@witnium-tech/witniumchain 0.10.0 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/FRONTEND-INTEGRATION.md +34 -8
- package/README.md +15 -5
- package/dist/index.d.mts +1827 -356
- package/dist/index.d.ts +1827 -356
- package/dist/index.js +72 -120
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +73 -120
- package/dist/index.mjs.map +1 -1
- package/package.json +5 -5
package/dist/index.d.mts
CHANGED
|
@@ -73,8 +73,8 @@ interface paths$1 {
|
|
|
73
73
|
};
|
|
74
74
|
};
|
|
75
75
|
responses: {
|
|
76
|
-
/** @description
|
|
77
|
-
|
|
76
|
+
/** @description Created */
|
|
77
|
+
201: {
|
|
78
78
|
headers: {
|
|
79
79
|
[name: string]: unknown;
|
|
80
80
|
};
|
|
@@ -242,6 +242,76 @@ interface paths$1 {
|
|
|
242
242
|
patch?: never;
|
|
243
243
|
trace?: never;
|
|
244
244
|
};
|
|
245
|
+
"/v1/auth/access-token": {
|
|
246
|
+
parameters: {
|
|
247
|
+
query?: never;
|
|
248
|
+
header?: never;
|
|
249
|
+
path?: never;
|
|
250
|
+
cookie?: never;
|
|
251
|
+
};
|
|
252
|
+
get?: never;
|
|
253
|
+
put?: never;
|
|
254
|
+
/**
|
|
255
|
+
* Exchange the session cookie for a bearer access token
|
|
256
|
+
* @description A logged-in (wac_session) user mints a short-lived OAuth-equivalent access token to call the bearer-only operational API (delegated keys, witness writes, chain reads). Keeps those endpoints off the ambient cookie (no CSRF surface). Same claim shape as an OAuth user token.
|
|
257
|
+
*/
|
|
258
|
+
post: {
|
|
259
|
+
parameters: {
|
|
260
|
+
query?: never;
|
|
261
|
+
header?: never;
|
|
262
|
+
path?: never;
|
|
263
|
+
cookie?: never;
|
|
264
|
+
};
|
|
265
|
+
requestBody?: never;
|
|
266
|
+
responses: {
|
|
267
|
+
/** @description Created */
|
|
268
|
+
201: {
|
|
269
|
+
headers: {
|
|
270
|
+
[name: string]: unknown;
|
|
271
|
+
};
|
|
272
|
+
content: {
|
|
273
|
+
"application/json": {
|
|
274
|
+
accessToken: string;
|
|
275
|
+
/** @enum {string} */
|
|
276
|
+
tokenType: "Bearer";
|
|
277
|
+
expiresIn: number;
|
|
278
|
+
expiresAt: string;
|
|
279
|
+
};
|
|
280
|
+
};
|
|
281
|
+
};
|
|
282
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
283
|
+
401: {
|
|
284
|
+
headers: {
|
|
285
|
+
[name: string]: unknown;
|
|
286
|
+
};
|
|
287
|
+
content: {
|
|
288
|
+
"application/json": {
|
|
289
|
+
/**
|
|
290
|
+
* @description HTTP status code
|
|
291
|
+
* @example 400
|
|
292
|
+
*/
|
|
293
|
+
statusCode?: number;
|
|
294
|
+
/**
|
|
295
|
+
* @description Short error label
|
|
296
|
+
* @example Bad Request
|
|
297
|
+
*/
|
|
298
|
+
error?: string;
|
|
299
|
+
/**
|
|
300
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
301
|
+
* @example Validation failed
|
|
302
|
+
*/
|
|
303
|
+
message: string | string[];
|
|
304
|
+
};
|
|
305
|
+
};
|
|
306
|
+
};
|
|
307
|
+
};
|
|
308
|
+
};
|
|
309
|
+
delete?: never;
|
|
310
|
+
options?: never;
|
|
311
|
+
head?: never;
|
|
312
|
+
patch?: never;
|
|
313
|
+
trace?: never;
|
|
314
|
+
};
|
|
245
315
|
"/v1/auth/login": {
|
|
246
316
|
parameters: {
|
|
247
317
|
query?: never;
|
|
@@ -253,7 +323,7 @@ interface paths$1 {
|
|
|
253
323
|
put?: never;
|
|
254
324
|
/**
|
|
255
325
|
* Log in with email + password
|
|
256
|
-
* @description
|
|
326
|
+
* @description Without confirmed TOTP: sets a `wac_session` cookie (httpOnly, secure, 30-day TTL) and returns `status: "authenticated"`. With confirmed TOTP: NO session is issued. The response is `status: "mfa_required"` and sets a `wac_mfa` challenge cookie (httpOnly, secure, Path=/v1/auth/login/mfa, 5 minutes); complete the login with `POST /v1/auth/login/mfa`. No token is included in the body.
|
|
257
327
|
*/
|
|
258
328
|
post: {
|
|
259
329
|
parameters: {
|
|
@@ -277,14 +347,163 @@ interface paths$1 {
|
|
|
277
347
|
};
|
|
278
348
|
};
|
|
279
349
|
responses: {
|
|
280
|
-
/** @description
|
|
281
|
-
|
|
350
|
+
/** @description Created */
|
|
351
|
+
201: {
|
|
352
|
+
headers: {
|
|
353
|
+
[name: string]: unknown;
|
|
354
|
+
};
|
|
355
|
+
content: {
|
|
356
|
+
"application/json": {
|
|
357
|
+
/**
|
|
358
|
+
* @description `authenticated`: the `wac_session` cookie is set. `mfa_required`: no session yet; send the second factor to `/v1/auth/login/mfa`.
|
|
359
|
+
* @enum {string}
|
|
360
|
+
*/
|
|
361
|
+
status: "authenticated" | "mfa_required";
|
|
362
|
+
message: string;
|
|
363
|
+
/** @description Present when `status` is `mfa_required`. */
|
|
364
|
+
methods?: ("totp" | "recovery_code")[];
|
|
365
|
+
/** @description Challenge lifetime; present when `status` is `mfa_required`. */
|
|
366
|
+
expiresInSeconds?: number;
|
|
367
|
+
};
|
|
368
|
+
};
|
|
369
|
+
};
|
|
370
|
+
/** @description Bad Request — validation failed */
|
|
371
|
+
400: {
|
|
372
|
+
headers: {
|
|
373
|
+
[name: string]: unknown;
|
|
374
|
+
};
|
|
375
|
+
content: {
|
|
376
|
+
"application/json": {
|
|
377
|
+
/**
|
|
378
|
+
* @description HTTP status code
|
|
379
|
+
* @example 400
|
|
380
|
+
*/
|
|
381
|
+
statusCode?: number;
|
|
382
|
+
/**
|
|
383
|
+
* @description Short error label
|
|
384
|
+
* @example Bad Request
|
|
385
|
+
*/
|
|
386
|
+
error?: string;
|
|
387
|
+
/**
|
|
388
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
389
|
+
* @example Validation failed
|
|
390
|
+
*/
|
|
391
|
+
message: string | string[];
|
|
392
|
+
};
|
|
393
|
+
};
|
|
394
|
+
};
|
|
395
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
396
|
+
401: {
|
|
397
|
+
headers: {
|
|
398
|
+
[name: string]: unknown;
|
|
399
|
+
};
|
|
400
|
+
content: {
|
|
401
|
+
"application/json": {
|
|
402
|
+
/**
|
|
403
|
+
* @description HTTP status code
|
|
404
|
+
* @example 400
|
|
405
|
+
*/
|
|
406
|
+
statusCode?: number;
|
|
407
|
+
/**
|
|
408
|
+
* @description Short error label
|
|
409
|
+
* @example Bad Request
|
|
410
|
+
*/
|
|
411
|
+
error?: string;
|
|
412
|
+
/**
|
|
413
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
414
|
+
* @example Validation failed
|
|
415
|
+
*/
|
|
416
|
+
message: string | string[];
|
|
417
|
+
};
|
|
418
|
+
};
|
|
419
|
+
};
|
|
420
|
+
/** @description Too Many Requests */
|
|
421
|
+
429: {
|
|
422
|
+
headers: {
|
|
423
|
+
[name: string]: unknown;
|
|
424
|
+
};
|
|
425
|
+
content: {
|
|
426
|
+
"application/json": {
|
|
427
|
+
/**
|
|
428
|
+
* @description HTTP status code
|
|
429
|
+
* @example 400
|
|
430
|
+
*/
|
|
431
|
+
statusCode?: number;
|
|
432
|
+
/**
|
|
433
|
+
* @description Short error label
|
|
434
|
+
* @example Bad Request
|
|
435
|
+
*/
|
|
436
|
+
error?: string;
|
|
437
|
+
/**
|
|
438
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
439
|
+
* @example Validation failed
|
|
440
|
+
*/
|
|
441
|
+
message: string | string[];
|
|
442
|
+
};
|
|
443
|
+
};
|
|
444
|
+
};
|
|
445
|
+
};
|
|
446
|
+
};
|
|
447
|
+
delete?: never;
|
|
448
|
+
options?: never;
|
|
449
|
+
head?: never;
|
|
450
|
+
patch?: never;
|
|
451
|
+
trace?: never;
|
|
452
|
+
};
|
|
453
|
+
"/v1/auth/login/mfa": {
|
|
454
|
+
parameters: {
|
|
455
|
+
query?: never;
|
|
456
|
+
header?: never;
|
|
457
|
+
path?: never;
|
|
458
|
+
cookie?: never;
|
|
459
|
+
};
|
|
460
|
+
get?: never;
|
|
461
|
+
put?: never;
|
|
462
|
+
/**
|
|
463
|
+
* Complete an MFA login with a TOTP or recovery code
|
|
464
|
+
* @description Second step after `/v1/auth/login` answered `mfa_required`. Requires the `wac_mfa` cookie that response set. On success sets `wac_session`, clears `wac_mfa` and returns `status: "authenticated"`. 401 with error `mfa_code_invalid`: wrong or already-used code, retry. 401 with error `mfa_challenge_invalid`: the challenge expired (5 min), was used, or saw 5 wrong codes; start again at `/v1/auth/login`. 429 `mfa_rate_limited`: the per-user attempt budget (10 per 15 min) is exhausted.
|
|
465
|
+
*/
|
|
466
|
+
post: {
|
|
467
|
+
parameters: {
|
|
468
|
+
query?: never;
|
|
469
|
+
header?: never;
|
|
470
|
+
path?: never;
|
|
471
|
+
cookie?: never;
|
|
472
|
+
};
|
|
473
|
+
requestBody?: {
|
|
474
|
+
content: {
|
|
475
|
+
"application/json": {
|
|
476
|
+
/**
|
|
477
|
+
* @description Current 6-digit TOTP code. Each code is accepted once.
|
|
478
|
+
* @example 123456
|
|
479
|
+
*/
|
|
480
|
+
code?: string;
|
|
481
|
+
/**
|
|
482
|
+
* @description An unused recovery code (consumed by this request).
|
|
483
|
+
* @example ABCD-EFGH
|
|
484
|
+
*/
|
|
485
|
+
recoveryCode?: string;
|
|
486
|
+
};
|
|
487
|
+
};
|
|
488
|
+
};
|
|
489
|
+
responses: {
|
|
490
|
+
/** @description Created */
|
|
491
|
+
201: {
|
|
282
492
|
headers: {
|
|
283
493
|
[name: string]: unknown;
|
|
284
494
|
};
|
|
285
495
|
content: {
|
|
286
496
|
"application/json": {
|
|
497
|
+
/**
|
|
498
|
+
* @description `authenticated`: the `wac_session` cookie is set. `mfa_required`: no session yet; send the second factor to `/v1/auth/login/mfa`.
|
|
499
|
+
* @enum {string}
|
|
500
|
+
*/
|
|
501
|
+
status: "authenticated" | "mfa_required";
|
|
287
502
|
message: string;
|
|
503
|
+
/** @description Present when `status` is `mfa_required`. */
|
|
504
|
+
methods?: ("totp" | "recovery_code")[];
|
|
505
|
+
/** @description Challenge lifetime; present when `status` is `mfa_required`. */
|
|
506
|
+
expiresInSeconds?: number;
|
|
288
507
|
};
|
|
289
508
|
};
|
|
290
509
|
};
|
|
@@ -382,7 +601,7 @@ interface paths$1 {
|
|
|
382
601
|
put?: never;
|
|
383
602
|
/**
|
|
384
603
|
* Clear the current session
|
|
385
|
-
* @description Revokes the session bound to the `wac_session` cookie (if present) and clears the cookie. Idempotent — works even with no active session.
|
|
604
|
+
* @description Revokes the session bound to the `wac_session` cookie (if present) and clears the cookie; access tokens minted from that session via `POST /v1/auth/access-token` stop working at once. Idempotent — works even with no active session.
|
|
386
605
|
*/
|
|
387
606
|
post: {
|
|
388
607
|
parameters: {
|
|
@@ -393,8 +612,8 @@ interface paths$1 {
|
|
|
393
612
|
};
|
|
394
613
|
requestBody?: never;
|
|
395
614
|
responses: {
|
|
396
|
-
/** @description
|
|
397
|
-
|
|
615
|
+
/** @description Created */
|
|
616
|
+
201: {
|
|
398
617
|
headers: {
|
|
399
618
|
[name: string]: unknown;
|
|
400
619
|
};
|
|
@@ -445,8 +664,8 @@ interface paths$1 {
|
|
|
445
664
|
};
|
|
446
665
|
};
|
|
447
666
|
responses: {
|
|
448
|
-
/** @description
|
|
449
|
-
|
|
667
|
+
/** @description Created */
|
|
668
|
+
201: {
|
|
450
669
|
headers: {
|
|
451
670
|
[name: string]: unknown;
|
|
452
671
|
};
|
|
@@ -525,7 +744,7 @@ interface paths$1 {
|
|
|
525
744
|
put?: never;
|
|
526
745
|
/**
|
|
527
746
|
* Apply a password reset
|
|
528
|
-
* @description Exchanges a reset token for a new password. The token from the email is single-use and time-limited.
|
|
747
|
+
* @description Exchanges a reset token for a new password. The token from the email is single-use and time-limited. Also signs the user out everywhere: every session, every token minted from one, and every connected OAuth app (grants revoked, security epoch bumped).
|
|
529
748
|
*/
|
|
530
749
|
post: {
|
|
531
750
|
parameters: {
|
|
@@ -545,8 +764,8 @@ interface paths$1 {
|
|
|
545
764
|
};
|
|
546
765
|
};
|
|
547
766
|
responses: {
|
|
548
|
-
/** @description
|
|
549
|
-
|
|
767
|
+
/** @description Created */
|
|
768
|
+
201: {
|
|
550
769
|
headers: {
|
|
551
770
|
[name: string]: unknown;
|
|
552
771
|
};
|
|
@@ -638,7 +857,7 @@ interface paths$1 {
|
|
|
638
857
|
content: {
|
|
639
858
|
"application/json": {
|
|
640
859
|
/**
|
|
641
|
-
* @description Stripe Price ID. Drives the line item on the Checkout session — the Price's
|
|
860
|
+
* @description Stripe Price ID. Drives the line item on the Checkout session — the Price's Product must carry `credits` (and, for subscriptions, `plan_slug`) metadata for credits/plan to apply via the webhook.
|
|
642
861
|
* @example price_1ABC...
|
|
643
862
|
*/
|
|
644
863
|
priceId: string;
|
|
@@ -647,12 +866,22 @@ interface paths$1 {
|
|
|
647
866
|
* @enum {string}
|
|
648
867
|
*/
|
|
649
868
|
mode: "payment" | "subscription";
|
|
869
|
+
/**
|
|
870
|
+
* Format: uri
|
|
871
|
+
* @description Override the post-checkout success redirect.
|
|
872
|
+
*/
|
|
873
|
+
successUrl?: string;
|
|
874
|
+
/**
|
|
875
|
+
* Format: uri
|
|
876
|
+
* @description Override the checkout-cancelled redirect.
|
|
877
|
+
*/
|
|
878
|
+
cancelUrl?: string;
|
|
650
879
|
};
|
|
651
880
|
};
|
|
652
881
|
};
|
|
653
882
|
responses: {
|
|
654
|
-
/** @description
|
|
655
|
-
|
|
883
|
+
/** @description Created */
|
|
884
|
+
201: {
|
|
656
885
|
headers: {
|
|
657
886
|
[name: string]: unknown;
|
|
658
887
|
};
|
|
@@ -856,9 +1085,11 @@ interface paths$1 {
|
|
|
856
1085
|
/**
|
|
857
1086
|
* Stripe webhook receiver
|
|
858
1087
|
* @description Source of truth for credit grants. Verifies the `stripe-signature` header against `STRIPE_WEBHOOK_SECRET` over the raw request body, then dispatches on event type:
|
|
859
|
-
* - `checkout.session.completed`
|
|
860
|
-
* - `invoice.paid` → grant subscription monthly credits
|
|
861
|
-
* - `customer.subscription.
|
|
1088
|
+
* - `checkout.session.completed` (payment mode only) → grant pack `credits`.
|
|
1089
|
+
* - `invoice.paid` → grant subscription monthly `credits`.
|
|
1090
|
+
* - `customer.subscription.created`/`.updated` → set org `plan`, `current_period_end`, `subscription_status`.
|
|
1091
|
+
* - `customer.subscription.deleted` → revert to free plan + resume free-tier.
|
|
1092
|
+
* - `invoice.payment_failed` → mark `past_due` (grace).
|
|
862
1093
|
* Idempotent via the `stripe_events` table keyed on `event.id`. Body is the raw Stripe event (consumed pre-JSON-parse), not the documented schema.
|
|
863
1094
|
*/
|
|
864
1095
|
post: {
|
|
@@ -870,8 +1101,8 @@ interface paths$1 {
|
|
|
870
1101
|
};
|
|
871
1102
|
requestBody?: never;
|
|
872
1103
|
responses: {
|
|
873
|
-
/** @description
|
|
874
|
-
|
|
1104
|
+
/** @description Created */
|
|
1105
|
+
201: {
|
|
875
1106
|
headers: {
|
|
876
1107
|
[name: string]: unknown;
|
|
877
1108
|
};
|
|
@@ -926,7 +1157,7 @@ interface paths$1 {
|
|
|
926
1157
|
put?: never;
|
|
927
1158
|
/**
|
|
928
1159
|
* Create an organisation with client-generated keys
|
|
929
|
-
* @description Phase RBAC Thread D — explicit org creation. The caller generates the owner key and the initial signing key client-side; Witnium never holds the private bytes. The response includes the freshly-deployed contract address and
|
|
1160
|
+
* @description Phase RBAC Thread D — explicit org creation. The caller generates the owner key and the initial signing key client-side; Witnium never holds the private bytes. The response includes the freshly-deployed contract address. The email-verify link is sent to adminEmail and is never returned. If that email cannot be sent, nothing is created and the route returns 502; retry the request.
