@witnium-tech/witniumchain 0.11.0 → 0.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/FRONTEND-INTEGRATION.md +34 -8
- package/README.md +15 -5
- package/dist/index.d.mts +1789 -321
- package/dist/index.d.ts +1789 -321
- package/dist/index.js +117 -32
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +117 -32
- package/dist/index.mjs.map +1 -1
- package/package.json +5 -5
package/dist/index.d.ts
CHANGED
|
@@ -73,8 +73,8 @@ interface paths$1 {
|
|
|
73
73
|
};
|
|
74
74
|
};
|
|
75
75
|
responses: {
|
|
76
|
-
/** @description
|
|
77
|
-
|
|
76
|
+
/** @description Created */
|
|
77
|
+
201: {
|
|
78
78
|
headers: {
|
|
79
79
|
[name: string]: unknown;
|
|
80
80
|
};
|
|
@@ -264,8 +264,8 @@ interface paths$1 {
|
|
|
264
264
|
};
|
|
265
265
|
requestBody?: never;
|
|
266
266
|
responses: {
|
|
267
|
-
/** @description
|
|
268
|
-
|
|
267
|
+
/** @description Created */
|
|
268
|
+
201: {
|
|
269
269
|
headers: {
|
|
270
270
|
[name: string]: unknown;
|
|
271
271
|
};
|
|
@@ -323,7 +323,7 @@ interface paths$1 {
|
|
|
323
323
|
put?: never;
|
|
324
324
|
/**
|
|
325
325
|
* Log in with email + password
|
|
326
|
-
* @description
|
|
326
|
+
* @description Without confirmed TOTP: sets a `wac_session` cookie (httpOnly, secure, 30-day TTL) and returns `status: "authenticated"`. With confirmed TOTP: NO session is issued. The response is `status: "mfa_required"` and sets a `wac_mfa` challenge cookie (httpOnly, secure, Path=/v1/auth/login/mfa, 5 minutes); complete the login with `POST /v1/auth/login/mfa`. No token is included in the body.
|
|
327
327
|
*/
|
|
328
328
|
post: {
|
|
329
329
|
parameters: {
|
|
@@ -347,14 +347,163 @@ interface paths$1 {
|
|
|
347
347
|
};
|
|
348
348
|
};
|
|
349
349
|
responses: {
|
|
350
|
-
/** @description
|
|
351
|
-
|
|
350
|
+
/** @description Created */
|
|
351
|
+
201: {
|
|
352
|
+
headers: {
|
|
353
|
+
[name: string]: unknown;
|
|
354
|
+
};
|
|
355
|
+
content: {
|
|
356
|
+
"application/json": {
|
|
357
|
+
/**
|
|
358
|
+
* @description `authenticated`: the `wac_session` cookie is set. `mfa_required`: no session yet; send the second factor to `/v1/auth/login/mfa`.
|
|
359
|
+
* @enum {string}
|
|
360
|
+
*/
|
|
361
|
+
status: "authenticated" | "mfa_required";
|
|
362
|
+
message: string;
|
|
363
|
+
/** @description Present when `status` is `mfa_required`. */
|
|
364
|
+
methods?: ("totp" | "recovery_code")[];
|
|
365
|
+
/** @description Challenge lifetime; present when `status` is `mfa_required`. */
|
|
366
|
+
expiresInSeconds?: number;
|
|
367
|
+
};
|
|
368
|
+
};
|
|
369
|
+
};
|
|
370
|
+
/** @description Bad Request — validation failed */
|
|
371
|
+
400: {
|
|
372
|
+
headers: {
|
|
373
|
+
[name: string]: unknown;
|
|
374
|
+
};
|
|
375
|
+
content: {
|
|
376
|
+
"application/json": {
|
|
377
|
+
/**
|
|
378
|
+
* @description HTTP status code
|
|
379
|
+
* @example 400
|
|
380
|
+
*/
|
|
381
|
+
statusCode?: number;
|
|
382
|
+
/**
|
|
383
|
+
* @description Short error label
|
|
384
|
+
* @example Bad Request
|
|
385
|
+
*/
|
|
386
|
+
error?: string;
|
|
387
|
+
/**
|
|
388
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
389
|
+
* @example Validation failed
|
|
390
|
+
*/
|
|
391
|
+
message: string | string[];
|
|
392
|
+
};
|
|
393
|
+
};
|
|
394
|
+
};
|
|
395
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
396
|
+
401: {
|
|
397
|
+
headers: {
|
|
398
|
+
[name: string]: unknown;
|
|
399
|
+
};
|
|
400
|
+
content: {
|
|
401
|
+
"application/json": {
|
|
402
|
+
/**
|
|
403
|
+
* @description HTTP status code
|
|
404
|
+
* @example 400
|
|
405
|
+
*/
|
|
406
|
+
statusCode?: number;
|
|
407
|
+
/**
|
|
408
|
+
* @description Short error label
|
|
409
|
+
* @example Bad Request
|
|
410
|
+
*/
|
|
411
|
+
error?: string;
|
|
412
|
+
/**
|
|
413
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
414
|
+
* @example Validation failed
|
|
415
|
+
*/
|
|
416
|
+
message: string | string[];
|
|
417
|
+
};
|
|
418
|
+
};
|
|
419
|
+
};
|
|
420
|
+
/** @description Too Many Requests */
|
|
421
|
+
429: {
|
|
422
|
+
headers: {
|
|
423
|
+
[name: string]: unknown;
|
|
424
|
+
};
|
|
425
|
+
content: {
|
|
426
|
+
"application/json": {
|
|
427
|
+
/**
|
|
428
|
+
* @description HTTP status code
|
|
429
|
+
* @example 400
|
|
430
|
+
*/
|
|
431
|
+
statusCode?: number;
|
|
432
|
+
/**
|
|
433
|
+
* @description Short error label
|
|
434
|
+
* @example Bad Request
|
|
435
|
+
*/
|
|
436
|
+
error?: string;
|
|
437
|
+
/**
|
|
438
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
439
|
+
* @example Validation failed
|
|
440
|
+
*/
|
|
441
|
+
message: string | string[];
|
|
442
|
+
};
|
|
443
|
+
};
|
|
444
|
+
};
|
|
445
|
+
};
|
|
446
|
+
};
|
|
447
|
+
delete?: never;
|
|
448
|
+
options?: never;
|
|
449
|
+
head?: never;
|
|
450
|
+
patch?: never;
|
|
451
|
+
trace?: never;
|
|
452
|
+
};
|
|
453
|
+
"/v1/auth/login/mfa": {
|
|
454
|
+
parameters: {
|
|
455
|
+
query?: never;
|
|
456
|
+
header?: never;
|
|
457
|
+
path?: never;
|
|
458
|
+
cookie?: never;
|
|
459
|
+
};
|
|
460
|
+
get?: never;
|
|
461
|
+
put?: never;
|
|
462
|
+
/**
|
|
463
|
+
* Complete an MFA login with a TOTP or recovery code
|
|
464
|
+
* @description Second step after `/v1/auth/login` answered `mfa_required`. Requires the `wac_mfa` cookie that response set. On success sets `wac_session`, clears `wac_mfa` and returns `status: "authenticated"`. 401 with error `mfa_code_invalid`: wrong or already-used code, retry. 401 with error `mfa_challenge_invalid`: the challenge expired (5 min), was used, or saw 5 wrong codes; start again at `/v1/auth/login`. 429 `mfa_rate_limited`: the per-user attempt budget (10 per 15 min) is exhausted.
|
|
465
|
+
*/
|
|
466
|
+
post: {
|
|
467
|
+
parameters: {
|
|
468
|
+
query?: never;
|
|
469
|
+
header?: never;
|
|
470
|
+
path?: never;
|
|
471
|
+
cookie?: never;
|
|
472
|
+
};
|
|
473
|
+
requestBody?: {
|
|
474
|
+
content: {
|
|
475
|
+
"application/json": {
|
|
476
|
+
/**
|
|
477
|
+
* @description Current 6-digit TOTP code. Each code is accepted once.
|
|
478
|
+
* @example 123456
|
|
479
|
+
*/
|
|
480
|
+
code?: string;
|
|
481
|
+
/**
|
|
482
|
+
* @description An unused recovery code (consumed by this request).
|
|
483
|
+
* @example ABCD-EFGH
|
|
484
|
+
*/
|
|
485
|
+
recoveryCode?: string;
|
|
486
|
+
};
|
|
487
|
+
};
|
|
488
|
+
};
|
|
489
|
+
responses: {
|
|
490
|
+
/** @description Created */
|
|
491
|
+
201: {
|
|
352
492
|
headers: {
|
|
353
493
|
[name: string]: unknown;
|
|
354
494
|
};
|
|
355
495
|
content: {
|
|
356
496
|
"application/json": {
|
|
497
|
+
/**
|
|
498
|
+
* @description `authenticated`: the `wac_session` cookie is set. `mfa_required`: no session yet; send the second factor to `/v1/auth/login/mfa`.
|
|
499
|
+
* @enum {string}
|
|
500
|
+
*/
|
|
501
|
+
status: "authenticated" | "mfa_required";
|
|
357
502
|
message: string;
|
|
503
|
+
/** @description Present when `status` is `mfa_required`. */
|
|
504
|
+
methods?: ("totp" | "recovery_code")[];
|
|
505
|
+
/** @description Challenge lifetime; present when `status` is `mfa_required`. */
|
|
506
|
+
expiresInSeconds?: number;
|
|
358
507
|
};
|
|
359
508
|
};
|
|
360
509
|
};
|
|
@@ -452,7 +601,7 @@ interface paths$1 {
|
|
|
452
601
|
put?: never;
|
|
453
602
|
/**
|
|
454
603
|
* Clear the current session
|
|
455
|
-
* @description Revokes the session bound to the `wac_session` cookie (if present) and clears the cookie. Idempotent — works even with no active session.
|
|
604
|
+
* @description Revokes the session bound to the `wac_session` cookie (if present) and clears the cookie; access tokens minted from that session via `POST /v1/auth/access-token` stop working at once. Idempotent — works even with no active session.
|
|
456
605
|
*/
|
|
457
606
|
post: {
|
|
458
607
|
parameters: {
|
|
@@ -463,8 +612,8 @@ interface paths$1 {
|
|
|
463
612
|
};
|
|
464
613
|
requestBody?: never;
|
|
465
614
|
responses: {
|
|
466
|
-
/** @description
|
|
467
|
-
|
|
615
|
+
/** @description Created */
|
|
616
|
+
201: {
|
|
468
617
|
headers: {
|
|
469
618
|
[name: string]: unknown;
|
|
470
619
|
};
|
|
@@ -515,8 +664,8 @@ interface paths$1 {
|
|
|
515
664
|
};
|
|
516
665
|
};
|
|
517
666
|
responses: {
|
|
518
|
-
/** @description
|
|
519
|
-
|
|
667
|
+
/** @description Created */
|
|
668
|
+
201: {
|
|
520
669
|
headers: {
|
|
521
670
|
[name: string]: unknown;
|
|
522
671
|
};
|
|
@@ -595,7 +744,7 @@ interface paths$1 {
|
|
|
595
744
|
put?: never;
|
|
596
745
|
/**
|
|
597
746
|
* Apply a password reset
|
|
598
|
-
* @description Exchanges a reset token for a new password. The token from the email is single-use and time-limited.
|
|
747
|
+
* @description Exchanges a reset token for a new password. The token from the email is single-use and time-limited. Also signs the user out everywhere: every session, every token minted from one, and every connected OAuth app (grants revoked, security epoch bumped).
|
|
599
748
|
*/
|
|
600
749
|
post: {
|
|
601
750
|
parameters: {
|
|
@@ -615,8 +764,8 @@ interface paths$1 {
|
|
|
615
764
|
};
|
|
616
765
|
};
|
|
617
766
|
responses: {
|
|
618
|
-
/** @description
|
|
619
|
-
|
|
767
|
+
/** @description Created */
|
|
768
|
+
201: {
|
|
620
769
|
headers: {
|
|
621
770
|
[name: string]: unknown;
|
|
622
771
|
};
|
|
@@ -708,7 +857,7 @@ interface paths$1 {
|
|
|
708
857
|
content: {
|
|
709
858
|
"application/json": {
|
|
710
859
|
/**
|
|
711
|
-
* @description Stripe Price ID. Drives the line item on the Checkout session — the Price's
|
|
860
|
+
* @description Stripe Price ID. Drives the line item on the Checkout session — the Price's Product must carry `credits` (and, for subscriptions, `plan_slug`) metadata for credits/plan to apply via the webhook.
|
|
712
861
|
* @example price_1ABC...
|
|
713
862
|
*/
|
|
714
863
|
priceId: string;
|
|
@@ -717,12 +866,22 @@ interface paths$1 {
|
|
|
717
866
|
* @enum {string}
|
|
718
867
|
*/
|
|
719
868
|
mode: "payment" | "subscription";
|
|
869
|
+
/**
|
|
870
|
+
* Format: uri
|
|
871
|
+
* @description Override the post-checkout success redirect.
|
|
872
|
+
*/
|
|
873
|
+
successUrl?: string;
|
|
874
|
+
/**
|
|
875
|
+
* Format: uri
|
|
876
|
+
* @description Override the checkout-cancelled redirect.
|
|
877
|
+
*/
|
|
878
|
+
cancelUrl?: string;
|
|
720
879
|
};
|
|
721
880
|
};
|
|
722
881
|
};
|
|
723
882
|
responses: {
|
|
724
|
-
/** @description
|
|
725
|
-
|
|
883
|
+
/** @description Created */
|
|
884
|
+
201: {
|
|
726
885
|
headers: {
|
|
727
886
|
[name: string]: unknown;
|
|
728
887
|
};
|
|
@@ -926,9 +1085,11 @@ interface paths$1 {
|
|
|
926
1085
|
/**
|
|
927
1086
|
* Stripe webhook receiver
|
|
928
1087
|
* @description Source of truth for credit grants. Verifies the `stripe-signature` header against `STRIPE_WEBHOOK_SECRET` over the raw request body, then dispatches on event type:
|
|
929
|
-
* - `checkout.session.completed`
|
|
930
|
-
* - `invoice.paid` → grant subscription monthly credits
|
|
931
|
-
* - `customer.subscription.
|
|
1088
|
+
* - `checkout.session.completed` (payment mode only) → grant pack `credits`.
|
|
1089
|
+
* - `invoice.paid` → grant subscription monthly `credits`.
|
|
1090
|
+
* - `customer.subscription.created`/`.updated` → set org `plan`, `current_period_end`, `subscription_status`.
|
|
1091
|
+
* - `customer.subscription.deleted` → revert to free plan + resume free-tier.
|
|
1092
|
+
* - `invoice.payment_failed` → mark `past_due` (grace).
|
|
932
1093
|
* Idempotent via the `stripe_events` table keyed on `event.id`. Body is the raw Stripe event (consumed pre-JSON-parse), not the documented schema.
|
|
933
1094
|
*/
|
|
934
1095
|
post: {
|
|
@@ -940,8 +1101,8 @@ interface paths$1 {
|
|
|
940
1101
|
};
|
|
941
1102
|
requestBody?: never;
|
|
942
1103
|
responses: {
|
|
943
|
-
/** @description
|
|
944
|
-
|
|
1104
|
+
/** @description Created */
|
|
1105
|
+
201: {
|
|
945
1106
|
headers: {
|
|
946
1107
|
[name: string]: unknown;
|
|
947
1108
|
};
|
|
@@ -996,7 +1157,7 @@ interface paths$1 {
|
|
|
996
1157
|
put?: never;
|
|
997
1158
|
/**
|
|
998
1159
|
* Create an organisation with client-generated keys
|
|
999
|
-
* @description Phase RBAC Thread D — explicit org creation. The caller generates the owner key and the initial signing key client-side; Witnium never holds the private bytes. The response includes the freshly-deployed contract address and
|
|
1160
|
+
* @description Phase RBAC Thread D — explicit org creation. The caller generates the owner key and the initial signing key client-side; Witnium never holds the private bytes. The response includes the freshly-deployed contract address. The email-verify link is sent to adminEmail and is never returned. If that email cannot be sent, nothing is created and the route returns 502; retry the request.
|
|
1000
1161
|
*/
|
|
1001
1162
|
post: {
|
|
1002
1163
|
parameters: {
|
|
@@ -1034,8 +1195,8 @@ interface paths$1 {
|
|
|
1034
1195
|
};
|
|
1035
1196
|
};
|
|
1036
1197
|
responses: {
|
|
1037
|
-
/** @description
|
|
1038
|
-
|
|
1198
|
+
/** @description Created */
|
|
1199
|
+
201: {
|
|
1039
1200
|
headers: {
|
|
1040
1201
|
[name: string]: unknown;
|
|
1041
1202
|
};
|
|
@@ -1055,8 +1216,6 @@ interface paths$1 {
|
|
|
1055
1216
|
contractAddress: string;
|
|
1056
1217
|
/** @description Semantic on-chain Solidity version (e.g. "5.0.0"). */
|
|
1057
1218
|
contractVersion: string;
|
|
1058
|
-
/** @description Email-verify token. Already sent to adminEmail; echoed here for flows that prefer to surface a "click this link" in their own UI. */
|
|
1059
|
-
emailVerifyToken: string;
|
|
1060
1219
|
};
|
|
1061
1220
|
};
|
|
1062
1221
|
};
|
|
@@ -1110,6 +1269,56 @@ interface paths$1 {
|
|
|
1110
1269
|
};
|
|
1111
1270
|
};
|
|
1112
1271
|
};
|
|
1272
|
+
/** @description Too Many Requests */
|
|
1273
|
+
429: {
|
|
1274
|
+
headers: {
|
|
1275
|
+
[name: string]: unknown;
|
|
1276
|
+
};
|
|
1277
|
+
content: {
|
|
1278
|
+
"application/json": {
|
|
1279
|
+
/**
|
|
1280
|
+
* @description HTTP status code
|
|
1281
|
+
* @example 400
|
|
1282
|
+
*/
|
|
1283
|
+
statusCode?: number;
|
|
1284
|
+
/**
|
|
1285
|
+
* @description Short error label
|
|
1286
|
+
* @example Bad Request
|
|
1287
|
+
*/
|
|
1288
|
+
error?: string;
|
|
1289
|
+
/**
|
|
1290
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1291
|
+
* @example Validation failed
|
|
1292
|
+
*/
|
|
1293
|
+
message: string | string[];
|
|
1294
|
+
};
|
|
1295
|
+
};
|
|
1296
|
+
};
|
|
1297
|
+
/** @description Bad Gateway */
|
|
1298
|
+
502: {
|
|
1299
|
+
headers: {
|
|
1300
|
+
[name: string]: unknown;
|
|
1301
|
+
};
|
|
1302
|
+
content: {
|
|
1303
|
+
"application/json": {
|
|
1304
|
+
/**
|
|
1305
|
+
* @description HTTP status code
|
|
1306
|
+
* @example 400
|
|
1307
|
+
*/
|
|
1308
|
+
statusCode?: number;
|
|
1309
|
+
/**
|
|
1310
|
+
* @description Short error label
|
|
1311
|
+
* @example Bad Request
|
|
1312
|
+
*/
|
|
1313
|
+
error?: string;
|
|
1314
|
+
/**
|
|
1315
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1316
|
+
* @example Validation failed
|
|
1317
|
+
*/
|
|
1318
|
+
message: string | string[];
|
|
1319
|
+
};
|
|
1320
|
+
};
|
|
1321
|
+
};
|
|
1113
1322
|
};
|
|
1114
1323
|
};
|
|
1115
1324
|
delete?: never;
|
|
@@ -1281,10 +1490,21 @@ interface paths$1 {
|
|
|
1281
1490
|
createdAt: string;
|
|
1282
1491
|
/**
|
|
1283
1492
|
* Format: date-time
|
|
1284
|
-
* @description
|
|
1493
|
+
* @description When the user proved control of the mailbox by consuming an emailed verify token. Null for users the org created via its API key until they do; org creation is recorded in identityAttestedByOrgId instead.
