@witnium-tech/witniumchain 0.3.0 → 0.6.0

package/dist/index.d.ts

@@ -1,8 +1,40 @@
+/**
+ * PKCE (RFC 7636) primitives for the Authorization Code + PKCE OAuth flow.
+ *
+ * Two functions and one storage interface, all browser-only (the OAuth helpers
+ * that consume them only make sense in a browser context — PKCE state has to
+ * survive the authorize redirect via sessionStorage or an equivalent).
+ *
+ * The maths is small: a random verifier, SHA-256 of the verifier base64url-
+ * encoded as the challenge, `S256` as the method. The server stores the
+ * challenge at /auth time and recomputes it from the verifier at /token time.
+ */
+/**
+ * Storage for the PKCE verifier between `beginOAuthLogin` (which writes) and
+ * `completeOAuthLogin` (which reads + clears). Keyed by the OAuth `state`
+ * value so concurrent in-flight logins don't collide.
+ *
+ * Default implementation in {@link defaultVerifierStorage} wraps the browser's
+ * `sessionStorage` under namespaced keys. Tests inject a Map-backed mock.
+ */
+interface PkceVerifierStorage {
+    set(stateKey: string, verifier: string): void;
+    get(stateKey: string): string | null;
+    remove(stateKey: string): void;
+}
+/**
+ * Default {@link PkceVerifierStorage} backed by `globalThis.sessionStorage`.
+ * Throws at construction time if sessionStorage is unavailable — the SDK
+ * shouldn't silently degrade to in-memory storage that loses state across
+ * the authorize redirect.
+ */
+declare function defaultVerifierStorage(): PkceVerifierStorage;
+
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
  */
-interface paths {
+interface paths$1 {
     "/v1/auth/signup": {
         parameters: {
             query?: never;
@@ -883,6 +915,139 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create an organisation with client-generated keys
+         * @description Phase RBAC Thread D — explicit org creation. The caller generates the owner key and the initial signing key client-side; Witnium never holds the private bytes. The response includes the freshly-deployed contract address and a one-time email-verify token.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description Display name of the organisation. */
+                        orgName: string;
+                        /**
+                         * Format: email
+                         * @description Email of the founding org-admin. Receives the email-verify link.
+                         * @example user@example.com
+                         */
+                        adminEmail: string;
+                        /** @description Password for the founding org-admin. argon2id-hashed server-side. Minimum 12 chars; callers are expected to gate via a strength meter. */
+                        adminPassword: string;
+                        /**
+                         * @description Client-generated Ed25519 public key that controls signing-key add/revoke on the new contract. Witnium never sees the private bytes (non-custodial).
+                         * @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
+                         */
+                        ownerPublicKey: string;
+                        /**
+                         * @description First signing key registered on the contract. Often the same identity as the org-admin's browser-held key (Mode 1) but may also be the public half of a separately-registered Vault-Transit delegated key (Mode 3).
+                         * @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
+                         */
+                        initialSigningPublicKey: string;
+                        /** @description Captcha proof. Not yet wired (no captcha provider configured); reserved for when one is added. Public endpoint without it relies on downstream billing/credit-ledger gates against abuse. */
+                        captchaToken?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description UUID v4
+                             * @example 550e8400-e29b-41d4-a716-446655440000
+                             */
+                            orgId: string;
+                            /**
+                             * @description UUID v4
+                             * @example 550e8400-e29b-41d4-a716-446655440000
+                             */
+                            userId: string;
+                            /** @description Address of the freshly-deployed contract. */
+                            contractAddress: string;
+                            /** @description Semantic on-chain Solidity version (e.g. "5.0.0"). */
+                            contractVersion: string;
+                            /** @description Email-verify token. Already sent to adminEmail; echoed here for flows that prefer to surface a "click this link" in their own UI. */
+                            emailVerifyToken: string;
+                        };
+                    };
+                };
+                /** @description Bad Request — validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/me": {
         parameters: {
             query?: never;
@@ -2596,9 +2761,13 @@ interface paths {
         get?: never;
         put?: never;
         /**
-         * Sign arbitrary bytes with a delegated key
+         * Sign bytes with a delegated key
          * @description Vault Transit signs the supplied payload using the user's delegated key. Vault returns the signature; the accounts-service process never sees the private bytes (delegated keys are created with `exportable=false`).
          *
+         *     **Use:** sign the canonical-intent JSON returned by chain-api `POST /v5/contracts/.../witnesses/propose` (and the analogous v4 endpoint). The endpoint signs whatever bytes you submit because sign:write is an explicit grant to use the user's key — the on-chain authority of the key is bounded to witness ops on the user's contract, and nothing else in Witnium currently consumes these signatures. Future signing surfaces that need different keys or scopes get their own.
+         *
+         *     **Limits:** payload ≤ 8 KiB (16384 hex chars), per-user rate-limited at 20 signs/minute (429 + Retry-After on excess). Both are resource bounds, not access-control fences.
+         *
          *     Optional `X-Request-Id` request header gets forwarded into the audit-log line; a UUID is generated if absent.