|
|
930
1161
|
*/
|
|
931
1162
|
post: {
|
|
932
1163
|
parameters: {
|
|
@@ -964,8 +1195,8 @@ interface paths$1 {
|
|
|
964
1195
|
};
|
|
965
1196
|
};
|
|
966
1197
|
responses: {
|
|
967
|
-
/** @description
|
|
968
|
-
|
|
1198
|
+
/** @description Created */
|
|
1199
|
+
201: {
|
|
969
1200
|
headers: {
|
|
970
1201
|
[name: string]: unknown;
|
|
971
1202
|
};
|
|
@@ -985,8 +1216,6 @@ interface paths$1 {
|
|
|
985
1216
|
contractAddress: string;
|
|
986
1217
|
/** @description Semantic on-chain Solidity version (e.g. "5.0.0"). */
|
|
987
1218
|
contractVersion: string;
|
|
988
|
-
/** @description Email-verify token. Already sent to adminEmail; echoed here for flows that prefer to surface a "click this link" in their own UI. */
|
|
989
|
-
emailVerifyToken: string;
|
|
990
1219
|
};
|
|
991
1220
|
};
|
|
992
1221
|
};
|
|
@@ -1040,53 +1269,103 @@ interface paths$1 {
|
|
|
1040
1269
|
};
|
|
1041
1270
|
};
|
|
1042
1271
|
};
|
|
1043
|
-
|
|
1044
|
-
|
|
1045
|
-
delete?: never;
|
|
1046
|
-
options?: never;
|
|
1047
|
-
head?: never;
|
|
1048
|
-
patch?: never;
|
|
1049
|
-
trace?: never;
|
|
1050
|
-
};
|
|
1051
|
-
"/v1/orgs/me": {
|
|
1052
|
-
parameters: {
|
|
1053
|
-
query?: never;
|
|
1054
|
-
header?: never;
|
|
1055
|
-
path?: never;
|
|
1056
|
-
cookie?: never;
|
|
1057
|
-
};
|
|
1058
|
-
/**
|
|
1059
|
-
* Read the calling organisation's public profile
|
|
1060
|
-
* @description Returns the org resolved from the OrgApiKey. Safe to expose in customer admin UIs — no secrets are included.
|
|
1061
|
-
*/
|
|
1062
|
-
get: {
|
|
1063
|
-
parameters: {
|
|
1064
|
-
query?: never;
|
|
1065
|
-
header?: never;
|
|
1066
|
-
path?: never;
|
|
1067
|
-
cookie?: never;
|
|
1068
|
-
};
|
|
1069
|
-
requestBody?: never;
|
|
1070
|
-
responses: {
|
|
1071
|
-
/** @description Success */
|
|
1072
|
-
200: {
|
|
1272
|
+
/** @description Too Many Requests */
|
|
1273
|
+
429: {
|
|
1073
1274
|
headers: {
|
|
1074
1275
|
[name: string]: unknown;
|
|
1075
1276
|
};
|
|
1076
1277
|
content: {
|
|
1077
1278
|
"application/json": {
|
|
1078
1279
|
/**
|
|
1079
|
-
* @description
|
|
1080
|
-
* @example
|
|
1280
|
+
* @description HTTP status code
|
|
1281
|
+
* @example 400
|
|
1081
1282
|
*/
|
|
1082
|
-
|
|
1083
|
-
name: string;
|
|
1283
|
+
statusCode?: number;
|
|
1084
1284
|
/**
|
|
1085
|
-
*
|
|
1086
|
-
* @
|
|
1087
|
-
* @example user@example.com
|
|
1285
|
+
* @description Short error label
|
|
1286
|
+
* @example Bad Request
|
|
1088
1287
|
*/
|
|
1089
|
-
|
|
1288
|
+
error?: string;
|
|
1289
|
+
/**
|
|
1290
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1291
|
+
* @example Validation failed
|
|
1292
|
+
*/
|
|
1293
|
+
message: string | string[];
|
|
1294
|
+
};
|
|
1295
|
+
};
|
|
1296
|
+
};
|
|
1297
|
+
/** @description Bad Gateway */
|
|
1298
|
+
502: {
|
|
1299
|
+
headers: {
|
|
1300
|
+
[name: string]: unknown;
|
|
1301
|
+
};
|
|
1302
|
+
content: {
|
|
1303
|
+
"application/json": {
|
|
1304
|
+
/**
|
|
1305
|
+
* @description HTTP status code
|
|
1306
|
+
* @example 400
|
|
1307
|
+
*/
|
|
1308
|
+
statusCode?: number;
|
|
1309
|
+
/**
|
|
1310
|
+
* @description Short error label
|
|
1311
|
+
* @example Bad Request
|
|
1312
|
+
*/
|
|
1313
|
+
error?: string;
|
|
1314
|
+
/**
|
|
1315
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1316
|
+
* @example Validation failed
|
|
1317
|
+
*/
|
|
1318
|
+
message: string | string[];
|
|
1319
|
+
};
|
|
1320
|
+
};
|
|
1321
|
+
};
|
|
1322
|
+
};
|
|
1323
|
+
};
|
|
1324
|
+
delete?: never;
|
|
1325
|
+
options?: never;
|
|
1326
|
+
head?: never;
|
|
1327
|
+
patch?: never;
|
|
1328
|
+
trace?: never;
|
|
1329
|
+
};
|
|
1330
|
+
"/v1/orgs/me": {
|
|
1331
|
+
parameters: {
|
|
1332
|
+
query?: never;
|
|
1333
|
+
header?: never;
|
|
1334
|
+
path?: never;
|
|
1335
|
+
cookie?: never;
|
|
1336
|
+
};
|
|
1337
|
+
/**
|
|
1338
|
+
* Read the calling organisation's public profile
|
|
1339
|
+
* @description Returns the org resolved from the OrgApiKey. Safe to expose in customer admin UIs — no secrets are included.
|
|
1340
|
+
*/
|
|
1341
|
+
get: {
|
|
1342
|
+
parameters: {
|
|
1343
|
+
query?: never;
|
|
1344
|
+
header?: never;
|
|
1345
|
+
path?: never;
|
|
1346
|
+
cookie?: never;
|
|
1347
|
+
};
|
|
1348
|
+
requestBody?: never;
|
|
1349
|
+
responses: {
|
|
1350
|
+
/** @description Success */
|
|
1351
|
+
200: {
|
|
1352
|
+
headers: {
|
|
1353
|
+
[name: string]: unknown;
|
|
1354
|
+
};
|
|
1355
|
+
content: {
|
|
1356
|
+
"application/json": {
|
|
1357
|
+
/**
|
|
1358
|
+
* @description UUID v4
|
|
1359
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
1360
|
+
*/
|
|
1361
|
+
id: string;
|
|
1362
|
+
name: string;
|
|
1363
|
+
/**
|
|
1364
|
+
* Format: email
|
|
1365
|
+
* @description RFC 5321 email address
|
|
1366
|
+
* @example user@example.com
|
|
1367
|
+
*/
|
|
1368
|
+
email: string;
|
|
1090
1369
|
/**
|
|
1091
1370
|
* Format: date-time
|
|
1092
1371
|
* @description ISO 8601 date-time string
|
|
@@ -1211,10 +1490,21 @@ interface paths$1 {
|
|
|
1211
1490
|
createdAt: string;
|
|
1212
1491
|
/**
|
|
1213
1492
|
* Format: date-time
|
|
1214
|
-
* @description
|
|
1493
|
+
* @description When the user proved control of the mailbox by consuming an emailed verify token. Null for users the org created via its API key until they do; org creation is recorded in identityAttestedByOrgId instead.
|
|
1215
1494
|
* @example 2026-05-20T10:30:00.000Z
|
|
1216
1495
|
*/
|
|
1217
1496
|
emailVerifiedAt: string | null;
|
|
1497
|
+
/**
|
|
1498
|
+
* @description Org whose API key created the user and vouched for the identity. This is NOT proof of mailbox control.
|
|
1499
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
1500
|
+
*/
|
|
1501
|
+
identityAttestedByOrgId: string | null;
|
|
1502
|
+
/**
|
|
1503
|
+
* Format: date-time
|
|
1504
|
+
* @description ISO 8601 date-time string
|
|
1505
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
1506
|
+
*/
|
|
1507
|
+
identityAttestedAt: string | null;
|
|
1218
1508
|
}[];
|
|
1219
1509
|
};
|
|
1220
1510
|
};
|
|
@@ -1273,8 +1563,8 @@ interface paths$1 {
|
|
|
1273
1563
|
};
|
|
1274
1564
|
};
|
|
1275
1565
|
responses: {
|
|
1276
|
-
/** @description
|
|
1277
|
-
|
|
1566
|
+
/** @description Created */
|
|
1567
|
+
201: {
|
|
1278
1568
|
headers: {
|
|
1279
1569
|
[name: string]: unknown;
|
|
1280
1570
|
};
|
|
@@ -1482,7 +1772,10 @@ interface paths$1 {
|
|
|
1482
1772
|
};
|
|
1483
1773
|
get?: never;
|
|
1484
1774
|
put?: never;
|
|
1485
|
-
/**
|
|
1775
|
+
/**
|
|
1776
|
+
* Invite a member to the caller's org
|
|
1777
|
+
* @description Adds the membership and, unless the invitee already verified their email, mails them an invitation with the verify link. Idempotent: re-inviting re-sends the mail. 502 means the membership was recorded but the email could not be sent; retry.
|
|
1778
|
+
*/
|
|
1486
1779
|
post: {
|
|
1487
1780
|
parameters: {
|
|
1488
1781
|
query?: never;
|
|
@@ -1508,8 +1801,8 @@ interface paths$1 {
|
|
|
1508
1801
|
};
|
|
1509
1802
|
};
|
|
1510
1803
|
responses: {
|
|
1511
|
-
/** @description
|
|
1512
|
-
|
|
1804
|
+
/** @description Created */
|
|
1805
|
+
201: {
|
|
1513
1806
|
headers: {
|
|
1514
1807
|
[name: string]: unknown;
|
|
1515
1808
|
};
|
|
@@ -1527,7 +1820,8 @@ interface paths$1 {
|
|
|
1527
1820
|
membershipId: string;
|
|
1528
1821
|
userPreexisted: boolean;
|
|
1529
1822
|
membershipPreexisted: boolean;
|
|
1530
|
-
|
|
1823
|
+
/** @description True when an invitation email (with the verify link) was sent, i.e. the invitee had not yet verified their email. The token is never returned. */
|
|
1824
|
+
inviteEmailSent: boolean;
|
|
1531
1825
|
};
|
|
1532
1826
|
};
|
|
1533
1827
|
};
|
|
@@ -1581,6 +1875,56 @@ interface paths$1 {
|
|
|
1581
1875
|
};
|
|
1582
1876
|
};
|
|
1583
1877
|
};
|
|
1878
|
+
/** @description Too Many Requests */
|
|
1879
|
+
429: {
|
|
1880
|
+
headers: {
|
|
1881
|
+
[name: string]: unknown;
|
|
1882
|
+
};
|
|
1883
|
+
content: {
|
|
1884
|
+
"application/json": {
|
|
1885
|
+
/**
|
|
1886
|
+
* @description HTTP status code
|
|
1887
|
+
* @example 400
|
|
1888
|
+
*/
|
|
1889
|
+
statusCode?: number;
|
|
1890
|
+
/**
|
|
1891
|
+
* @description Short error label
|
|
1892
|
+
* @example Bad Request
|
|
1893
|
+
*/
|
|
1894
|
+
error?: string;
|
|
1895
|
+
/**
|
|
1896
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1897
|
+
* @example Validation failed
|
|
1898
|
+
*/
|
|
1899
|
+
message: string | string[];
|
|
1900
|
+
};
|
|
1901
|
+
};
|
|
1902
|
+
};
|
|
1903
|
+
/** @description Bad Gateway */
|
|
1904
|
+
502: {
|
|
1905
|
+
headers: {
|
|
1906
|
+
[name: string]: unknown;
|
|
1907
|
+
};
|
|
1908
|
+
content: {
|
|
1909
|
+
"application/json": {
|
|
1910
|
+
/**
|
|
1911
|
+
* @description HTTP status code
|
|
1912
|
+
* @example 400
|
|
1913
|
+
*/
|
|
1914
|
+
statusCode?: number;
|
|
1915
|
+
/**
|
|
1916
|
+
* @description Short error label
|
|
1917
|
+
* @example Bad Request
|
|
1918
|
+
*/
|
|
1919
|
+
error?: string;
|
|
1920
|
+
/**
|
|
1921
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1922
|
+
* @example Validation failed
|
|
1923
|
+
*/
|
|
1924
|
+
message: string | string[];
|
|
1925
|
+
};
|
|
1926
|
+
};
|
|
1927
|
+
};
|
|
1584
1928
|
};
|
|
1585
1929
|
};
|
|
1586
1930
|
delete?: never;
|
|
@@ -1608,8 +1952,8 @@ interface paths$1 {
|
|
|
1608
1952
|
};
|
|
1609
1953
|
requestBody?: never;
|
|
1610
1954
|
responses: {
|
|
1611
|
-
/** @description
|
|
1612
|
-
|
|
1955
|
+
/** @description Created */
|
|
1956
|
+
201: {
|
|
1613
1957
|
headers: {
|
|
1614
1958
|
[name: string]: unknown;
|
|
1615
1959
|
};
|
|
@@ -1731,8 +2075,8 @@ interface paths$1 {
|
|
|
1731
2075
|
};
|
|
1732
2076
|
requestBody?: never;
|
|
1733
2077
|
responses: {
|
|
1734
|
-
/** @description
|
|
1735
|
-
|
|
2078
|
+
/** @description Created */
|
|
2079
|
+
201: {
|
|
1736
2080
|
headers: {
|
|
1737
2081
|
[name: string]: unknown;
|
|
1738
2082
|
};
|
|
@@ -2063,7 +2407,10 @@ interface paths$1 {
|
|
|
2063
2407
|
};
|
|
2064
2408
|
get?: never;
|
|
2065
2409
|
put?: never;
|
|
2066
|
-
/**
|
|
2410
|
+
/**
|
|
2411
|
+
* Re-send the invitation email to a pending member
|
|
2412
|
+
* @description Mints a fresh verify token, invalidates earlier ones and mails it. The token is never returned. 502 means the email could not be sent and nothing changed (the previous link stays valid).
|
|
2413
|
+
*/
|
|
2067
2414
|
post: {
|
|
2068
2415
|
parameters: {
|
|
2069
2416
|
query?: never;
|
|
@@ -2073,14 +2420,13 @@ interface paths$1 {
|
|
|
2073
2420
|
};
|
|
2074
2421
|
requestBody?: never;
|
|
2075
2422
|
responses: {
|
|
2076
|
-
/** @description
|
|
2077
|
-
|
|
2423
|
+
/** @description Created */
|
|
2424
|
+
201: {
|
|
2078
2425
|
headers: {
|
|
2079
2426
|
[name: string]: unknown;
|
|
2080
2427
|
};
|
|
2081
2428
|
content: {
|
|
2082
2429
|
"application/json": {
|
|
2083
|
-
emailVerifyToken: string;
|
|
2084
2430
|
/**
|
|
2085
2431
|
* Format: email
|
|
2086
2432
|
* @description RFC 5321 email address
|
|
@@ -2165,6 +2511,56 @@ interface paths$1 {
|
|
|
2165
2511
|
};
|
|
2166
2512
|
};
|
|
2167
2513
|
};
|
|
2514
|
+
/** @description Too Many Requests */
|
|
2515
|
+
429: {
|
|
2516
|
+
headers: {
|
|
2517
|
+
[name: string]: unknown;
|
|
2518
|
+
};
|
|
2519
|
+
content: {
|
|
2520
|
+
"application/json": {
|
|
2521
|
+
/**
|
|
2522
|
+
* @description HTTP status code
|
|
2523
|
+
* @example 400
|
|
2524
|
+
*/
|
|
2525
|
+
statusCode?: number;
|
|
2526
|
+
/**
|
|
2527
|
+
* @description Short error label
|
|
2528
|
+
* @example Bad Request
|
|
2529
|
+
*/
|
|
2530
|
+
error?: string;
|
|
2531
|
+
/**
|
|
2532
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
2533
|
+
* @example Validation failed
|
|
2534
|
+
*/
|
|
2535
|
+
message: string | string[];
|
|
2536
|
+
};
|
|
2537
|
+
};
|
|
2538
|
+
};
|
|
2539
|
+
/** @description Bad Gateway */
|
|
2540
|
+
502: {
|
|
2541
|
+
headers: {
|
|
2542
|
+
[name: string]: unknown;
|
|
2543
|
+
};
|
|
2544
|
+
content: {
|
|
2545
|
+
"application/json": {
|
|
2546
|
+
/**
|
|
2547
|
+
* @description HTTP status code
|
|
2548
|
+
* @example 400
|
|
2549
|
+
*/
|
|
2550
|
+
statusCode?: number;
|
|
2551
|
+
/**
|
|
2552
|
+
* @description Short error label
|
|
2553
|
+
* @example Bad Request
|
|
2554
|
+
*/
|
|
2555
|
+
error?: string;
|
|
2556
|
+
/**
|
|
2557
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
2558
|
+
* @example Validation failed
|
|
2559
|
+
*/
|
|
2560
|
+
message: string | string[];
|
|
2561
|
+
};
|
|
2562
|
+
};
|
|
2563
|
+
};
|
|
2168
2564
|
};
|
|
2169
2565
|
};
|
|
2170
2566
|
delete?: never;
|
|
@@ -2217,8 +2613,8 @@ interface paths$1 {
|
|
|
2217
2613
|
};
|
|
2218
2614
|
};
|
|
2219
2615
|
responses: {
|
|
2220
|
-
/** @description
|
|
2221
|
-
|
|
2616
|
+
/** @description Created */
|
|
2617
|
+
201: {
|
|
2222
2618
|
headers: {
|
|
2223
2619
|
[name: string]: unknown;
|
|
2224
2620
|
};
|
|
@@ -2656,8 +3052,8 @@ interface paths$1 {
|
|
|
2656
3052
|
};
|
|
2657
3053
|
requestBody?: never;
|
|
2658
3054
|
responses: {
|
|
2659
|
-
/** @description
|
|
2660
|
-
|
|
3055
|
+
/** @description Created */
|
|
3056
|
+
201: {
|
|
2661
3057
|
headers: {
|
|
2662
3058
|
[name: string]: unknown;
|
|
2663
3059
|
};
|
|
@@ -2807,8 +3203,8 @@ interface paths$1 {
|
|
|
2807
3203
|
};
|
|
2808
3204
|
};
|
|
2809
3205
|
responses: {
|
|
2810
|
-
/** @description
|
|
2811
|
-
|
|
3206
|
+
/** @description Created */
|
|
3207
|
+
201: {
|
|
2812
3208
|
headers: {
|
|
2813
3209
|
[name: string]: unknown;
|
|
2814
3210
|
};
|
|
@@ -2946,6 +3342,10 @@ interface paths$1 {
|
|
|
2946
3342
|
* @example 2026-05-20T10:30:00.000Z
|
|
2947
3343
|
*/
|
|
2948
3344
|
revokedAt: string | null;
|
|
3345
|
+
/** @description True when the key belongs to one OAuth grant (a connected app): only that app can sign with it, and disconnecting the app ends it. */
|
|
3346
|
+
boundToOauthGrant: boolean;
|
|
3347
|
+
/** @description For a key that belongs to no grant: whether the user shared it with OAuth clients (PATCH). Only shared keys are visible and usable to them. */
|
|
3348
|
+
sharedWithOauthClients: boolean;
|
|
2949
3349
|
}[];
|
|
2950
3350
|
};
|
|
2951
3351
|
};
|
|
@@ -3050,8 +3450,8 @@ interface paths$1 {
|
|
|
3050
3450
|
};
|
|
3051
3451
|
};
|
|
3052
3452
|
responses: {
|
|
3053
|
-
/** @description
|
|
3054
|
-
|
|
3453
|
+
/** @description Created */
|
|
3454
|
+
201: {
|
|
3055
3455
|
headers: {
|
|
3056
3456
|
[name: string]: unknown;
|
|
3057
3457
|
};
|
|
@@ -3223,8 +3623,8 @@ interface paths$1 {
|
|
|
3223
3623
|
};
|
|
3224
3624
|
};
|
|
3225
3625
|
responses: {
|
|
3226
|
-
/** @description
|
|
3227
|
-
|
|
3626
|
+
/** @description Created */
|
|
3627
|
+
201: {
|
|
3228
3628
|
headers: {
|
|
3229
3629
|
[name: string]: unknown;
|
|
3230
3630
|
};
|
|
@@ -3548,45 +3948,23 @@ interface paths$1 {
|
|
|
3548
3948
|
};
|
|
3549
3949
|
options?: never;
|
|
3550
3950
|
head?: never;
|
|
3551
|
-
patch?: never;
|
|
3552
|
-
trace?: never;
|
|
3553
|
-
};
|
|
3554
|
-
"/v1/sign": {
|
|
3555
|
-
parameters: {
|
|
3556
|
-
query?: never;
|
|
3557
|
-
header?: never;
|
|
3558
|
-
path?: never;
|
|
3559
|
-
cookie?: never;
|
|
3560
|
-
};
|
|
3561
|
-
get?: never;
|
|
3562
|
-
put?: never;
|
|
3563
3951
|
/**
|
|
3564
|
-
*
|
|
3565
|
-
* @description
|
|
3566
|
-
*
|
|
3567
|
-
* **Use:** sign the canonical-intent JSON returned by chain-api `POST /v5/contracts/.../witnesses/propose` (and the analogous v4 endpoint). The endpoint signs whatever bytes you submit because sign:write is an explicit grant to use the user's key — the on-chain authority of the key is bounded to witness ops on the user's contract, and nothing else in Witnium currently consumes these signatures. Future signing surfaces that need different keys or scopes get their own.
