestamp"];
+        };
+    };
+    responses: {
+        /** @description Lifecycle error; `code` is one of the operation's x-totalis-errors */
+        readonly Error: {
+            headers: {
+                readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["Error"];
+            };
+        };
+        /** @description Key-management quota exhausted; resend after Retry-After */
+        readonly RateLimited: {
+            headers: {
+                readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                readonly "Retry-After": components["headers"]["RetryAfter"];
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["Error"];
+            };
+        };
+        /** @description Credential authority unavailable or its chain projection stale; resend after Retry-After */
+        readonly Unavailable: {
+            headers: {
+                readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                readonly "Retry-After": components["headers"]["RetryAfter"];
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["Error"];
+            };
+        };
+    };
+    parameters: {
+        /**
+         * @description Maximum items per page, 1 to 200, default 50. A page may hold fewer, even none, while has_more is true.
+         * @example 50
+         */
+        readonly Limit: components["schemas"]["PageLimit"];
+        /**
+         * @description Omit for the first page; then send the previous response's next_cursor unchanged.
+         * @example eyJ2IjoxLCJzIjoiMTIzNDUifQ
+         */
+        readonly Cursor: components["schemas"]["PageCursor"];
+        /**
+         * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+         * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+         */
+        readonly IdempotencyKey: string;
+        /**
+         * @description ID of a key on this account, from the key list or the create response.
+         * @example 01995000-0000-7000-8000-000000000001
+         */
+        readonly KeyId: components["schemas"]["Uuid"];
+        /**
+         * @description On-chain maker ID, as a decimal string. The credential must be authorized for this maker.
+         * @example 3
+         */
+        readonly MakerId: components["schemas"]["NonZeroUInt64String"];
+    };
+    requestBodies: never;
+    headers: {
+        /** @description Never cache API-key management responses. */
+        readonly CacheControlNoStore: "no-store";
+        /** @description Seconds to wait before resending the same request. */
+        readonly RetryAfter: number;
+    };
+    pathItems: never;
+};
+export type $defs = Record<string, never>;
+export interface operations {
+    readonly listPersonalApiKeys: {
+        readonly parameters: {
+            readonly query?: {
+                /**
+                 * @description Maximum items per page, 1 to 200, default 50. A page may hold fewer, even none, while has_more is true.
+                 * @example 50
+                 */
+                readonly limit?: components["parameters"]["Limit"];
+                /**
+                 * @description Omit for the first page; then send the previous response's next_cursor unchanged.
+                 * @example eyJ2IjoxLCJzIjoiMTIzNDUifQ
+                 */
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description One page of key metadata, never a secret. */
+            readonly 200: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["PersonalKeyList"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly createPersonalApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["CreateKeyRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description The new key and its secret, shown only in this response. */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["PersonalCreatedKey"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a `proof` that is not the owner's signature of an unexpired, unused challenge for exactly this request. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 422: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly revokePersonalApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                /**
+                 * @description ID of a key on this account, from the key list or the create response.
+                 * @example 01995000-0000-7000-8000-000000000001
+                 */
+                readonly key_id: components["parameters"]["KeyId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Revoked or already revoked */
+            readonly 204: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly rotatePersonalApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path: {
+                /**
+                 * @description ID of a key on this account, from the key list or the create response.
+                 * @example 01995000-0000-7000-8000-000000000001
+                 */
+                readonly key_id: components["parameters"]["KeyId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["RotateKeyRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description The replacement key and its secret, shown only in this response. */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["PersonalRotatedKey"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a `proof` that is not the owner's signature of an unexpired, unused challenge for exactly this request. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 422: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly createPersonalApiKeyChallenge: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["KeyChallengeRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description Five-minute, one-use SIWE challenge (purpose=issue_key) the account owner signs for the exact key request */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["KeyChallenge"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly listMakerApiKeys: {
+        readonly parameters: {
+            readonly query?: {
+                /**
+                 * @description Maximum items per page, 1 to 200, default 50. A page may hold fewer, even none, while has_more is true.
+                 * @example 50
+                 */
+                readonly limit?: components["parameters"]["Limit"];
+                /**
+                 * @description Omit for the first page; then send the previous response's next_cursor unchanged.
+                 * @example eyJ2IjoxLCJzIjoiMTIzNDUifQ
+                 */
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path: {
+                /**
+                 * @description On-chain maker ID, as a decimal string. The credential must be authorized for this maker.
+                 * @example 3
+                 */
+                readonly maker_id: components["parameters"]["MakerId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description One page of key metadata, never a secret. */
+            readonly 200: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["MakerKeyList"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a session whose wallet is not the maker's current controller. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly createMakerApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path: {
+                /**
+                 * @description On-chain maker ID, as a decimal string. The credential must be authorized for this maker.