          */
         post: {
@@ -2616,7 +2785,7 @@ interface paths {
                          * @example 550e8400-e29b-41d4-a716-446655440000
                          */
                         delegatedKeyId: string;
-                        /** @description Hex-encoded bytes to sign (no 0x prefix). Must have an even length. Witnium never logs the bytes themselves — only their SHA-256 hash is recorded for audit cross-correlation with Vault. */
+                        /** @description Hex-encoded bytes to sign (no 0x prefix). Must have an even length and at most 16384 hex characters (8 KiB raw). The expected use is signing the UTF-8 bytes of a v5 canonical-intent JSON returned by chain-api `/propose`, but the endpoint signs whatever bytes you submit — sign:write is an explicit grant to use the user's key. Witnium never logs the bytes; only their SHA-256 hash is recorded for audit cross-correlation with Vault. */
                         payload: string;
                     };
                 };
@@ -5108,18 +5277,20 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/health/live": {
+    "/v1/account/mfa/totp/enroll": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
+        get?: never;
+        put?: never;
         /**
-         * Liveness probe
-         * @description Returns 200/`{status:"ok"}` whenever the process is running. Used by Kubernetes to decide whether to restart the pod.
+         * Start TOTP enrolment
+         * @description Generates a fresh TOTP secret + otpauth URL. The user scans the QR (rendered client-side from `otpauthUrl`) into their authenticator app and then calls `/v1/account/mfa/totp/confirm` with the first 6-digit code. The enrolment is NOT a usable second factor until confirmed.
          */
-        get: {
+        post: {
             parameters: {
                 query?: never;
                 header?: never;
@@ -5135,40 +5306,108 @@ interface paths {
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "ok";
+                            /**
+                             * @description Base32 TOTP secret. Show to the user as a typeable fallback alongside the QR code rendered from `otpauthUrl`.
+                             * @example JBSWY3DPEHPK3PXP
+                             */
+                            secret: string;
+                            /**
+                             * @description Standard `otpauth://totp/...` URL. The dashboard renders this as a QR code; the user scans it with an authenticator app.
+                             * @example otpauth://totp/WitniumChain:alice%40example.com?secret=JBSWY3DPEHPK3PXP&issuer=WitniumChain&algorithm=SHA1&digits=6&period=30
+                             */
+                            otpauthUrl: string;
+                        };
+                    };
+                };
+                /** @description Bad Request — validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+                /** @description Unauthorized — authentication required or invalid */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
                         };
                     };
                 };
             };
         };
-        put?: never;
-        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/health/ready": {
+    "/v1/account/mfa/totp/confirm": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
+        get?: never;
+        put?: never;
         /**
-         * Readiness probe
-         * @description Returns 200/`{status:"ok"}` once a trivial `SELECT 1` succeeds against PostgreSQL. 503 if the DB is unreachable.
+         * Confirm TOTP enrolment
+         * @description Validates the first user-supplied code against the secret minted by `/enroll`, marks the enrolment confirmed, and returns 10 single-use recovery codes. The recovery codes appear ONCE in this response and are never readable again — the dashboard must show them immediately and prompt the user to store them.
          */
-        get: {
+        post: {
             parameters: {
                 query?: never;
                 header?: never;
                 path?: never;
                 cookie?: never;
             };
-            requestBody?: never;
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /**
+                         * @description Current 6-digit TOTP code shown by the authenticator app.
+                         * @example 123456
+                         */
+                        code: string;
+                    };
+                };
+            };
             responses: {
                 /** @description Success */
                 200: {
@@ -5177,13 +5416,38 @@ interface paths {
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "ok";
+                            /** @description Ten single-use recovery codes. Shown ONCE and never returned again — the user must store them now. Each code is consumed atomically when used in place of a TOTP code at MFA challenge time. */
+                            recoveryCodes: string[];
                         };
                     };
                 };
-                /** @description Service Unavailable */
-                503: {
+                /** @description Bad Request — validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+                /** @description Unauthorized — authentication required or invalid */
+                401: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -5209,34 +5473,3787 @@ interface paths {
                 };
             };
         };
-        put?: never;
-        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-}
-
-/**
- * Type shortcuts over the openapi-typescript-generated `paths` interface.
- *
- * Patterns mirror chain-sdk-v5/src/types.ts: each request/response shape is
- * `Req<path, method>` / `Res<path, method, status>` so callers see named,
- * ergonomic types without losing the single-source-of-truth guarantee — the
- * types are derived from the generated openapi types, not hand-rolled.