|
|
3568
|
-
*
|
|
3569
|
-
* **Limits:** payload ≤ 8 KiB (16384 hex chars), per-user rate-limited at 20 signs/minute (429 + Retry-After on excess). Both are resource bounds, not access-control fences.
|
|
3570
|
-
*
|
|
3571
|
-
* Optional `X-Request-Id` request header gets forwarded into the audit-log line; a UUID is generated if absent.
|
|
3952
|
+
* Share a durable delegated key with OAuth clients (or stop)
|
|
3953
|
+
* @description Dashboard only (a token from POST /v1/auth/access-token); OAuth tokens get 403. Applies to keys that belong to no OAuth grant. A shared key can be listed and used to sign by every OAuth client the user connected to this org, but submitted or revoked only from the dashboard.
|
|
3572
3954
|
*/
|
|
3573
|
-
|
|
3955
|
+
patch: {
|
|
3574
3956
|
parameters: {
|
|
3575
3957
|
query?: never;
|
|
3576
3958
|
header?: never;
|
|
3577
|
-
path
|
|
3959
|
+
path: {
|
|
3960
|
+
id: string;
|
|
3961
|
+
};
|
|
3578
3962
|
cookie?: never;
|
|
3579
3963
|
};
|
|
3580
3964
|
requestBody?: {
|
|
3581
3965
|
content: {
|
|
3582
3966
|
"application/json": {
|
|
3583
|
-
|
|
3584
|
-
* @description The delegated key (per-user, per-contract) used to sign. Must be confirmed on-chain and not revoked.
|
|
3585
|
-
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
3586
|
-
*/
|
|
3587
|
-
delegatedKeyId: string;
|
|
3588
|
-
/** @description Hex-encoded bytes to sign (no 0x prefix). Must have an even length and at most 16384 hex characters (8 KiB raw). The expected use is signing the UTF-8 bytes of a v5 canonical-intent JSON returned by chain-api `/propose`, but the endpoint signs whatever bytes you submit — sign:write is an explicit grant to use the user's key. Witnium never logs the bytes; only their SHA-256 hash is recorded for audit cross-correlation with Vault. */
|
|
3589
|
-
payload: string;
|
|
3967
|
+
sharedWithOauthClients: boolean;
|
|
3590
3968
|
};
|
|
3591
3969
|
};
|
|
3592
3970
|
};
|
|
@@ -3598,25 +3976,244 @@ interface paths$1 {
|
|
|
3598
3976
|
};
|
|
3599
3977
|
content: {
|
|
3600
3978
|
"application/json": {
|
|
3601
|
-
/** @description Ed25519 signature over the payload bytes, hex-encoded. */
|
|
3602
|
-
signature: string;
|
|
3603
|
-
/**
|
|
3604
|
-
* @description Public key of the delegated key used to sign — for verification.
|
|
3605
|
-
* @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
|
|
3606
|
-
*/
|
|
3607
|
-
signerPublicKey: string;
|
|
3608
3979
|
/**
|
|
3609
3980
|
* @description UUID v4
|
|
3610
3981
|
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
3611
3982
|
*/
|
|
3612
|
-
|
|
3613
|
-
|
|
3614
|
-
|
|
3615
|
-
|
|
3616
|
-
|
|
3617
|
-
|
|
3618
|
-
|
|
3619
|
-
|
|
3983
|
+
id: string;
|
|
3984
|
+
/**
|
|
3985
|
+
* @description Ethereum address (0x + 40 hex characters)
|
|
3986
|
+
* @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
|
|
3987
|
+
*/
|
|
3988
|
+
contractAddress: string;
|
|
3989
|
+
/**
|
|
3990
|
+
* @description Ed25519 public key — 32 bytes hex-encoded (64 chars, no 0x prefix)
|
|
3991
|
+
* @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
|
|
3992
|
+
*/
|
|
3993
|
+
publicKey: string;
|
|
3994
|
+
/**
|
|
3995
|
+
* Format: date-time
|
|
3996
|
+
* @description ISO 8601 date-time string
|
|
3997
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
3998
|
+
*/
|
|
3999
|
+
createdAt: string;
|
|
4000
|
+
/**
|
|
4001
|
+
* Format: date-time
|
|
4002
|
+
* @description Set once the on-chain addSigningKey tx is mined.
|
|
4003
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
4004
|
+
*/
|
|
4005
|
+
confirmedAt: string | null;
|
|
4006
|
+
/** @description Transaction hash from the addSigningKey submission, if any. */
|
|
4007
|
+
confirmedTxHash: string | null;
|
|
4008
|
+
confirmedBlockNumber: number | null;
|
|
4009
|
+
/**
|
|
4010
|
+
* Format: date-time
|
|
4011
|
+
* @description Set when the user locally revokes the key (Vault key wiped). Does NOT mean the on-chain record was revoked.
|
|
4012
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
4013
|
+
*/
|
|
4014
|
+
revokedAt: string | null;
|
|
4015
|
+
/** @description True when the key belongs to one OAuth grant (a connected app): only that app can sign with it, and disconnecting the app ends it. */
|
|
4016
|
+
boundToOauthGrant: boolean;
|
|
4017
|
+
/** @description For a key that belongs to no grant: whether the user shared it with OAuth clients (PATCH). Only shared keys are visible and usable to them. */
|
|
4018
|
+
sharedWithOauthClients: boolean;
|
|
4019
|
+
};
|
|
4020
|
+
};
|
|
4021
|
+
};
|
|
4022
|
+
/** @description Bad Request — validation failed */
|
|
4023
|
+
400: {
|
|
4024
|
+
headers: {
|
|
4025
|
+
[name: string]: unknown;
|
|
4026
|
+
};
|
|
4027
|
+
content: {
|
|
4028
|
+
"application/json": {
|
|
4029
|
+
/**
|
|
4030
|
+
* @description HTTP status code
|
|
4031
|
+
* @example 400
|
|
4032
|
+
*/
|
|
4033
|
+
statusCode?: number;
|
|
4034
|
+
/**
|
|
4035
|
+
* @description Short error label
|
|
4036
|
+
* @example Bad Request
|
|
4037
|
+
*/
|
|
4038
|
+
error?: string;
|
|
4039
|
+
/**
|
|
4040
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4041
|
+
* @example Validation failed
|
|
4042
|
+
*/
|
|
4043
|
+
message: string | string[];
|
|
4044
|
+
};
|
|
4045
|
+
};
|
|
4046
|
+
};
|
|
4047
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
4048
|
+
401: {
|
|
4049
|
+
headers: {
|
|
4050
|
+
[name: string]: unknown;
|
|
4051
|
+
};
|
|
4052
|
+
content: {
|
|
4053
|
+
"application/json": {
|
|
4054
|
+
/**
|
|
4055
|
+
* @description HTTP status code
|
|
4056
|
+
* @example 400
|
|
4057
|
+
*/
|
|
4058
|
+
statusCode?: number;
|
|
4059
|
+
/**
|
|
4060
|
+
* @description Short error label
|
|
4061
|
+
* @example Bad Request
|
|
4062
|
+
*/
|
|
4063
|
+
error?: string;
|
|
4064
|
+
/**
|
|
4065
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4066
|
+
* @example Validation failed
|
|
4067
|
+
*/
|
|
4068
|
+
message: string | string[];
|
|
4069
|
+
};
|
|
4070
|
+
};
|
|
4071
|
+
};
|
|
4072
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
4073
|
+
403: {
|
|
4074
|
+
headers: {
|
|
4075
|
+
[name: string]: unknown;
|
|
4076
|
+
};
|
|
4077
|
+
content: {
|
|
4078
|
+
"application/json": {
|
|
4079
|
+
/**
|
|
4080
|
+
* @description HTTP status code
|
|
4081
|
+
* @example 400
|
|
4082
|
+
*/
|
|
4083
|
+
statusCode?: number;
|
|
4084
|
+
/**
|
|
4085
|
+
* @description Short error label
|
|
4086
|
+
* @example Bad Request
|
|
4087
|
+
*/
|
|
4088
|
+
error?: string;
|
|
4089
|
+
/**
|
|
4090
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4091
|
+
* @example Validation failed
|
|
4092
|
+
*/
|
|
4093
|
+
message: string | string[];
|
|
4094
|
+
};
|
|
4095
|
+
};
|
|
4096
|
+
};
|
|
4097
|
+
/** @description Not Found */
|
|
4098
|
+
404: {
|
|
4099
|
+
headers: {
|
|
4100
|
+
[name: string]: unknown;
|
|
4101
|
+
};
|
|
4102
|
+
content: {
|
|
4103
|
+
"application/json": {
|
|
4104
|
+
/**
|
|
4105
|
+
* @description HTTP status code
|
|
4106
|
+
* @example 400
|
|
4107
|
+
*/
|
|
4108
|
+
statusCode?: number;
|
|
4109
|
+
/**
|
|
4110
|
+
* @description Short error label
|
|
4111
|
+
* @example Bad Request
|
|
4112
|
+
*/
|
|
4113
|
+
error?: string;
|
|
4114
|
+
/**
|
|
4115
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4116
|
+
* @example Validation failed
|
|
4117
|
+
*/
|
|
4118
|
+
message: string | string[];
|
|
4119
|
+
};
|
|
4120
|
+
};
|
|
4121
|
+
};
|
|
4122
|
+
/** @description Conflict */
|
|
4123
|
+
409: {
|
|
4124
|
+
headers: {
|
|
4125
|
+
[name: string]: unknown;
|
|
4126
|
+
};
|
|
4127
|
+
content: {
|
|
4128
|
+
"application/json": {
|
|
4129
|
+
/**
|
|
4130
|
+
* @description HTTP status code
|
|
4131
|
+
* @example 400
|
|
4132
|
+
*/
|
|
4133
|
+
statusCode?: number;
|
|
4134
|
+
/**
|
|
4135
|
+
* @description Short error label
|
|
4136
|
+
* @example Bad Request
|
|
4137
|
+
*/
|
|
4138
|
+
error?: string;
|
|
4139
|
+
/**
|
|
4140
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4141
|
+
* @example Validation failed
|
|
4142
|
+
*/
|
|
4143
|
+
message: string | string[];
|
|
4144
|
+
};
|
|
4145
|
+
};
|
|
4146
|
+
};
|
|
4147
|
+
};
|
|
4148
|
+
};
|
|
4149
|
+
trace?: never;
|
|
4150
|
+
};
|
|
4151
|
+
"/v1/sign": {
|
|
4152
|
+
parameters: {
|
|
4153
|
+
query?: never;
|
|
4154
|
+
header?: never;
|
|
4155
|
+
path?: never;
|
|
4156
|
+
cookie?: never;
|
|
4157
|
+
};
|
|
4158
|
+
get?: never;
|
|
4159
|
+
put?: never;
|
|
4160
|
+
/**
|
|
4161
|
+
* Sign bytes with a delegated key
|
|
4162
|
+
* @description Vault Transit signs the supplied payload using the user's delegated key. Vault returns the signature; the accounts-service process never sees the private bytes (delegated keys are created with `exportable=false`).
|
|
4163
|
+
*
|
|
4164
|
+
* **Use:** sign the canonical-intent JSON returned by chain-api `POST /v5/contracts/.../witnesses/propose` (and the analogous v4 endpoint). The endpoint signs whatever bytes you submit because sign:write is an explicit grant to use the user's key — the on-chain authority of the key is bounded to witness ops on the user's contract, and nothing else in Witnium currently consumes these signatures. Future signing surfaces that need different keys or scopes get their own.
|
|
4165
|
+
*
|
|
4166
|
+
* **Limits:** payload ≤ 8 KiB (16384 hex chars), per-user rate-limited at 20 signs/minute (429 + Retry-After on excess). Both are resource bounds, not access-control fences.
|
|
4167
|
+
*
|
|
4168
|
+
* Optional `X-Request-Id` request header gets forwarded into the audit-log line; a UUID is generated if absent.
|
|
4169
|
+
*/
|
|
4170
|
+
post: {
|
|
4171
|
+
parameters: {
|
|
4172
|
+
query?: never;
|
|
4173
|
+
header?: never;
|
|
4174
|
+
path?: never;
|
|
4175
|
+
cookie?: never;
|
|
4176
|
+
};
|
|
4177
|
+
requestBody?: {
|
|
4178
|
+
content: {
|
|
4179
|
+
"application/json": {
|
|
4180
|
+
/**
|
|
4181
|
+
* @description The delegated key (per-user, per-contract) used to sign. Must be confirmed on-chain and not revoked.
|
|
4182
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
4183
|
+
*/
|
|
4184
|
+
delegatedKeyId: string;
|
|
4185
|
+
/** @description Hex-encoded bytes to sign (no 0x prefix). Must have an even length and at most 16384 hex characters (8 KiB raw). The expected use is signing the UTF-8 bytes of a v5 canonical-intent JSON returned by chain-api `/propose`, but the endpoint signs whatever bytes you submit — sign:write is an explicit grant to use the user's key. Witnium never logs the bytes; only their SHA-256 hash is recorded for audit cross-correlation with Vault. */
|
|
4186
|
+
payload: string;
|
|
4187
|
+
};
|
|
4188
|
+
};
|
|
4189
|
+
};
|
|
4190
|
+
responses: {
|
|
4191
|
+
/** @description Created */
|
|
4192
|
+
201: {
|
|
4193
|
+
headers: {
|
|
4194
|
+
[name: string]: unknown;
|
|
4195
|
+
};
|
|
4196
|
+
content: {
|
|
4197
|
+
"application/json": {
|
|
4198
|
+
/** @description Ed25519 signature over the payload bytes, hex-encoded. */
|
|
4199
|
+
signature: string;
|
|
4200
|
+
/**
|
|
4201
|
+
* @description Public key of the delegated key used to sign — for verification.