|
|
1285
1494
|
* @example 2026-05-20T10:30:00.000Z
|
|
1286
1495
|
*/
|
|
1287
1496
|
emailVerifiedAt: string | null;
|
|
1497
|
+
/**
|
|
1498
|
+
* @description Org whose API key created the user and vouched for the identity. This is NOT proof of mailbox control.
|
|
1499
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
1500
|
+
*/
|
|
1501
|
+
identityAttestedByOrgId: string | null;
|
|
1502
|
+
/**
|
|
1503
|
+
* Format: date-time
|
|
1504
|
+
* @description ISO 8601 date-time string
|
|
1505
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
1506
|
+
*/
|
|
1507
|
+
identityAttestedAt: string | null;
|
|
1288
1508
|
}[];
|
|
1289
1509
|
};
|
|
1290
1510
|
};
|
|
@@ -1343,8 +1563,8 @@ interface paths$1 {
|
|
|
1343
1563
|
};
|
|
1344
1564
|
};
|
|
1345
1565
|
responses: {
|
|
1346
|
-
/** @description
|
|
1347
|
-
|
|
1566
|
+
/** @description Created */
|
|
1567
|
+
201: {
|
|
1348
1568
|
headers: {
|
|
1349
1569
|
[name: string]: unknown;
|
|
1350
1570
|
};
|
|
@@ -1552,7 +1772,10 @@ interface paths$1 {
|
|
|
1552
1772
|
};
|
|
1553
1773
|
get?: never;
|
|
1554
1774
|
put?: never;
|
|
1555
|
-
/**
|
|
1775
|
+
/**
|
|
1776
|
+
* Invite a member to the caller's org
|
|
1777
|
+
* @description Adds the membership and, unless the invitee already verified their email, mails them an invitation with the verify link. Idempotent: re-inviting re-sends the mail. 502 means the membership was recorded but the email could not be sent; retry.
|
|
1778
|
+
*/
|
|
1556
1779
|
post: {
|
|
1557
1780
|
parameters: {
|
|
1558
1781
|
query?: never;
|
|
@@ -1578,8 +1801,8 @@ interface paths$1 {
|
|
|
1578
1801
|
};
|
|
1579
1802
|
};
|
|
1580
1803
|
responses: {
|
|
1581
|
-
/** @description
|
|
1582
|
-
|
|
1804
|
+
/** @description Created */
|
|
1805
|
+
201: {
|
|
1583
1806
|
headers: {
|
|
1584
1807
|
[name: string]: unknown;
|
|
1585
1808
|
};
|
|
@@ -1597,7 +1820,8 @@ interface paths$1 {
|
|
|
1597
1820
|
membershipId: string;
|
|
1598
1821
|
userPreexisted: boolean;
|
|
1599
1822
|
membershipPreexisted: boolean;
|
|
1600
|
-
|
|
1823
|
+
/** @description True when an invitation email (with the verify link) was sent, i.e. the invitee had not yet verified their email. The token is never returned. */
|
|
1824
|
+
inviteEmailSent: boolean;
|
|
1601
1825
|
};
|
|
1602
1826
|
};
|
|
1603
1827
|
};
|
|
@@ -1651,49 +1875,99 @@ interface paths$1 {
|
|
|
1651
1875
|
};
|
|
1652
1876
|
};
|
|
1653
1877
|
};
|
|
1654
|
-
|
|
1655
|
-
|
|
1656
|
-
delete?: never;
|
|
1657
|
-
options?: never;
|
|
1658
|
-
head?: never;
|
|
1659
|
-
patch?: never;
|
|
1660
|
-
trace?: never;
|
|
1661
|
-
};
|
|
1662
|
-
"/v1/orgs/me/members/{userId}/suspend": {
|
|
1663
|
-
parameters: {
|
|
1664
|
-
query?: never;
|
|
1665
|
-
header?: never;
|
|
1666
|
-
path?: never;
|
|
1667
|
-
cookie?: never;
|
|
1668
|
-
};
|
|
1669
|
-
get?: never;
|
|
1670
|
-
put?: never;
|
|
1671
|
-
/** Suspend a member (reversible). The owner cannot be suspended. */
|
|
1672
|
-
post: {
|
|
1673
|
-
parameters: {
|
|
1674
|
-
query?: never;
|
|
1675
|
-
header?: never;
|
|
1676
|
-
path?: never;
|
|
1677
|
-
cookie?: never;
|
|
1678
|
-
};
|
|
1679
|
-
requestBody?: never;
|
|
1680
|
-
responses: {
|
|
1681
|
-
/** @description Success */
|
|
1682
|
-
200: {
|
|
1878
|
+
/** @description Too Many Requests */
|
|
1879
|
+
429: {
|
|
1683
1880
|
headers: {
|
|
1684
1881
|
[name: string]: unknown;
|
|
1685
1882
|
};
|
|
1686
1883
|
content: {
|
|
1687
1884
|
"application/json": {
|
|
1688
1885
|
/**
|
|
1689
|
-
* @description
|
|
1690
|
-
* @example
|
|
1886
|
+
* @description HTTP status code
|
|
1887
|
+
* @example 400
|
|
1691
1888
|
*/
|
|
1692
|
-
|
|
1889
|
+
statusCode?: number;
|
|
1693
1890
|
/**
|
|
1694
|
-
*
|
|
1695
|
-
* @
|
|
1696
|
-
|
|
1891
|
+
* @description Short error label
|
|
1892
|
+
* @example Bad Request
|
|
1893
|
+
*/
|
|
1894
|
+
error?: string;
|
|
1895
|
+
/**
|
|
1896
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1897
|
+
* @example Validation failed
|
|
1898
|
+
*/
|
|
1899
|
+
message: string | string[];
|
|
1900
|
+
};
|
|
1901
|
+
};
|
|
1902
|
+
};
|
|
1903
|
+
/** @description Bad Gateway */
|
|
1904
|
+
502: {
|
|
1905
|
+
headers: {
|
|
1906
|
+
[name: string]: unknown;
|
|
1907
|
+
};
|
|
1908
|
+
content: {
|
|
1909
|
+
"application/json": {
|
|
1910
|
+
/**
|
|
1911
|
+
* @description HTTP status code
|
|
1912
|
+
* @example 400
|
|
1913
|
+
*/
|
|
1914
|
+
statusCode?: number;
|
|
1915
|
+
/**
|
|
1916
|
+
* @description Short error label
|
|
1917
|
+
* @example Bad Request
|
|
1918
|
+
*/
|
|
1919
|
+
error?: string;
|
|
1920
|
+
/**
|
|
1921
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
1922
|
+
* @example Validation failed
|
|
1923
|
+
*/
|
|
1924
|
+
message: string | string[];
|
|
1925
|
+
};
|
|
1926
|
+
};
|
|
1927
|
+
};
|
|
1928
|
+
};
|
|
1929
|
+
};
|
|
1930
|
+
delete?: never;
|
|
1931
|
+
options?: never;
|
|
1932
|
+
head?: never;
|
|
1933
|
+
patch?: never;
|
|
1934
|
+
trace?: never;
|
|
1935
|
+
};
|
|
1936
|
+
"/v1/orgs/me/members/{userId}/suspend": {
|
|
1937
|
+
parameters: {
|
|
1938
|
+
query?: never;
|
|
1939
|
+
header?: never;
|
|
1940
|
+
path?: never;
|
|
1941
|
+
cookie?: never;
|
|
1942
|
+
};
|
|
1943
|
+
get?: never;
|
|
1944
|
+
put?: never;
|
|
1945
|
+
/** Suspend a member (reversible). The owner cannot be suspended. */
|
|
1946
|
+
post: {
|
|
1947
|
+
parameters: {
|
|
1948
|
+
query?: never;
|
|
1949
|
+
header?: never;
|
|
1950
|
+
path?: never;
|
|
1951
|
+
cookie?: never;
|
|
1952
|
+
};
|
|
1953
|
+
requestBody?: never;
|
|
1954
|
+
responses: {
|
|
1955
|
+
/** @description Created */
|
|
1956
|
+
201: {
|
|
1957
|
+
headers: {
|
|
1958
|
+
[name: string]: unknown;
|
|
1959
|
+
};
|
|
1960
|
+
content: {
|
|
1961
|
+
"application/json": {
|
|
1962
|
+
/**
|
|
1963
|
+
* @description UUID v4
|
|
1964
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
1965
|
+
*/
|
|
1966
|
+
membershipId: string;
|
|
1967
|
+
/**
|
|
1968
|
+
* Format: date-time
|
|
1969
|
+
* @description ISO 8601 date-time string
|
|
1970
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
1697
1971
|
*/
|
|
1698
1972
|
suspendedAt: string;
|
|
1699
1973
|
};
|
|
@@ -1801,8 +2075,8 @@ interface paths$1 {
|
|
|
1801
2075
|
};
|
|
1802
2076
|
requestBody?: never;
|
|
1803
2077
|
responses: {
|
|
1804
|
-
/** @description
|
|
1805
|
-
|
|
2078
|
+
/** @description Created */
|
|
2079
|
+
201: {
|
|
1806
2080
|
headers: {
|
|
1807
2081
|
[name: string]: unknown;
|
|
1808
2082
|
};
|
|
@@ -2133,7 +2407,10 @@ interface paths$1 {
|
|
|
2133
2407
|
};
|
|
2134
2408
|
get?: never;
|
|
2135
2409
|
put?: never;
|
|
2136
|
-
/**
|
|
2410
|
+
/**
|
|
2411
|
+
* Re-send the invitation email to a pending member
|
|
2412
|
+
* @description Mints a fresh verify token, invalidates earlier ones and mails it. The token is never returned. 502 means the email could not be sent and nothing changed (the previous link stays valid).
|
|
2413
|
+
*/
|
|
2137
2414
|
post: {
|
|
2138
2415
|
parameters: {
|
|
2139
2416
|
query?: never;
|
|
@@ -2143,14 +2420,13 @@ interface paths$1 {
|
|
|
2143
2420
|
};
|
|
2144
2421
|
requestBody?: never;
|
|
2145
2422
|
responses: {
|
|
2146
|
-
/** @description
|
|
2147
|
-
|
|
2423
|
+
/** @description Created */
|
|
2424
|
+
201: {
|
|
2148
2425
|
headers: {
|
|
2149
2426
|
[name: string]: unknown;
|
|
2150
2427
|
};
|
|
2151
2428
|
content: {
|
|
2152
2429
|
"application/json": {
|
|
2153
|
-
emailVerifyToken: string;
|
|
2154
2430
|
/**
|
|
2155
2431
|
* Format: email
|
|
2156
2432
|
* @description RFC 5321 email address
|
|
@@ -2235,6 +2511,56 @@ interface paths$1 {
|
|
|
2235
2511
|
};
|
|
2236
2512
|
};
|
|
2237
2513
|
};
|
|
2514
|
+
/** @description Too Many Requests */
|
|
2515
|
+
429: {
|
|
2516
|
+
headers: {
|
|
2517
|
+
[name: string]: unknown;
|
|
2518
|
+
};
|
|
2519
|
+
content: {
|
|
2520
|
+
"application/json": {
|
|
2521
|
+
/**
|
|
2522
|
+
* @description HTTP status code
|
|
2523
|
+
* @example 400
|
|
2524
|
+
*/
|
|
2525
|
+
statusCode?: number;
|
|
2526
|
+
/**
|
|
2527
|
+
* @description Short error label
|
|
2528
|
+
* @example Bad Request
|
|
2529
|
+
*/
|
|
2530
|
+
error?: string;
|
|
2531
|
+
/**
|
|
2532
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
2533
|
+
* @example Validation failed
|
|
2534
|
+
*/
|
|
2535
|
+
message: string | string[];
|
|
2536
|
+
};
|
|
2537
|
+
};
|
|
2538
|
+
};
|
|
2539
|
+
/** @description Bad Gateway */
|
|
2540
|
+
502: {
|
|
2541
|
+
headers: {
|
|
2542
|
+
[name: string]: unknown;
|
|
2543
|
+
};
|
|
2544
|
+
content: {
|
|
2545
|
+
"application/json": {
|
|
2546
|
+
/**
|
|
2547
|
+
* @description HTTP status code
|
|
2548
|
+
* @example 400
|
|
2549
|
+
*/
|
|
2550
|
+
statusCode?: number;
|
|
2551
|
+
/**
|
|
2552
|
+
* @description Short error label
|
|
2553
|
+
* @example Bad Request
|
|
2554
|
+
*/
|
|
2555
|
+
error?: string;
|
|
2556
|
+
/**
|
|
2557
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
2558
|
+
* @example Validation failed
|
|
2559
|
+
*/
|
|
2560
|
+
message: string | string[];
|
|
2561
|
+
};
|
|
2562
|
+
};
|
|
2563
|
+
};
|
|
2238
2564
|
};
|
|
2239
2565
|
};
|
|
2240
2566
|
delete?: never;
|
|
@@ -2287,8 +2613,8 @@ interface paths$1 {
|
|
|
2287
2613
|
};
|
|
2288
2614
|
};
|
|
2289
2615
|
responses: {
|
|
2290
|
-
/** @description
|
|
2291
|
-
|
|
2616
|
+
/** @description Created */
|
|
2617
|
+
201: {
|
|
2292
2618
|
headers: {
|
|
2293
2619
|
[name: string]: unknown;
|
|
2294
2620
|
};
|
|
@@ -2726,8 +3052,8 @@ interface paths$1 {
|
|
|
2726
3052
|
};
|
|
2727
3053
|
requestBody?: never;
|
|
2728
3054
|
responses: {
|
|
2729
|
-
/** @description
|
|
2730
|
-
|
|
3055
|
+
/** @description Created */
|
|
3056
|
+
201: {
|
|
2731
3057
|
headers: {
|
|
2732
3058
|
[name: string]: unknown;
|
|
2733
3059
|
};
|
|
@@ -2877,8 +3203,8 @@ interface paths$1 {
|
|
|
2877
3203
|
};
|
|
2878
3204
|
};
|
|
2879
3205
|
responses: {
|
|
2880
|
-
/** @description
|
|
2881
|
-
|
|
3206
|
+
/** @description Created */
|
|
3207
|
+
201: {
|
|
2882
3208
|
headers: {
|
|
2883
3209
|
[name: string]: unknown;
|
|
2884
3210
|
};
|
|
@@ -3016,6 +3342,10 @@ interface paths$1 {
|
|
|
3016
3342
|
* @example 2026-05-20T10:30:00.000Z
|
|
3017
3343
|
*/
|
|
3018
3344
|
revokedAt: string | null;
|
|
3345
|
+
/** @description True when the key belongs to one OAuth grant (a connected app): only that app can sign with it, and disconnecting the app ends it. */
|
|
3346
|
+
boundToOauthGrant: boolean;
|
|
3347
|
+
/** @description For a key that belongs to no grant: whether the user shared it with OAuth clients (PATCH). Only shared keys are visible and usable to them. */
|
|
3348
|
+
sharedWithOauthClients: boolean;
|
|
3019
3349
|
}[];
|
|
3020
3350
|
};
|
|
3021
3351
|
};
|
|
@@ -3120,8 +3450,8 @@ interface paths$1 {
|
|
|
3120
3450
|
};
|
|
3121
3451
|
};
|
|
3122
3452
|
responses: {
|
|
3123
|
-
/** @description
|
|
3124
|
-
|
|
3453
|
+
/** @description Created */
|
|
3454
|
+
201: {
|
|
3125
3455
|
headers: {
|
|
3126
3456
|
[name: string]: unknown;
|
|
3127
3457
|
};
|
|
@@ -3293,8 +3623,8 @@ interface paths$1 {
|
|
|
3293
3623
|
};
|
|
3294
3624
|
};
|
|
3295
3625
|
responses: {
|
|
3296
|
-
/** @description
|
|
3297
|
-
|
|
3626
|
+
/** @description Created */
|
|
3627
|
+
201: {
|
|
3298
3628
|
headers: {
|
|
3299
3629
|
[name: string]: unknown;
|
|
3300
3630
|
};
|
|
@@ -3618,45 +3948,23 @@ interface paths$1 {
|
|
|
3618
3948
|
};
|
|
3619
3949
|
options?: never;
|
|
3620
3950
|
head?: never;
|
|
3621
|
-
patch?: never;
|
|
3622
|
-
trace?: never;
|
|
3623
|
-
};
|
|
3624
|
-
"/v1/sign": {
|
|
3625
|
-
parameters: {
|
|
3626
|
-
query?: never;
|
|
3627
|
-
header?: never;
|
|
3628
|
-
path?: never;
|
|
3629
|
-
cookie?: never;
|
|
3630
|
-
};
|
|
3631
|
-
get?: never;
|
|
3632
|
-
put?: never;
|
|
3633
3951
|
/**
|
|
3634
|
-
*
|
|
3635
|
-
* @description
|
|
3636
|
-
*
|
|
3637
|
-
* **Use:** sign the canonical-intent JSON returned by chain-api `POST /v5/contracts/.../witnesses/propose` (and the analogous v4 endpoint). The endpoint signs whatever bytes you submit because sign:write is an explicit grant to use the user's key — the on-chain authority of the key is bounded to witness ops on the user's contract, and nothing else in Witnium currently consumes these signatures. Future signing surfaces that need different keys or scopes get their own.