- */
-
-type JsonBody<T> = T extends {
-    content: {
-        'application/json': infer B;
-    };
+    "/v1/account/mfa/totp": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Disable TOTP and clear recovery codes
+         * @description Wipes the TOTP secret and all recovery codes. The user re-enrolls from scratch with `/enroll`. Future versions of this endpoint will require a recent MFA assertion (step-up) — Thread E of Phase AUTH.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {boolean} */
+                            disabled: true;
+                        };
+                    };
+                };
+                /** @description Unauthorized — authentication required or invalid */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/account/mfa/recovery-codes/regenerate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Generate a fresh set of recovery codes
+         * @description Invalidates the prior set and issues 10 new codes. Future versions will require step-up auth.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @description Ten single-use recovery codes. Shown ONCE and never returned again — the user must store them now. Each code is consumed atomically when used in place of a TOTP code at MFA challenge time. */
+                            recoveryCodes: string[];
+                        };
+                    };
+                };
+                /** @description Bad Request — validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+                /** @description Unauthorized — authentication required or invalid */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/health/live": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Liveness probe
+         * @description Returns 200/`{status:"ok"}` whenever the process is running. Used by Kubernetes to decide whether to restart the pod.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "ok";
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/health/ready": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Readiness probe
+         * @description Returns 200/`{status:"ok"}` once a trivial `SELECT 1` succeeds against PostgreSQL. 503 if the DB is unreachable.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "ok";
+                        };
+                    };
+                };
+                /** @description Service Unavailable */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+interface paths {
+    "/v5/contracts/deploy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Deploy a WitnessRegistry v5 contract (Admin)
+         * @description Deploy a v5 contract with owner key + initial signing key. V5 adds optional drand IBE time-lock per witness (see /v5/contracts/{addr}/witnesses/propose).
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        contractId: string;
+                        /**
+                         * Ed25519PublicKey
+                         * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                         */
+                        ownerPublicKey: string;
+                        /**
+                         * Ed25519PublicKey
+                         * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                         */
+                        initialSigningPublicKey: string;
+                        strictSeries: boolean;
+                        metadata?: {
+                            [key: string]: unknown;
+                        };
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            contractAddress: string;
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            walletAddress: string;
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                            blockNumber: number;
+                            contractVersion: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/info": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get v5 contract metadata + active signing keys
+         * @description Returns the contract record from chain-api storage: owner key, signing keys (with addedAt/revokedAt block timestamps), strictSeries flag, current pause state, owner nonce, and deployment block. This endpoint reads chain-api storage, not the chain directly — it returns 404 if the contract was deployed outside chain-api.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            contractAddress: string;
+                            contractId: string;
+                            contractVersion: string;
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            walletAddress: string;
+                            /**
+                             * Ed25519PublicKey
+                             * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                             */
+                            ownerKey: string;
+                            strictSeries: boolean;
+                            paused: boolean;
+                            ownerNonce: number;
+                            signingKeys: {
+                                /**
+                                 * Ed25519PublicKey
+                                 * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                                 */
+                                publicKey: string;
+                                /** @description block.timestamp at which the signing key was added */
+                                addedAt: number;
+                                /** @description 0 if active, else block.timestamp at revocation */
+                                revokedAt: number;
+                            }[];
+                            deploymentBlockNumber: number;
+                            isActive: boolean;
+                        };
+                    };
+                };
+                /** @description Not Found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Check whether an address has deployed contract bytecode
+         * @description Lightweight existence check: returns `exists: true` if `eth_getCode` returns non-empty bytecode at the address. Does NOT verify the contract is a WitnessRegistry V5 — that requires `/info`.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            contractAddress: string;
+                            /** @description true if the address has deployed bytecode on the chain (any contract). Does NOT verify that the bytecode is a WitnessRegistry V5 — use /info for that. */
+                            exists: boolean;
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/witnesses/propose": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Propose a v5 witness
+         * @description Propose a v5 witness, optionally with a drand IBE time-lock pair (drandRound + tlockCiphertext). Returns intentId + canonical intent payload to sign. Each required signer calls /sign before /finalize. The witnessId is unknown until /finalize completes.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /**
+                         * DataIdV5
+                         * @description SHA256 hash of the witnessed data (64 hex chars)
+                         */
+                        dataId: string;
+                        requiredSigners: string[];
+                        /**
+                         * UserTimestamp
+                         * @description User-asserted event time as ISO 8601 UTC second-precision. Optional; when omitted, the witness has no user timestamp.
+                         * @example 2026-05-19T08:14:04Z
+                         */
+                        userTimestamp?: string;
+                        /**
+                         * WitnessIdV5
+                         * @description 32-byte contract-derived witness identifier (hex, no 0x prefix)
+                         */
+                        previousWitnessId?: string;
+                        metadataCommitment?: string;
+                        revealAfter?: number;
+                        /**
+                         * DrandRound
+                         * @description drand quicknet round number (uint64). Must be strictly in the future, and ≥60s away in wall-clock terms.
+                         * @example 19000000
+                         */
+                        drandRound?: number;
+                        /**
+                         * TlockCiphertext
+                         * @description AGE-armored tlock ciphertext, hex-encoded UTF-8. Output of tlock-js `timelockEncrypt`. Max 4096 bytes (8192 hex chars).
+                         */
+                        tlockCiphertext?: string;
+                        /**
+                         * Format: uri
+                         * @description Valid URL
+                         * @example https://example.com/path
+                         */
+                        callbackUrl?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * IntentId
+                             * Format: uuid
+                             * @description UUID issued by chain-api at /propose time. Used to correlate /sign and /finalize calls. Distinct from the witnessId, which is only known once the contract mines the createWitness tx.