|
|
4202
|
+
* @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
|
|
4203
|
+
*/
|
|
4204
|
+
signerPublicKey: string;
|
|
4205
|
+
/**
|
|
4206
|
+
* @description UUID v4
|
|
4207
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
4208
|
+
*/
|
|
4209
|
+
delegatedKeyId: string;
|
|
4210
|
+
};
|
|
4211
|
+
};
|
|
4212
|
+
};
|
|
4213
|
+
/** @description Bad Request — validation failed */
|
|
4214
|
+
400: {
|
|
4215
|
+
headers: {
|
|
4216
|
+
[name: string]: unknown;
|
|
3620
4217
|
};
|
|
3621
4218
|
content: {
|
|
3622
4219
|
"application/json": {
|
|
@@ -3810,8 +4407,8 @@ interface paths$1 {
|
|
|
3810
4407
|
};
|
|
3811
4408
|
};
|
|
3812
4409
|
responses: {
|
|
3813
|
-
/** @description
|
|
3814
|
-
|
|
4410
|
+
/** @description Created */
|
|
4411
|
+
201: {
|
|
3815
4412
|
headers: {
|
|
3816
4413
|
[name: string]: unknown;
|
|
3817
4414
|
};
|
|
@@ -3923,8 +4520,8 @@ interface paths$1 {
|
|
|
3923
4520
|
};
|
|
3924
4521
|
};
|
|
3925
4522
|
responses: {
|
|
3926
|
-
/** @description
|
|
3927
|
-
|
|
4523
|
+
/** @description Created */
|
|
4524
|
+
201: {
|
|
3928
4525
|
headers: {
|
|
3929
4526
|
[name: string]: unknown;
|
|
3930
4527
|
};
|
|
@@ -4028,8 +4625,8 @@ interface paths$1 {
|
|
|
4028
4625
|
};
|
|
4029
4626
|
};
|
|
4030
4627
|
responses: {
|
|
4031
|
-
/** @description
|
|
4032
|
-
|
|
4628
|
+
/** @description Created */
|
|
4629
|
+
201: {
|
|
4033
4630
|
headers: {
|
|
4034
4631
|
[name: string]: unknown;
|
|
4035
4632
|
};
|
|
@@ -4128,8 +4725,8 @@ interface paths$1 {
|
|
|
4128
4725
|
};
|
|
4129
4726
|
};
|
|
4130
4727
|
responses: {
|
|
4131
|
-
/** @description
|
|
4132
|
-
|
|
4728
|
+
/** @description Created */
|
|
4729
|
+
201: {
|
|
4133
4730
|
headers: {
|
|
4134
4731
|
[name: string]: unknown;
|
|
4135
4732
|
};
|
|
@@ -4228,8 +4825,8 @@ interface paths$1 {
|
|
|
4228
4825
|
};
|
|
4229
4826
|
};
|
|
4230
4827
|
responses: {
|
|
4231
|
-
/** @description
|
|
4232
|
-
|
|
4828
|
+
/** @description Created */
|
|
4829
|
+
201: {
|
|
4233
4830
|
headers: {
|
|
4234
4831
|
[name: string]: unknown;
|
|
4235
4832
|
};
|
|
@@ -4341,8 +4938,8 @@ interface paths$1 {
|
|
|
4341
4938
|
};
|
|
4342
4939
|
};
|
|
4343
4940
|
responses: {
|
|
4344
|
-
/** @description
|
|
4345
|
-
|
|
4941
|
+
/** @description Created */
|
|
4942
|
+
201: {
|
|
4346
4943
|
headers: {
|
|
4347
4944
|
[name: string]: unknown;
|
|
4348
4945
|
};
|
|
@@ -4473,8 +5070,8 @@ interface paths$1 {
|
|
|
4473
5070
|
};
|
|
4474
5071
|
};
|
|
4475
5072
|
responses: {
|
|
4476
|
-
/** @description
|
|
4477
|
-
|
|
5073
|
+
/** @description Created */
|
|
5074
|
+
201: {
|
|
4478
5075
|
headers: {
|
|
4479
5076
|
[name: string]: unknown;
|
|
4480
5077
|
};
|
|
@@ -4592,8 +5189,8 @@ interface paths$1 {
|
|
|
4592
5189
|
};
|
|
4593
5190
|
requestBody?: never;
|
|
4594
5191
|
responses: {
|
|
4595
|
-
/** @description
|
|
4596
|
-
|
|
5192
|
+
/** @description Created */
|
|
5193
|
+
201: {
|
|
4597
5194
|
headers: {
|
|
4598
5195
|
[name: string]: unknown;
|
|
4599
5196
|
};
|
|
@@ -4727,8 +5324,8 @@ interface paths$1 {
|
|
|
4727
5324
|
};
|
|
4728
5325
|
};
|
|
4729
5326
|
responses: {
|
|
4730
|
-
/** @description
|
|
4731
|
-
|
|
5327
|
+
/** @description Created */
|
|
5328
|
+
201: {
|
|
4732
5329
|
headers: {
|
|
4733
5330
|
[name: string]: unknown;
|
|
4734
5331
|
};
|
|
@@ -4904,7 +5501,7 @@ interface paths$1 {
|
|
|
4904
5501
|
put?: never;
|
|
4905
5502
|
/**
|
|
4906
5503
|
* Internal callback from chain-api
|
|
4907
|
-
* @description NOT for external use. Invoked by chain-api when a witness tx settles so accounts can update its credit reservations.
|
|
5504
|
+
* @description NOT for external use. Invoked by chain-api when a witness tx settles so accounts can update its credit reservations. Authenticated by internal callback protocol v1 (docs/internal-callback-protocol.md): X-Witnium-Event-Id, X-Witnium-Callback-Timestamp and X-Witnium-Callback-Signature, an HMAC over the event id, timestamp, method, path with query and body hash using the shared INTERNAL_CALLBACK_HMAC_SECRET. Deduplicated by event id: a redelivered event returns 200 without side effects. Listed in the spec for completeness; SDK consumers should ignore.
|
|
4908
5505
|
*/
|
|
4909
5506
|
post: {
|
|
4910
5507
|
parameters: {
|
|
@@ -4919,12 +5516,12 @@ interface paths$1 {
|
|
|
4919
5516
|
content: {
|
|
4920
5517
|
"application/json": {
|
|
4921
5518
|
/** @description 32-byte hash, lower-case hex without 0x prefix. */
|
|
4922
|
-
witnessId
|
|
5519
|
+
witnessId: string;
|
|
4923
5520
|
/**
|
|
4924
|
-
* @description Settlement state from chain-api. `confirmed` →
|
|
5521
|
+
* @description Settlement state from chain-api. `confirmed` → commit the reservation against the witness. `failed` → release it back to the org.
|
|
4925
5522
|
* @enum {string}
|
|
4926
5523
|
*/
|
|
4927
|
-
status
|
|
5524
|
+
status: "confirmed" | "failed";
|
|
4928
5525
|
error?: string;
|
|
4929
5526
|
};
|
|
4930
5527
|
};
|
|
@@ -4937,8 +5534,8 @@ interface paths$1 {
|
|
|
4937
5534
|
};
|
|
4938
5535
|
content: {
|
|
4939
5536
|
"application/json": {
|
|
4940
|
-
|
|
4941
|
-
|
|
5537
|
+
/** @enum {boolean} */
|
|
5538
|
+
ok: true;
|
|
4942
5539
|
};
|
|
4943
5540
|
};
|
|
4944
5541
|
};
|
|
@@ -5605,25 +6202,583 @@ interface paths$1 {
|
|
|
5605
6202
|
patch?: never;
|
|
5606
6203
|
trace?: never;
|
|
5607
6204
|
};
|
|
5608
|
-
"/
|
|
6205
|
+
"/v3/contracts/{contractAddress}/witnesses/intents/{intentId}": {
|
|
5609
6206
|
parameters: {
|
|
5610
6207
|
query?: never;
|
|
5611
6208
|
header?: never;
|
|
5612
6209
|
path?: never;
|
|
5613
6210
|
cookie?: never;
|
|
5614
6211
|
};
|
|
5615
|
-
get?: never;
|
|
5616
|
-
put?: never;
|
|
5617
6212
|
/**
|
|
5618
|
-
*
|
|
5619
|
-
* @description
|
|
6213
|
+
* Recover a v3 witness intent's outcome
|
|
6214
|
+
* @description For a client that lost a finalize (or propose) response. Returns the stored finalize response when accounts has one, otherwise chain-api's status for the intent. The URL contract must be the caller's. Read-only: never finalizes.
|
|
5620
6215
|
*/
|
|
5621
|
-
|
|
6216
|
+
get: {
|
|
5622
6217
|
parameters: {
|
|
5623
6218
|
query?: never;
|
|
5624
6219
|
header?: never;
|
|
5625
|
-
path
|
|
5626
|
-
|
|
6220
|
+
path: {
|
|
6221
|
+
contractAddress: string;
|
|
6222
|
+
intentId: string;
|
|
6223
|
+
};
|
|
6224
|
+
cookie?: never;
|
|
6225
|
+
};
|
|
6226
|
+
requestBody?: never;
|
|
6227
|
+
responses: {
|
|
6228
|
+
/** @description Success */
|
|
6229
|
+
200: {
|
|
6230
|
+
headers: {
|
|
6231
|
+
[name: string]: unknown;
|
|
6232
|
+
};
|
|
6233
|
+
content: {
|
|
6234
|
+
"application/json": {
|
|
6235
|
+
/** @enum {string} */
|
|
6236
|
+
source: "stored";
|
|
6237
|
+
intentId: string;
|
|
6238
|
+
registryVersion: number;
|
|
6239
|
+
/**
|
|
6240
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6241
|
+
* @enum {string}
|
|
6242
|
+
*/
|
|
6243
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired";
|
|
6244
|
+
/** @description The finalize response, exactly as first returned. */
|
|
6245
|
+
result: {
|
|
6246
|
+
[key: string]: unknown;
|
|
6247
|
+
};
|
|
6248
|
+
} | {
|
|
6249
|
+
/** @enum {string} */
|
|
6250
|
+
source: "chain";
|
|
6251
|
+
intentId: string;
|
|
6252
|
+
registryVersion: number;
|
|
6253
|
+
/**
|
|
6254
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6255
|
+
* @enum {string|null}
|
|
6256
|
+
*/
|
|
6257
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired" | null;
|
|
6258
|
+
/**
|
|
6259
|
+
* WitnessIntentChainStatus
|
|
6260
|
+
* @description chain-api's status for the intent, verbatim.
|
|
6261
|
+
*/
|
|
6262
|
+
status: {
|
|
6263
|
+
intentId: string;
|
|
6264
|
+
contractAddress: string;
|
|
6265
|
+
registryVersion: number;
|
|
6266
|
+
/** @enum {string} */
|
|
6267
|
+
status: "prepared" | "allocated" | "submitted" | "confirmed" | "failed" | "cancelled" | "expired_unsubmitted" | "unknown";
|
|
6268
|
+
prepareTtlSeconds: number;
|
|
6269
|
+
/** @description Present when `confirmed`. */
|
|
6270
|
+
witnessId?: string;
|
|
6271
|
+
/** @description Present when `confirmed`. */
|
|
6272
|
+
transactionHash?: string;
|
|
6273
|
+
/** @description Present when `confirmed`. */
|
|
6274
|
+
blockNumber?: number;
|
|
6275
|
+
/** @description Present when `unknown`. */
|
|
6276
|
+
reason?: string;
|
|
6277
|
+
};
|
|
6278
|
+
};
|
|
6279
|
+
};
|
|
6280
|
+
};
|
|
6281
|
+
/** @description Bad Request — validation failed */
|
|
6282
|
+
400: {
|
|
6283
|
+
headers: {
|
|
6284
|
+
[name: string]: unknown;
|
|
6285
|
+
};
|
|
6286
|
+
content: {
|
|
6287
|
+
"application/json": {
|
|
6288
|
+
/**
|
|
6289
|
+
* @description HTTP status code
|
|
6290
|
+
* @example 400
|
|
6291
|
+
*/
|
|
6292
|
+
statusCode?: number;
|
|
6293
|
+
/**
|
|
6294
|
+
* @description Short error label
|
|
6295
|
+
* @example Bad Request
|
|
6296
|
+
*/
|
|
6297
|
+
error?: string;
|
|
6298
|
+
/**
|
|
6299
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6300
|
+
* @example Validation failed
|
|
6301
|
+
*/
|
|
6302
|
+
message: string | string[];
|
|
6303
|
+
};
|
|
6304
|
+
};
|
|
6305
|
+
};
|
|
6306
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
6307
|
+
401: {
|
|
6308
|
+
headers: {
|
|
6309
|
+
[name: string]: unknown;
|
|
6310
|
+
};
|
|
6311
|
+
content: {
|
|
6312
|
+
"application/json": {
|
|
6313
|
+
/**
|
|
6314
|
+
* @description HTTP status code
|
|
6315
|
+
* @example 400
|
|
6316
|
+
*/
|
|
6317
|
+
statusCode?: number;
|
|
6318
|
+
/**
|
|
6319
|
+
* @description Short error label
|
|
6320
|
+
* @example Bad Request
|
|
6321
|
+
*/
|
|
6322
|
+
error?: string;
|
|
6323
|
+
/**
|
|
6324
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6325
|
+
* @example Validation failed
|
|
6326
|
+
*/
|
|
6327
|
+
message: string | string[];
|
|
6328
|
+
};
|
|
6329
|
+
};
|
|
6330
|
+
};
|
|
6331
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
6332
|
+
403: {
|
|
6333
|
+
headers: {
|
|
6334
|
+
[name: string]: unknown;
|
|
6335
|
+
};
|
|
6336
|
+
content: {
|
|
6337
|
+
"application/json": {
|
|
6338
|
+
/**
|
|
6339
|
+
* @description HTTP status code
|
|
6340
|
+
* @example 400
|
|
6341
|
+
*/
|
|
6342
|
+
statusCode?: number;
|
|
6343
|
+
/**
|
|
6344
|
+
* @description Short error label
|
|
6345
|
+
* @example Bad Request
|
|
6346
|
+
*/
|
|
6347
|
+
error?: string;
|
|
6348
|
+
/**
|
|
6349
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6350
|
+
* @example Validation failed
|
|
6351
|
+
*/
|
|
6352
|
+
message: string | string[];
|
|
6353
|
+
};
|
|
6354
|
+
};
|
|
6355
|
+
};
|
|
6356
|
+
/** @description Not Found */
|
|
6357
|
+
404: {
|
|
6358
|
+
headers: {
|
|
6359
|
+
[name: string]: unknown;
|
|
6360
|
+
};
|
|
6361
|
+
content: {
|
|
6362
|
+
"application/json": {
|
|
6363
|
+
/**
|
|
6364
|
+
* @description HTTP status code
|
|
6365
|
+
* @example 400
|
|
6366
|
+
*/
|
|
6367
|
+
statusCode?: number;
|
|
6368
|
+
/**
|
|
6369
|
+
* @description Short error label
|
|
6370
|
+
* @example Bad Request
|
|
6371
|
+
*/
|
|
6372
|
+
error?: string;
|
|
6373
|
+
/**
|
|
6374
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6375
|
+
* @example Validation failed
|
|
6376
|
+
*/
|
|
6377
|
+
message: string | string[];
|
|
6378
|
+
};
|
|
6379
|
+
};
|
|
6380
|
+
};
|
|
6381
|
+
};
|
|
6382
|
+
};
|
|
6383
|
+
put?: never;
|
|
6384
|
+
post?: never;
|
|
6385
|
+
delete?: never;
|
|
6386
|
+
options?: never;
|
|
6387
|
+
head?: never;
|
|
6388
|
+
patch?: never;
|
|
6389
|
+
trace?: never;
|
|
6390
|
+
};
|
|
6391
|
+
"/v4/contracts/{contractAddress}/witnesses/intents/{intentId}": {
|
|
6392
|
+
parameters: {
|
|
6393
|
+
query?: never;
|
|
6394
|
+
header?: never;
|
|
6395
|
+
path?: never;
|
|
6396
|
+
cookie?: never;
|
|
6397
|
+
};
|
|
6398
|
+
/**
|
|
6399
|
+
* Recover a v4 witness intent's outcome
|
|
6400
|
+
* @description For a client that lost a finalize (or propose) response. Returns the stored finalize response when accounts has one, otherwise chain-api's status for the intent. The URL contract must be the caller's. Read-only: never finalizes.
|
|
6401
|
+
*/
|
|
6402
|
+
get: {
|
|
6403
|
+
parameters: {
|
|
6404
|
+
query?: never;
|
|
6405
|
+
header?: never;
|
|
6406
|
+
path: {
|
|
6407
|
+
contractAddress: string;
|
|
6408
|
+
intentId: string;
|
|
6409
|
+
};
|
|
6410
|
+
cookie?: never;
|
|
6411
|
+
};
|
|
6412
|
+
requestBody?: never;
|
|
6413
|
+
responses: {
|
|
6414
|
+
/** @description Success */
|
|
6415
|
+
200: {
|
|
6416
|
+
headers: {
|
|
6417
|
+
[name: string]: unknown;
|
|
6418
|
+
};
|
|
6419
|
+
content: {
|
|
6420
|
+
"application/json": {
|
|
6421
|
+
/** @enum {string} */
|
|
6422
|
+
source: "stored";
|
|
6423
|
+
intentId: string;
|
|
6424
|
+
registryVersion: number;
|
|
6425
|
+
/**
|
|
6426
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6427
|
+
* @enum {string}
|
|
6428
|
+
*/
|
|
6429
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired";
|
|
6430
|
+
/** @description The finalize response, exactly as first returned. */
|
|
6431
|
+
result: {
|
|
6432
|
+
[key: string]: unknown;
|
|
6433
|
+
};
|
|
6434
|
+
} | {
|
|
6435
|
+
/** @enum {string} */
|
|
6436
|
+
source: "chain";
|
|
6437
|
+
intentId: string;
|
|
6438
|
+
registryVersion: number;
|
|
6439
|
+
/**
|
|
6440
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6441
|
+
* @enum {string|null}
|
|
6442
|
+
*/
|
|
6443
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired" | null;
|
|
6444
|
+
/**
|
|
6445
|
+
* WitnessIntentChainStatus
|
|
6446
|
+
* @description chain-api's status for the intent, verbatim.