|
|
3638
|
-
*
|
|
3639
|
-
* **Limits:** payload ≤ 8 KiB (16384 hex chars), per-user rate-limited at 20 signs/minute (429 + Retry-After on excess). Both are resource bounds, not access-control fences.
|
|
3640
|
-
*
|
|
3641
|
-
* Optional `X-Request-Id` request header gets forwarded into the audit-log line; a UUID is generated if absent.
|
|
3952
|
+
* Share a durable delegated key with OAuth clients (or stop)
|
|
3953
|
+
* @description Dashboard only (a token from POST /v1/auth/access-token); OAuth tokens get 403. Applies to keys that belong to no OAuth grant. A shared key can be listed and used to sign by every OAuth client the user connected to this org, but submitted or revoked only from the dashboard.
|
|
3642
3954
|
*/
|
|
3643
|
-
|
|
3955
|
+
patch: {
|
|
3644
3956
|
parameters: {
|
|
3645
3957
|
query?: never;
|
|
3646
3958
|
header?: never;
|
|
3647
|
-
path
|
|
3959
|
+
path: {
|
|
3960
|
+
id: string;
|
|
3961
|
+
};
|
|
3648
3962
|
cookie?: never;
|
|
3649
3963
|
};
|
|
3650
3964
|
requestBody?: {
|
|
3651
3965
|
content: {
|
|
3652
3966
|
"application/json": {
|
|
3653
|
-
|
|
3654
|
-
* @description The delegated key (per-user, per-contract) used to sign. Must be confirmed on-chain and not revoked.
|
|
3655
|
-
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
3656
|
-
*/
|
|
3657
|
-
delegatedKeyId: string;
|
|
3658
|
-
/** @description Hex-encoded bytes to sign (no 0x prefix). Must have an even length and at most 16384 hex characters (8 KiB raw). The expected use is signing the UTF-8 bytes of a v5 canonical-intent JSON returned by chain-api `/propose`, but the endpoint signs whatever bytes you submit — sign:write is an explicit grant to use the user's key. Witnium never logs the bytes; only their SHA-256 hash is recorded for audit cross-correlation with Vault. */
|
|
3659
|
-
payload: string;
|
|
3967
|
+
sharedWithOauthClients: boolean;
|
|
3660
3968
|
};
|
|
3661
3969
|
};
|
|
3662
3970
|
};
|
|
@@ -3668,18 +3976,46 @@ interface paths$1 {
|
|
|
3668
3976
|
};
|
|
3669
3977
|
content: {
|
|
3670
3978
|
"application/json": {
|
|
3671
|
-
/** @description Ed25519 signature over the payload bytes, hex-encoded. */
|
|
3672
|
-
signature: string;
|
|
3673
3979
|
/**
|
|
3674
|
-
* @description
|
|
3980
|
+
* @description UUID v4
|
|
3981
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
3982
|
+
*/
|
|
3983
|
+
id: string;
|
|
3984
|
+
/**
|
|
3985
|
+
* @description Ethereum address (0x + 40 hex characters)
|
|
3986
|
+
* @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
|
|
3987
|
+
*/
|
|
3988
|
+
contractAddress: string;
|
|
3989
|
+
/**
|
|
3990
|
+
* @description Ed25519 public key — 32 bytes hex-encoded (64 chars, no 0x prefix)
|
|
3675
3991
|
* @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
|
|
3676
3992
|
*/
|
|
3677
|
-
|
|
3993
|
+
publicKey: string;
|
|
3678
3994
|
/**
|
|
3679
|
-
*
|
|
3680
|
-
* @
|
|
3995
|
+
* Format: date-time
|
|
3996
|
+
* @description ISO 8601 date-time string
|
|
3997
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
3681
3998
|
*/
|
|
3682
|
-
|
|
3999
|
+
createdAt: string;
|
|
4000
|
+
/**
|
|
4001
|
+
* Format: date-time
|
|
4002
|
+
* @description Set once the on-chain addSigningKey tx is mined.
|
|
4003
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
4004
|
+
*/
|
|
4005
|
+
confirmedAt: string | null;
|
|
4006
|
+
/** @description Transaction hash from the addSigningKey submission, if any. */
|
|
4007
|
+
confirmedTxHash: string | null;
|
|
4008
|
+
confirmedBlockNumber: number | null;
|
|
4009
|
+
/**
|
|
4010
|
+
* Format: date-time
|
|
4011
|
+
* @description Set when the user locally revokes the key (Vault key wiped). Does NOT mean the on-chain record was revoked.
|
|
4012
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
4013
|
+
*/
|
|
4014
|
+
revokedAt: string | null;
|
|
4015
|
+
/** @description True when the key belongs to one OAuth grant (a connected app): only that app can sign with it, and disconnecting the app ends it. */
|
|
4016
|
+
boundToOauthGrant: boolean;
|
|
4017
|
+
/** @description For a key that belongs to no grant: whether the user shared it with OAuth clients (PATCH). Only shared keys are visible and usable to them. */
|
|
4018
|
+
sharedWithOauthClients: boolean;
|
|
3683
4019
|
};
|
|
3684
4020
|
};
|
|
3685
4021
|
};
|
|
@@ -3808,40 +4144,11 @@ interface paths$1 {
|
|
|
3808
4144
|
};
|
|
3809
4145
|
};
|
|
3810
4146
|
};
|
|
3811
|
-
/** @description Too Many Requests */
|
|
3812
|
-
429: {
|
|
3813
|
-
headers: {
|
|
3814
|
-
[name: string]: unknown;
|
|
3815
|
-
};
|
|
3816
|
-
content: {
|
|
3817
|
-
"application/json": {
|
|
3818
|
-
/**
|
|
3819
|
-
* @description HTTP status code
|
|
3820
|
-
* @example 400
|
|
3821
|
-
*/
|
|
3822
|
-
statusCode?: number;
|
|
3823
|
-
/**
|
|
3824
|
-
* @description Short error label
|
|
3825
|
-
* @example Bad Request
|
|
3826
|
-
*/
|
|
3827
|
-
error?: string;
|
|
3828
|
-
/**
|
|
3829
|
-
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
3830
|
-
* @example Validation failed
|
|
3831
|
-
*/
|
|
3832
|
-
message: string | string[];
|
|
3833
|
-
};
|
|
3834
|
-
};
|
|
3835
|
-
};
|
|
3836
4147
|
};
|
|
3837
4148
|
};
|
|
3838
|
-
delete?: never;
|
|
3839
|
-
options?: never;
|
|
3840
|
-
head?: never;
|
|
3841
|
-
patch?: never;
|
|
3842
4149
|
trace?: never;
|
|
3843
4150
|
};
|
|
3844
|
-
"/v1/
|
|
4151
|
+
"/v1/sign": {
|
|
3845
4152
|
parameters: {
|
|
3846
4153
|
query?: never;
|
|
3847
4154
|
header?: never;
|
|
@@ -3851,8 +4158,14 @@ interface paths$1 {
|
|
|
3851
4158
|
get?: never;
|
|
3852
4159
|
put?: never;
|
|
3853
4160
|
/**
|
|
3854
|
-
*
|
|
3855
|
-
* @description
|
|
4161
|
+
* Sign bytes with a delegated key
|
|
4162
|
+
* @description Vault Transit signs the supplied payload using the user's delegated key. Vault returns the signature; the accounts-service process never sees the private bytes (delegated keys are created with `exportable=false`).
|
|
4163
|
+
*
|
|
4164
|
+
* **Use:** sign the canonical-intent JSON returned by chain-api `POST /v5/contracts/.../witnesses/propose` (and the analogous v4 endpoint). The endpoint signs whatever bytes you submit because sign:write is an explicit grant to use the user's key — the on-chain authority of the key is bounded to witness ops on the user's contract, and nothing else in Witnium currently consumes these signatures. Future signing surfaces that need different keys or scopes get their own.
|
|
4165
|
+
*
|
|
4166
|
+
* **Limits:** payload ≤ 8 KiB (16384 hex chars), per-user rate-limited at 20 signs/minute (429 + Retry-After on excess). Both are resource bounds, not access-control fences.
|
|
4167
|
+
*
|
|
4168
|
+
* Optional `X-Request-Id` request header gets forwarded into the audit-log line; a UUID is generated if absent.
|
|
3856
4169
|
*/
|
|
3857
4170
|
post: {
|
|
3858
4171
|
parameters: {
|
|
@@ -3864,11 +4177,225 @@ interface paths$1 {
|
|
|
3864
4177
|
requestBody?: {
|
|
3865
4178
|
content: {
|
|
3866
4179
|
"application/json": {
|
|
3867
|
-
/** @description One-time token issued after email verification (or by an org admin via POST /v1/orgs/me/users). Consumed atomically. */
|
|
3868
|
-
provisioningToken: string;
|
|
3869
4180
|
/**
|
|
3870
|
-
* @description
|
|
3871
|
-
* @example
|
|
4181
|
+
* @description The delegated key (per-user, per-contract) used to sign. Must be confirmed on-chain and not revoked.
|
|
4182
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
4183
|
+
*/
|
|
4184
|
+
delegatedKeyId: string;
|
|
4185
|
+
/** @description Hex-encoded bytes to sign (no 0x prefix). Must have an even length and at most 16384 hex characters (8 KiB raw). The expected use is signing the UTF-8 bytes of a v5 canonical-intent JSON returned by chain-api `/propose`, but the endpoint signs whatever bytes you submit — sign:write is an explicit grant to use the user's key. Witnium never logs the bytes; only their SHA-256 hash is recorded for audit cross-correlation with Vault. */
|
|
4186
|
+
payload: string;
|
|
4187
|
+
};
|
|
4188
|
+
};
|
|
4189
|
+
};
|
|
4190
|
+
responses: {
|
|
4191
|
+
/** @description Created */
|
|
4192
|
+
201: {
|
|
4193
|
+
headers: {
|
|
4194
|
+
[name: string]: unknown;
|
|
4195
|
+
};
|
|
4196
|
+
content: {
|
|
4197
|
+
"application/json": {
|
|
4198
|
+
/** @description Ed25519 signature over the payload bytes, hex-encoded. */
|
|
4199
|
+
signature: string;
|
|
4200
|
+
/**
|
|
4201
|
+
* @description Public key of the delegated key used to sign — for verification.
|
|
4202
|
+
* @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
|
|
4203
|
+
*/
|
|
4204
|
+
signerPublicKey: string;
|
|
4205
|
+
/**
|
|
4206
|
+
* @description UUID v4
|
|
4207
|
+
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
4208
|
+
*/
|
|
4209
|
+
delegatedKeyId: string;
|
|
4210
|
+
};
|
|
4211
|
+
};
|
|
4212
|
+
};
|
|
4213
|
+
/** @description Bad Request — validation failed */
|
|
4214
|
+
400: {
|
|
4215
|
+
headers: {
|
|
4216
|
+
[name: string]: unknown;
|
|
4217
|
+
};
|
|
4218
|
+
content: {
|
|
4219
|
+
"application/json": {
|
|
4220
|
+
/**
|
|
4221
|
+
* @description HTTP status code
|
|
4222
|
+
* @example 400
|
|
4223
|
+
*/
|
|
4224
|
+
statusCode?: number;
|
|
4225
|
+
/**
|
|
4226
|
+
* @description Short error label
|
|
4227
|
+
* @example Bad Request
|
|
4228
|
+
*/
|
|
4229
|
+
error?: string;
|
|
4230
|
+
/**
|
|
4231
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4232
|
+
* @example Validation failed
|
|
4233
|
+
*/
|
|
4234
|
+
message: string | string[];
|
|
4235
|
+
};
|
|
4236
|
+
};
|
|
4237
|
+
};
|
|
4238
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
4239
|
+
401: {
|
|
4240
|
+
headers: {
|
|
4241
|
+
[name: string]: unknown;
|
|
4242
|
+
};
|
|
4243
|
+
content: {
|
|
4244
|
+
"application/json": {
|
|
4245
|
+
/**
|
|
4246
|
+
* @description HTTP status code
|
|
4247
|
+
* @example 400
|
|
4248
|
+
*/
|
|
4249
|
+
statusCode?: number;
|
|
4250
|
+
/**
|
|
4251
|
+
* @description Short error label
|
|
4252
|
+
* @example Bad Request
|
|
4253
|
+
*/
|
|
4254
|
+
error?: string;
|
|
4255
|
+
/**
|
|
4256
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4257
|
+
* @example Validation failed
|
|
4258
|
+
*/
|
|
4259
|
+
message: string | string[];
|
|
4260
|
+
};
|
|
4261
|
+
};
|
|
4262
|
+
};
|
|
4263
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
4264
|
+
403: {
|
|
4265
|
+
headers: {
|
|
4266
|
+
[name: string]: unknown;
|
|
4267
|
+
};
|
|
4268
|
+
content: {
|
|
4269
|
+
"application/json": {
|
|
4270
|
+
/**
|
|
4271
|
+
* @description HTTP status code
|
|
4272
|
+
* @example 400
|
|
4273
|
+
*/
|
|
4274
|
+
statusCode?: number;
|
|
4275
|
+
/**
|
|
4276
|
+
* @description Short error label
|
|
4277
|
+
* @example Bad Request
|
|
4278
|
+
*/
|
|
4279
|
+
error?: string;
|
|
4280
|
+
/**
|
|
4281
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4282
|
+
* @example Validation failed
|
|
4283
|
+
*/
|
|
4284
|
+
message: string | string[];
|
|
4285
|
+
};
|
|
4286
|
+
};
|
|
4287
|
+
};
|
|
4288
|
+
/** @description Not Found */
|
|
4289
|
+
404: {
|
|
4290
|
+
headers: {
|
|
4291
|
+
[name: string]: unknown;
|
|
4292
|
+
};
|
|
4293
|
+
content: {
|
|
4294
|
+
"application/json": {
|
|
4295
|
+
/**
|
|
4296
|
+
* @description HTTP status code
|
|
4297
|
+
* @example 400
|
|
4298
|
+
*/
|
|
4299
|
+
statusCode?: number;
|
|
4300
|
+
/**
|
|
4301
|
+
* @description Short error label
|
|
4302
|
+
* @example Bad Request
|
|
4303
|
+
*/
|
|
4304
|
+
error?: string;
|
|
4305
|
+
/**
|
|
4306
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4307
|
+
* @example Validation failed
|
|
4308
|
+
*/
|
|
4309
|
+
message: string | string[];
|
|
4310
|
+
};
|
|
4311
|
+
};
|
|
4312
|
+
};
|
|
4313
|
+
/** @description Conflict */
|
|
4314
|
+
409: {
|
|
4315
|
+
headers: {
|
|
4316
|
+
[name: string]: unknown;
|
|
4317
|
+
};
|
|
4318
|
+
content: {
|
|
4319
|
+
"application/json": {
|
|
4320
|
+
/**
|
|
4321
|
+
* @description HTTP status code
|
|
4322
|
+
* @example 400
|
|
4323
|
+
*/
|
|
4324
|
+
statusCode?: number;
|
|
4325
|
+
/**
|
|
4326
|
+
* @description Short error label
|
|
4327
|
+
* @example Bad Request
|
|
4328
|
+
*/
|
|
4329
|
+
error?: string;
|
|
4330
|
+
/**
|
|
4331
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4332
|
+
* @example Validation failed
|
|
4333
|
+
*/
|
|
4334
|
+
message: string | string[];
|
|
4335
|
+
};
|
|
4336
|
+
};
|
|
4337
|
+
};
|
|
4338
|
+
/** @description Too Many Requests */
|
|
4339
|
+
429: {
|
|
4340
|
+
headers: {
|
|
4341
|
+
[name: string]: unknown;
|
|
4342
|
+
};
|
|
4343
|
+
content: {
|
|
4344
|
+
"application/json": {
|
|
4345
|
+
/**
|
|
4346
|
+
* @description HTTP status code
|
|
4347
|
+
* @example 400
|
|
4348
|
+
*/
|
|
4349
|
+
statusCode?: number;
|
|
4350
|
+
/**
|
|
4351
|
+
* @description Short error label
|
|
4352
|
+
* @example Bad Request
|
|
4353
|
+
*/
|
|
4354
|
+
error?: string;
|
|
4355
|
+
/**
|
|
4356
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
4357
|
+
* @example Validation failed
|
|
4358
|
+
*/
|
|
4359
|
+
message: string | string[];
|
|
4360
|
+
};
|
|
4361
|
+
};
|
|
4362
|
+
};
|
|
4363
|
+
};
|
|
4364
|
+
};
|
|
4365
|
+
delete?: never;
|
|
4366
|
+
options?: never;
|
|
4367
|
+
head?: never;
|
|
4368
|
+
patch?: never;
|
|
4369
|
+
trace?: never;
|
|
4370
|
+
};
|
|
4371
|
+
"/v1/contracts/provision": {
|
|
4372
|
+
parameters: {
|
|
4373
|
+
query?: never;
|
|
4374
|
+
header?: never;
|
|
4375
|
+
path?: never;
|
|
4376
|
+
cookie?: never;
|
|
4377
|
+
};
|
|
4378
|
+
get?: never;
|
|
4379
|
+
put?: never;
|
|
4380
|
+
/**
|
|
4381
|
+
* Provision a witness contract for a user
|
|
4382
|
+
* @description Consumes the user's `provisioningToken` and deploys their on-chain WitnessRegistry. Email must already be verified (the token bundles that gate). Idempotent in the sense that a second call with the same token returns 4xx because the token is single-use.
|
|
4383
|
+
*/
|
|
4384
|
+
post: {
|
|
4385
|
+
parameters: {
|
|
4386
|
+
query?: never;
|
|
4387
|
+
header?: never;
|
|
4388
|
+
path?: never;
|
|
4389
|
+
cookie?: never;
|
|
4390
|
+
};
|
|
4391
|
+
requestBody?: {
|
|
4392
|
+
content: {
|
|
4393
|
+
"application/json": {
|
|
4394
|
+
/** @description One-time token issued after email verification (or by an org admin via POST /v1/orgs/me/users). Consumed atomically. */
|
|
4395
|
+
provisioningToken: string;
|
|
4396
|
+
/**
|
|
4397
|
+
* @description Owner Ed25519 public key. Generated client-side and never seen by the server again — must NOT equal `initialSigningPublicKey`.