+                             */
+                            intentId: string;
+                            witnessNonce: string;
+                            /** @description Canonical intent JSON to Ed25519-sign. JSON.stringify({dataId, userTimestamp, nonce, previousWitnessId, requiredSigners, drandRound, tlockCiphertextHash}). drandRound is 0 and tlockCiphertextHash is "0".repeat(64) when no time-lock. */
+                            payloadToSign: string;
+                            expiresInSeconds: number;
+                            requiredSigners: string[];
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Not Found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/witnesses/{intentId}/sign": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Submit a signature for a pending v5 witness
+         * @description Each required signer calls this with their pubkey + Ed25519 signature over the canonical intent JSON returned from /propose.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                    /** @description UUID issued by chain-api at /propose time. Used to correlate /sign and /finalize calls. Distinct from the witnessId, which is only known once the contract mines the createWitness tx. */
+                    intentId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /**
+                         * Ed25519PublicKey
+                         * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                         */
+                        signerPubKey: string;
+                        /**
+                         * Ed25519Signature
+                         * @description 64-byte Ed25519 signature (hex, no 0x prefix)
+                         */
+                        signature: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            signaturesCollected: number;
+                            signaturesRequired: number;
+                            ready: boolean;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Response */
+                410: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/witnesses/{intentId}/finalize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Finalize a v5 witness (broadcast + wait for receipt)
+         * @description Broadcasts createWitness and blocks until the tx is mined so the contract-derived witnessId can be returned. Typical latency: 10–15s on Witnium (10s QBFT block period).
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                    /** @description UUID issued by chain-api at /propose time. Used to correlate /sign and /finalize calls. Distinct from the witnessId, which is only known once the contract mines the createWitness tx. */
+                    intentId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * IntentId
+                             * Format: uuid
+                             * @description UUID issued by chain-api at /propose time. Used to correlate /sign and /finalize calls. Distinct from the witnessId, which is only known once the contract mines the createWitness tx.
+                             */
+                            intentId: string;
+                            /**
+                             * WitnessIdV5
+                             * @description 32-byte contract-derived witness identifier (hex, no 0x prefix)
+                             */
+                            witnessId: string;
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                            blockNumber: number;
+                            /** @description block.timestamp at the block that included the createWitness tx — this is the value the contract used as chainTimestamp when deriving the witnessId. */
+                            chainTimestamp: number;
+                            /** @description drand round encoded in the witness (0 when not time-locked). */
+                            drandRound: number;
+                            status: string;
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Response */
+                410: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/witnesses/{witnessId}/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Revoke a v5 witness (tombstone) */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                    /** @description 32-byte contract-derived witness identifier (hex, no 0x prefix) */
+                    witnessId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        reasonHash: string;
+                        /**
+                         * Ed25519PublicKey
+                         * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                         */
+                        revokerPubKey: string;
+                        /**
+                         * Ed25519Signature
+                         * @description 64-byte Ed25519 signature (hex, no 0x prefix)
+                         */
+                        revokerSignature: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/keys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add a signing key (owner-signed)
+         * @description Add a new Ed25519 signing key to the contract. Payload is owner-signed; the bytes signed are the canonical JSON `{op:1, contract, nonce, newKey}` (UTF-8, no whitespace). The Admin bearer token authenticates the caller (typically the accounts service forwarding the owner-signed payload). Owner-op `op` codes (numeric, match on-chain): 1=addSigningKey, 2=revokeSigningKey, 3=pause, 4=unpause.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /**
+                         * Ed25519PublicKey
+                         * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                         */
+                        newKey: string;
+                        /** @description Monotonic owner nonce. Read the current value from /v5/contracts/{addr}/info as `ownerNonce`, then use `ownerNonce + 1` here. */
+                        ownerNonce: number;
+                        /**
+                         * Ed25519Signature
+                         * @description 64-byte Ed25519 signature (hex, no 0x prefix)
+                         */
+                        ownerSignature: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/keys/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Revoke a signing key (owner-signed)
+         * @description Revoke an existing Ed25519 signing key. Once revoked, the key cannot create new witnesses but previously-created witnesses are unaffected. The bytes signed are the canonical JSON `{op:2, contract, nonce, key}` (UTF-8, no whitespace). Owner-op `op` codes (numeric, match on-chain): 1=addSigningKey, 2=revokeSigningKey, 3=pause, 4=unpause.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /**
+                         * Ed25519PublicKey
+                         * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                         */
+                        keyToRevoke: string;
+                        ownerNonce: number;
+                        /**
+                         * Ed25519Signature
+                         * @description 64-byte Ed25519 signature (hex, no 0x prefix)
+                         */
+                        ownerSignature: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/pause": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Pause a contract (owner-signed)
+         * @description Pause witness creation on the contract. While paused, /propose/sign/finalize reject. Reads continue to work. Pair with /unpause to resume. The bytes signed are the canonical JSON `{op:3, contract, nonce}` (UTF-8, no whitespace). Owner-op `op` codes (numeric, match on-chain): 1=addSigningKey, 2=revokeSigningKey, 3=pause, 4=unpause.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        ownerNonce: number;