|
|
6447
|
+
*/
|
|
6448
|
+
status: {
|
|
6449
|
+
intentId: string;
|
|
6450
|
+
contractAddress: string;
|
|
6451
|
+
registryVersion: number;
|
|
6452
|
+
/** @enum {string} */
|
|
6453
|
+
status: "prepared" | "allocated" | "submitted" | "confirmed" | "failed" | "cancelled" | "expired_unsubmitted" | "unknown";
|
|
6454
|
+
prepareTtlSeconds: number;
|
|
6455
|
+
/** @description Present when `confirmed`. */
|
|
6456
|
+
witnessId?: string;
|
|
6457
|
+
/** @description Present when `confirmed`. */
|
|
6458
|
+
transactionHash?: string;
|
|
6459
|
+
/** @description Present when `confirmed`. */
|
|
6460
|
+
blockNumber?: number;
|
|
6461
|
+
/** @description Present when `unknown`. */
|
|
6462
|
+
reason?: string;
|
|
6463
|
+
};
|
|
6464
|
+
};
|
|
6465
|
+
};
|
|
6466
|
+
};
|
|
6467
|
+
/** @description Bad Request — validation failed */
|
|
6468
|
+
400: {
|
|
6469
|
+
headers: {
|
|
6470
|
+
[name: string]: unknown;
|
|
6471
|
+
};
|
|
6472
|
+
content: {
|
|
6473
|
+
"application/json": {
|
|
6474
|
+
/**
|
|
6475
|
+
* @description HTTP status code
|
|
6476
|
+
* @example 400
|
|
6477
|
+
*/
|
|
6478
|
+
statusCode?: number;
|
|
6479
|
+
/**
|
|
6480
|
+
* @description Short error label
|
|
6481
|
+
* @example Bad Request
|
|
6482
|
+
*/
|
|
6483
|
+
error?: string;
|
|
6484
|
+
/**
|
|
6485
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6486
|
+
* @example Validation failed
|
|
6487
|
+
*/
|
|
6488
|
+
message: string | string[];
|
|
6489
|
+
};
|
|
6490
|
+
};
|
|
6491
|
+
};
|
|
6492
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
6493
|
+
401: {
|
|
6494
|
+
headers: {
|
|
6495
|
+
[name: string]: unknown;
|
|
6496
|
+
};
|
|
6497
|
+
content: {
|
|
6498
|
+
"application/json": {
|
|
6499
|
+
/**
|
|
6500
|
+
* @description HTTP status code
|
|
6501
|
+
* @example 400
|
|
6502
|
+
*/
|
|
6503
|
+
statusCode?: number;
|
|
6504
|
+
/**
|
|
6505
|
+
* @description Short error label
|
|
6506
|
+
* @example Bad Request
|
|
6507
|
+
*/
|
|
6508
|
+
error?: string;
|
|
6509
|
+
/**
|
|
6510
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6511
|
+
* @example Validation failed
|
|
6512
|
+
*/
|
|
6513
|
+
message: string | string[];
|
|
6514
|
+
};
|
|
6515
|
+
};
|
|
6516
|
+
};
|
|
6517
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
6518
|
+
403: {
|
|
6519
|
+
headers: {
|
|
6520
|
+
[name: string]: unknown;
|
|
6521
|
+
};
|
|
6522
|
+
content: {
|
|
6523
|
+
"application/json": {
|
|
6524
|
+
/**
|
|
6525
|
+
* @description HTTP status code
|
|
6526
|
+
* @example 400
|
|
6527
|
+
*/
|
|
6528
|
+
statusCode?: number;
|
|
6529
|
+
/**
|
|
6530
|
+
* @description Short error label
|
|
6531
|
+
* @example Bad Request
|
|
6532
|
+
*/
|
|
6533
|
+
error?: string;
|
|
6534
|
+
/**
|
|
6535
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6536
|
+
* @example Validation failed
|
|
6537
|
+
*/
|
|
6538
|
+
message: string | string[];
|
|
6539
|
+
};
|
|
6540
|
+
};
|
|
6541
|
+
};
|
|
6542
|
+
/** @description Not Found */
|
|
6543
|
+
404: {
|
|
6544
|
+
headers: {
|
|
6545
|
+
[name: string]: unknown;
|
|
6546
|
+
};
|
|
6547
|
+
content: {
|
|
6548
|
+
"application/json": {
|
|
6549
|
+
/**
|
|
6550
|
+
* @description HTTP status code
|
|
6551
|
+
* @example 400
|
|
6552
|
+
*/
|
|
6553
|
+
statusCode?: number;
|
|
6554
|
+
/**
|
|
6555
|
+
* @description Short error label
|
|
6556
|
+
* @example Bad Request
|
|
6557
|
+
*/
|
|
6558
|
+
error?: string;
|
|
6559
|
+
/**
|
|
6560
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6561
|
+
* @example Validation failed
|
|
6562
|
+
*/
|
|
6563
|
+
message: string | string[];
|
|
6564
|
+
};
|
|
6565
|
+
};
|
|
6566
|
+
};
|
|
6567
|
+
};
|
|
6568
|
+
};
|
|
6569
|
+
put?: never;
|
|
6570
|
+
post?: never;
|
|
6571
|
+
delete?: never;
|
|
6572
|
+
options?: never;
|
|
6573
|
+
head?: never;
|
|
6574
|
+
patch?: never;
|
|
6575
|
+
trace?: never;
|
|
6576
|
+
};
|
|
6577
|
+
"/v5/contracts/{contractAddress}/witnesses/intents/{intentId}": {
|
|
6578
|
+
parameters: {
|
|
6579
|
+
query?: never;
|
|
6580
|
+
header?: never;
|
|
6581
|
+
path?: never;
|
|
6582
|
+
cookie?: never;
|
|
6583
|
+
};
|
|
6584
|
+
/**
|
|
6585
|
+
* Recover a v5 witness intent's outcome
|
|
6586
|
+
* @description For a client that lost a finalize (or propose) response. Returns the stored finalize response when accounts has one, otherwise chain-api's status for the intent. The URL contract must be the caller's. Read-only: never finalizes.
|
|
6587
|
+
*/
|
|
6588
|
+
get: {
|
|
6589
|
+
parameters: {
|
|
6590
|
+
query?: never;
|
|
6591
|
+
header?: never;
|
|
6592
|
+
path: {
|
|
6593
|
+
contractAddress: string;
|
|
6594
|
+
intentId: string;
|
|
6595
|
+
};
|
|
6596
|
+
cookie?: never;
|
|
6597
|
+
};
|
|
6598
|
+
requestBody?: never;
|
|
6599
|
+
responses: {
|
|
6600
|
+
/** @description Success */
|
|
6601
|
+
200: {
|
|
6602
|
+
headers: {
|
|
6603
|
+
[name: string]: unknown;
|
|
6604
|
+
};
|
|
6605
|
+
content: {
|
|
6606
|
+
"application/json": {
|
|
6607
|
+
/** @enum {string} */
|
|
6608
|
+
source: "stored";
|
|
6609
|
+
intentId: string;
|
|
6610
|
+
registryVersion: number;
|
|
6611
|
+
/**
|
|
6612
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6613
|
+
* @enum {string}
|
|
6614
|
+
*/
|
|
6615
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired";
|
|
6616
|
+
/** @description The finalize response, exactly as first returned. */
|
|
6617
|
+
result: {
|
|
6618
|
+
[key: string]: unknown;
|
|
6619
|
+
};
|
|
6620
|
+
} | {
|
|
6621
|
+
/** @enum {string} */
|
|
6622
|
+
source: "chain";
|
|
6623
|
+
intentId: string;
|
|
6624
|
+
registryVersion: number;
|
|
6625
|
+
/**
|
|
6626
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6627
|
+
* @enum {string|null}
|
|
6628
|
+
*/
|
|
6629
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired" | null;
|
|
6630
|
+
/**
|
|
6631
|
+
* WitnessIntentChainStatus
|
|
6632
|
+
* @description chain-api's status for the intent, verbatim.
|
|
6633
|
+
*/
|
|
6634
|
+
status: {
|
|
6635
|
+
intentId: string;
|
|
6636
|
+
contractAddress: string;
|
|
6637
|
+
registryVersion: number;
|
|
6638
|
+
/** @enum {string} */
|
|
6639
|
+
status: "prepared" | "allocated" | "submitted" | "confirmed" | "failed" | "cancelled" | "expired_unsubmitted" | "unknown";
|
|
6640
|
+
prepareTtlSeconds: number;
|
|
6641
|
+
/** @description Present when `confirmed`. */
|
|
6642
|
+
witnessId?: string;
|
|
6643
|
+
/** @description Present when `confirmed`. */
|
|
6644
|
+
transactionHash?: string;
|
|
6645
|
+
/** @description Present when `confirmed`. */
|
|
6646
|
+
blockNumber?: number;
|
|
6647
|
+
/** @description Present when `unknown`. */
|
|
6648
|
+
reason?: string;
|
|
6649
|
+
};
|
|
6650
|
+
};
|
|
6651
|
+
};
|
|
6652
|
+
};
|
|
6653
|
+
/** @description Bad Request — validation failed */
|
|
6654
|
+
400: {
|
|
6655
|
+
headers: {
|
|
6656
|
+
[name: string]: unknown;
|
|
6657
|
+
};
|
|
6658
|
+
content: {
|
|
6659
|
+
"application/json": {
|
|
6660
|
+
/**
|
|
6661
|
+
* @description HTTP status code
|
|
6662
|
+
* @example 400
|
|
6663
|
+
*/
|
|
6664
|
+
statusCode?: number;
|
|
6665
|
+
/**
|
|
6666
|
+
* @description Short error label
|
|
6667
|
+
* @example Bad Request
|
|
6668
|
+
*/
|
|
6669
|
+
error?: string;
|
|
6670
|
+
/**
|
|
6671
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6672
|
+
* @example Validation failed
|
|
6673
|
+
*/
|
|
6674
|
+
message: string | string[];
|
|
6675
|
+
};
|
|
6676
|
+
};
|
|
6677
|
+
};
|
|
6678
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
6679
|
+
401: {
|
|
6680
|
+
headers: {
|
|
6681
|
+
[name: string]: unknown;
|
|
6682
|
+
};
|
|
6683
|
+
content: {
|
|
6684
|
+
"application/json": {
|
|
6685
|
+
/**
|
|
6686
|
+
* @description HTTP status code
|
|
6687
|
+
* @example 400
|
|
6688
|
+
*/
|
|
6689
|
+
statusCode?: number;
|
|
6690
|
+
/**
|
|
6691
|
+
* @description Short error label
|
|
6692
|
+
* @example Bad Request
|
|
6693
|
+
*/
|
|
6694
|
+
error?: string;
|
|
6695
|
+
/**
|
|
6696
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6697
|
+
* @example Validation failed
|
|
6698
|
+
*/
|
|
6699
|
+
message: string | string[];
|
|
6700
|
+
};
|
|
6701
|
+
};
|
|
6702
|
+
};
|
|
6703
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
6704
|
+
403: {
|
|
6705
|
+
headers: {
|
|
6706
|
+
[name: string]: unknown;
|
|
6707
|
+
};
|
|
6708
|
+
content: {
|
|
6709
|
+
"application/json": {
|
|
6710
|
+
/**
|
|
6711
|
+
* @description HTTP status code
|
|
6712
|
+
* @example 400
|
|
6713
|
+
*/
|
|
6714
|
+
statusCode?: number;
|
|
6715
|
+
/**
|
|
6716
|
+
* @description Short error label
|
|
6717
|
+
* @example Bad Request
|
|
6718
|
+
*/
|
|
6719
|
+
error?: string;
|
|
6720
|
+
/**
|
|
6721
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6722
|
+
* @example Validation failed
|
|
6723
|
+
*/
|
|
6724
|
+
message: string | string[];
|
|
6725
|
+
};
|
|
6726
|
+
};
|
|
6727
|
+
};
|
|
6728
|
+
/** @description Not Found */
|
|
6729
|
+
404: {
|
|
6730
|
+
headers: {
|
|
6731
|
+
[name: string]: unknown;
|
|
6732
|
+
};
|
|
6733
|
+
content: {
|
|
6734
|
+
"application/json": {
|
|
6735
|
+
/**
|
|
6736
|
+
* @description HTTP status code
|
|
6737
|
+
* @example 400
|
|
6738
|
+
*/
|
|
6739
|
+
statusCode?: number;
|
|
6740
|
+
/**
|
|
6741
|
+
* @description Short error label
|
|
6742
|
+
* @example Bad Request
|
|
6743
|
+
*/
|
|
6744
|
+
error?: string;
|
|
6745
|
+
/**
|
|
6746
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6747
|
+
* @example Validation failed
|
|
6748
|
+
*/
|
|
6749
|
+
message: string | string[];
|
|
6750
|
+
};
|
|
6751
|
+
};
|
|
6752
|
+
};
|
|
6753
|
+
};
|
|
6754
|
+
};
|
|
6755
|
+
put?: never;
|
|
6756
|
+
post?: never;
|
|
6757
|
+
delete?: never;
|
|
6758
|
+
options?: never;
|
|
6759
|
+
head?: never;
|
|
6760
|
+
patch?: never;
|
|
6761
|
+
trace?: never;
|
|
6762
|
+
};
|
|
6763
|
+
"/v1/account/provisioning-token/reissue": {
|
|
6764
|
+
parameters: {
|
|
6765
|
+
query?: never;
|
|
6766
|
+
header?: never;
|
|
6767
|
+
path?: never;
|
|
6768
|
+
cookie?: never;
|
|
6769
|
+
};
|
|
6770
|
+
get?: never;
|
|
6771
|
+
put?: never;
|
|
6772
|
+
/**
|
|
6773
|
+
* Re-mint a provisioning token (verified-but-not-provisioned recovery)
|
|
6774
|
+
* @description Mints a fresh single-use provisioning token for a signed-in user whose email is verified but who has no contract yet — recovery for when the token from email-verify was lost (e.g. verify opened on another device). Returns 409 if email is unverified or a contract already exists. Rate limited per account.
|
|
6775
|
+
*/
|
|
6776
|
+
post: {
|
|
6777
|
+
parameters: {
|
|
6778
|
+
query?: never;
|
|
6779
|
+
header?: never;
|
|
6780
|
+
path?: never;
|
|
6781
|
+
cookie?: never;
|
|
5627
6782
|
};
|
|
5628
6783
|
requestBody?: never;
|
|
5629
6784
|
responses: {
|
|
@@ -5811,6 +6966,18 @@ interface paths$1 {
|
|
|
5811
6966
|
* @enum {string}
|
|
5812
6967
|
*/
|
|
5813
6968
|
accountType: "metered" | "unlimited";
|
|
6969
|
+
/**
|
|
6970
|
+
* @description Subscription plan tier (drives the UI badge).
|
|
6971
|
+
* @enum {string}
|
|
6972
|
+
*/
|
|
6973
|
+
plan: "free" | "starter" | "professional" | "business" | "enterprise";
|
|
6974
|
+
/**
|
|
6975
|
+
* @description Stripe subscription state; `none` on the free tier.
|
|
6976
|
+
* @enum {string}
|
|
6977
|
+
*/
|
|
6978
|
+
subscriptionStatus: "none" | "active" | "past_due" | "canceled";
|
|
6979
|
+
/** @description ISO end of the current paid period ("Renews on…"); null on free. */
|
|
6980
|
+
currentPeriodEnd: string | null;
|
|
5814
6981
|
/** @description Cached credit balance; `null` for `unlimited` orgs. */
|
|
5815
6982
|
balance: number | null;
|
|
5816
6983
|
isPersonal: boolean;
|
|
@@ -5926,6 +7093,8 @@ interface paths$1 {
|
|
|
5926
7093
|
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
5927
7094
|
*/
|
|
5928
7095
|
organizationId: string;
|
|
7096
|
+
/** @description True if the org was also deleted (personal org). False for a shared org, where only the caller was removed and the org left intact. */
|
|
7097
|
+
orgDeleted: boolean;
|
|
5929
7098
|
/** @description How many OpenBao Transit keys were destroyed. */
|
|
5930
7099
|
vaultKeysPurged: number;
|
|
5931
7100
|
notice: string;
|
|
@@ -6116,7 +7285,7 @@ interface paths$1 {
|
|
|
6116
7285
|
content: {
|
|
6117
7286
|
"application/json": {
|
|
6118
7287
|
sessions: {
|
|
6119
|
-
/** @description
|
|
7288
|
+
/** @description Opaque identifier of the token: the sha256 of its id, never the token itself. Use as the path param for DELETE. */
|
|
6120
7289
|
jti: string;
|
|
6121
7290
|
/** @enum {string} */
|
|
6122
7291
|
kind: "AccessToken" | "RefreshToken";
|
|
@@ -6288,6 +7457,109 @@ interface paths$1 {
|
|
|
6288
7457
|
patch?: never;
|
|
6289
7458
|
trace?: never;
|
|
6290
7459
|
};
|
|
7460
|
+
"/v1/oauth/introspect": {
|
|
7461
|
+
parameters: {
|
|
7462
|
+
query?: never;
|
|
7463
|
+
header?: never;
|
|
7464
|
+
path?: never;
|
|
7465
|
+
cookie?: never;
|
|
7466
|
+
};
|
|
7467
|
+
get?: never;
|
|
7468
|
+
put?: never;
|
|
7469
|
+
/**
|
|
7470
|
+
* Check whether an accounts-minted access token is still active
|
|
7471
|
+
* @description For resource servers (MCP, chain API). Verifies the signature, then checks the security epoch, the grant or session the token came from, and the membership, uncached. Answers 200 `{active:false}` for any token that is not active. Callers MUST treat any non-200 answer or network failure as inactive. See docs/token-introspection.md.
|
|
7472
|
+
*/
|
|
7473
|
+
post: {
|
|
7474
|
+
parameters: {
|
|
7475
|
+
query?: never;
|
|
7476
|
+
header?: never;
|
|
7477
|
+
path?: never;
|
|
7478
|
+
cookie?: never;
|
|
7479
|
+
};
|
|
7480
|
+
requestBody?: {
|
|
7481
|
+
content: {
|
|
7482
|
+
"application/json": {
|
|
7483
|
+
/** @description The bearer JWT the caller received (an accounts-minted access token). */
|
|
7484
|
+
token: string;
|
|
7485
|
+
};
|
|
7486
|
+
};
|
|
7487
|
+
};
|
|
7488
|
+
responses: {
|
|
7489
|
+
/** @description Success */
|
|
7490
|
+
200: {
|
|
7491
|
+
headers: {
|
|
7492
|
+
[name: string]: unknown;
|
|
7493
|
+
};
|
|
7494
|
+
content: {
|
|
7495
|
+
"application/json": {
|
|
7496
|
+
/** @enum {boolean} */
|
|
7497
|
+
active: true;
|
|
7498
|
+
/**
|
|
7499
|
+
* @description `oauth`: issued by the OAuth flow from a grant. `session`: minted by POST /v1/auth/access-token.
|
|
7500
|
+
* @enum {string}
|
|
7501
|
+
*/
|
|
7502
|
+
token_kind: "oauth" | "session";
|
|
7503
|
+
/** @description False when the membership in `org` is suspended: the caller MUST refuse writes. */
|
|
7504
|
+
writable: boolean;
|
|
7505
|
+
sub: string;
|
|
7506
|
+
client_id: string | null;
|
|
7507
|
+
scope: string;
|
|
7508
|
+
aud: string | string[] | unknown;
|
|
7509
|
+
iss: string;
|
|
7510
|
+
exp: number;
|
|
7511
|
+
iat: number;
|
|
7512
|
+
jti: string;
|
|
7513
|
+
/** @description Organization the token acts in; its membership is active. */
|
|
7514
|
+
org: string;
|
|
7515
|
+
/**
|
|
7516
|
+
* @description The CURRENT membership role in `org` (authoritative over the token's `role` claim).
|
|
7517
|
+
* @enum {string}
|
|
7518
|
+
*/
|
|
7519
|
+
role: "org-admin" | "member";
|
|
7520
|
+
contracts: string[];
|
|
7521
|
+
sepoch: number;
|
|
7522
|
+
grant_id: string | null;
|
|
7523
|
+
session_id: string | null;
|
|
7524
|
+
} | {
|
|
7525
|
+
/** @enum {boolean} */
|
|
7526
|
+
active: false;
|
|
7527
|
+
};
|
|
7528
|
+
};
|
|
7529
|
+
};
|
|
7530
|
+
/** @description Bad Request — validation failed */
|
|
7531
|
+
400: {
|
|
7532
|
+
headers: {
|
|
7533
|
+
[name: string]: unknown;
|
|
7534
|
+
};
|
|
7535
|
+
content: {
|
|
7536
|
+
"application/json": {
|
|
7537
|
+
/**
|
|
7538
|
+
* @description HTTP status code
|
|
7539
|
+
* @example 400
|
|
7540
|
+
*/
|
|
7541
|
+
statusCode?: number;
|
|
7542
|
+
/**
|
|
7543
|
+
* @description Short error label
|
|
7544
|
+
* @example Bad Request
|
|
7545
|
+
*/
|
|
7546
|
+
error?: string;
|
|
7547
|
+
/**
|
|
7548
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7549
|
+
* @example Validation failed
|
|
7550
|
+
*/
|
|
7551
|
+
message: string | string[];
|
|
7552
|
+
};
|
|
7553
|
+
};
|
|
7554
|
+
};
|
|
7555
|
+
};
|
|
7556
|
+
};
|
|
7557
|
+
delete?: never;
|
|
7558
|
+
options?: never;
|
|
7559
|
+
head?: never;
|
|
7560
|
+
patch?: never;
|
|
7561
|
+
trace?: never;
|
|
7562
|
+
};
|
|
6291
7563
|
"/v1/account/mfa/totp/enroll": {
|
|
6292
7564
|
parameters: {
|
|
6293
7565
|
query?: never;
|
|
@@ -6310,28 +7582,180 @@ interface paths$1 {
|
|
|
6310
7582
|
};
|
|
6311
7583
|
requestBody?: never;
|
|
6312
7584
|
responses: {
|
|
6313
|
-
/** @description
|
|
6314
|
-
|
|
7585
|
+
/** @description Created */
|
|
7586
|
+
201: {
|
|
7587
|
+
headers: {
|
|
7588
|
+
[name: string]: unknown;
|
|
7589
|
+
};
|
|
7590
|
+
content: {
|
|
7591
|
+
"application/json": {
|
|
7592
|
+
/**
|
|
7593
|
+
* @description Base32 TOTP secret. Show to the user as a typeable fallback alongside the QR code rendered from `otpauthUrl`.