|
|
4398
|
+
* @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
|
|
3872
4399
|
*/
|
|
3873
4400
|
ownerPublicKey: string;
|
|
3874
4401
|
/**
|
|
@@ -3880,8 +4407,8 @@ interface paths$1 {
|
|
|
3880
4407
|
};
|
|
3881
4408
|
};
|
|
3882
4409
|
responses: {
|
|
3883
|
-
/** @description
|
|
3884
|
-
|
|
4410
|
+
/** @description Created */
|
|
4411
|
+
201: {
|
|
3885
4412
|
headers: {
|
|
3886
4413
|
[name: string]: unknown;
|
|
3887
4414
|
};
|
|
@@ -3993,8 +4520,8 @@ interface paths$1 {
|
|
|
3993
4520
|
};
|
|
3994
4521
|
};
|
|
3995
4522
|
responses: {
|
|
3996
|
-
/** @description
|
|
3997
|
-
|
|
4523
|
+
/** @description Created */
|
|
4524
|
+
201: {
|
|
3998
4525
|
headers: {
|
|
3999
4526
|
[name: string]: unknown;
|
|
4000
4527
|
};
|
|
@@ -4098,8 +4625,8 @@ interface paths$1 {
|
|
|
4098
4625
|
};
|
|
4099
4626
|
};
|
|
4100
4627
|
responses: {
|
|
4101
|
-
/** @description
|
|
4102
|
-
|
|
4628
|
+
/** @description Created */
|
|
4629
|
+
201: {
|
|
4103
4630
|
headers: {
|
|
4104
4631
|
[name: string]: unknown;
|
|
4105
4632
|
};
|
|
@@ -4198,8 +4725,8 @@ interface paths$1 {
|
|
|
4198
4725
|
};
|
|
4199
4726
|
};
|
|
4200
4727
|
responses: {
|
|
4201
|
-
/** @description
|
|
4202
|
-
|
|
4728
|
+
/** @description Created */
|
|
4729
|
+
201: {
|
|
4203
4730
|
headers: {
|
|
4204
4731
|
[name: string]: unknown;
|
|
4205
4732
|
};
|
|
@@ -4298,8 +4825,8 @@ interface paths$1 {
|
|
|
4298
4825
|
};
|
|
4299
4826
|
};
|
|
4300
4827
|
responses: {
|
|
4301
|
-
/** @description
|
|
4302
|
-
|
|
4828
|
+
/** @description Created */
|
|
4829
|
+
201: {
|
|
4303
4830
|
headers: {
|
|
4304
4831
|
[name: string]: unknown;
|
|
4305
4832
|
};
|
|
@@ -4411,8 +4938,8 @@ interface paths$1 {
|
|
|
4411
4938
|
};
|
|
4412
4939
|
};
|
|
4413
4940
|
responses: {
|
|
4414
|
-
/** @description
|
|
4415
|
-
|
|
4941
|
+
/** @description Created */
|
|
4942
|
+
201: {
|
|
4416
4943
|
headers: {
|
|
4417
4944
|
[name: string]: unknown;
|
|
4418
4945
|
};
|
|
@@ -4543,8 +5070,8 @@ interface paths$1 {
|
|
|
4543
5070
|
};
|
|
4544
5071
|
};
|
|
4545
5072
|
responses: {
|
|
4546
|
-
/** @description
|
|
4547
|
-
|
|
5073
|
+
/** @description Created */
|
|
5074
|
+
201: {
|
|
4548
5075
|
headers: {
|
|
4549
5076
|
[name: string]: unknown;
|
|
4550
5077
|
};
|
|
@@ -4662,8 +5189,8 @@ interface paths$1 {
|
|
|
4662
5189
|
};
|
|
4663
5190
|
requestBody?: never;
|
|
4664
5191
|
responses: {
|
|
4665
|
-
/** @description
|
|
4666
|
-
|
|
5192
|
+
/** @description Created */
|
|
5193
|
+
201: {
|
|
4667
5194
|
headers: {
|
|
4668
5195
|
[name: string]: unknown;
|
|
4669
5196
|
};
|
|
@@ -4797,8 +5324,8 @@ interface paths$1 {
|
|
|
4797
5324
|
};
|
|
4798
5325
|
};
|
|
4799
5326
|
responses: {
|
|
4800
|
-
/** @description
|
|
4801
|
-
|
|
5327
|
+
/** @description Created */
|
|
5328
|
+
201: {
|
|
4802
5329
|
headers: {
|
|
4803
5330
|
[name: string]: unknown;
|
|
4804
5331
|
};
|
|
@@ -4974,7 +5501,7 @@ interface paths$1 {
|
|
|
4974
5501
|
put?: never;
|
|
4975
5502
|
/**
|
|
4976
5503
|
* Internal callback from chain-api
|
|
4977
|
-
* @description NOT for external use. Invoked by chain-api when a witness tx settles so accounts can update its credit reservations.
|
|
5504
|
+
* @description NOT for external use. Invoked by chain-api when a witness tx settles so accounts can update its credit reservations. Authenticated by internal callback protocol v1 (docs/internal-callback-protocol.md): X-Witnium-Event-Id, X-Witnium-Callback-Timestamp and X-Witnium-Callback-Signature, an HMAC over the event id, timestamp, method, path with query and body hash using the shared INTERNAL_CALLBACK_HMAC_SECRET. Deduplicated by event id: a redelivered event returns 200 without side effects. Listed in the spec for completeness; SDK consumers should ignore.
|
|
4978
5505
|
*/
|
|
4979
5506
|
post: {
|
|
4980
5507
|
parameters: {
|
|
@@ -4989,12 +5516,12 @@ interface paths$1 {
|
|
|
4989
5516
|
content: {
|
|
4990
5517
|
"application/json": {
|
|
4991
5518
|
/** @description 32-byte hash, lower-case hex without 0x prefix. */
|
|
4992
|
-
witnessId
|
|
5519
|
+
witnessId: string;
|
|
4993
5520
|
/**
|
|
4994
|
-
* @description Settlement state from chain-api. `confirmed` →
|
|
5521
|
+
* @description Settlement state from chain-api. `confirmed` → commit the reservation against the witness. `failed` → release it back to the org.
|
|
4995
5522
|
* @enum {string}
|
|
4996
5523
|
*/
|
|
4997
|
-
status
|
|
5524
|
+
status: "confirmed" | "failed";
|
|
4998
5525
|
error?: string;
|
|
4999
5526
|
};
|
|
5000
5527
|
};
|
|
@@ -5007,8 +5534,8 @@ interface paths$1 {
|
|
|
5007
5534
|
};
|
|
5008
5535
|
content: {
|
|
5009
5536
|
"application/json": {
|
|
5010
|
-
|
|
5011
|
-
|
|
5537
|
+
/** @enum {boolean} */
|
|
5538
|
+
ok: true;
|
|
5012
5539
|
};
|
|
5013
5540
|
};
|
|
5014
5541
|
};
|
|
@@ -5675,24 +6202,25 @@ interface paths$1 {
|
|
|
5675
6202
|
patch?: never;
|
|
5676
6203
|
trace?: never;
|
|
5677
6204
|
};
|
|
5678
|
-
"/
|
|
6205
|
+
"/v3/contracts/{contractAddress}/witnesses/intents/{intentId}": {
|
|
5679
6206
|
parameters: {
|
|
5680
6207
|
query?: never;
|
|
5681
6208
|
header?: never;
|
|
5682
6209
|
path?: never;
|
|
5683
6210
|
cookie?: never;
|
|
5684
6211
|
};
|
|
5685
|
-
get?: never;
|
|
5686
|
-
put?: never;
|
|
5687
6212
|
/**
|
|
5688
|
-
*
|
|
5689
|
-
* @description
|
|
6213
|
+
* Recover a v3 witness intent's outcome
|
|
6214
|
+
* @description For a client that lost a finalize (or propose) response. Returns the stored finalize response when accounts has one, otherwise chain-api's status for the intent. The URL contract must be the caller's. Read-only: never finalizes.
|
|
5690
6215
|
*/
|
|
5691
|
-
|
|
6216
|
+
get: {
|
|
5692
6217
|
parameters: {
|
|
5693
6218
|
query?: never;
|
|
5694
6219
|
header?: never;
|
|
5695
|
-
path
|
|
6220
|
+
path: {
|
|
6221
|
+
contractAddress: string;
|
|
6222
|
+
intentId: string;
|
|
6223
|
+
};
|
|
5696
6224
|
cookie?: never;
|
|
5697
6225
|
};
|
|
5698
6226
|
requestBody?: never;
|
|
@@ -5704,16 +6232,573 @@ interface paths$1 {
|
|
|
5704
6232
|
};
|
|
5705
6233
|
content: {
|
|
5706
6234
|
"application/json": {
|
|
5707
|
-
|
|
6235
|
+
/** @enum {string} */
|
|
6236
|
+
source: "stored";
|
|
6237
|
+
intentId: string;
|
|
6238
|
+
registryVersion: number;
|
|
5708
6239
|
/**
|
|
5709
|
-
*
|
|
5710
|
-
* @
|
|
5711
|
-
* @example 2026-05-20T10:30:00.000Z
|
|
6240
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6241
|
+
* @enum {string}
|
|
5712
6242
|
*/
|
|
5713
|
-
|
|
5714
|
-
|
|
5715
|
-
|
|
5716
|
-
|
|
6243
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired";
|
|
6244
|
+
/** @description The finalize response, exactly as first returned. */
|
|
6245
|
+
result: {
|
|
6246
|
+
[key: string]: unknown;
|
|
6247
|
+
};
|
|
6248
|
+
} | {
|
|
6249
|
+
/** @enum {string} */
|
|
6250
|
+
source: "chain";
|
|
6251
|
+
intentId: string;
|
|
6252
|
+
registryVersion: number;
|
|
6253
|
+
/**
|
|
6254
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6255
|
+
* @enum {string|null}
|
|
6256
|
+
*/
|
|
6257
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired" | null;
|
|
6258
|
+
/**
|
|
6259
|
+
* WitnessIntentChainStatus
|
|
6260
|
+
* @description chain-api's status for the intent, verbatim.
|
|
6261
|
+
*/
|
|
6262
|
+
status: {
|
|
6263
|
+
intentId: string;
|
|
6264
|
+
contractAddress: string;
|
|
6265
|
+
registryVersion: number;
|
|
6266
|
+
/** @enum {string} */
|
|
6267
|
+
status: "prepared" | "allocated" | "submitted" | "confirmed" | "failed" | "cancelled" | "expired_unsubmitted" | "unknown";
|
|
6268
|
+
prepareTtlSeconds: number;
|
|
6269
|
+
/** @description Present when `confirmed`. */
|
|
6270
|
+
witnessId?: string;
|
|
6271
|
+
/** @description Present when `confirmed`. */
|
|
6272
|
+
transactionHash?: string;
|
|
6273
|
+
/** @description Present when `confirmed`. */
|
|
6274
|
+
blockNumber?: number;
|
|
6275
|
+
/** @description Present when `unknown`. */
|
|
6276
|
+
reason?: string;
|
|
6277
|
+
};
|
|
6278
|
+
};
|
|
6279
|
+
};
|
|
6280
|
+
};
|
|
6281
|
+
/** @description Bad Request — validation failed */
|
|
6282
|
+
400: {
|
|
6283
|
+
headers: {
|
|
6284
|
+
[name: string]: unknown;
|
|
6285
|
+
};
|
|
6286
|
+
content: {
|
|
6287
|
+
"application/json": {
|
|
6288
|
+
/**
|
|
6289
|
+
* @description HTTP status code
|
|
6290
|
+
* @example 400
|
|
6291
|
+
*/
|
|
6292
|
+
statusCode?: number;
|
|
6293
|
+
/**
|
|
6294
|
+
* @description Short error label
|
|
6295
|
+
* @example Bad Request
|
|
6296
|
+
*/
|
|
6297
|
+
error?: string;
|
|
6298
|
+
/**
|
|
6299
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6300
|
+
* @example Validation failed
|
|
6301
|
+
*/
|
|
6302
|
+
message: string | string[];
|
|
6303
|
+
};
|
|
6304
|
+
};
|
|
6305
|
+
};
|
|
6306
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
6307
|
+
401: {
|
|
6308
|
+
headers: {
|
|
6309
|
+
[name: string]: unknown;
|
|
6310
|
+
};
|
|
6311
|
+
content: {
|
|
6312
|
+
"application/json": {
|
|
6313
|
+
/**
|
|
6314
|
+
* @description HTTP status code
|
|
6315
|
+
* @example 400
|
|
6316
|
+
*/
|
|
6317
|
+
statusCode?: number;
|
|
6318
|
+
/**
|
|
6319
|
+
* @description Short error label
|
|
6320
|
+
* @example Bad Request
|
|
6321
|
+
*/
|
|
6322
|
+
error?: string;
|
|
6323
|
+
/**
|
|
6324
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6325
|
+
* @example Validation failed
|
|
6326
|
+
*/
|
|
6327
|
+
message: string | string[];
|
|
6328
|
+
};
|
|
6329
|
+
};
|
|
6330
|
+
};
|
|
6331
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
6332
|
+
403: {
|
|
6333
|
+
headers: {
|
|
6334
|
+
[name: string]: unknown;
|
|
6335
|
+
};
|
|
6336
|
+
content: {
|
|
6337
|
+
"application/json": {
|
|
6338
|
+
/**
|
|
6339
|
+
* @description HTTP status code
|
|
6340
|
+
* @example 400
|
|
6341
|
+
*/
|
|
6342
|
+
statusCode?: number;
|
|
6343
|
+
/**
|
|
6344
|
+
* @description Short error label
|
|
6345
|
+
* @example Bad Request
|
|
6346
|
+
*/
|
|
6347
|
+
error?: string;
|
|
6348
|
+
/**
|
|
6349
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6350
|
+
* @example Validation failed
|
|
6351
|
+
*/
|
|
6352
|
+
message: string | string[];
|
|
6353
|
+
};
|
|
6354
|
+
};
|
|
6355
|
+
};
|
|
6356
|
+
/** @description Not Found */
|
|
6357
|
+
404: {
|
|
6358
|
+
headers: {
|
|
6359
|
+
[name: string]: unknown;
|
|
6360
|
+
};
|
|
6361
|
+
content: {
|
|
6362
|
+
"application/json": {
|
|
6363
|
+
/**
|
|
6364
|
+
* @description HTTP status code
|
|
6365
|
+
* @example 400
|
|
6366
|
+
*/
|
|
6367
|
+
statusCode?: number;
|
|
6368
|
+
/**
|
|
6369
|
+
* @description Short error label
|
|
6370
|
+
* @example Bad Request
|
|
6371
|
+
*/
|
|
6372
|
+
error?: string;
|
|
6373
|
+
/**
|
|
6374
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6375
|
+
* @example Validation failed
|
|
6376
|
+
*/
|
|
6377
|
+
message: string | string[];
|
|
6378
|
+
};
|
|
6379
|
+
};
|
|
6380
|
+
};
|
|
6381
|
+
};
|
|
6382
|
+
};
|
|
6383
|
+
put?: never;
|
|
6384
|
+
post?: never;
|
|
6385
|
+
delete?: never;
|
|
6386
|
+
options?: never;
|
|
6387
|
+
head?: never;
|
|
6388
|
+
patch?: never;
|
|
6389
|
+
trace?: never;
|
|
6390
|
+
};
|
|
6391
|
+
"/v4/contracts/{contractAddress}/witnesses/intents/{intentId}": {
|
|
6392
|
+
parameters: {
|
|
6393
|
+
query?: never;
|
|
6394
|
+
header?: never;
|
|
6395
|
+
path?: never;
|
|
6396
|
+
cookie?: never;
|
|
6397
|
+
};
|
|
6398
|
+
/**
|
|
6399
|
+
* Recover a v4 witness intent's outcome
|
|
6400
|
+
* @description For a client that lost a finalize (or propose) response. Returns the stored finalize response when accounts has one, otherwise chain-api's status for the intent. The URL contract must be the caller's. Read-only: never finalizes.
|
|
6401
|
+
*/
|
|
6402
|
+
get: {
|
|
6403
|
+
parameters: {
|
|
6404
|
+
query?: never;
|
|
6405
|
+
header?: never;
|
|
6406
|
+
path: {
|
|
6407
|
+
contractAddress: string;
|
|
6408
|
+
intentId: string;
|
|
6409
|
+
};
|
|
6410
|
+
cookie?: never;
|
|
6411
|
+
};
|
|
6412
|
+
requestBody?: never;
|
|
6413
|
+
responses: {
|
|
6414
|
+
/** @description Success */
|
|
6415
|
+
200: {
|
|
6416
|
+
headers: {
|
|
6417
|
+
[name: string]: unknown;
|
|
6418
|
+
};
|
|
6419
|
+
content: {
|
|
6420
|
+
"application/json": {
|
|
6421
|
+
/** @enum {string} */
|
|
6422
|
+
source: "stored";
|
|
6423
|
+
intentId: string;
|
|
6424
|
+
registryVersion: number;
|
|
6425
|
+
/**
|
|
6426
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6427
|
+
* @enum {string}
|
|
6428
|
+
*/
|
|
6429
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired";
|
|
6430
|
+
/** @description The finalize response, exactly as first returned. */
|
|
6431
|
+
result: {
|
|
6432
|
+
[key: string]: unknown;
|
|
6433
|
+
};
|
|
6434
|
+
} | {
|
|
6435
|
+
/** @enum {string} */
|
|
6436
|
+
source: "chain";
|
|
6437
|
+
intentId: string;
|
|
6438
|
+
registryVersion: number;
|
|
6439
|
+
/**
|
|
6440
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6441
|
+
* @enum {string|null}
|
|
6442
|
+
*/
|
|
6443
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired" | null;
|
|
6444
|
+
/**
|
|
6445
|
+
* WitnessIntentChainStatus
|
|
6446
|
+
* @description chain-api's status for the intent, verbatim.