+                        /**
+                         * Ed25519Signature
+                         * @description 64-byte Ed25519 signature (hex, no 0x prefix)
+                         */
+                        ownerSignature: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/unpause": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Unpause a contract (owner-signed)
+         * @description Inverse of /pause. The bytes signed are the canonical JSON `{op:4, contract, nonce}` (UTF-8, no whitespace). Owner-op `op` codes (numeric, match on-chain): 1=addSigningKey, 2=revokeSigningKey, 3=pause, 4=unpause.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        ownerNonce: number;
+                        /**
+                         * Ed25519Signature
+                         * @description 64-byte Ed25519 signature (hex, no 0x prefix)
+                         */
+                        ownerSignature: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/witnesses": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List v5 witnesses (optionally filtered by dataId)
+         * @description Scans the WitnessCreated event log from contract deployment to head. The v5 event adds drandRound — non-zero means the witness carries a drand IBE ciphertext decryptable at that round. Query the full witness via /get for the ciphertext bytes.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    dataId?: string;
+                    limit?: number;
+                    offset?: number | null;
+                };
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            witnesses: {
+                                /**
+                                 * WitnessIdV5
+                                 * @description 32-byte contract-derived witness identifier (hex, no 0x prefix)
+                                 */
+                                witnessId: string;
+                                dataId: string;
+                                timestamp: number;
+                                blockNumber: number;
+                                previousWitnessId: string | null;
+                                signerCount: number;
+                                timeLocked: boolean;
+                                hasUserTimestamp: boolean;
+                                drandRound: number;
+                            }[];
+                            hasMore: boolean;
+                            totalReturned: number;
+                        };
+                    };
+                };
+                /** @description Not Found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/witnesses/{witnessId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a single v5 witness by ID
+         * @description Returns the full on-chain witness record. For time-locked witnesses (drandRound != 0), the `tlockCiphertext` is returned as hex-encoded AGE-armored bytes; decrypt it via MCP `reveal_witness` after the drand round publishes.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                    /** @description 32-byte contract-derived witness identifier (hex, no 0x prefix) */
+                    witnessId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * WitnessIdV5
+                             * @description 32-byte contract-derived witness identifier (hex, no 0x prefix)
+                             */
+                            witnessId: string;
+                            /** @description SHA256 of the witnessed data, as 64 hex chars. */
+                            dataId: string;
+                            /** @description block.timestamp at the block that created the witness */
+                            timestamp: number;
+                            blockNumber: number;
+                            /** @description Witness ID this witness chains from, or null. Used by strictSeries contracts to enforce a single linear chain. */
+                            previousWitnessId: string | null;
+                            /** @description Per-witness nonce (64 hex chars). Generated by chain-api at /propose time. */
+                            nonce: string;
+                            /** @description 32-byte commitment to off-chain metadata, or "0".repeat(64) if none. */
+                            metadataCommitment: string;
+                            /** @description Legacy time-lock unix timestamp from V3/V4 — left for shape compatibility. For real time-lock use `drandRound` + `tlockCiphertext` instead. */
+                            revealAfter: number;
+                            /** @description User-asserted event time as ISO 8601 UTC second-precision, or "" if none was supplied at propose time. */
+                            userTimestamp: string;
+                            /** @description 0 if active, else block.timestamp at revocation. */
+                            revokedAt: number;
+                            /** @description 32-byte hash of the revocation reason, or "0".repeat(64) if never revoked. */
+                            revokedReason: string;
+                            /** @description true if `revealAfter` is set and still in the future. Sealed witnesses redact `userTimestamp` to "". Not related to drand time-lock. */
+                            sealed: boolean;
+                            exists: boolean;
+                            /** @description drand quicknet round at which `tlockCiphertext` becomes decryptable. 0 means the witness is not drand-time-locked. */
+                            drandRound: number;
+                            /** @description AGE-armored ciphertext, hex-encoded UTF-8. Empty string when the witness is not drand-time-locked. Decrypt via MCP `reveal_witness` after `drandRound` has published. */
+                            tlockCiphertext: string;
+                            signers: {
+                                /**
+                                 * Ed25519PublicKey
+                                 * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                                 */
+                                pubKey: string;
+                                /** @description R component of the Ed25519 signature, 32 hex chars. */
+                                sigR: string;
+                                /** @description S component of the Ed25519 signature, 32 hex chars. */
+                                sigS: string;
+                            }[];
+                        };
+                    };
+                };
+                /** @description Not Found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/transactions/{txHash}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get transaction status
+         * @description Lightweight mempool + chain lookup for a tx hash. Use this to poll a tx after /finalize or any owner op until it confirms.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum transaction hash (0x + 64 hex characters) */
+                    txHash: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                            /** @description Block number if mined, null if still pending in mempool. */
+                            blockNumber: number | null;
+                            /**
+                             * @description `confirmed` once mined into a block; `pending` if in mempool but not mined; `not-found` if no node has seen it.