|
|
7594
|
+
* @example JBSWY3DPEHPK3PXP
|
|
7595
|
+
*/
|
|
7596
|
+
secret: string;
|
|
7597
|
+
/**
|
|
7598
|
+
* @description Standard `otpauth://totp/...` URL. The dashboard renders this as a QR code; the user scans it with an authenticator app.
|
|
7599
|
+
* @example otpauth://totp/WitniumChain:alice%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=WitniumChain&algorithm=SHA1&digits=6&period=30
|
|
7600
|
+
*/
|
|
7601
|
+
otpauthUrl: string;
|
|
7602
|
+
};
|
|
7603
|
+
};
|
|
7604
|
+
};
|
|
7605
|
+
/** @description Bad Request — validation failed */
|
|
7606
|
+
400: {
|
|
7607
|
+
headers: {
|
|
7608
|
+
[name: string]: unknown;
|
|
7609
|
+
};
|
|
7610
|
+
content: {
|
|
7611
|
+
"application/json": {
|
|
7612
|
+
/**
|
|
7613
|
+
* @description HTTP status code
|
|
7614
|
+
* @example 400
|
|
7615
|
+
*/
|
|
7616
|
+
statusCode?: number;
|
|
7617
|
+
/**
|
|
7618
|
+
* @description Short error label
|
|
7619
|
+
* @example Bad Request
|
|
7620
|
+
*/
|
|
7621
|
+
error?: string;
|
|
7622
|
+
/**
|
|
7623
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7624
|
+
* @example Validation failed
|
|
7625
|
+
*/
|
|
7626
|
+
message: string | string[];
|
|
7627
|
+
};
|
|
7628
|
+
};
|
|
7629
|
+
};
|
|
7630
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
7631
|
+
401: {
|
|
7632
|
+
headers: {
|
|
7633
|
+
[name: string]: unknown;
|
|
7634
|
+
};
|
|
7635
|
+
content: {
|
|
7636
|
+
"application/json": {
|
|
7637
|
+
/**
|
|
7638
|
+
* @description HTTP status code
|
|
7639
|
+
* @example 400
|
|
7640
|
+
*/
|
|
7641
|
+
statusCode?: number;
|
|
7642
|
+
/**
|
|
7643
|
+
* @description Short error label
|
|
7644
|
+
* @example Bad Request
|
|
7645
|
+
*/
|
|
7646
|
+
error?: string;
|
|
7647
|
+
/**
|
|
7648
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7649
|
+
* @example Validation failed
|
|
7650
|
+
*/
|
|
7651
|
+
message: string | string[];
|
|
7652
|
+
};
|
|
7653
|
+
};
|
|
7654
|
+
};
|
|
7655
|
+
};
|
|
7656
|
+
};
|
|
7657
|
+
delete?: never;
|
|
7658
|
+
options?: never;
|
|
7659
|
+
head?: never;
|
|
7660
|
+
patch?: never;
|
|
7661
|
+
trace?: never;
|
|
7662
|
+
};
|
|
7663
|
+
"/v1/account/mfa/totp/confirm": {
|
|
7664
|
+
parameters: {
|
|
7665
|
+
query?: never;
|
|
7666
|
+
header?: never;
|
|
7667
|
+
path?: never;
|
|
7668
|
+
cookie?: never;
|
|
7669
|
+
};
|
|
7670
|
+
get?: never;
|
|
7671
|
+
put?: never;
|
|
7672
|
+
/**
|
|
7673
|
+
* Confirm TOTP enrolment
|
|
7674
|
+
* @description Validates the first user-supplied code against the secret minted by `/enroll`, marks the enrolment confirmed, and returns 10 single-use recovery codes. The recovery codes appear ONCE in this response and are never readable again — the dashboard must show them immediately and prompt the user to store them. Confirming bumps the user's security epoch: every OTHER session, session-minted access token and OAuth grant of the user ends; the calling session stays valid. Access tokens minted earlier from this session via `/v1/auth/access-token` stop working too and must be re-minted. 409 when the enrolment was restarted (`/enroll` called again) after this code was checked: scan the new QR code and confirm again. 429 when the per-user second-factor attempt budget is exhausted.
|
|
7675
|
+
*/
|
|
7676
|
+
post: {
|
|
7677
|
+
parameters: {
|
|
7678
|
+
query?: never;
|
|
7679
|
+
header?: never;
|
|
7680
|
+
path?: never;
|
|
7681
|
+
cookie?: never;
|
|
7682
|
+
};
|
|
7683
|
+
requestBody?: {
|
|
7684
|
+
content: {
|
|
7685
|
+
"application/json": {
|
|
7686
|
+
/**
|
|
7687
|
+
* @description Current 6-digit TOTP code shown by the authenticator app.
|
|
7688
|
+
* @example 123456
|
|
7689
|
+
*/
|
|
7690
|
+
code: string;
|
|
7691
|
+
};
|
|
7692
|
+
};
|
|
7693
|
+
};
|
|
7694
|
+
responses: {
|
|
7695
|
+
/** @description Created */
|
|
7696
|
+
201: {
|
|
7697
|
+
headers: {
|
|
7698
|
+
[name: string]: unknown;
|
|
7699
|
+
};
|
|
7700
|
+
content: {
|
|
7701
|
+
"application/json": {
|
|
7702
|
+
/** @description Ten single-use recovery codes. Shown ONCE and never returned again — the user must store them now. Each code is consumed atomically when used in place of a TOTP code at MFA challenge time. */
|
|
7703
|
+
recoveryCodes: string[];
|
|
7704
|
+
};
|
|
7705
|
+
};
|
|
7706
|
+
};
|
|
7707
|
+
/** @description Bad Request — validation failed */
|
|
7708
|
+
400: {
|
|
7709
|
+
headers: {
|
|
7710
|
+
[name: string]: unknown;
|
|
7711
|
+
};
|
|
7712
|
+
content: {
|
|
7713
|
+
"application/json": {
|
|
7714
|
+
/**
|
|
7715
|
+
* @description HTTP status code
|
|
7716
|
+
* @example 400
|
|
7717
|
+
*/
|
|
7718
|
+
statusCode?: number;
|
|
7719
|
+
/**
|
|
7720
|
+
* @description Short error label
|
|
7721
|
+
* @example Bad Request
|
|
7722
|
+
*/
|
|
7723
|
+
error?: string;
|
|
7724
|
+
/**
|
|
7725
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7726
|
+
* @example Validation failed
|
|
7727
|
+
*/
|
|
7728
|
+
message: string | string[];
|
|
7729
|
+
};
|
|
7730
|
+
};
|
|
7731
|
+
};
|
|
7732
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
7733
|
+
401: {
|
|
6315
7734
|
headers: {
|
|
6316
7735
|
[name: string]: unknown;
|
|
6317
7736
|
};
|
|
6318
7737
|
content: {
|
|
6319
7738
|
"application/json": {
|
|
6320
7739
|
/**
|
|
6321
|
-
* @description
|
|
6322
|
-
* @example
|
|
7740
|
+
* @description HTTP status code
|
|
7741
|
+
* @example 400
|
|
6323
7742
|
*/
|
|
6324
|
-
|
|
7743
|
+
statusCode?: number;
|
|
6325
7744
|
/**
|
|
6326
|
-
* @description
|
|
6327
|
-
* @example
|
|
7745
|
+
* @description Short error label
|
|
7746
|
+
* @example Bad Request
|
|
6328
7747
|
*/
|
|
6329
|
-
|
|
7748
|
+
error?: string;
|
|
7749
|
+
/**
|
|
7750
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7751
|
+
* @example Validation failed
|
|
7752
|
+
*/
|
|
7753
|
+
message: string | string[];
|
|
6330
7754
|
};
|
|
6331
7755
|
};
|
|
6332
7756
|
};
|
|
6333
|
-
/** @description
|
|
6334
|
-
|
|
7757
|
+
/** @description Conflict */
|
|
7758
|
+
409: {
|
|
6335
7759
|
headers: {
|
|
6336
7760
|
[name: string]: unknown;
|
|
6337
7761
|
};
|
|
@@ -6355,8 +7779,8 @@ interface paths$1 {
|
|
|
6355
7779
|
};
|
|
6356
7780
|
};
|
|
6357
7781
|
};
|
|
6358
|
-
/** @description
|
|
6359
|
-
|
|
7782
|
+
/** @description Too Many Requests */
|
|
7783
|
+
429: {
|
|
6360
7784
|
headers: {
|
|
6361
7785
|
[name: string]: unknown;
|
|
6362
7786
|
};
|
|
@@ -6388,7 +7812,7 @@ interface paths$1 {
|
|
|
6388
7812
|
patch?: never;
|
|
6389
7813
|
trace?: never;
|
|
6390
7814
|
};
|
|
6391
|
-
"/v1/account/mfa/totp
|
|
7815
|
+
"/v1/account/mfa/totp": {
|
|
6392
7816
|
parameters: {
|
|
6393
7817
|
query?: never;
|
|
6394
7818
|
header?: never;
|
|
@@ -6397,11 +7821,12 @@ interface paths$1 {
|
|
|
6397
7821
|
};
|
|
6398
7822
|
get?: never;
|
|
6399
7823
|
put?: never;
|
|
7824
|
+
post?: never;
|
|
6400
7825
|
/**
|
|
6401
|
-
*
|
|
6402
|
-
* @description
|
|
7826
|
+
* Disable TOTP and clear recovery codes
|
|
7827
|
+
* @description Wipes the TOTP secret and all recovery codes. The user re-enrolls from scratch with `/enroll`. Step-up: the JSON body must carry a fresh second factor (`code` or `recoveryCode`); 403 `mfa_step_up_failed` when it is wrong or already used, 429 when the attempt budget is exhausted.
|
|
6403
7828
|
*/
|
|
6404
|
-
|
|
7829
|
+
delete: {
|
|
6405
7830
|
parameters: {
|
|
6406
7831
|
query?: never;
|
|
6407
7832
|
header?: never;
|
|
@@ -6412,10 +7837,15 @@ interface paths$1 {
|
|
|
6412
7837
|
content: {
|
|
6413
7838
|
"application/json": {
|
|
6414
7839
|
/**
|
|
6415
|
-
* @description Current 6-digit TOTP code
|
|
7840
|
+
* @description Current 6-digit TOTP code. Each code is accepted once.
|
|
6416
7841
|
* @example 123456
|
|
6417
7842
|
*/
|
|
6418
|
-
code
|
|
7843
|
+
code?: string;
|
|
7844
|
+
/**
|
|
7845
|
+
* @description An unused recovery code (consumed by this request).
|
|
7846
|
+
* @example ABCD-EFGH
|
|
7847
|
+
*/
|
|
7848
|
+
recoveryCode?: string;
|
|
6419
7849
|
};
|
|
6420
7850
|
};
|
|
6421
7851
|
};
|
|
@@ -6427,8 +7857,8 @@ interface paths$1 {
|
|
|
6427
7857
|
};
|
|
6428
7858
|
content: {
|
|
6429
7859
|
"application/json": {
|
|
6430
|
-
/** @
|
|
6431
|
-
|
|
7860
|
+
/** @enum {boolean} */
|
|
7861
|
+
disabled: true;
|
|
6432
7862
|
};
|
|
6433
7863
|
};
|
|
6434
7864
|
};
|
|
@@ -6482,51 +7912,33 @@ interface paths$1 {
|
|
|
6482
7912
|
};
|
|
6483
7913
|
};
|
|
6484
7914
|
};
|
|
6485
|
-
|
|
6486
|
-
|
|
6487
|
-
delete?: never;
|
|
6488
|
-
options?: never;
|
|
6489
|
-
head?: never;
|
|
6490
|
-
patch?: never;
|
|
6491
|
-
trace?: never;
|
|
6492
|
-
};
|
|
6493
|
-
"/v1/account/mfa/totp": {
|
|
6494
|
-
parameters: {
|
|
6495
|
-
query?: never;
|
|
6496
|
-
header?: never;
|
|
6497
|
-
path?: never;
|
|
6498
|
-
cookie?: never;
|
|
6499
|
-
};
|
|
6500
|
-
get?: never;
|
|
6501
|
-
put?: never;
|
|
6502
|
-
post?: never;
|
|
6503
|
-
/**
|
|
6504
|
-
* Disable TOTP and clear recovery codes
|
|
6505
|
-
* @description Wipes the TOTP secret and all recovery codes. The user re-enrolls from scratch with `/enroll`. Future versions of this endpoint will require a recent MFA assertion (step-up) — Thread E of Phase AUTH.
|
|
6506
|
-
*/
|
|
6507
|
-
delete: {
|
|
6508
|
-
parameters: {
|
|
6509
|
-
query?: never;
|
|
6510
|
-
header?: never;
|
|
6511
|
-
path?: never;
|
|
6512
|
-
cookie?: never;
|
|
6513
|
-
};
|
|
6514
|
-
requestBody?: never;
|
|
6515
|
-
responses: {
|
|
6516
|
-
/** @description Success */
|
|
6517
|
-
200: {
|
|
7915
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
7916
|
+
403: {
|
|
6518
7917
|
headers: {
|
|
6519
7918
|
[name: string]: unknown;
|
|
6520
7919
|
};
|
|
6521
7920
|
content: {
|
|
6522
7921
|
"application/json": {
|
|
6523
|
-
/**
|
|
6524
|
-
|
|
7922
|
+
/**
|
|
7923
|
+
* @description HTTP status code
|
|
7924
|
+
* @example 400
|
|
7925
|
+
*/
|
|
7926
|
+
statusCode?: number;
|
|
7927
|
+
/**
|
|
7928
|
+
* @description Short error label
|
|
7929
|
+
* @example Bad Request
|
|
7930
|
+
*/
|
|
7931
|
+
error?: string;
|
|
7932
|
+
/**
|
|
7933
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7934
|
+
* @example Validation failed
|
|
7935
|
+
*/
|
|
7936
|
+
message: string | string[];
|
|
6525
7937
|
};
|
|
6526
7938
|
};
|
|
6527
7939
|
};
|
|
6528
|
-
/** @description
|
|
6529
|
-
|
|
7940
|
+
/** @description Too Many Requests */
|
|
7941
|
+
429: {
|
|
6530
7942
|
headers: {
|
|
6531
7943
|
[name: string]: unknown;
|
|
6532
7944
|
};
|
|
@@ -6568,7 +7980,7 @@ interface paths$1 {
|
|
|
6568
7980
|
put?: never;
|
|
6569
7981
|
/**
|
|
6570
7982
|
* Generate a fresh set of recovery codes
|
|
6571
|
-
* @description Invalidates the prior set and issues 10 new codes.
|
|
7983
|
+
* @description Invalidates the prior set and issues 10 new codes. Step-up: the JSON body must carry a fresh second factor (`code` or `recoveryCode`); 403 `mfa_step_up_failed` when it is wrong or already used, 429 when the attempt budget is exhausted.
|
|
6572
7984
|
*/
|
|
6573
7985
|
post: {
|
|
6574
7986
|
parameters: {
|
|
@@ -6577,10 +7989,25 @@ interface paths$1 {
|
|
|
6577
7989
|
path?: never;
|
|
6578
7990
|
cookie?: never;
|
|
6579
7991
|
};
|
|
6580
|
-
requestBody?:
|
|
7992
|
+
requestBody?: {
|
|
7993
|
+
content: {
|
|
7994
|
+
"application/json": {
|
|
7995
|
+
/**
|
|
7996
|
+
* @description Current 6-digit TOTP code. Each code is accepted once.
|
|
7997
|
+
* @example 123456
|
|
7998
|
+
*/
|
|
7999
|
+
code?: string;
|
|
8000
|
+
/**
|
|
8001
|
+
* @description An unused recovery code (consumed by this request).
|
|
8002
|
+
* @example ABCD-EFGH
|
|
8003
|
+
*/
|
|
8004
|
+
recoveryCode?: string;
|
|
8005
|
+
};
|
|
8006
|
+
};
|
|
8007
|
+
};
|
|
6581
8008
|
responses: {
|
|
6582
|
-
/** @description
|
|
6583
|
-
|
|
8009
|
+
/** @description Created */
|
|
8010
|
+
201: {
|
|
6584
8011
|
headers: {
|
|
6585
8012
|
[name: string]: unknown;
|
|
6586
8013
|
};
|
|
@@ -6641,6 +8068,56 @@ interface paths$1 {
|
|
|
6641
8068
|
};
|
|
6642
8069
|
};
|
|
6643
8070
|
};
|
|
8071
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
8072
|
+
403: {
|
|
8073
|
+
headers: {
|
|
8074
|
+
[name: string]: unknown;
|
|
8075
|
+
};
|
|
8076
|
+
content: {
|
|
8077
|
+
"application/json": {
|
|
8078
|
+
/**
|
|
8079
|
+
* @description HTTP status code
|
|
8080
|
+
* @example 400
|
|
8081
|
+
*/
|
|
8082
|
+
statusCode?: number;
|
|
8083
|
+
/**
|
|
8084
|
+
* @description Short error label
|
|
8085
|
+
* @example Bad Request
|
|
8086
|
+
*/
|
|
8087
|
+
error?: string;
|
|
8088
|
+
/**
|
|
8089
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
8090
|
+
* @example Validation failed
|
|
8091
|
+
*/
|
|
8092
|
+
message: string | string[];
|
|
8093
|
+
};
|
|
8094
|
+
};
|
|
8095
|
+
};
|
|
8096
|
+
/** @description Too Many Requests */
|
|
8097
|
+
429: {
|
|
8098
|
+
headers: {
|
|
8099
|
+
[name: string]: unknown;
|
|
8100
|
+
};
|
|
8101
|
+
content: {
|
|
8102
|
+
"application/json": {
|
|
8103
|
+
/**
|
|
8104
|
+
* @description HTTP status code
|
|
8105
|
+
* @example 400
|
|
8106
|
+
*/
|
|
8107
|
+
statusCode?: number;
|
|
8108
|
+
/**
|
|
8109
|
+
* @description Short error label
|
|
8110
|
+
* @example Bad Request
|
|
8111
|
+
*/
|
|
8112
|
+
error?: string;
|
|
8113
|
+
/**
|
|
8114
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
8115
|
+
* @example Validation failed
|
|
8116
|
+
*/
|
|
8117
|
+
message: string | string[];
|
|
8118
|
+
};
|
|
8119
|
+
};
|
|
8120
|
+
};
|
|
6644
8121
|
};
|
|
6645
8122
|
};
|
|
6646
8123
|
delete?: never;
|
|
@@ -7168,12 +8645,6 @@ interface paths {
|
|
|
7168
8645
|
* @description AGE-armored tlock ciphertext, hex-encoded UTF-8. Output of tlock-js `timelockEncrypt`. Max 4096 bytes (8192 hex chars).