|
|
6447
|
+
*/
|
|
6448
|
+
status: {
|
|
6449
|
+
intentId: string;
|
|
6450
|
+
contractAddress: string;
|
|
6451
|
+
registryVersion: number;
|
|
6452
|
+
/** @enum {string} */
|
|
6453
|
+
status: "prepared" | "allocated" | "submitted" | "confirmed" | "failed" | "cancelled" | "expired_unsubmitted" | "unknown";
|
|
6454
|
+
prepareTtlSeconds: number;
|
|
6455
|
+
/** @description Present when `confirmed`. */
|
|
6456
|
+
witnessId?: string;
|
|
6457
|
+
/** @description Present when `confirmed`. */
|
|
6458
|
+
transactionHash?: string;
|
|
6459
|
+
/** @description Present when `confirmed`. */
|
|
6460
|
+
blockNumber?: number;
|
|
6461
|
+
/** @description Present when `unknown`. */
|
|
6462
|
+
reason?: string;
|
|
6463
|
+
};
|
|
6464
|
+
};
|
|
6465
|
+
};
|
|
6466
|
+
};
|
|
6467
|
+
/** @description Bad Request — validation failed */
|
|
6468
|
+
400: {
|
|
6469
|
+
headers: {
|
|
6470
|
+
[name: string]: unknown;
|
|
6471
|
+
};
|
|
6472
|
+
content: {
|
|
6473
|
+
"application/json": {
|
|
6474
|
+
/**
|
|
6475
|
+
* @description HTTP status code
|
|
6476
|
+
* @example 400
|
|
6477
|
+
*/
|
|
6478
|
+
statusCode?: number;
|
|
6479
|
+
/**
|
|
6480
|
+
* @description Short error label
|
|
6481
|
+
* @example Bad Request
|
|
6482
|
+
*/
|
|
6483
|
+
error?: string;
|
|
6484
|
+
/**
|
|
6485
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6486
|
+
* @example Validation failed
|
|
6487
|
+
*/
|
|
6488
|
+
message: string | string[];
|
|
6489
|
+
};
|
|
6490
|
+
};
|
|
6491
|
+
};
|
|
6492
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
6493
|
+
401: {
|
|
6494
|
+
headers: {
|
|
6495
|
+
[name: string]: unknown;
|
|
6496
|
+
};
|
|
6497
|
+
content: {
|
|
6498
|
+
"application/json": {
|
|
6499
|
+
/**
|
|
6500
|
+
* @description HTTP status code
|
|
6501
|
+
* @example 400
|
|
6502
|
+
*/
|
|
6503
|
+
statusCode?: number;
|
|
6504
|
+
/**
|
|
6505
|
+
* @description Short error label
|
|
6506
|
+
* @example Bad Request
|
|
6507
|
+
*/
|
|
6508
|
+
error?: string;
|
|
6509
|
+
/**
|
|
6510
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6511
|
+
* @example Validation failed
|
|
6512
|
+
*/
|
|
6513
|
+
message: string | string[];
|
|
6514
|
+
};
|
|
6515
|
+
};
|
|
6516
|
+
};
|
|
6517
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
6518
|
+
403: {
|
|
6519
|
+
headers: {
|
|
6520
|
+
[name: string]: unknown;
|
|
6521
|
+
};
|
|
6522
|
+
content: {
|
|
6523
|
+
"application/json": {
|
|
6524
|
+
/**
|
|
6525
|
+
* @description HTTP status code
|
|
6526
|
+
* @example 400
|
|
6527
|
+
*/
|
|
6528
|
+
statusCode?: number;
|
|
6529
|
+
/**
|
|
6530
|
+
* @description Short error label
|
|
6531
|
+
* @example Bad Request
|
|
6532
|
+
*/
|
|
6533
|
+
error?: string;
|
|
6534
|
+
/**
|
|
6535
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6536
|
+
* @example Validation failed
|
|
6537
|
+
*/
|
|
6538
|
+
message: string | string[];
|
|
6539
|
+
};
|
|
6540
|
+
};
|
|
6541
|
+
};
|
|
6542
|
+
/** @description Not Found */
|
|
6543
|
+
404: {
|
|
6544
|
+
headers: {
|
|
6545
|
+
[name: string]: unknown;
|
|
6546
|
+
};
|
|
6547
|
+
content: {
|
|
6548
|
+
"application/json": {
|
|
6549
|
+
/**
|
|
6550
|
+
* @description HTTP status code
|
|
6551
|
+
* @example 400
|
|
6552
|
+
*/
|
|
6553
|
+
statusCode?: number;
|
|
6554
|
+
/**
|
|
6555
|
+
* @description Short error label
|
|
6556
|
+
* @example Bad Request
|
|
6557
|
+
*/
|
|
6558
|
+
error?: string;
|
|
6559
|
+
/**
|
|
6560
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6561
|
+
* @example Validation failed
|
|
6562
|
+
*/
|
|
6563
|
+
message: string | string[];
|
|
6564
|
+
};
|
|
6565
|
+
};
|
|
6566
|
+
};
|
|
6567
|
+
};
|
|
6568
|
+
};
|
|
6569
|
+
put?: never;
|
|
6570
|
+
post?: never;
|
|
6571
|
+
delete?: never;
|
|
6572
|
+
options?: never;
|
|
6573
|
+
head?: never;
|
|
6574
|
+
patch?: never;
|
|
6575
|
+
trace?: never;
|
|
6576
|
+
};
|
|
6577
|
+
"/v5/contracts/{contractAddress}/witnesses/intents/{intentId}": {
|
|
6578
|
+
parameters: {
|
|
6579
|
+
query?: never;
|
|
6580
|
+
header?: never;
|
|
6581
|
+
path?: never;
|
|
6582
|
+
cookie?: never;
|
|
6583
|
+
};
|
|
6584
|
+
/**
|
|
6585
|
+
* Recover a v5 witness intent's outcome
|
|
6586
|
+
* @description For a client that lost a finalize (or propose) response. Returns the stored finalize response when accounts has one, otherwise chain-api's status for the intent. The URL contract must be the caller's. Read-only: never finalizes.
|
|
6587
|
+
*/
|
|
6588
|
+
get: {
|
|
6589
|
+
parameters: {
|
|
6590
|
+
query?: never;
|
|
6591
|
+
header?: never;
|
|
6592
|
+
path: {
|
|
6593
|
+
contractAddress: string;
|
|
6594
|
+
intentId: string;
|
|
6595
|
+
};
|
|
6596
|
+
cookie?: never;
|
|
6597
|
+
};
|
|
6598
|
+
requestBody?: never;
|
|
6599
|
+
responses: {
|
|
6600
|
+
/** @description Success */
|
|
6601
|
+
200: {
|
|
6602
|
+
headers: {
|
|
6603
|
+
[name: string]: unknown;
|
|
6604
|
+
};
|
|
6605
|
+
content: {
|
|
6606
|
+
"application/json": {
|
|
6607
|
+
/** @enum {string} */
|
|
6608
|
+
source: "stored";
|
|
6609
|
+
intentId: string;
|
|
6610
|
+
registryVersion: number;
|
|
6611
|
+
/**
|
|
6612
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6613
|
+
* @enum {string}
|
|
6614
|
+
*/
|
|
6615
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired";
|
|
6616
|
+
/** @description The finalize response, exactly as first returned. */
|
|
6617
|
+
result: {
|
|
6618
|
+
[key: string]: unknown;
|
|
6619
|
+
};
|
|
6620
|
+
} | {
|
|
6621
|
+
/** @enum {string} */
|
|
6622
|
+
source: "chain";
|
|
6623
|
+
intentId: string;
|
|
6624
|
+
registryVersion: number;
|
|
6625
|
+
/**
|
|
6626
|
+
* @description The caller's credit reservation for this intent: `held` (reserved, not finalized), `finalizing` (finalize forwarded, outcome pending), `committed` (charged), `released` / `expired` (refunded; nothing was charged).
|
|
6627
|
+
* @enum {string|null}
|
|
6628
|
+
*/
|
|
6629
|
+
reservationState: "held" | "finalizing" | "committed" | "released" | "expired" | null;
|
|
6630
|
+
/**
|
|
6631
|
+
* WitnessIntentChainStatus
|
|
6632
|
+
* @description chain-api's status for the intent, verbatim.
|
|
6633
|
+
*/
|
|
6634
|
+
status: {
|
|
6635
|
+
intentId: string;
|
|
6636
|
+
contractAddress: string;
|
|
6637
|
+
registryVersion: number;
|
|
6638
|
+
/** @enum {string} */
|
|
6639
|
+
status: "prepared" | "allocated" | "submitted" | "confirmed" | "failed" | "cancelled" | "expired_unsubmitted" | "unknown";
|
|
6640
|
+
prepareTtlSeconds: number;
|
|
6641
|
+
/** @description Present when `confirmed`. */
|
|
6642
|
+
witnessId?: string;
|
|
6643
|
+
/** @description Present when `confirmed`. */
|
|
6644
|
+
transactionHash?: string;
|
|
6645
|
+
/** @description Present when `confirmed`. */
|
|
6646
|
+
blockNumber?: number;
|
|
6647
|
+
/** @description Present when `unknown`. */
|
|
6648
|
+
reason?: string;
|
|
6649
|
+
};
|
|
6650
|
+
};
|
|
6651
|
+
};
|
|
6652
|
+
};
|
|
6653
|
+
/** @description Bad Request — validation failed */
|
|
6654
|
+
400: {
|
|
6655
|
+
headers: {
|
|
6656
|
+
[name: string]: unknown;
|
|
6657
|
+
};
|
|
6658
|
+
content: {
|
|
6659
|
+
"application/json": {
|
|
6660
|
+
/**
|
|
6661
|
+
* @description HTTP status code
|
|
6662
|
+
* @example 400
|
|
6663
|
+
*/
|
|
6664
|
+
statusCode?: number;
|
|
6665
|
+
/**
|
|
6666
|
+
* @description Short error label
|
|
6667
|
+
* @example Bad Request
|
|
6668
|
+
*/
|
|
6669
|
+
error?: string;
|
|
6670
|
+
/**
|
|
6671
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6672
|
+
* @example Validation failed
|
|
6673
|
+
*/
|
|
6674
|
+
message: string | string[];
|
|
6675
|
+
};
|
|
6676
|
+
};
|
|
6677
|
+
};
|
|
6678
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
6679
|
+
401: {
|
|
6680
|
+
headers: {
|
|
6681
|
+
[name: string]: unknown;
|
|
6682
|
+
};
|
|
6683
|
+
content: {
|
|
6684
|
+
"application/json": {
|
|
6685
|
+
/**
|
|
6686
|
+
* @description HTTP status code
|
|
6687
|
+
* @example 400
|
|
6688
|
+
*/
|
|
6689
|
+
statusCode?: number;
|
|
6690
|
+
/**
|
|
6691
|
+
* @description Short error label
|
|
6692
|
+
* @example Bad Request
|
|
6693
|
+
*/
|
|
6694
|
+
error?: string;
|
|
6695
|
+
/**
|
|
6696
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6697
|
+
* @example Validation failed
|
|
6698
|
+
*/
|
|
6699
|
+
message: string | string[];
|
|
6700
|
+
};
|
|
6701
|
+
};
|
|
6702
|
+
};
|
|
6703
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
6704
|
+
403: {
|
|
6705
|
+
headers: {
|
|
6706
|
+
[name: string]: unknown;
|
|
6707
|
+
};
|
|
6708
|
+
content: {
|
|
6709
|
+
"application/json": {
|
|
6710
|
+
/**
|
|
6711
|
+
* @description HTTP status code
|
|
6712
|
+
* @example 400
|
|
6713
|
+
*/
|
|
6714
|
+
statusCode?: number;
|
|
6715
|
+
/**
|
|
6716
|
+
* @description Short error label
|
|
6717
|
+
* @example Bad Request
|
|
6718
|
+
*/
|
|
6719
|
+
error?: string;
|
|
6720
|
+
/**
|
|
6721
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6722
|
+
* @example Validation failed
|
|
6723
|
+
*/
|
|
6724
|
+
message: string | string[];
|
|
6725
|
+
};
|
|
6726
|
+
};
|
|
6727
|
+
};
|
|
6728
|
+
/** @description Not Found */
|
|
6729
|
+
404: {
|
|
6730
|
+
headers: {
|
|
6731
|
+
[name: string]: unknown;
|
|
6732
|
+
};
|
|
6733
|
+
content: {
|
|
6734
|
+
"application/json": {
|
|
6735
|
+
/**
|
|
6736
|
+
* @description HTTP status code
|
|
6737
|
+
* @example 400
|
|
6738
|
+
*/
|
|
6739
|
+
statusCode?: number;
|
|
6740
|
+
/**
|
|
6741
|
+
* @description Short error label
|
|
6742
|
+
* @example Bad Request
|
|
6743
|
+
*/
|
|
6744
|
+
error?: string;
|
|
6745
|
+
/**
|
|
6746
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
6747
|
+
* @example Validation failed
|
|
6748
|
+
*/
|
|
6749
|
+
message: string | string[];
|
|
6750
|
+
};
|
|
6751
|
+
};
|
|
6752
|
+
};
|
|
6753
|
+
};
|
|
6754
|
+
};
|
|
6755
|
+
put?: never;
|
|
6756
|
+
post?: never;
|
|
6757
|
+
delete?: never;
|
|
6758
|
+
options?: never;
|
|
6759
|
+
head?: never;
|
|
6760
|
+
patch?: never;
|
|
6761
|
+
trace?: never;
|
|
6762
|
+
};
|
|
6763
|
+
"/v1/account/provisioning-token/reissue": {
|
|
6764
|
+
parameters: {
|
|
6765
|
+
query?: never;
|
|
6766
|
+
header?: never;
|
|
6767
|
+
path?: never;
|
|
6768
|
+
cookie?: never;
|
|
6769
|
+
};
|
|
6770
|
+
get?: never;
|
|
6771
|
+
put?: never;
|
|
6772
|
+
/**
|
|
6773
|
+
* Re-mint a provisioning token (verified-but-not-provisioned recovery)
|
|
6774
|
+
* @description Mints a fresh single-use provisioning token for a signed-in user whose email is verified but who has no contract yet — recovery for when the token from email-verify was lost (e.g. verify opened on another device). Returns 409 if email is unverified or a contract already exists. Rate limited per account.
|
|
6775
|
+
*/
|
|
6776
|
+
post: {
|
|
6777
|
+
parameters: {
|
|
6778
|
+
query?: never;
|
|
6779
|
+
header?: never;
|
|
6780
|
+
path?: never;
|
|
6781
|
+
cookie?: never;
|
|
6782
|
+
};
|
|
6783
|
+
requestBody?: never;
|
|
6784
|
+
responses: {
|
|
6785
|
+
/** @description Success */
|
|
6786
|
+
200: {
|
|
6787
|
+
headers: {
|
|
6788
|
+
[name: string]: unknown;
|
|
6789
|
+
};
|
|
6790
|
+
content: {
|
|
6791
|
+
"application/json": {
|
|
6792
|
+
provisioningToken: string;
|
|
6793
|
+
/**
|
|
6794
|
+
* Format: date-time
|
|
6795
|
+
* @description ISO 8601 date-time string
|
|
6796
|
+
* @example 2026-05-20T10:30:00.000Z
|
|
6797
|
+
*/
|
|
6798
|
+
expiresAt: string;
|
|
6799
|
+
};
|
|
6800
|
+
};
|
|
6801
|
+
};
|
|
5717
6802
|
/** @description Unauthorized — authentication required or invalid */
|
|
5718
6803
|
401: {
|
|
5719
6804
|
headers: {
|
|
@@ -5881,6 +6966,18 @@ interface paths$1 {
|
|
|
5881
6966
|
* @enum {string}
|
|
5882
6967
|
*/
|
|
5883
6968
|
accountType: "metered" | "unlimited";
|
|
6969
|
+
/**
|
|
6970
|
+
* @description Subscription plan tier (drives the UI badge).
|
|
6971
|
+
* @enum {string}
|
|
6972
|
+
*/
|
|
6973
|
+
plan: "free" | "starter" | "professional" | "business" | "enterprise";
|
|
6974
|
+
/**
|
|
6975
|
+
* @description Stripe subscription state; `none` on the free tier.
|
|
6976
|
+
* @enum {string}
|
|
6977
|
+
*/
|
|
6978
|
+
subscriptionStatus: "none" | "active" | "past_due" | "canceled";
|
|
6979
|
+
/** @description ISO end of the current paid period ("Renews on…"); null on free. */
|
|
6980
|
+
currentPeriodEnd: string | null;
|
|
5884
6981
|
/** @description Cached credit balance; `null` for `unlimited` orgs. */
|
|
5885
6982
|
balance: number | null;
|
|
5886
6983
|
isPersonal: boolean;
|
|
@@ -5996,6 +7093,8 @@ interface paths$1 {
|
|
|
5996
7093
|
* @example 550e8400-e29b-41d4-a716-446655440000
|
|
5997
7094
|
*/
|
|
5998
7095
|
organizationId: string;
|
|
7096
|
+
/** @description True if the org was also deleted (personal org). False for a shared org, where only the caller was removed and the org left intact. */
|
|
7097
|
+
orgDeleted: boolean;
|
|
5999
7098
|
/** @description How many OpenBao Transit keys were destroyed. */
|
|
6000
7099
|
vaultKeysPurged: number;
|
|
6001
7100
|
notice: string;
|
|
@@ -6186,7 +7285,7 @@ interface paths$1 {
|
|
|
6186
7285
|
content: {
|
|
6187
7286
|
"application/json": {
|
|
6188
7287
|
sessions: {
|
|
6189
|
-
/** @description
|
|
7288
|
+
/** @description Opaque identifier of the token: the sha256 of its id, never the token itself. Use as the path param for DELETE. */
|
|
6190
7289
|
jti: string;
|
|
6191
7290
|
/** @enum {string} */
|
|
6192
7291
|
kind: "AccessToken" | "RefreshToken";
|
|
@@ -6358,6 +7457,109 @@ interface paths$1 {
|
|
|
6358
7457
|
patch?: never;
|
|
6359
7458
|
trace?: never;
|
|
6360
7459
|
};
|
|
7460
|
+
"/v1/oauth/introspect": {
|
|
7461
|
+
parameters: {
|
|
7462
|
+
query?: never;
|
|
7463
|
+
header?: never;
|
|
7464
|
+
path?: never;
|
|
7465
|
+
cookie?: never;
|
|
7466
|
+
};
|
|
7467
|
+
get?: never;
|
|
7468
|
+
put?: never;
|
|
7469
|
+
/**
|
|
7470
|
+
* Check whether an accounts-minted access token is still active
|
|
7471
|
+
* @description For resource servers (MCP, chain API). Verifies the signature, then checks the security epoch, the grant or session the token came from, and the membership, uncached. Answers 200 `{active:false}` for any token that is not active. Callers MUST treat any non-200 answer or network failure as inactive. See docs/token-introspection.md.