+                             * @enum {string}
+                             */
+                            status: "pending" | "confirmed" | "not-found";
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/contracts/{contractAddress}/transactions/{txHash}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get full transaction details
+         * @description Returns receipt-level detail: block + timestamp + gas + sender/recipient. `contractAddress` is contextual (not used in the lookup) — included so consumers can scope tx lookups to a contract namespace.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    contractAddress: string;
+                    /** @description Ethereum transaction hash (0x + 64 hex characters) */
+                    txHash: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum transaction hash (0x + 64 hex characters)
+                             * @example 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+                             */
+                            transactionHash: string;
+                            blockNumber: number;
+                            /** @description 0x-prefixed 32-byte block hash that included the tx. */
+                            blockHash: string;
+                            /** @description block.timestamp (unix seconds) of the including block. */
+                            blockTimestamp: number;
+                            transactionIndex: number;
+                            /** @description Decimal string (wei units of gas units), big-int-safe. */
+                            gasUsed: string;
+                            /** @description Decimal string (wei per gas unit), big-int-safe. */
+                            effectiveGasPrice: string;
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            from: string;
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            to: string;
+                        } | null;
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/wallets/{address}/balance": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the native-token balance of an address
+         * @description Returns the address balance in both ETH-formatted and wei representations. Useful for checking that a per-contract wallet has gas to fund subsequent createWitness txs.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    address: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            address: string;
+                            /**
+                             * @description Balance formatted as ETH (decimal string, 18-decimal place).
+                             * @example 1.234567890123456789
+                             */
+                            balanceEth: string;
+                            /**
+                             * @description Balance in wei (big-int as decimal string).
+                             * @example 1234567890123456789
+                             */
+                            balanceWei: string;
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/dashboard/witnesses": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the authenticated user's witnesses, filtered (newest-first)
+         * @description Returns paginated witness headers for the contract resolved from the OAuth
+         *     JWT `contract` claim. Filters are applied during the event scan:
+         *
+         *     - `from` / `to`: unix-second range over `block.timestamp`
+         *     - `timeLock`: structural filter on whether the witness carries a drandRound
+         *
+         *     Response shape is identical to GET /v5/contracts/{addr}/witnesses; the
+         *     scan is always newest-first.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    /** @description Filter to witnesses with block.timestamp >= this unix-second value. */
+                    from?: number;
+                    /** @description Filter to witnesses with block.timestamp <= this unix-second value. */
+                    to?: number;
+                    /** @description Filter by drand IBE time-lock state. "locked" = witness has a drandRound, "none" = no time-lock, "any" = no filter (default). */
+                    timeLock?: "locked" | "none" | "any";
+                    /** @description Page size, 1-200, default 50. */
+                    limit?: number;
+                    /** @description Offset into the filtered set, default 0. */
+                    offset?: number | null;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            witnesses: {
+                                /**
+                                 * WitnessIdV5
+                                 * @description 32-byte contract-derived witness identifier (hex, no 0x prefix)
+                                 */
+                                witnessId: string;
+                                dataId: string;
+                                timestamp: number;
+                                blockNumber: number;
+                                previousWitnessId: string | null;
+                                signerCount: number;
+                                timeLocked: boolean;
+                                hasUserTimestamp: boolean;
+                                drandRound: number;
+                            }[];
+                            hasMore: boolean;
+                            totalReturned: number;
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Not Found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v5/dashboard/contract": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the authenticated user's contract info
+         * @description Returns the contract record for the contract resolved from the OAuth JWT
+         *     `contract` claim — same shape as GET /v5/contracts/{addr}/info, but with
+         *     no address in the URL: identity is taken from the bearer token.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            contractAddress: string;
+                            contractId: string;
+                            contractVersion: string;
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            walletAddress: string;
+                            /**
+                             * Ed25519PublicKey
+                             * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                             */
+                            ownerKey: string;
+                            strictSeries: boolean;
+                            paused: boolean;
+                            ownerNonce: number;
+                            signingKeys: {
+                                /**
+                                 * Ed25519PublicKey
+                                 * @description 32-byte Ed25519 public key (hex, no 0x prefix)
+                                 */
+                                publicKey: string;
+                                /** @description block.timestamp at which the signing key was added */
+                                addedAt: number;
+                                /** @description 0 if active, else block.timestamp at revocation */
+                                revokedAt: number;
+                            }[];
+                            deploymentBlockNumber: number;
+                            isActive: boolean;
+                        };
+                    };
+                };
+                /** @description Unauthorized - Authentication required */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Not Found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/validators/propose": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Propose adding or removing a validator
+         * @description Submit a vote to add or remove a validator from the network.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /**
+                         * @description Ethereum address (0x + 40 hex characters)
+                         * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                         */
+                        validatorAddress: string;
+                        /** @description true = vote to add, false = vote to remove */
+                        add: boolean;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {boolean} */
+                            success: true;
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            validatorAddress: string;
+                            add: boolean;
+                            message: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/validators/vote/{address}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Discard a vote for a validator
+         * @description Remove a vote for adding or removing a validator.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Ethereum address (0x + 40 hex characters) */
+                    address: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {boolean} */
+                            success: true;