+                 * @example 3
+                 */
+                readonly maker_id: components["parameters"]["MakerId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["CreateKeyRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description The new key and its secret, shown only in this response. */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["MakerCreatedKey"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a session whose wallet is not the maker's current controller, or a `proof` that is not the owner's signature of an unexpired, unused challenge for exactly this request. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 422: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly revokeMakerApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                /**
+                 * @description On-chain maker ID, as a decimal string. The credential must be authorized for this maker.
+                 * @example 3
+                 */
+                readonly maker_id: components["parameters"]["MakerId"];
+                /**
+                 * @description ID of a key on this account, from the key list or the create response.
+                 * @example 01995000-0000-7000-8000-000000000001
+                 */
+                readonly key_id: components["parameters"]["KeyId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Revoked or already revoked */
+            readonly 204: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a session whose wallet is not the maker's current controller. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly rotateMakerApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path: {
+                /**
+                 * @description On-chain maker ID, as a decimal string. The credential must be authorized for this maker.
+                 * @example 3
+                 */
+                readonly maker_id: components["parameters"]["MakerId"];
+                /**
+                 * @description ID of a key on this account, from the key list or the create response.
+                 * @example 01995000-0000-7000-8000-000000000001
+                 */
+                readonly key_id: components["parameters"]["KeyId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["RotateKeyRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description The replacement key and its secret, shown only in this response. */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["MakerRotatedKey"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a session whose wallet is not the maker's current controller, or a `proof` that is not the owner's signature of an unexpired, unused challenge for exactly this request. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 422: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly listOperatorApiKeys: {
+        readonly parameters: {
+            readonly query?: {
+                /**
+                 * @description Maximum items per page, 1 to 200, default 50. A page may hold fewer, even none, while has_more is true.
+                 * @example 50
+                 */
+                readonly limit?: components["parameters"]["Limit"];
+                /**
+                 * @description Omit for the first page; then send the previous response's next_cursor unchanged.
+                 * @example eyJ2IjoxLCJzIjoiMTIzNDUifQ
+                 */
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Metadata only */
+            readonly 200: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["OperatorKeyList"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            readonly 401: components["responses"]["Error"];
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly createOperatorApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["OperatorCreateKeyRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description Secret returned once; Cache-Control: no-store */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["OperatorCreatedKey"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            readonly 401: components["responses"]["Error"];
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 422: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly revokeOperatorApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                /**
+                 * @description ID of a key on this account, from the key list or the create response.
+                 * @example 01995000-0000-7000-8000-000000000001
+                 */
+                readonly key_id: components["parameters"]["KeyId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Revoked or already revoked */
+            readonly 204: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 400: components["responses"]["Error"];
+            readonly 401: components["responses"]["Error"];
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly rotateOperatorApiKey: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path: {
+                /**
+                 * @description ID of a key on this account, from the key list or the create response.
+                 * @example 01995000-0000-7000-8000-000000000001
+                 */
+                readonly key_id: components["parameters"]["KeyId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["RotateKeyRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description Secret returned once; Cache-Control: no-store */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["OperatorRotatedKey"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            readonly 401: components["responses"]["Error"];
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 422: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly createMakerApiKeyChallenge: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                /**
+                 * @description Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns `409 IDEMPOTENCY_KEY_REUSED`.
+                 * @example 0198a6f6-82a5-7abc-9f2a-4f0fb437493e
+                 */
+                readonly "Idempotency-Key": components["parameters"]["IdempotencyKey"];
+            };
+            readonly path: {
+                /**
+                 * @description On-chain maker ID, as a decimal string. The credential must be authorized for this maker.
+                 * @example 3
+                 */
+                readonly maker_id: components["parameters"]["MakerId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["KeyChallengeRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description Five-minute, one-use SIWE challenge (purpose=issue_key) the account owner signs for the exact key request */
+            readonly 201: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["KeyChallenge"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a session whose wallet is not the maker's current controller. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 409: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly getPersonalApiKeyCapabilities: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Current key capability snapshot */
+            readonly 200: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["KeyCapabilities"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+    readonly getMakerApiKeyCapabilities: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                /**
+                 * @description On-chain maker ID, as a decimal string. The credential must be authorized for this maker.
+                 * @example 3
+                 */
+                readonly maker_id: components["parameters"]["MakerId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Current key capability snapshot */
+            readonly 200: {
+                headers: {
+                    readonly "Cache-Control": components["headers"]["CacheControlNoStore"];
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["KeyCapabilities"];
+                };
+            };
+            readonly 400: components["responses"]["Error"];
+            /** @description No session, or an API key (`ttk_`), which never manages keys. */
+            readonly 401: components["responses"]["Error"];
+            /** @description A missing, repeated or unregistered `Origin`, or a session whose wallet is not the maker's current controller. */
+            readonly 403: components["responses"]["Error"];
+            readonly 404: components["responses"]["Error"];
+            readonly 429: components["responses"]["RateLimited"];
+            readonly 503: components["responses"]["Unavailable"];
+        };
+    };
+}