|
|
7169
8646
|
*/
|
|
7170
8647
|
tlockCiphertext?: string;
|
|
7171
|
-
/**
|
|
7172
|
-
* Format: uri
|
|
7173
|
-
* @description Valid URL
|
|
7174
|
-
* @example https://example.com/path
|
|
7175
|
-
*/
|
|
7176
|
-
callbackUrl?: string;
|
|
7177
8648
|
};
|
|
7178
8649
|
};
|
|
7179
8650
|
};
|
|
@@ -8424,14 +9895,20 @@ interface paths {
|
|
|
8424
9895
|
};
|
|
8425
9896
|
/**
|
|
8426
9897
|
* List v5 witnesses (optionally filtered by dataId)
|
|
8427
|
-
* @description
|
|
9898
|
+
* @description Lists WitnessCreated events, newest first. The v5 event adds drandRound — non-zero means the witness carries a drand IBE ciphertext decryptable at that round. Query the full witness via /get for the ciphertext bytes. Each request scans one window of at most 200,000 blocks of the WitnessCreated event log, newest first: from `beforeBlock - 1` (or the head) down, never below the deploy block. To list everything, repeat the request with `beforeBlock = nextBeforeBlock`, `beforeLogIndex = nextBeforeLogIndex` (omitted when null) and no `offset`, until `nextBeforeBlock` is null; every matching witness is returned exactly once, newest first. A page can be empty while older witnesses exist; only a null `nextBeforeBlock` means the listing is exhausted. `hasMore` reports more matches inside the current window.
|
|
8428
9899
|
*/
|
|
8429
9900
|
get: {
|
|
8430
9901
|
parameters: {
|
|
8431
9902
|
query?: {
|
|
8432
9903
|
dataId?: string;
|
|
9904
|
+
/** @description Page size, 1-200, default 50. */
|
|
8433
9905
|
limit?: number;
|
|
9906
|
+
/** @description Offset into the matches of this scan window, 0-10000. */
|
|
8434
9907
|
offset?: number | null;
|
|
9908
|
+
/** @description Exclusive upper bound of the scan: blocks below it are scanned. Omit for the head; to continue, pass the previous response's `nextBeforeBlock`. At most the current head + 1. */
|
|
9909
|
+
beforeBlock?: number | null;
|
|
9910
|
+
/** @description Requires `beforeBlock`. Within block `beforeBlock - 1`, only logs with a lower log index are listed. Pass the previous response's `nextBeforeLogIndex` when it is not null. */
|
|
9911
|
+
beforeLogIndex?: number | null;
|
|
8435
9912
|
};
|
|
8436
9913
|
header?: never;
|
|
8437
9914
|
path: {
|
|
@@ -8466,6 +9943,12 @@ interface paths {
|
|
|
8466
9943
|
}[];
|
|
8467
9944
|
hasMore: boolean;
|
|
8468
9945
|
totalReturned: number;
|
|
9946
|
+
/** @description True when this request's scan window reached the contract's deploy block. */
|
|
9947
|
+
scanComplete: boolean;
|
|
9948
|
+
/** @description The `beforeBlock` of the next page. Null when every matching witness has been listed. */
|
|
9949
|
+
nextBeforeBlock: number | null;
|
|
9950
|
+
/** @description The `beforeLogIndex` of the next page, or null to start at the top of block `nextBeforeBlock - 1`. */
|
|
9951
|
+
nextBeforeLogIndex: number | null;
|
|
8469
9952
|
};
|
|
8470
9953
|
};
|
|
8471
9954
|
};
|
|
@@ -8934,6 +10417,8 @@ interface paths {
|
|
|
8934
10417
|
*
|
|
8935
10418
|
* Response shape is identical to GET /v5/contracts/{addr}/witnesses; the
|
|
8936
10419
|
* scan is always newest-first.
|
|
10420
|
+
*
|
|
10421
|
+
* Each request scans one window of at most 200,000 blocks of the WitnessCreated event log, newest first: from `beforeBlock - 1` (or the head) down, never below the deploy block. To list everything, repeat the request with `beforeBlock = nextBeforeBlock`, `beforeLogIndex = nextBeforeLogIndex` (omitted when null) and no `offset`, until `nextBeforeBlock` is null; every matching witness is returned exactly once, newest first. A page can be empty while older witnesses exist; only a null `nextBeforeBlock` means the listing is exhausted. `hasMore` reports more matches inside the current window.
|
|
8937
10422
|
*/
|
|
8938
10423
|
get: {
|
|
8939
10424
|
parameters: {
|
|
@@ -8946,8 +10431,12 @@ interface paths {
|
|
|
8946
10431
|
timeLock?: "locked" | "none" | "any";
|
|
8947
10432
|
/** @description Page size, 1-200, default 50. */
|
|
8948
10433
|
limit?: number;
|
|
8949
|
-
/** @description Offset into the
|
|
10434
|
+
/** @description Offset into the matches of this scan window, 0-10000. */
|
|
8950
10435
|
offset?: number | null;
|
|
10436
|
+
/** @description Exclusive upper bound of the scan: blocks below it are scanned. Omit for the head; to continue, pass the previous response's `nextBeforeBlock`. At most the current head + 1. */
|
|
10437
|
+
beforeBlock?: number | null;
|
|
10438
|
+
/** @description Requires `beforeBlock`. Within block `beforeBlock - 1`, only logs with a lower log index are listed. Pass the previous response's `nextBeforeLogIndex` when it is not null. */
|
|
10439
|
+
beforeLogIndex?: number | null;
|
|
8951
10440
|
};
|
|
8952
10441
|
header?: never;
|
|
8953
10442
|
path?: never;
|
|
@@ -8979,6 +10468,12 @@ interface paths {
|
|
|
8979
10468
|
}[];
|
|
8980
10469
|
hasMore: boolean;
|
|
8981
10470
|
totalReturned: number;
|
|
10471
|
+
/** @description True when this request's scan window reached the contract's deploy block. */
|
|
10472
|
+
scanComplete: boolean;
|
|
10473
|
+
/** @description The `beforeBlock` of the next page. Null when every matching witness has been listed. */
|
|
10474
|
+
nextBeforeBlock: number | null;
|
|
10475
|
+
/** @description The `beforeLogIndex` of the next page, or null to start at the top of block `nextBeforeBlock - 1`. */
|
|
10476
|
+
nextBeforeLogIndex: number | null;
|
|
8982
10477
|
};
|
|
8983
10478
|
};
|
|
8984
10479
|
};
|
|
@@ -9992,7 +11487,7 @@ interface paths {
|
|
|
9992
11487
|
};
|
|
9993
11488
|
/**
|
|
9994
11489
|
* Liveness probe
|
|
9995
|
-
* @description Kubernetes liveness probe.
|
|
11490
|
+
* @description Kubernetes liveness probe. Answers 200 while the process serves HTTP; it checks no dependency (dependency health is the readiness probe).
|
|
9996
11491
|
*/
|
|
9997
11492
|
get: {
|
|
9998
11493
|
parameters: {
|
|
@@ -10011,41 +11506,7 @@ interface paths {
|
|
|
10011
11506
|
content: {
|
|
10012
11507
|
"application/json": {
|
|
10013
11508
|
/** @enum {string} */
|
|
10014
|
-
status: "
|
|
10015
|
-
/**
|
|
10016
|
-
* QueueStatus
|
|
10017
|
-
* @description Queue health status
|
|
10018
|
-
*/
|
|
10019
|
-
queue: {
|
|
10020
|
-
healthy: boolean;
|
|
10021
|
-
timeSinceLastPingMs: number;
|
|
10022
|
-
/** Format: date-time */
|
|
10023
|
-
lastPing?: string;
|
|
10024
|
-
};
|
|
10025
|
-
};
|
|
10026
|
-
};
|
|
10027
|
-
};
|
|
10028
|
-
/** @description Service Unavailable */
|
|
10029
|
-
503: {
|
|
10030
|
-
headers: {
|
|
10031
|
-
[name: string]: unknown;
|
|
10032
|
-
};
|
|
10033
|
-
content: {
|
|
10034
|
-
"application/json": {
|
|
10035
|
-
/**
|
|
10036
|
-
* @description Error message
|
|
10037
|
-
* @example Validation failed
|
|
10038
|
-
*/
|
|
10039
|
-
error: string;
|
|
10040
|
-
/**
|
|
10041
|
-
* @description Machine-readable error code
|
|
10042
|
-
* @example VALIDATION_FAILED
|
|
10043
|
-
*/
|
|
10044
|
-
code?: string;
|
|
10045
|
-
/** @description Field-level validation errors */
|
|
10046
|
-
details?: {
|
|
10047
|
-
[key: string]: string[];
|
|
10048
|
-
};
|
|
11509
|
+
status: "alive";
|
|
10049
11510
|
};
|
|
10050
11511
|
};
|
|
10051
11512
|
};
|
|
@@ -10259,11 +11720,15 @@ type JsonBody<T> = T extends {
|
|
|
10259
11720
|
type Req<P extends keyof paths$1, M extends keyof paths$1[P]> = JsonBody<Extract<paths$1[P][M], {
|
|
10260
11721
|
requestBody?: unknown;
|
|
10261
11722
|
}>['requestBody']>;
|
|
10262
|
-
|
|
10263
|
-
|
|
10264
|
-
|
|
10265
|
-
|
|
10266
|
-
|
|
11723
|
+
/** HTTP success codes an operation's response body is taken from. */
|
|
11724
|
+
type SuccessCode = 200 | 201 | 202 | 203;
|
|
11725
|
+
/**
|
|
11726
|
+
* The JSON body of an accounts operation's success response, whichever 2xx
|
|
11727
|
+
* code the spec documents (accounts answers POSTs with 201).
|
|
11728
|
+
*/
|
|
11729
|
+
type Res<P extends keyof paths$1, M extends keyof paths$1[P]> = paths$1[P][M] extends {
|
|
11730
|
+
responses: infer R;
|
|
11731
|
+
} ? JsonBody<R[Extract<keyof R, SuccessCode>]> : never;
|
|
10267
11732
|
type ChainRes<P extends keyof paths, M extends keyof paths[P], S extends number = 200> = paths[P][M] extends {
|
|
10268
11733
|
responses: {
|
|
10269
11734
|
[K in S]: infer R;
|
|
@@ -10274,6 +11739,7 @@ type SignupResponse = Res<'/v1/auth/signup', 'post'>;
|
|
|
10274
11739
|
type VerifyEmailResponse = Res<'/v1/auth/verify', 'get'>;
|
|
10275
11740
|
type LoginRequest = Req<'/v1/auth/login', 'post'>;
|
|
10276
11741
|
type LoginResponse = Res<'/v1/auth/login', 'post'>;
|
|
11742
|
+
type LoginMfaResponse = Res<'/v1/auth/login/mfa', 'post'>;
|
|
10277
11743
|
type LogoutResponse = Res<'/v1/auth/logout', 'post'>;
|
|
10278
11744
|
type ForgotPasswordRequest = Req<'/v1/auth/forgot-password', 'post'>;
|
|
10279
11745
|
type ForgotPasswordResponse = Res<'/v1/auth/forgot-password', 'post'>;
|
|
@@ -10296,14 +11762,6 @@ type SetMemberRoleRequest = Req<'/v1/orgs/me/members/{userId}/role', 'put'>;
|
|
|
10296
11762
|
type SetMemberRoleResponse = Res<'/v1/orgs/me/members/{userId}/role', 'put'>;
|
|
10297
11763
|
type RemoveMemberResponse = Res<'/v1/orgs/me/members/{userId}', 'delete'>;
|
|
10298
11764
|
type ResendInviteResponse = Res<'/v1/orgs/me/members/{userId}/resend-invite', 'post'>;
|
|
10299
|
-
type CreateOrganizationRequest = Req<'/v1/admin/organizations', 'post'>;
|
|
10300
|
-
type CreateOrganizationResponse = Res<'/v1/admin/organizations', 'post'>;
|
|
10301
|
-
type SetAccountTypeRequest = Req<'/v1/admin/organizations/{id}/account-type', 'patch'>;
|
|
10302
|
-
type SetAccountTypeResponse = Res<'/v1/admin/organizations/{id}/account-type', 'patch'>;
|
|
10303
|
-
type VerifyOrganizationResponse = Res<'/v1/admin/organizations/{id}/verify', 'patch'>;
|
|
10304
|
-
type RotateApiKeyResponse = Res<'/v1/admin/organizations/{id}/rotate-key', 'post'>;
|
|
10305
|
-
type AdjustCreditsRequest = Req<'/v1/admin/organizations/{id}/adjust-credits', 'post'>;
|
|
10306
|
-
type AdjustCreditsResponse = Res<'/v1/admin/organizations/{id}/adjust-credits', 'post'>;
|
|
10307
11765
|
type ListDelegatedKeysResponse = Res<'/v1/users/me/delegated-keys', 'get'>;
|
|
10308
11766
|
type PrepareDelegatedKeyRequest = Req<'/v1/users/me/delegated-keys', 'post'>;
|
|
10309
11767
|
type PreparedDelegatedKeyResponse = Res<'/v1/users/me/delegated-keys', 'post'>;
|
|
@@ -10344,6 +11802,18 @@ type LedgerResponse = Res<'/v1/account/ledger', 'get'>;
|
|
|
10344
11802
|
type TotpEnrollResponse = Res<'/v1/account/mfa/totp/enroll', 'post'>;
|
|
10345
11803
|
type TotpConfirmRequest = Req<'/v1/account/mfa/totp/confirm', 'post'>;
|
|
10346
11804
|
type TotpConfirmResponse = Res<'/v1/account/mfa/totp/confirm', 'post'>;
|
|
11805
|
+
/**
|
|
11806
|
+
* A second-factor proof: exactly one of a 6-digit TOTP `code` or a
|
|
11807
|
+
* `recoveryCode` (`ABCD-EFGH`). The spec types both as optional; the server
|
|
11808
|
+
* rejects a body with neither or both, so the SDK type enforces exactly one.
|
|
11809
|
+
*/
|
|
11810
|
+
type MfaProofRequest = {
|
|
11811
|
+
code: string;
|
|
11812
|
+
recoveryCode?: never;
|
|
11813
|
+
} | {
|
|
11814
|
+
recoveryCode: string;
|
|
11815
|
+
code?: never;
|
|
11816
|
+
};
|
|
10347
11817
|
type TotpDisableResponse = Res<'/v1/account/mfa/totp', 'delete'>;
|
|
10348
11818
|
type RecoveryCodesRegenerateResponse = Res<'/v1/account/mfa/recovery-codes/regenerate', 'post'>;
|
|
10349
11819
|
type ListOauthSessionsResponse = Res<'/v1/oauth/sessions', 'get'>;
|
|
@@ -10364,10 +11834,11 @@ type DashboardWitnessesResponse = ChainRes<'/v5/dashboard/witnesses', 'get'>;
|
|
|
10364
11834
|
*
|
|
10365
11835
|
* Covers both accounts (identity / billing / OAuth / delegated keys / witness
|
|
10366
11836
|
* writes via the metered v5 proxy) and chain-api read surfaces (contract
|
|
10367
|
-
* info / witness lookup / wallet balance / dashboards).
|
|
10368
|
-
* clients layer on top — `WitniumchainClient` (end-user)
|
|
10369
|
-
* `WitniumchainOrgClient` (org admin)
|
|
10370
|
-
*
|
|
11837
|
+
* info / witness lookup / wallet balance / dashboards). Two convenience
|
|
11838
|
+
* clients layer on top — `WitniumchainClient` (end-user) and
|
|
11839
|
+
* `WitniumchainOrgClient` (org admin) — with helpers for signup,
|
|
11840
|
+
* subscriptions, and delegated-key provisioning. The sysadmin surface lives in
|
|
11841
|
+
* the separate PRIVATE `@witnium/chain-admin-sdk` package, not here.
|
|
10371
11842
|
*
|
|
10372
11843
|
* Stripe surface is intentionally Checkout + Customer Portal ONLY. Witnium is
|
|
10373
11844
|
* not a marketplace, so there is no Stripe Connect onboarding.
|
|
@@ -10379,7 +11850,6 @@ type DashboardWitnessesResponse = ChainRes<'/v5/dashboard/witnesses', 'get'>;
|
|
|
10379
11850
|
* - sessionCookie — `wac_session` value for browser-cookie routes.
|
|
10380
11851
|
* - accessToken — OAuth Bearer JWT for end-user API.
|
|
10381
11852
|
* - orgApiKey — `wcorg_live_…` for org admin.
|
|
10382
|
-
* - adminToken — sysadmin token.
|
|
10383
11853
|
* - signedRequest — Ed25519 signer for SDK signed-request routes
|
|
10384
11854
|
* (witnesses propose/sign/finalize/revoke). The SDK
|
|
10385
11855
|
* does the canonical-message construction; you supply
|
|
@@ -10505,8 +11975,6 @@ interface WitniumchainClientConfig {
|
|
|
10505
11975
|
verifierStorage?: PkceVerifierStorage;
|
|
10506
11976
|
/** Organisation API key (`wcorg_live_…`). */
|
|
10507
11977
|
orgApiKey?: string;
|
|
10508
|
-
/** System-admin token (`Authorization: Bearer <ADMIN_TOKEN>`). */
|
|
10509
|
-
adminToken?: string;
|
|
10510
11978
|
/** Ed25519 signer for SDK signed-request routes (witness write ops). */
|
|
10511
11979
|
signedRequest?: SignedRequestSigner;
|
|
10512
11980
|
/** Per-request timeout in milliseconds. Default 30000. */
|
|
@@ -10607,9 +12075,10 @@ declare class WitniumchainClient {
|
|
|
10607
12075
|
* the contract with the caller's client-generated `ownerPublicKey` +
|
|
10608
12076
|
* `initialSigningPublicKey`. Witnium never sees the private bytes.
|
|
10609
12077
|
*
|
|
10610
|
-
* Returns `{ orgId, userId, contractAddress, contractVersion
|
|
10611
|
-
*
|
|
10612
|
-
*
|
|
12078
|
+
* Returns `{ orgId, userId, contractAddress, contractVersion }`. The
|
|
12079
|
+
* email-verify link is mailed to `adminEmail` and never returned, so there
|
|
12080
|
+
* is nothing to render. If the mail cannot be sent, nothing is created and
|
|
12081
|
+
* the call fails with a 502; retry it.