|
|
7472
|
+
*/
|
|
7473
|
+
post: {
|
|
7474
|
+
parameters: {
|
|
7475
|
+
query?: never;
|
|
7476
|
+
header?: never;
|
|
7477
|
+
path?: never;
|
|
7478
|
+
cookie?: never;
|
|
7479
|
+
};
|
|
7480
|
+
requestBody?: {
|
|
7481
|
+
content: {
|
|
7482
|
+
"application/json": {
|
|
7483
|
+
/** @description The bearer JWT the caller received (an accounts-minted access token). */
|
|
7484
|
+
token: string;
|
|
7485
|
+
};
|
|
7486
|
+
};
|
|
7487
|
+
};
|
|
7488
|
+
responses: {
|
|
7489
|
+
/** @description Success */
|
|
7490
|
+
200: {
|
|
7491
|
+
headers: {
|
|
7492
|
+
[name: string]: unknown;
|
|
7493
|
+
};
|
|
7494
|
+
content: {
|
|
7495
|
+
"application/json": {
|
|
7496
|
+
/** @enum {boolean} */
|
|
7497
|
+
active: true;
|
|
7498
|
+
/**
|
|
7499
|
+
* @description `oauth`: issued by the OAuth flow from a grant. `session`: minted by POST /v1/auth/access-token.
|
|
7500
|
+
* @enum {string}
|
|
7501
|
+
*/
|
|
7502
|
+
token_kind: "oauth" | "session";
|
|
7503
|
+
/** @description False when the membership in `org` is suspended: the caller MUST refuse writes. */
|
|
7504
|
+
writable: boolean;
|
|
7505
|
+
sub: string;
|
|
7506
|
+
client_id: string | null;
|
|
7507
|
+
scope: string;
|
|
7508
|
+
aud: string | string[] | unknown;
|
|
7509
|
+
iss: string;
|
|
7510
|
+
exp: number;
|
|
7511
|
+
iat: number;
|
|
7512
|
+
jti: string;
|
|
7513
|
+
/** @description Organization the token acts in; its membership is active. */
|
|
7514
|
+
org: string;
|
|
7515
|
+
/**
|
|
7516
|
+
* @description The CURRENT membership role in `org` (authoritative over the token's `role` claim).
|
|
7517
|
+
* @enum {string}
|
|
7518
|
+
*/
|
|
7519
|
+
role: "org-admin" | "member";
|
|
7520
|
+
contracts: string[];
|
|
7521
|
+
sepoch: number;
|
|
7522
|
+
grant_id: string | null;
|
|
7523
|
+
session_id: string | null;
|
|
7524
|
+
} | {
|
|
7525
|
+
/** @enum {boolean} */
|
|
7526
|
+
active: false;
|
|
7527
|
+
};
|
|
7528
|
+
};
|
|
7529
|
+
};
|
|
7530
|
+
/** @description Bad Request — validation failed */
|
|
7531
|
+
400: {
|
|
7532
|
+
headers: {
|
|
7533
|
+
[name: string]: unknown;
|
|
7534
|
+
};
|
|
7535
|
+
content: {
|
|
7536
|
+
"application/json": {
|
|
7537
|
+
/**
|
|
7538
|
+
* @description HTTP status code
|
|
7539
|
+
* @example 400
|
|
7540
|
+
*/
|
|
7541
|
+
statusCode?: number;
|
|
7542
|
+
/**
|
|
7543
|
+
* @description Short error label
|
|
7544
|
+
* @example Bad Request
|
|
7545
|
+
*/
|
|
7546
|
+
error?: string;
|
|
7547
|
+
/**
|
|
7548
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7549
|
+
* @example Validation failed
|
|
7550
|
+
*/
|
|
7551
|
+
message: string | string[];
|
|
7552
|
+
};
|
|
7553
|
+
};
|
|
7554
|
+
};
|
|
7555
|
+
};
|
|
7556
|
+
};
|
|
7557
|
+
delete?: never;
|
|
7558
|
+
options?: never;
|
|
7559
|
+
head?: never;
|
|
7560
|
+
patch?: never;
|
|
7561
|
+
trace?: never;
|
|
7562
|
+
};
|
|
6361
7563
|
"/v1/account/mfa/totp/enroll": {
|
|
6362
7564
|
parameters: {
|
|
6363
7565
|
query?: never;
|
|
@@ -6380,28 +7582,155 @@ interface paths$1 {
|
|
|
6380
7582
|
};
|
|
6381
7583
|
requestBody?: never;
|
|
6382
7584
|
responses: {
|
|
6383
|
-
/** @description
|
|
6384
|
-
|
|
7585
|
+
/** @description Created */
|
|
7586
|
+
201: {
|
|
7587
|
+
headers: {
|
|
7588
|
+
[name: string]: unknown;
|
|
7589
|
+
};
|
|
7590
|
+
content: {
|
|
7591
|
+
"application/json": {
|
|
7592
|
+
/**
|
|
7593
|
+
* @description Base32 TOTP secret. Show to the user as a typeable fallback alongside the QR code rendered from `otpauthUrl`.
|
|
7594
|
+
* @example JBSWY3DPEHPK3PXP
|
|
7595
|
+
*/
|
|
7596
|
+
secret: string;
|
|
7597
|
+
/**
|
|
7598
|
+
* @description Standard `otpauth://totp/...` URL. The dashboard renders this as a QR code; the user scans it with an authenticator app.
|
|
7599
|
+
* @example otpauth://totp/WitniumChain:alice%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=WitniumChain&algorithm=SHA1&digits=6&period=30
|
|
7600
|
+
*/
|
|
7601
|
+
otpauthUrl: string;
|
|
7602
|
+
};
|
|
7603
|
+
};
|
|
7604
|
+
};
|
|
7605
|
+
/** @description Bad Request — validation failed */
|
|
7606
|
+
400: {
|
|
7607
|
+
headers: {
|
|
7608
|
+
[name: string]: unknown;
|
|
7609
|
+
};
|
|
7610
|
+
content: {
|
|
7611
|
+
"application/json": {
|
|
7612
|
+
/**
|
|
7613
|
+
* @description HTTP status code
|
|
7614
|
+
* @example 400
|
|
7615
|
+
*/
|
|
7616
|
+
statusCode?: number;
|
|
7617
|
+
/**
|
|
7618
|
+
* @description Short error label
|
|
7619
|
+
* @example Bad Request
|
|
7620
|
+
*/
|
|
7621
|
+
error?: string;
|
|
7622
|
+
/**
|
|
7623
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7624
|
+
* @example Validation failed
|
|
7625
|
+
*/
|
|
7626
|
+
message: string | string[];
|
|
7627
|
+
};
|
|
7628
|
+
};
|
|
7629
|
+
};
|
|
7630
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
7631
|
+
401: {
|
|
7632
|
+
headers: {
|
|
7633
|
+
[name: string]: unknown;
|
|
7634
|
+
};
|
|
7635
|
+
content: {
|
|
7636
|
+
"application/json": {
|
|
7637
|
+
/**
|
|
7638
|
+
* @description HTTP status code
|
|
7639
|
+
* @example 400
|
|
7640
|
+
*/
|
|
7641
|
+
statusCode?: number;
|
|
7642
|
+
/**
|
|
7643
|
+
* @description Short error label
|
|
7644
|
+
* @example Bad Request
|
|
7645
|
+
*/
|
|
7646
|
+
error?: string;
|
|
7647
|
+
/**
|
|
7648
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7649
|
+
* @example Validation failed
|
|
7650
|
+
*/
|
|
7651
|
+
message: string | string[];
|
|
7652
|
+
};
|
|
7653
|
+
};
|
|
7654
|
+
};
|
|
7655
|
+
};
|
|
7656
|
+
};
|
|
7657
|
+
delete?: never;
|
|
7658
|
+
options?: never;
|
|
7659
|
+
head?: never;
|
|
7660
|
+
patch?: never;
|
|
7661
|
+
trace?: never;
|
|
7662
|
+
};
|
|
7663
|
+
"/v1/account/mfa/totp/confirm": {
|
|
7664
|
+
parameters: {
|
|
7665
|
+
query?: never;
|
|
7666
|
+
header?: never;
|
|
7667
|
+
path?: never;
|
|
7668
|
+
cookie?: never;
|
|
7669
|
+
};
|
|
7670
|
+
get?: never;
|
|
7671
|
+
put?: never;
|
|
7672
|
+
/**
|
|
7673
|
+
* Confirm TOTP enrolment
|
|
7674
|
+
* @description Validates the first user-supplied code against the secret minted by `/enroll`, marks the enrolment confirmed, and returns 10 single-use recovery codes. The recovery codes appear ONCE in this response and are never readable again — the dashboard must show them immediately and prompt the user to store them. Confirming bumps the user's security epoch: every OTHER session, session-minted access token and OAuth grant of the user ends; the calling session stays valid. Access tokens minted earlier from this session via `/v1/auth/access-token` stop working too and must be re-minted. 409 when the enrolment was restarted (`/enroll` called again) after this code was checked: scan the new QR code and confirm again. 429 when the per-user second-factor attempt budget is exhausted.
|
|
7675
|
+
*/
|
|
7676
|
+
post: {
|
|
7677
|
+
parameters: {
|
|
7678
|
+
query?: never;
|
|
7679
|
+
header?: never;
|
|
7680
|
+
path?: never;
|
|
7681
|
+
cookie?: never;
|
|
7682
|
+
};
|
|
7683
|
+
requestBody?: {
|
|
7684
|
+
content: {
|
|
7685
|
+
"application/json": {
|
|
7686
|
+
/**
|
|
7687
|
+
* @description Current 6-digit TOTP code shown by the authenticator app.
|
|
7688
|
+
* @example 123456
|
|
7689
|
+
*/
|
|
7690
|
+
code: string;
|
|
7691
|
+
};
|
|
7692
|
+
};
|
|
7693
|
+
};
|
|
7694
|
+
responses: {
|
|
7695
|
+
/** @description Created */
|
|
7696
|
+
201: {
|
|
7697
|
+
headers: {
|
|
7698
|
+
[name: string]: unknown;
|
|
7699
|
+
};
|
|
7700
|
+
content: {
|
|
7701
|
+
"application/json": {
|
|
7702
|
+
/** @description Ten single-use recovery codes. Shown ONCE and never returned again — the user must store them now. Each code is consumed atomically when used in place of a TOTP code at MFA challenge time. */
|
|
7703
|
+
recoveryCodes: string[];
|
|
7704
|
+
};
|
|
7705
|
+
};
|
|
7706
|
+
};
|
|
7707
|
+
/** @description Bad Request — validation failed */
|
|
7708
|
+
400: {
|
|
6385
7709
|
headers: {
|
|
6386
7710
|
[name: string]: unknown;
|
|
6387
7711
|
};
|
|
6388
7712
|
content: {
|
|
6389
7713
|
"application/json": {
|
|
6390
7714
|
/**
|
|
6391
|
-
* @description
|
|
6392
|
-
* @example
|
|
7715
|
+
* @description HTTP status code
|
|
7716
|
+
* @example 400
|
|
6393
7717
|
*/
|
|
6394
|
-
|
|
7718
|
+
statusCode?: number;
|
|
6395
7719
|
/**
|
|
6396
|
-
* @description
|
|
6397
|
-
* @example
|
|
7720
|
+
* @description Short error label
|
|
7721
|
+
* @example Bad Request
|
|
6398
7722
|
*/
|
|
6399
|
-
|
|
7723
|
+
error?: string;
|
|
7724
|
+
/**
|
|
7725
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7726
|
+
* @example Validation failed
|
|
7727
|
+
*/
|
|
7728
|
+
message: string | string[];
|
|
6400
7729
|
};
|
|
6401
7730
|
};
|
|
6402
7731
|
};
|
|
6403
|
-
/** @description
|
|
6404
|
-
|
|
7732
|
+
/** @description Unauthorized — authentication required or invalid */
|
|
7733
|
+
401: {
|
|
6405
7734
|
headers: {
|
|
6406
7735
|
[name: string]: unknown;
|
|
6407
7736
|
};
|
|
@@ -6425,8 +7754,33 @@ interface paths$1 {
|
|
|
6425
7754
|
};
|
|
6426
7755
|
};
|
|
6427
7756
|
};
|
|
6428
|
-
/** @description
|
|
6429
|
-
|
|
7757
|
+
/** @description Conflict */
|
|
7758
|
+
409: {
|
|
7759
|
+
headers: {
|
|
7760
|
+
[name: string]: unknown;
|
|
7761
|
+
};
|
|
7762
|
+
content: {
|
|
7763
|
+
"application/json": {
|
|
7764
|
+
/**
|
|
7765
|
+
* @description HTTP status code
|
|
7766
|
+
* @example 400
|
|
7767
|
+
*/
|
|
7768
|
+
statusCode?: number;
|
|
7769
|
+
/**
|
|
7770
|
+
* @description Short error label
|
|
7771
|
+
* @example Bad Request
|
|
7772
|
+
*/
|
|
7773
|
+
error?: string;
|
|
7774
|
+
/**
|
|
7775
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7776
|
+
* @example Validation failed
|
|
7777
|
+
*/
|
|
7778
|
+
message: string | string[];
|
|
7779
|
+
};
|
|
7780
|
+
};
|
|
7781
|
+
};
|
|
7782
|
+
/** @description Too Many Requests */
|
|
7783
|
+
429: {
|
|
6430
7784
|
headers: {
|
|
6431
7785
|
[name: string]: unknown;
|
|
6432
7786
|
};
|
|
@@ -6458,7 +7812,7 @@ interface paths$1 {
|
|
|
6458
7812
|
patch?: never;
|
|
6459
7813
|
trace?: never;
|
|
6460
7814
|
};
|
|
6461
|
-
"/v1/account/mfa/totp
|
|
7815
|
+
"/v1/account/mfa/totp": {
|
|
6462
7816
|
parameters: {
|
|
6463
7817
|
query?: never;
|
|
6464
7818
|
header?: never;
|
|
@@ -6467,11 +7821,12 @@ interface paths$1 {
|
|
|
6467
7821
|
};
|
|
6468
7822
|
get?: never;
|
|
6469
7823
|
put?: never;
|
|
7824
|
+
post?: never;
|
|
6470
7825
|
/**
|
|
6471
|
-
*
|
|
6472
|
-
* @description
|
|
7826
|
+
* Disable TOTP and clear recovery codes
|
|
7827
|
+
* @description Wipes the TOTP secret and all recovery codes. The user re-enrolls from scratch with `/enroll`. Step-up: the JSON body must carry a fresh second factor (`code` or `recoveryCode`); 403 `mfa_step_up_failed` when it is wrong or already used, 429 when the attempt budget is exhausted.
|
|
6473
7828
|
*/
|
|
6474
|
-
|
|
7829
|
+
delete: {
|
|
6475
7830
|
parameters: {
|
|
6476
7831
|
query?: never;
|
|
6477
7832
|
header?: never;
|
|
@@ -6482,10 +7837,15 @@ interface paths$1 {
|
|
|
6482
7837
|
content: {
|
|
6483
7838
|
"application/json": {
|
|
6484
7839
|
/**
|
|
6485
|
-
* @description Current 6-digit TOTP code
|
|
7840
|
+
* @description Current 6-digit TOTP code. Each code is accepted once.
|
|
6486
7841
|
* @example 123456
|
|
6487
7842
|
*/
|
|
6488
|
-
code
|
|
7843
|
+
code?: string;
|
|
7844
|
+
/**
|
|
7845
|
+
* @description An unused recovery code (consumed by this request).
|
|
7846
|
+
* @example ABCD-EFGH
|
|
7847
|
+
*/
|
|
7848
|
+
recoveryCode?: string;
|
|
6489
7849
|
};
|
|
6490
7850
|
};
|
|
6491
7851
|
};
|
|
@@ -6497,8 +7857,8 @@ interface paths$1 {
|
|
|
6497
7857
|
};
|
|
6498
7858
|
content: {
|
|
6499
7859
|
"application/json": {
|
|
6500
|
-
/** @
|
|
6501
|
-
|
|
7860
|
+
/** @enum {boolean} */
|
|
7861
|
+
disabled: true;
|
|
6502
7862
|
};
|
|
6503
7863
|
};
|
|
6504
7864
|
};
|
|
@@ -6552,51 +7912,33 @@ interface paths$1 {
|
|
|
6552
7912
|
};
|
|
6553
7913
|
};
|
|
6554
7914
|
};
|
|
6555
|
-
|
|
6556
|
-
|
|
6557
|
-
delete?: never;
|
|
6558
|
-
options?: never;
|
|
6559
|
-
head?: never;
|
|
6560
|
-
patch?: never;
|
|
6561
|
-
trace?: never;
|
|
6562
|
-
};
|
|
6563
|
-
"/v1/account/mfa/totp": {
|
|
6564
|
-
parameters: {
|
|
6565
|
-
query?: never;
|
|
6566
|
-
header?: never;
|
|
6567
|
-
path?: never;
|
|
6568
|
-
cookie?: never;
|
|
6569
|
-
};
|
|
6570
|
-
get?: never;
|
|
6571
|
-
put?: never;
|
|
6572
|
-
post?: never;
|
|
6573
|
-
/**
|
|
6574
|
-
* Disable TOTP and clear recovery codes
|
|
6575
|
-
* @description Wipes the TOTP secret and all recovery codes. The user re-enrolls from scratch with `/enroll`. Future versions of this endpoint will require a recent MFA assertion (step-up) — Thread E of Phase AUTH.