+                            message: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Not Found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/validators": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get list of validators
+         * @description Get the current list of validators in the network.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            validators: {
+                                /**
+                                 * @description Ethereum address (0x + 40 hex characters)
+                                 * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                                 */
+                                address: string;
+                                added: boolean;
+                            }[];
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/validators/pending": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get list of pending validators
+         * @description Get validators that have votes but are not yet added/removed.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            pending: {
+                                /**
+                                 * @description Ethereum address (0x + 40 hex characters)
+                                 * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                                 */
+                                address: string;
+                                addVotes: number;
+                                removeVotes: number;
+                            }[];
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/network/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get network status
+         * @description Get the current status of the blockchain network.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            chainId: number;
+                            blockNumber: number;
+                            validatorCount: number;
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/network/peers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get network peers
+         * @description Get the list of connected network peers.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            peers: {
+                                id: string;
+                                name?: string;
+                                enode: string;
+                                /** @enum {string} */
+                                status: "connected" | "disconnected";
+                            }[];
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Add a network peer
+         * @description Add a peer to the network.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        enode: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {boolean} */
+                            success: true;
+                            message: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        /**
+         * Remove a network peer
+         * @description Remove a peer from the network.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        enode: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {boolean} */
+                            success: true;
+                            message: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/utils/pubkey-to-address": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Convert public key to Ethereum address
+         * @description Utility endpoint to convert a public key to an Ethereum address.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        pubkey: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Ethereum address (0x + 40 hex characters)
+                             * @example 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0
+                             */
+                            address: string;
+                            pubkey: string;
+                        };
+                    };
+                };
+                /** @description Bad Request - Validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+                /** @description Internal Server Error */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/health/live": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Liveness probe
+         * @description Kubernetes liveness probe. Fails if queue connection lost for > 1 minute.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "healthy";
+                            /**
+                             * QueueStatus
+                             * @description Queue health status
+                             */
+                            queue: {
+                                healthy: boolean;
+                                timeSinceLastPingMs: number;
+                                /** Format: date-time */
+                                lastPing?: string;
+                            };
+                        };
+                    };
+                };
+                /** @description Service Unavailable */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/health/ready": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Readiness probe
+         * @description Kubernetes readiness probe. Fails if queue or blockchain is unhealthy.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "ready";
+                            /**
+                             * QueueStatus
+                             * @description Queue health status
+                             */
+                            queue: {
+                                healthy: boolean;
+                                timeSinceLastPingMs: number;
+                                /** Format: date-time */
+                                lastPing?: string;
+                            };
+                            /**
+                             * BlockchainStatus
+                             * @description Blockchain connection status
+                             */
+                            blockchain: {
+                                connected: boolean;
+                                chainId?: number;
+                                blockNumber?: number;
+                            };
+                        };
+                    };
+                };
+                /** @description Service Unavailable */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/health": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Detailed health check
+         * @description Get detailed health status for debugging. Not used for K8s probes.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "healthy" | "degraded";
+                            /** Format: date-time */
+                            timestamp: string;
+                            /**
+                             * QueueStatus
+                             * @description Queue health status
+                             */
+                            queue: {
+                                healthy: boolean;
+                                timeSinceLastPingMs: number;
+                                /** Format: date-time */
+                                lastPing?: string;
+                            };
+                            /**
+                             * BlockchainStatus
+                             * @description Blockchain connection status
+                             */
+                            blockchain: {
+                                connected: boolean;
+                                chainId?: number;
+                                blockNumber?: number;
+                            };
+                            /**
+                             * RedisStatus
+                             * @description Redis connection status
+                             */
+                            redis?: {
+                                connected: boolean;
+                            };
+                        };
+                    };
+                };
+                /** @description Service Unavailable */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Error message
+                             * @example Validation failed
+                             */
+                            error: string;
+                            /**
+                             * @description Machine-readable error code
+                             * @example VALIDATION_FAILED
+                             */
+                            code?: string;
+                            /** @description Field-level validation errors */
+                            details?: {
+                                [key: string]: string[];
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+
+/**
+ * Type shortcuts over the openapi-typescript-generated `paths` interfaces of
+ * both services.
+ *
+ * Patterns mirror chain-sdk-v5/src/types.ts: each request/response shape is
+ * `Req<path, method>` / `Res<path, method, status>` for accounts, and
+ * `ChainReq<...>` / `ChainRes<...>` for chain-api. Callers see named,
+ * ergonomic types without losing the single-source-of-truth guarantee — the
+ * types are derived from the generated openapi types, not hand-rolled.