|
|
10613
12082
|
*/
|
|
10614
12083
|
createOrg(body: CreateOrgRequest): Promise<CreateOrgResponse>;
|
|
10615
12084
|
listMembers(): Promise<MembersListResponse>;
|
|
@@ -10622,7 +12091,26 @@ declare class WitniumchainClient {
|
|
|
10622
12091
|
removeMember(userId: string): Promise<RemoveMemberResponse>;
|
|
10623
12092
|
resendMemberInvite(userId: string): Promise<ResendInviteResponse>;
|
|
10624
12093
|
verifyEmail(token: string): Promise<VerifyEmailResponse>;
|
|
12094
|
+
/**
|
|
12095
|
+
* Password login. Check `status`: `'authenticated'` means the session
|
|
12096
|
+
* cookie is set. `'mfa_required'` means NO session exists yet: the server
|
|
12097
|
+
* set a short-lived challenge cookie, and {@link loginMfa} must follow with
|
|
12098
|
+
* the user's TOTP or recovery code.
|
|
12099
|
+
*/
|
|
10625
12100
|
login(body: LoginRequest): Promise<LoginResponse>;
|
|
12101
|
+
/**
|
|
12102
|
+
* Second step of an MFA login, after `login()` returned `'mfa_required'`.
|
|
12103
|
+
* Relies on the challenge cookie from that call (`credentials: 'include'`).
|
|
12104
|
+
* 401 `mfa_code_invalid`: wrong or reused code, the user may retry.
|
|
12105
|
+
* 401 `mfa_challenge_invalid`: expired or used up, start again at `login()`.
|
|
12106
|
+
* 429 `mfa_rate_limited`: the body carries `retryAfterSeconds`.
|
|
12107
|
+
*/
|
|
12108
|
+
loginMfa(body: MfaProofRequest): Promise<LoginMfaResponse>;
|
|
12109
|
+
/**
|
|
12110
|
+
* End the first-party session. The cached bearer token is dropped even when
|
|
12111
|
+
* the request fails, so a logged-out tab never keeps the previous user's
|
|
12112
|
+
* token.
|
|
12113
|
+
*/
|
|
10626
12114
|
logout(): Promise<LogoutResponse>;
|
|
10627
12115
|
forgotPassword(body: ForgotPasswordRequest): Promise<ForgotPasswordResponse>;
|
|
10628
12116
|
resetPassword(body: ResetPasswordRequest): Promise<ResetPasswordResponse>;
|
|
@@ -10631,11 +12119,6 @@ declare class WitniumchainClient {
|
|
|
10631
12119
|
getMyOrg(): Promise<PublicOrgResponse>;
|
|
10632
12120
|
createOrgUser(body: CreateUserRequest): Promise<CreateUserResponse>;
|
|
10633
12121
|
listOrgUsers(): Promise<ListUsersResponse>;
|
|
10634
|
-
createOrganization(body: CreateOrganizationRequest): Promise<CreateOrganizationResponse>;
|
|
10635
|
-
setOrgAccountType(id: string, body: SetAccountTypeRequest): Promise<SetAccountTypeResponse>;
|
|
10636
|
-
verifyOrganization(id: string): Promise<VerifyOrganizationResponse>;
|
|
10637
|
-
rotateOrgApiKey(id: string): Promise<RotateApiKeyResponse>;
|
|
10638
|
-
adjustOrgCredits(id: string, body: AdjustCreditsRequest): Promise<AdjustCreditsResponse>;
|
|
10639
12122
|
listDelegatedKeys(query?: {
|
|
10640
12123
|
contractAddress?: string;
|
|
10641
12124
|
active?: 'true' | 'false';
|
|
@@ -10676,9 +12159,16 @@ declare class WitniumchainClient {
|
|
|
10676
12159
|
*/
|
|
10677
12160
|
reissueProvisioningToken(): Promise<ReissueProvisioningTokenResponse>;
|
|
10678
12161
|
enrollTotp(): Promise<TotpEnrollResponse>;
|
|
12162
|
+
/**
|
|
12163
|
+
* Confirming bumps the user's security epoch server-side, which ends every
|
|
12164
|
+
* session-minted access token. A cached one is dropped so the next bearer
|
|
12165
|
+
* call mints a fresh token.
|
|
12166
|
+
*/
|
|
10679
12167
|
confirmTotp(body: TotpConfirmRequest): Promise<TotpConfirmResponse>;
|
|
10680
|
-
|
|
10681
|
-
|
|
12168
|
+
/** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
|
|
12169
|
+
disableTotp(body: MfaProofRequest): Promise<TotpDisableResponse>;
|
|
12170
|
+
/** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
|
|
12171
|
+
regenerateRecoveryCodes(body: MfaProofRequest): Promise<RecoveryCodesRegenerateResponse>;
|
|
10682
12172
|
listOauthSessions(): Promise<ListOauthSessionsResponse>;
|
|
10683
12173
|
revokeOauthSession(jti: string): Promise<void>;
|
|
10684
12174
|
revokeAllOauthSessions(): Promise<void>;
|
|
@@ -10686,10 +12176,19 @@ declare class WitniumchainClient {
|
|
|
10686
12176
|
healthReady(): Promise<HealthReadyResponse>;
|
|
10687
12177
|
getContractInfo(contractAddress: string): Promise<ContractInfoResponse>;
|
|
10688
12178
|
getContractVerification(contractAddress: string): Promise<VerifyContractResponse>;
|
|
10689
|
-
listWitnessesV5(contractAddress: string,
|
|
12179
|
+
listWitnessesV5(contractAddress: string,
|
|
12180
|
+
/**
|
|
12181
|
+
* One bounded scan window per call. To list everything, call again with
|
|
12182
|
+
* `beforeBlock: res.nextBeforeBlock` and, when not null,
|
|
12183
|
+
* `beforeLogIndex: res.nextBeforeLogIndex` until `res.nextBeforeBlock`
|
|
12184
|
+
* is null; an empty page does not mean the end.
|
|
12185
|
+
*/
|
|
12186
|
+
params?: {
|
|
10690
12187
|
dataId?: string;
|
|
10691
12188
|
limit?: number;
|
|
10692
12189
|
offset?: number;
|
|
12190
|
+
beforeBlock?: number;
|
|
12191
|
+
beforeLogIndex?: number;
|
|
10693
12192
|
}): Promise<ListWitnessesResponse>;
|
|
10694
12193
|
getWitnessV5(contractAddress: string, witnessId: string): Promise<GetChainWitnessResponse>;
|
|
10695
12194
|
getContractTransaction(contractAddress: string, txHash: string): Promise<GetContractTransactionResponse>;
|
|
@@ -10702,6 +12201,9 @@ declare class WitniumchainClient {
|
|
|
10702
12201
|
timeLock?: 'locked' | 'none';
|
|
10703
12202
|
limit?: number;
|
|
10704
12203
|
offset?: number;
|
|
12204
|
+
/** Cursor; see listWitnessesV5. */
|
|
12205
|
+
beforeBlock?: number;
|
|
12206
|
+
beforeLogIndex?: number;
|
|
10705
12207
|
}): Promise<DashboardWitnessesResponse>;
|
|
10706
12208
|
/**
|
|
10707
12209
|
* Build the authorization-server URL for the start of an OAuth login flow.
|
|
@@ -10959,7 +12461,12 @@ declare class OrgMembers {
|
|
|
10959
12461
|
constructor(client: WitniumchainClient);
|
|
10960
12462
|
/** List the caller's org members (role, suspendedAt, isOwner, keys). */
|
|
10961
12463
|
list(): Promise<MembersListResponse>;
|
|
10962
|
-
/**
|
|
12464
|
+
/**
|
|
12465
|
+
* Invite a member by email (default role `member`). `inviteEmailSent` says
|
|
12466
|
+
* whether the invitation (with the verify link) was mailed; the token is
|
|
12467
|
+
* never returned. A 502 means the membership was recorded but the mail
|
|
12468
|
+
* failed; retry.
|
|
12469
|
+
*/
|
|
10963
12470
|
invite(body: InviteMemberRequest): Promise<InviteMemberResponse>;
|
|
10964
12471
|
/** Suspend a member (reversible). The owner cannot be suspended. */
|
|
10965
12472
|
suspend(userId: string): Promise<SuspendMemberResponse>;
|
|
@@ -10971,7 +12478,10 @@ declare class OrgMembers {
|
|
|
10971
12478
|
setRole(userId: string, role: SetMemberRoleRequest['role']): Promise<SetMemberRoleResponse>;
|
|
10972
12479
|
/** Remove a member (terminal; revokes their delegated keys). Owner protected. */
|
|
10973
12480
|
remove(userId: string): Promise<RemoveMemberResponse>;
|
|
10974
|
-
/**
|
|
12481
|
+
/**
|
|
12482
|
+
* Re-send the invitation email to a pending member. Returns `{ email }`;
|
|
12483
|
+
* the fresh verify token is mailed, never returned.
|
|
12484
|
+
*/
|
|
10975
12485
|
resendInvite(userId: string): Promise<ResendInviteResponse>;
|
|
10976
12486
|
}
|
|
10977
12487
|
declare class MfaTotp {
|
|
@@ -10989,11 +12499,15 @@ declare class MfaTotp {
|
|
|
10989
12499
|
* Confirm enrolment with the first user-supplied code. Returns the 10
|
|
10990
12500
|
* single-use recovery codes — show them to the user ONCE; the server never
|
|
10991
12501
|
* returns them again. Throws `WitniumchainApiError` with status 400 when
|
|
10992
|
-
* the code is invalid or the enrolment is already confirmed.
|
|
12502
|
+
* the code is invalid or the enrolment is already confirmed. Signs the
|
|
12503
|
+
* user out of every other device and connected app.
|
|
10993
12504
|
*/
|
|
10994
12505
|
confirm(code: string): Promise<TotpConfirmResponse>;
|
|
10995
|
-
/**
|
|
10996
|
-
|
|
12506
|
+
/**
|
|
12507
|
+
* Disable TOTP, wiping both the secret and all recovery codes. Requires the
|
|
12508
|
+
* user's current code or a recovery code.
|
|
12509
|
+
*/
|
|
12510
|
+
disable(proof: MfaProofRequest): Promise<TotpDisableResponse>;
|
|
10997
12511
|
}
|
|
10998
12512
|
declare class MfaRecoveryCodes {
|
|
10999
12513
|
private readonly client;
|
|
@@ -11001,52 +12515,9 @@ declare class MfaRecoveryCodes {
|
|
|
11001
12515
|
/**
|
|
11002
12516
|
* Issue a fresh set of 10 recovery codes, invalidating the prior ones.
|
|
11003
12517
|
* Same as `confirm` — codes are returned ONCE and never readable again.
|
|
12518
|
+
* Requires the user's current code or a recovery code.
|
|
11004
12519
|
*/
|
|
11005
|
-
regenerate(): Promise<RecoveryCodesRegenerateResponse>;
|
|
11006
|
-
}
|
|
11007
|
-
|
|
11008
|
-
interface WitniumchainAdminClientConfig {
|
|
11009
|
-
/** Base URL, e.g. `https://auth.witniumchain.com`. Trailing slash optional. */
|
|
11010
|
-
baseUrl: string;
|
|
11011
|
-
/** System-admin token (`Authorization: Bearer <ADMIN_TOKEN>`). */
|
|
11012
|
-
adminToken: string;
|
|
11013
|
-
/** Per-request timeout in milliseconds. Default 30000. */
|
|
11014
|
-
timeout?: number;
|
|
11015
|
-
/** Alternate fetch implementation (e.g. for tests). Default `globalThis.fetch`. */
|
|
11016
|
-
fetch?: typeof fetch;
|
|
11017
|
-
}
|
|
11018
|
-
type AccountType = 'metered' | 'unlimited';
|
|
11019
|
-
declare class WitniumchainAdminClient {
|
|
11020
|
-
private readonly inner;
|
|
11021
|
-
constructor(config: WitniumchainAdminClientConfig);
|
|
11022
|
-
/**
|
|
11023
|
-
* Mint a new organisation. The returned `apiKey` is shown ONCE — the server
|
|
11024
|
-
* only retains its SHA-256 hash. Persist it before the response leaves
|
|
11025
|
-
* scope; there is no recovery path.
|
|
11026
|
-
*
|
|
11027
|
-
* @param body Organisation seed: name, email, optional accountType and
|
|
11028
|
-
* signup credit grant, optional skip-email-verification flag.
|
|
11029
|
-
*/
|
|
11030
|
-
createOrganization(body: CreateOrganizationRequest): Promise<CreateOrganizationResponse>;
|
|
11031
|
-
/** Flip an org between `metered` (Stripe checkout + credit ledger) and `unlimited` (flat-fee). */
|
|
11032
|
-
setAccountType(orgId: string, accountType: AccountType): Promise<SetAccountTypeResponse>;
|
|
11033
|
-
/** Mark an org's email as verified. Prerequisite for the org to create users. */
|
|
11034
|
-
verifyEmail(orgId: string): Promise<VerifyOrganizationResponse>;
|
|
11035
|
-
/**
|
|
11036
|
-
* Rotate the org's API key. The previous `wcorg_live_…` is invalidated and
|
|
11037
|
-
* the new key is returned ONCE — same one-time-secret semantics as
|
|
11038
|
-
* {@link createOrganization}.
|
|
11039
|
-
*/
|
|
11040
|
-
rotateApiKey(orgId: string): Promise<RotateApiKeyResponse>;
|
|
11041
|
-
/**
|
|
11042
|
-
* Apply a signed credit delta to an org's ledger. Positive `delta` grants
|
|
11043
|
-
* credits (goodwill, migration backfill); negative claws them back.
|
|
11044
|
-
* Recorded as `reason: adjustment` with the supplied `note`.
|
|
11045
|
-
*
|
|
11046
|
-
* Use sparingly — this bypasses Stripe and should be auditable from the
|
|
11047
|
-
* `note` alone.
|
|
11048
|
-
*/
|
|
11049
|
-
adjustCredits(orgId: string, delta: number, note?: string): Promise<AdjustCreditsResponse>;
|
|
12520
|
+
regenerate(proof: MfaProofRequest): Promise<RecoveryCodesRegenerateResponse>;
|
|
11050
12521
|
}
|
|
11051
12522
|
|
|
11052
12523
|
type Body<T> = T extends {
|
|
@@ -11115,13 +12586,13 @@ declare class WitniumchainChainAdminClient {
|
|
|
11115
12586
|
* Wraps the three `/v1/orgs/me/*` routes that org admins use to read their
|
|
11116
12587
|
* own org profile and manage their users. This is the client B2B2C apps and
|
|
11117
12588
|
* customer-admin dashboards consume — auth is the `wcorg_live_…` API key
|
|
11118
|
-
* minted
|
|
11119
|
-
* a subsequent `rotateApiKey`.
|
|
12589
|
+
* minted by the sysadmin admin SDK or returned by a subsequent `rotateApiKey`.
|
|
11120
12590
|
*
|
|
11121
12591
|
* The surface is intentionally minimal — the underlying API only exposes
|
|
11122
12592
|
* profile read + user create + user list. Anything more powerful (provision
|
|
11123
12593
|
* credits, change account type, verify email) requires the sysadmin
|
|
11124
|
-
* `
|
|
12594
|
+
* `ADMIN_TOKEN` and lives in the PRIVATE `@witnium/chain-admin-sdk` package,
|
|
12595
|
+
* never in this public SDK.
|
|
11125
12596
|
*/
|
|
11126
12597
|
|
|
11127
12598
|
interface WitniumchainOrgClientConfig {
|
|
@@ -11239,4 +12710,4 @@ declare function buildRevokeSigningKeyPayload(args: {
|
|
|
11239
12710
|
key: string;
|
|
11240
12711
|
}): string;
|
|
11241
12712
|
|
|
11242
|
-
export { type AccountResponse, type
|
|
12713
|
+
export { type AccountResponse, type paths$1 as AccountsPaths, type AddSigningKeyRequest$1 as AddSigningKeyRequest, type AddSigningKeyResponse, type BeginOAuthLoginArgs, type BeginOAuthLoginResult, type paths as ChainPaths, type CheckoutRequest, type CheckoutResponse, type CreateOrgRequest, type CreateOrgResponse, type CreateUserRequest, type CreateUserResponse, DelegatedKeys, type FinalizeWitnessResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GetWitnessResponse, type HealthLiveResponse, type HealthReadyResponse, type InviteMemberRequest, type InviteMemberResponse, type LedgerResponse, type ListDelegatedKeysResponse, type ListOauthSessionsResponse, type ListUsersResponse, type LoginMfaResponse, type LoginRequest, type LoginResponse, type LogoutResponse, type MembersListResponse, MfaNamespace, type MfaProofRequest, MfaRecoveryCodes, MfaTotp, type OAuthTokenSnapshot, OWNER_OP, OauthNamespace, OauthSessions, OrgMembers, OrgUsers, type OwnerOpName, type OwnerSigner, type PauseRequest$1 as PauseRequest, type PauseResponse, type PkceVerifierStorage, type PortalResponse, type PrepareDelegatedKeyRequest, type PreparedDelegatedKeyResponse, type ProposeWitnessRequest, type ProposeWitnessResponse, type ProvisionContractRequest, type ProvisionContractResponse, type ProvisionDelegatedKeyArgs, type ProvisionDelegatedKeyResult, type PublicOrgResponse, type RecoveryCodesRegenerateResponse, type ReissueProvisioningTokenResponse, type RemoveMemberResponse, type ResendInviteResponse, type ResetAccountResponse, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDelegatedKeyResponse, type RevokeSigningKeyRequest$1 as RevokeSigningKeyRequest, type RevokeSigningKeyResponse, type RevokeWitnessRequest, type RevokeWitnessResponse, type SetMemberRoleRequest, type SetMemberRoleResponse, type SignRequest, type SignResponse, type SignWitnessRequest, type SignWitnessResponse, type SignedRequestSigner, SigningKeys, type SignupRequest, type SignupResponse, type SubmitDelegatedKeyRequest, type SubmitDelegatedKeyResponse, Subscriptions, type SuspendMemberResponse, type TotpConfirmRequest, type TotpConfirmResponse, type TotpDisableResponse, type TotpEnrollResponse, type UnpauseRequest, type UnpauseResponse, type VerifyEmailResponse, WitniumchainApiError, WitniumchainChainAdminClient, type WitniumchainChainAdminClientConfig, WitniumchainClient, type WitniumchainClientConfig, WitniumchainOrgClient, type WitniumchainOrgClientConfig, buildAddSigningKeyPayload, buildPausePayload, buildRevokeSigningKeyPayload, buildUnpausePayload, defaultVerifierStorage };
|