|
|
6576
|
-
*/
|
|
6577
|
-
delete: {
|
|
6578
|
-
parameters: {
|
|
6579
|
-
query?: never;
|
|
6580
|
-
header?: never;
|
|
6581
|
-
path?: never;
|
|
6582
|
-
cookie?: never;
|
|
6583
|
-
};
|
|
6584
|
-
requestBody?: never;
|
|
6585
|
-
responses: {
|
|
6586
|
-
/** @description Success */
|
|
6587
|
-
200: {
|
|
7915
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
7916
|
+
403: {
|
|
6588
7917
|
headers: {
|
|
6589
7918
|
[name: string]: unknown;
|
|
6590
7919
|
};
|
|
6591
7920
|
content: {
|
|
6592
7921
|
"application/json": {
|
|
6593
|
-
/**
|
|
6594
|
-
|
|
7922
|
+
/**
|
|
7923
|
+
* @description HTTP status code
|
|
7924
|
+
* @example 400
|
|
7925
|
+
*/
|
|
7926
|
+
statusCode?: number;
|
|
7927
|
+
/**
|
|
7928
|
+
* @description Short error label
|
|
7929
|
+
* @example Bad Request
|
|
7930
|
+
*/
|
|
7931
|
+
error?: string;
|
|
7932
|
+
/**
|
|
7933
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
7934
|
+
* @example Validation failed
|
|
7935
|
+
*/
|
|
7936
|
+
message: string | string[];
|
|
6595
7937
|
};
|
|
6596
7938
|
};
|
|
6597
7939
|
};
|
|
6598
|
-
/** @description
|
|
6599
|
-
|
|
7940
|
+
/** @description Too Many Requests */
|
|
7941
|
+
429: {
|
|
6600
7942
|
headers: {
|
|
6601
7943
|
[name: string]: unknown;
|
|
6602
7944
|
};
|
|
@@ -6638,7 +7980,7 @@ interface paths$1 {
|
|
|
6638
7980
|
put?: never;
|
|
6639
7981
|
/**
|
|
6640
7982
|
* Generate a fresh set of recovery codes
|
|
6641
|
-
* @description Invalidates the prior set and issues 10 new codes.
|
|
7983
|
+
* @description Invalidates the prior set and issues 10 new codes. Step-up: the JSON body must carry a fresh second factor (`code` or `recoveryCode`); 403 `mfa_step_up_failed` when it is wrong or already used, 429 when the attempt budget is exhausted.
|
|
6642
7984
|
*/
|
|
6643
7985
|
post: {
|
|
6644
7986
|
parameters: {
|
|
@@ -6647,10 +7989,25 @@ interface paths$1 {
|
|
|
6647
7989
|
path?: never;
|
|
6648
7990
|
cookie?: never;
|
|
6649
7991
|
};
|
|
6650
|
-
requestBody?:
|
|
7992
|
+
requestBody?: {
|
|
7993
|
+
content: {
|
|
7994
|
+
"application/json": {
|
|
7995
|
+
/**
|
|
7996
|
+
* @description Current 6-digit TOTP code. Each code is accepted once.
|
|
7997
|
+
* @example 123456
|
|
7998
|
+
*/
|
|
7999
|
+
code?: string;
|
|
8000
|
+
/**
|
|
8001
|
+
* @description An unused recovery code (consumed by this request).
|
|
8002
|
+
* @example ABCD-EFGH
|
|
8003
|
+
*/
|
|
8004
|
+
recoveryCode?: string;
|
|
8005
|
+
};
|
|
8006
|
+
};
|
|
8007
|
+
};
|
|
6651
8008
|
responses: {
|
|
6652
|
-
/** @description
|
|
6653
|
-
|
|
8009
|
+
/** @description Created */
|
|
8010
|
+
201: {
|
|
6654
8011
|
headers: {
|
|
6655
8012
|
[name: string]: unknown;
|
|
6656
8013
|
};
|
|
@@ -6711,6 +8068,56 @@ interface paths$1 {
|
|
|
6711
8068
|
};
|
|
6712
8069
|
};
|
|
6713
8070
|
};
|
|
8071
|
+
/** @description Forbidden — insufficient permissions or scope */
|
|
8072
|
+
403: {
|
|
8073
|
+
headers: {
|
|
8074
|
+
[name: string]: unknown;
|
|
8075
|
+
};
|
|
8076
|
+
content: {
|
|
8077
|
+
"application/json": {
|
|
8078
|
+
/**
|
|
8079
|
+
* @description HTTP status code
|
|
8080
|
+
* @example 400
|
|
8081
|
+
*/
|
|
8082
|
+
statusCode?: number;
|
|
8083
|
+
/**
|
|
8084
|
+
* @description Short error label
|
|
8085
|
+
* @example Bad Request
|
|
8086
|
+
*/
|
|
8087
|
+
error?: string;
|
|
8088
|
+
/**
|
|
8089
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
8090
|
+
* @example Validation failed
|
|
8091
|
+
*/
|
|
8092
|
+
message: string | string[];
|
|
8093
|
+
};
|
|
8094
|
+
};
|
|
8095
|
+
};
|
|
8096
|
+
/** @description Too Many Requests */
|
|
8097
|
+
429: {
|
|
8098
|
+
headers: {
|
|
8099
|
+
[name: string]: unknown;
|
|
8100
|
+
};
|
|
8101
|
+
content: {
|
|
8102
|
+
"application/json": {
|
|
8103
|
+
/**
|
|
8104
|
+
* @description HTTP status code
|
|
8105
|
+
* @example 400
|
|
8106
|
+
*/
|
|
8107
|
+
statusCode?: number;
|
|
8108
|
+
/**
|
|
8109
|
+
* @description Short error label
|
|
8110
|
+
* @example Bad Request
|
|
8111
|
+
*/
|
|
8112
|
+
error?: string;
|
|
8113
|
+
/**
|
|
8114
|
+
* @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
|
|
8115
|
+
* @example Validation failed
|
|
8116
|
+
*/
|
|
8117
|
+
message: string | string[];
|
|
8118
|
+
};
|
|
8119
|
+
};
|
|
8120
|
+
};
|
|
6714
8121
|
};
|
|
6715
8122
|
};
|
|
6716
8123
|
delete?: never;
|
|
@@ -7238,12 +8645,6 @@ interface paths {
|
|
|
7238
8645
|
* @description AGE-armored tlock ciphertext, hex-encoded UTF-8. Output of tlock-js `timelockEncrypt`. Max 4096 bytes (8192 hex chars).
|
|
7239
8646
|
*/
|
|
7240
8647
|
tlockCiphertext?: string;
|
|
7241
|
-
/**
|
|
7242
|
-
* Format: uri
|
|
7243
|
-
* @description Valid URL
|
|
7244
|
-
* @example https://example.com/path
|
|
7245
|
-
*/
|
|
7246
|
-
callbackUrl?: string;
|
|
7247
8648
|
};
|
|
7248
8649
|
};
|
|
7249
8650
|
};
|
|
@@ -8494,14 +9895,20 @@ interface paths {
|
|
|
8494
9895
|
};
|
|
8495
9896
|
/**
|
|
8496
9897
|
* List v5 witnesses (optionally filtered by dataId)
|
|
8497
|
-
* @description
|
|
9898
|
+
* @description Lists WitnessCreated events, newest first. The v5 event adds drandRound — non-zero means the witness carries a drand IBE ciphertext decryptable at that round. Query the full witness via /get for the ciphertext bytes. Each request scans one window of at most 200,000 blocks of the WitnessCreated event log, newest first: from `beforeBlock - 1` (or the head) down, never below the deploy block. To list everything, repeat the request with `beforeBlock = nextBeforeBlock`, `beforeLogIndex = nextBeforeLogIndex` (omitted when null) and no `offset`, until `nextBeforeBlock` is null; every matching witness is returned exactly once, newest first. A page can be empty while older witnesses exist; only a null `nextBeforeBlock` means the listing is exhausted. `hasMore` reports more matches inside the current window.
|
|
8498
9899
|
*/
|
|
8499
9900
|
get: {
|
|
8500
9901
|
parameters: {
|
|
8501
9902
|
query?: {
|
|
8502
9903
|
dataId?: string;
|
|
9904
|
+
/** @description Page size, 1-200, default 50. */
|
|
8503
9905
|
limit?: number;
|
|
9906
|
+
/** @description Offset into the matches of this scan window, 0-10000. */
|
|
8504
9907
|
offset?: number | null;
|
|
9908
|
+
/** @description Exclusive upper bound of the scan: blocks below it are scanned. Omit for the head; to continue, pass the previous response's `nextBeforeBlock`. At most the current head + 1. */
|
|
9909
|
+
beforeBlock?: number | null;
|
|
9910
|
+
/** @description Requires `beforeBlock`. Within block `beforeBlock - 1`, only logs with a lower log index are listed. Pass the previous response's `nextBeforeLogIndex` when it is not null. */
|
|
9911
|
+
beforeLogIndex?: number | null;
|
|
8505
9912
|
};
|
|
8506
9913
|
header?: never;
|
|
8507
9914
|
path: {
|
|
@@ -8536,6 +9943,12 @@ interface paths {
|
|
|
8536
9943
|
}[];
|
|
8537
9944
|
hasMore: boolean;
|
|
8538
9945
|
totalReturned: number;
|
|
9946
|
+
/** @description True when this request's scan window reached the contract's deploy block. */
|
|
9947
|
+
scanComplete: boolean;
|
|
9948
|
+
/** @description The `beforeBlock` of the next page. Null when every matching witness has been listed. */
|
|
9949
|
+
nextBeforeBlock: number | null;
|
|
9950
|
+
/** @description The `beforeLogIndex` of the next page, or null to start at the top of block `nextBeforeBlock - 1`. */
|
|
9951
|
+
nextBeforeLogIndex: number | null;
|
|
8539
9952
|
};
|
|
8540
9953
|
};
|
|
8541
9954
|
};
|
|
@@ -9004,6 +10417,8 @@ interface paths {
|
|
|
9004
10417
|
*
|
|
9005
10418
|
* Response shape is identical to GET /v5/contracts/{addr}/witnesses; the
|
|
9006
10419
|
* scan is always newest-first.
|
|
10420
|
+
*
|
|
10421
|
+
* Each request scans one window of at most 200,000 blocks of the WitnessCreated event log, newest first: from `beforeBlock - 1` (or the head) down, never below the deploy block. To list everything, repeat the request with `beforeBlock = nextBeforeBlock`, `beforeLogIndex = nextBeforeLogIndex` (omitted when null) and no `offset`, until `nextBeforeBlock` is null; every matching witness is returned exactly once, newest first. A page can be empty while older witnesses exist; only a null `nextBeforeBlock` means the listing is exhausted. `hasMore` reports more matches inside the current window.
|
|
9007
10422
|
*/
|
|
9008
10423
|
get: {
|
|
9009
10424
|
parameters: {
|
|
@@ -9016,8 +10431,12 @@ interface paths {
|
|
|
9016
10431
|
timeLock?: "locked" | "none" | "any";
|
|
9017
10432
|
/** @description Page size, 1-200, default 50. */
|
|
9018
10433
|
limit?: number;
|
|
9019
|
-
/** @description Offset into the
|
|
10434
|
+
/** @description Offset into the matches of this scan window, 0-10000. */
|
|
9020
10435
|
offset?: number | null;
|
|
10436
|
+
/** @description Exclusive upper bound of the scan: blocks below it are scanned. Omit for the head; to continue, pass the previous response's `nextBeforeBlock`. At most the current head + 1. */
|
|
10437
|
+
beforeBlock?: number | null;
|
|
10438
|
+
/** @description Requires `beforeBlock`. Within block `beforeBlock - 1`, only logs with a lower log index are listed. Pass the previous response's `nextBeforeLogIndex` when it is not null. */
|
|
10439
|
+
beforeLogIndex?: number | null;
|
|
9021
10440
|
};
|
|
9022
10441
|
header?: never;
|
|
9023
10442
|
path?: never;
|
|
@@ -9049,6 +10468,12 @@ interface paths {
|
|
|
9049
10468
|
}[];
|
|
9050
10469
|
hasMore: boolean;
|
|
9051
10470
|
totalReturned: number;
|
|
10471
|
+
/** @description True when this request's scan window reached the contract's deploy block. */
|
|
10472
|
+
scanComplete: boolean;
|
|
10473
|
+
/** @description The `beforeBlock` of the next page. Null when every matching witness has been listed. */
|
|
10474
|
+
nextBeforeBlock: number | null;
|
|
10475
|
+
/** @description The `beforeLogIndex` of the next page, or null to start at the top of block `nextBeforeBlock - 1`. */
|
|
10476
|
+
nextBeforeLogIndex: number | null;
|
|
9052
10477
|
};
|
|
9053
10478
|
};
|
|
9054
10479
|
};
|
|
@@ -10062,7 +11487,7 @@ interface paths {
|
|
|
10062
11487
|
};
|
|
10063
11488
|
/**
|
|
10064
11489
|
* Liveness probe
|
|
10065
|
-
* @description Kubernetes liveness probe.
|
|
11490
|
+
* @description Kubernetes liveness probe. Answers 200 while the process serves HTTP; it checks no dependency (dependency health is the readiness probe).
|
|
10066
11491
|
*/
|
|
10067
11492
|
get: {
|
|
10068
11493
|
parameters: {
|
|
@@ -10081,41 +11506,7 @@ interface paths {
|
|
|
10081
11506
|
content: {
|
|
10082
11507
|
"application/json": {
|
|
10083
11508
|
/** @enum {string} */
|
|
10084
|
-
status: "
|
|
10085
|
-
/**
|
|
10086
|
-
* QueueStatus
|
|
10087
|
-
* @description Queue health status
|
|
10088
|
-
*/
|
|
10089
|
-
queue: {
|
|
10090
|
-
healthy: boolean;
|
|
10091
|
-
timeSinceLastPingMs: number;
|
|
10092
|
-
/** Format: date-time */
|
|
10093
|
-
lastPing?: string;
|
|
10094
|
-
};
|
|
10095
|
-
};
|
|
10096
|
-
};
|
|
10097
|
-
};
|
|
10098
|
-
/** @description Service Unavailable */
|
|
10099
|
-
503: {
|
|
10100
|
-
headers: {
|
|
10101
|
-
[name: string]: unknown;
|
|
10102
|
-
};
|
|
10103
|
-
content: {
|
|
10104
|
-
"application/json": {
|
|
10105
|
-
/**
|
|
10106
|
-
* @description Error message
|
|
10107
|
-
* @example Validation failed
|
|
10108
|
-
*/
|
|
10109
|
-
error: string;
|
|
10110
|
-
/**
|
|
10111
|
-
* @description Machine-readable error code
|
|
10112
|
-
* @example VALIDATION_FAILED
|
|
10113
|
-
*/
|
|
10114
|
-
code?: string;
|
|
10115
|
-
/** @description Field-level validation errors */
|
|
10116
|
-
details?: {
|
|
10117
|
-
[key: string]: string[];
|
|
10118
|
-
};
|
|
11509
|
+
status: "alive";
|
|
10119
11510
|
};
|
|
10120
11511
|
};
|
|
10121
11512
|
};
|
|
@@ -10329,11 +11720,15 @@ type JsonBody<T> = T extends {
|
|
|
10329
11720
|
type Req<P extends keyof paths$1, M extends keyof paths$1[P]> = JsonBody<Extract<paths$1[P][M], {
|
|
10330
11721
|
requestBody?: unknown;
|
|
10331
11722
|
}>['requestBody']>;
|
|
10332
|
-
|
|
10333
|
-
|
|
10334
|
-
|
|
10335
|
-
|
|
10336
|
-
|
|
11723
|
+
/** HTTP success codes an operation's response body is taken from. */
|
|
11724
|
+
type SuccessCode = 200 | 201 | 202 | 203;
|
|
11725
|
+
/**
|
|
11726
|
+
* The JSON body of an accounts operation's success response, whichever 2xx
|
|
11727
|
+
* code the spec documents (accounts answers POSTs with 201).
|
|
11728
|
+
*/
|
|
11729
|
+
type Res<P extends keyof paths$1, M extends keyof paths$1[P]> = paths$1[P][M] extends {
|
|
11730
|
+
responses: infer R;
|
|
11731
|
+
} ? JsonBody<R[Extract<keyof R, SuccessCode>]> : never;
|
|
10337
11732
|
type ChainRes<P extends keyof paths, M extends keyof paths[P], S extends number = 200> = paths[P][M] extends {
|
|
10338
11733
|
responses: {
|
|
10339
11734
|
[K in S]: infer R;
|
|
@@ -10344,6 +11739,7 @@ type SignupResponse = Res<'/v1/auth/signup', 'post'>;
|
|
|
10344
11739
|
type VerifyEmailResponse = Res<'/v1/auth/verify', 'get'>;
|
|
10345
11740
|
type LoginRequest = Req<'/v1/auth/login', 'post'>;
|
|
10346
11741
|
type LoginResponse = Res<'/v1/auth/login', 'post'>;
|
|
11742
|
+
type LoginMfaResponse = Res<'/v1/auth/login/mfa', 'post'>;
|
|
10347
11743
|
type LogoutResponse = Res<'/v1/auth/logout', 'post'>;
|
|
10348
11744
|
type ForgotPasswordRequest = Req<'/v1/auth/forgot-password', 'post'>;
|
|
10349
11745
|
type ForgotPasswordResponse = Res<'/v1/auth/forgot-password', 'post'>;
|
|
@@ -10406,6 +11802,18 @@ type LedgerResponse = Res<'/v1/account/ledger', 'get'>;
|
|
|
10406
11802
|
type TotpEnrollResponse = Res<'/v1/account/mfa/totp/enroll', 'post'>;
|
|
10407
11803
|
type TotpConfirmRequest = Req<'/v1/account/mfa/totp/confirm', 'post'>;
|
|
10408
11804
|
type TotpConfirmResponse = Res<'/v1/account/mfa/totp/confirm', 'post'>;
|
|
11805
|
+
/**
|
|
11806
|
+
* A second-factor proof: exactly one of a 6-digit TOTP `code` or a
|
|
11807
|
+
* `recoveryCode` (`ABCD-EFGH`). The spec types both as optional; the server
|
|
11808
|
+
* rejects a body with neither or both, so the SDK type enforces exactly one.
|
|
11809
|
+
*/
|
|
11810
|
+
type MfaProofRequest = {
|
|
11811
|
+
code: string;
|
|
11812
|
+
recoveryCode?: never;
|
|
11813
|
+
} | {
|
|
11814
|
+
recoveryCode: string;
|
|
11815
|
+
code?: never;
|
|
11816
|
+
};
|
|
10409
11817
|
type TotpDisableResponse = Res<'/v1/account/mfa/totp', 'delete'>;
|
|
10410
11818
|
type RecoveryCodesRegenerateResponse = Res<'/v1/account/mfa/recovery-codes/regenerate', 'post'>;
|
|
10411
11819
|
type ListOauthSessionsResponse = Res<'/v1/oauth/sessions', 'get'>;
|
|
@@ -10642,6 +12050,7 @@ declare class WitniumchainClient {
|
|
|
10642
12050
|
private refreshInFlight;
|
|
10643
12051
|
private accessTokenFromSession;
|
|
10644
12052
|
private sessionExchangeInFlight;
|
|
12053
|
+
private credentialGeneration;
|
|
10645
12054
|
/** Subscriptions / billing helpers. See {@link Subscriptions}. */
|
|
10646
12055
|
readonly subscriptions: Subscriptions;
|
|
10647
12056
|
/** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
|
|
@@ -10667,9 +12076,10 @@ declare class WitniumchainClient {
|
|
|
10667
12076
|
* the contract with the caller's client-generated `ownerPublicKey` +
|
|
10668
12077
|
* `initialSigningPublicKey`. Witnium never sees the private bytes.
|
|
10669
12078
|
*
|
|
10670
|
-
* Returns `{ orgId, userId, contractAddress, contractVersion
|
|
10671
|
-
*
|
|
10672
|
-
*
|
|
12079
|
+
* Returns `{ orgId, userId, contractAddress, contractVersion }`. The
|
|
12080
|
+
* email-verify link is mailed to `adminEmail` and never returned, so there
|
|
12081
|
+
* is nothing to render. If the mail cannot be sent, nothing is created and
|
|
12082
|
+
* the call fails with a 502; retry it.
|
|
10673
12083
|
*/
|
|
10674
12084
|
createOrg(body: CreateOrgRequest): Promise<CreateOrgResponse>;
|
|
10675
12085
|
listMembers(): Promise<MembersListResponse>;
|
|
@@ -10682,7 +12092,26 @@ declare class WitniumchainClient {
|
|
|
10682
12092
|
removeMember(userId: string): Promise<RemoveMemberResponse>;
|
|
10683
12093
|
resendMemberInvite(userId: string): Promise<ResendInviteResponse>;
|
|
10684
12094
|
verifyEmail(token: string): Promise<VerifyEmailResponse>;
|
|
12095
|
+
/**
|
|
12096
|
+
* Password login. Check `status`: `'authenticated'` means the session
|
|
12097
|
+
* cookie is set. `'mfa_required'` means NO session exists yet: the server
|
|
12098
|
+
* set a short-lived challenge cookie, and {@link loginMfa} must follow with
|
|
12099
|
+
* the user's TOTP or recovery code.
|
|
12100
|
+
*/
|
|
10685
12101
|
login(body: LoginRequest): Promise<LoginResponse>;
|
|
12102
|
+
/**
|
|
12103
|
+
* Second step of an MFA login, after `login()` returned `'mfa_required'`.
|
|
12104
|
+
* Relies on the challenge cookie from that call (`credentials: 'include'`).
|
|
12105
|
+
* 401 `mfa_code_invalid`: wrong or reused code, the user may retry.
|
|
12106
|
+
* 401 `mfa_challenge_invalid`: expired or used up, start again at `login()`.
|
|
12107
|
+
* 429 `mfa_rate_limited`: the body carries `retryAfterSeconds`.
|
|
12108
|
+
*/
|
|
12109
|
+
loginMfa(body: MfaProofRequest): Promise<LoginMfaResponse>;
|
|
12110
|
+
/**
|
|
12111
|
+
* End the first-party session. The cached bearer token is dropped even when
|
|
12112
|
+
* the request fails, so a logged-out tab never keeps the previous user's
|
|
12113
|
+
* token.
|
|
12114
|
+
*/
|
|
10686
12115
|
logout(): Promise<LogoutResponse>;
|
|
10687
12116
|
forgotPassword(body: ForgotPasswordRequest): Promise<ForgotPasswordResponse>;
|
|
10688
12117
|
resetPassword(body: ResetPasswordRequest): Promise<ResetPasswordResponse>;
|
|
@@ -10731,9 +12160,17 @@ declare class WitniumchainClient {
|
|
|
10731
12160
|
*/
|
|
10732
12161
|
reissueProvisioningToken(): Promise<ReissueProvisioningTokenResponse>;
|
|
10733
12162
|
enrollTotp(): Promise<TotpEnrollResponse>;
|
|
12163
|
+
/**
|
|
12164
|
+
* Confirming bumps the user's security epoch server-side, which ends every
|
|
12165
|
+
* session-minted access token and OAuth artifact of the user. Cached and
|
|
12166
|
+
* in-flight tokens are dropped so the next bearer call mints a fresh one
|
|
12167
|
+
* from the (surviving) session.
|
|
12168
|
+
*/
|
|
10734
12169
|
confirmTotp(body: TotpConfirmRequest): Promise<TotpConfirmResponse>;
|
|
10735
|
-
|
|
10736
|
-
|
|
12170
|
+
/** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
|
|
12171
|
+
disableTotp(body: MfaProofRequest): Promise<TotpDisableResponse>;
|
|
12172
|
+
/** Step-up: 403 `mfa_step_up_failed` on a wrong proof, 429 `mfa_rate_limited`. */
|
|
12173
|
+
regenerateRecoveryCodes(body: MfaProofRequest): Promise<RecoveryCodesRegenerateResponse>;
|
|
10737
12174
|
listOauthSessions(): Promise<ListOauthSessionsResponse>;
|
|
10738
12175
|
revokeOauthSession(jti: string): Promise<void>;
|
|
10739
12176
|
revokeAllOauthSessions(): Promise<void>;
|
|
@@ -10741,10 +12178,19 @@ declare class WitniumchainClient {
|
|
|
10741
12178
|
healthReady(): Promise<HealthReadyResponse>;
|
|
10742
12179
|
getContractInfo(contractAddress: string): Promise<ContractInfoResponse>;
|
|
10743
12180
|
getContractVerification(contractAddress: string): Promise<VerifyContractResponse>;
|
|
10744
|
-
listWitnessesV5(contractAddress: string,
|
|
12181
|
+
listWitnessesV5(contractAddress: string,
|
|
12182
|
+
/**
|
|
12183
|
+
* One bounded scan window per call. To list everything, call again with
|
|
12184
|
+
* `beforeBlock: res.nextBeforeBlock` and, when not null,
|
|
12185
|
+
* `beforeLogIndex: res.nextBeforeLogIndex` until `res.nextBeforeBlock`
|
|
12186
|
+
* is null; an empty page does not mean the end.
|
|
12187
|
+
*/
|
|
12188
|
+
params?: {
|
|
10745
12189
|
dataId?: string;
|
|
10746
12190
|
limit?: number;
|
|
10747
12191
|
offset?: number;
|
|
12192
|
+
beforeBlock?: number;
|
|
12193
|
+
beforeLogIndex?: number;
|
|
10748
12194
|
}): Promise<ListWitnessesResponse>;
|
|
10749
12195
|
getWitnessV5(contractAddress: string, witnessId: string): Promise<GetChainWitnessResponse>;
|
|
10750
12196
|
getContractTransaction(contractAddress: string, txHash: string): Promise<GetContractTransactionResponse>;
|
|
@@ -10757,6 +12203,9 @@ declare class WitniumchainClient {
|
|
|
10757
12203
|
timeLock?: 'locked' | 'none';
|
|
10758
12204
|
limit?: number;
|
|
10759
12205
|
offset?: number;
|
|
12206
|
+
/** Cursor; see listWitnessesV5. */
|
|
12207
|
+
beforeBlock?: number;
|
|
12208
|
+
beforeLogIndex?: number;
|
|
10760
12209
|
}): Promise<DashboardWitnessesResponse>;
|
|
10761
12210
|
/**
|
|
10762
12211
|
* Build the authorization-server URL for the start of an OAuth login flow.
|
|
@@ -10833,6 +12282,12 @@ declare class WitniumchainClient {
|
|
|
10833
12282
|
* valid session.
|
|
10834
12283
|
*/
|
|
10835
12284
|
exchangeSessionForToken(): Promise<OAuthTokenSnapshot>;
|
|
12285
|
+
private assertCredentialGeneration;
|
|
12286
|
+
/**
|
|
12287
|
+
* Forget every cached credential and orphan in-flight mints/refreshes, so
|
|
12288
|
+
* none of them can store a token afterwards.
|
|
12289
|
+
*/
|
|
12290
|
+
private invalidateCredentials;
|
|
10836
12291
|
/**
|
|
10837
12292
|
* Best-effort transparent mint for the `BearerJWT` path: if no access token
|
|
10838
12293
|
* is cached, try the session exchange (single-flight). Swallows failure so
|
|
@@ -11014,7 +12469,12 @@ declare class OrgMembers {
|
|
|
11014
12469
|
constructor(client: WitniumchainClient);
|
|
11015
12470
|
/** List the caller's org members (role, suspendedAt, isOwner, keys). */
|
|
11016
12471
|
list(): Promise<MembersListResponse>;
|
|
11017
|
-
/**
|
|
12472
|
+
/**
|
|
12473
|
+
* Invite a member by email (default role `member`). `inviteEmailSent` says
|
|
12474
|
+
* whether the invitation (with the verify link) was mailed; the token is
|
|
12475
|
+
* never returned. A 502 means the membership was recorded but the mail
|
|
12476
|
+
* failed; retry.
|
|
12477
|
+
*/
|
|
11018
12478
|
invite(body: InviteMemberRequest): Promise<InviteMemberResponse>;
|
|
11019
12479
|
/** Suspend a member (reversible). The owner cannot be suspended. */
|
|
11020
12480
|
suspend(userId: string): Promise<SuspendMemberResponse>;
|
|
@@ -11026,7 +12486,10 @@ declare class OrgMembers {
|
|
|
11026
12486
|
setRole(userId: string, role: SetMemberRoleRequest['role']): Promise<SetMemberRoleResponse>;
|
|
11027
12487
|
/** Remove a member (terminal; revokes their delegated keys). Owner protected. */
|
|
11028
12488
|
remove(userId: string): Promise<RemoveMemberResponse>;
|
|
11029
|
-
/**
|
|
12489
|
+
/**
|
|
12490
|
+
* Re-send the invitation email to a pending member. Returns `{ email }`;
|
|
12491
|
+
* the fresh verify token is mailed, never returned.
|
|
12492
|
+
*/
|
|
11030
12493
|
resendInvite(userId: string): Promise<ResendInviteResponse>;
|
|
11031
12494
|
}
|
|
11032
12495
|
declare class MfaTotp {
|
|
@@ -11044,11 +12507,15 @@ declare class MfaTotp {
|
|
|
11044
12507
|
* Confirm enrolment with the first user-supplied code. Returns the 10
|
|
11045
12508
|
* single-use recovery codes — show them to the user ONCE; the server never
|
|
11046
12509
|
* returns them again. Throws `WitniumchainApiError` with status 400 when
|
|
11047
|
-
* the code is invalid or the enrolment is already confirmed.
|
|
12510
|
+
* the code is invalid or the enrolment is already confirmed. Signs the
|
|
12511
|
+
* user out of every other device and connected app.
|
|
11048
12512
|
*/
|
|
11049
12513
|
confirm(code: string): Promise<TotpConfirmResponse>;
|
|
11050
|
-
/**
|
|
11051
|
-
|
|
12514
|
+
/**
|
|
12515
|
+
* Disable TOTP, wiping both the secret and all recovery codes. Requires the
|
|
12516
|
+
* user's current code or a recovery code.
|
|
12517
|
+
*/
|
|
12518
|
+
disable(proof: MfaProofRequest): Promise<TotpDisableResponse>;
|
|
11052
12519
|
}
|
|
11053
12520
|
declare class MfaRecoveryCodes {
|
|
11054
12521
|
private readonly client;
|
|
@@ -11056,8 +12523,9 @@ declare class MfaRecoveryCodes {
|
|
|
11056
12523
|
/**
|
|
11057
12524
|
* Issue a fresh set of 10 recovery codes, invalidating the prior ones.
|
|
11058
12525
|
* Same as `confirm` — codes are returned ONCE and never readable again.
|
|
12526
|
+
* Requires the user's current code or a recovery code.
|
|
11059
12527
|
*/
|
|
11060
|
-
regenerate(): Promise<RecoveryCodesRegenerateResponse>;
|
|
12528
|
+
regenerate(proof: MfaProofRequest): Promise<RecoveryCodesRegenerateResponse>;
|
|
11061
12529
|
}
|
|
11062
12530
|
|
|
11063
12531
|
type Body<T> = T extends {
|
|
@@ -11250,4 +12718,4 @@ declare function buildRevokeSigningKeyPayload(args: {
|
|
|
11250
12718
|
key: string;
|
|
11251
12719
|
}): string;
|
|
11252
12720
|
|
|
11253
|
-
export { type AccountResponse, type paths$1 as AccountsPaths, type AddSigningKeyRequest$1 as AddSigningKeyRequest, type AddSigningKeyResponse, type BeginOAuthLoginArgs, type BeginOAuthLoginResult, type paths as ChainPaths, type CheckoutRequest, type CheckoutResponse, type CreateOrgRequest, type CreateOrgResponse, type CreateUserRequest, type CreateUserResponse, DelegatedKeys, type FinalizeWitnessResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GetWitnessResponse, type HealthLiveResponse, type HealthReadyResponse, type InviteMemberRequest, type InviteMemberResponse, type LedgerResponse, type ListDelegatedKeysResponse, type ListOauthSessionsResponse, type ListUsersResponse, type LoginRequest, type LoginResponse, type LogoutResponse, type MembersListResponse, MfaNamespace, MfaRecoveryCodes, MfaTotp, type OAuthTokenSnapshot, OWNER_OP, OauthNamespace, OauthSessions, OrgMembers, OrgUsers, type OwnerOpName, type OwnerSigner, type PauseRequest$1 as PauseRequest, type PauseResponse, type PkceVerifierStorage, type PortalResponse, type PrepareDelegatedKeyRequest, type PreparedDelegatedKeyResponse, type ProposeWitnessRequest, type ProposeWitnessResponse, type ProvisionContractRequest, type ProvisionContractResponse, type ProvisionDelegatedKeyArgs, type ProvisionDelegatedKeyResult, type PublicOrgResponse, type RecoveryCodesRegenerateResponse, type ReissueProvisioningTokenResponse, type RemoveMemberResponse, type ResendInviteResponse, type ResetAccountResponse, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDelegatedKeyResponse, type RevokeSigningKeyRequest$1 as RevokeSigningKeyRequest, type RevokeSigningKeyResponse, type RevokeWitnessRequest, type RevokeWitnessResponse, type SetMemberRoleRequest, type SetMemberRoleResponse, type SignRequest, type SignResponse, type SignWitnessRequest, type SignWitnessResponse, type SignedRequestSigner, SigningKeys, type SignupRequest, type SignupResponse, type SubmitDelegatedKeyRequest, type SubmitDelegatedKeyResponse, Subscriptions, type SuspendMemberResponse, type TotpConfirmRequest, type TotpConfirmResponse, type TotpDisableResponse, type TotpEnrollResponse, type UnpauseRequest, type UnpauseResponse, type VerifyEmailResponse, WitniumchainApiError, WitniumchainChainAdminClient, type WitniumchainChainAdminClientConfig, WitniumchainClient, type WitniumchainClientConfig, WitniumchainOrgClient, type WitniumchainOrgClientConfig, buildAddSigningKeyPayload, buildPausePayload, buildRevokeSigningKeyPayload, buildUnpausePayload, defaultVerifierStorage };
|
|
12721
|
+
export { type AccountResponse, type paths$1 as AccountsPaths, type AddSigningKeyRequest$1 as AddSigningKeyRequest, type AddSigningKeyResponse, type BeginOAuthLoginArgs, type BeginOAuthLoginResult, type paths as ChainPaths, type CheckoutRequest, type CheckoutResponse, type CreateOrgRequest, type CreateOrgResponse, type CreateUserRequest, type CreateUserResponse, DelegatedKeys, type FinalizeWitnessResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GetWitnessResponse, type HealthLiveResponse, type HealthReadyResponse, type InviteMemberRequest, type InviteMemberResponse, type LedgerResponse, type ListDelegatedKeysResponse, type ListOauthSessionsResponse, type ListUsersResponse, type LoginMfaResponse, type LoginRequest, type LoginResponse, type LogoutResponse, type MembersListResponse, MfaNamespace, type MfaProofRequest, MfaRecoveryCodes, MfaTotp, type OAuthTokenSnapshot, OWNER_OP, OauthNamespace, OauthSessions, OrgMembers, OrgUsers, type OwnerOpName, type OwnerSigner, type PauseRequest$1 as PauseRequest, type PauseResponse, type PkceVerifierStorage, type PortalResponse, type PrepareDelegatedKeyRequest, type PreparedDelegatedKeyResponse, type ProposeWitnessRequest, type ProposeWitnessResponse, type ProvisionContractRequest, type ProvisionContractResponse, type ProvisionDelegatedKeyArgs, type ProvisionDelegatedKeyResult, type PublicOrgResponse, type RecoveryCodesRegenerateResponse, type ReissueProvisioningTokenResponse, type RemoveMemberResponse, type ResendInviteResponse, type ResetAccountResponse, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDelegatedKeyResponse, type RevokeSigningKeyRequest$1 as RevokeSigningKeyRequest, type RevokeSigningKeyResponse, type RevokeWitnessRequest, type RevokeWitnessResponse, type SetMemberRoleRequest, type SetMemberRoleResponse, type SignRequest, type SignResponse, type SignWitnessRequest, type SignWitnessResponse, type SignedRequestSigner, SigningKeys, type SignupRequest, type SignupResponse, type SubmitDelegatedKeyRequest, type SubmitDelegatedKeyResponse, Subscriptions, type SuspendMemberResponse, type TotpConfirmRequest, type TotpConfirmResponse, type TotpDisableResponse, type TotpEnrollResponse, type UnpauseRequest, type UnpauseResponse, type VerifyEmailResponse, WitniumchainApiError, WitniumchainChainAdminClient, type WitniumchainChainAdminClientConfig, WitniumchainClient, type WitniumchainClientConfig, WitniumchainOrgClient, type WitniumchainOrgClientConfig, buildAddSigningKeyPayload, buildPausePayload, buildRevokeSigningKeyPayload, buildUnpausePayload, defaultVerifierStorage };
|