+ */
+
+type JsonBody<T> = T extends {
+    content: {
+        'application/json': infer B;
+    };
 } ? B : never;
-type Req<P extends keyof paths, M extends keyof paths[P]> = JsonBody<Extract<paths[P][M], {
+type Req<P extends keyof paths$1, M extends keyof paths$1[P]> = JsonBody<Extract<paths$1[P][M], {
     requestBody?: unknown;
 }>['requestBody']>;
-type Res<P extends keyof paths, M extends keyof paths[P], S extends number = 200> = paths[P][M] extends {
+type Res<P extends keyof paths$1, M extends keyof paths$1[P], S extends number = 200> = paths$1[P][M] extends {
+    responses: {
+        [K in S]: infer R;
+    };
+} ? JsonBody<R> : never;
+type ChainRes<P extends keyof paths, M extends keyof paths[P], S extends number = 200> = paths[P][M] extends {
     responses: {
         [K in S]: infer R;
     };
@@ -5258,6 +9275,8 @@ type PublicOrgResponse = Res<'/v1/orgs/me', 'get'>;
 type CreateUserRequest = Req<'/v1/orgs/me/users', 'post'>;
 type CreateUserResponse = Res<'/v1/orgs/me/users', 'post'>;
 type ListUsersResponse = Res<'/v1/orgs/me/users', 'get'>;
+type CreateOrgRequest = Req<'/v1/orgs', 'post'>;
+type CreateOrgResponse = Res<'/v1/orgs', 'post'>;
 type CreateOrganizationRequest = Req<'/v1/admin/organizations', 'post'>;
 type CreateOrganizationResponse = Res<'/v1/admin/organizations', 'post'>;
 type SetAccountTypeRequest = Req<'/v1/admin/organizations/{id}/account-type', 'patch'>;
@@ -5276,11 +9295,11 @@ type SignRequest = Req<'/v1/sign', 'post'>;
 type SignResponse = Res<'/v1/sign', 'post'>;
 type ProvisionContractRequest = Req<'/v1/contracts/provision', 'post'>;
 type ProvisionContractResponse = Res<'/v1/contracts/provision', 'post'>;
-type AddSigningKeyRequest = Req<'/v1/keys', 'post'>;
+type AddSigningKeyRequest$1 = Req<'/v1/keys', 'post'>;
 type AddSigningKeyResponse = Res<'/v1/keys', 'post'>;
-type RevokeSigningKeyRequest = Req<'/v1/keys/revoke', 'post'>;
+type RevokeSigningKeyRequest$1 = Req<'/v1/keys/revoke', 'post'>;
 type RevokeSigningKeyResponse = Res<'/v1/keys/revoke', 'post'>;
-type PauseRequest = Req<'/v1/contracts/pause', 'post'>;
+type PauseRequest$1 = Req<'/v1/contracts/pause', 'post'>;
 type PauseResponse = Res<'/v1/contracts/pause', 'post'>;
 type UnpauseRequest = Req<'/v1/contracts/unpause', 'post'>;
 type UnpauseResponse = Res<'/v1/contracts/unpause', 'post'>;
@@ -5301,19 +9320,36 @@ type RevokeWitnessV5Request = Req<'/v5/contracts/{contractAddress}/witnesses/{wi
 type RevokeWitnessV5Response = Res<'/v5/contracts/{contractAddress}/witnesses/{witnessId}/revoke', 'post'>;
 type AccountResponse = Res<'/v1/account', 'get'>;
 type LedgerResponse = Res<'/v1/account/ledger', 'get'>;
+type TotpEnrollResponse = Res<'/v1/account/mfa/totp/enroll', 'post'>;
+type TotpConfirmRequest = Req<'/v1/account/mfa/totp/confirm', 'post'>;
+type TotpConfirmResponse = Res<'/v1/account/mfa/totp/confirm', 'post'>;
+type TotpDisableResponse = Res<'/v1/account/mfa/totp', 'delete'>;
+type RecoveryCodesRegenerateResponse = Res<'/v1/account/mfa/recovery-codes/regenerate', 'post'>;
 type ListOauthSessionsResponse = Res<'/v1/oauth/sessions', 'get'>;
 type HealthLiveResponse = Res<'/health/live', 'get'>;
 type HealthReadyResponse = Res<'/health/ready', 'get'>;
+type ContractInfoResponse = ChainRes<'/v5/contracts/{contractAddress}/info', 'get'>;
+type VerifyContractResponse = ChainRes<'/v5/contracts/{contractAddress}/verify', 'get'>;
+type ListWitnessesResponse = ChainRes<'/v5/contracts/{contractAddress}/witnesses', 'get'>;
+type GetChainWitnessResponse = ChainRes<'/v5/contracts/{contractAddress}/witnesses/{witnessId}', 'get'>;
+type GetContractTransactionResponse = ChainRes<'/v5/contracts/{contractAddress}/transactions/{txHash}', 'get'>;
+type GetTransactionResponse = ChainRes<'/v5/transactions/{txHash}', 'get'>;
+type GetWalletBalanceResponse = ChainRes<'/v5/wallets/{address}/balance', 'get'>;
+type DashboardContractResponse = ChainRes<'/v5/dashboard/contract', 'get'>;
+type DashboardWitnessesResponse = ChainRes<'/v5/dashboard/witnesses', 'get'>;
 
 /**
- * WitniumchainClient — typed HTTP client for the WitniumChain accounts API.
+ * WitniumchainClient — typed HTTP client for the WitniumChain API surface.
+ *
+ * Covers both accounts (identity / billing / OAuth / delegated keys / witness
+ * writes via the metered v5 proxy) and chain-api read surfaces (contract
+ * info / witness lookup / wallet balance / dashboards). Three convenience
+ * clients layer on top — `WitniumchainClient` (end-user),
+ * `WitniumchainOrgClient` (org admin), `WitniumchainAdminClient` (sysadmin) —
+ * with helpers for signup, subscriptions, and delegated-key provisioning.
  *
- * This is the v1 "shell" client: one low-level method per OpenAPI route.
- * Thread 4 (per docs/PLAN-PHASE-C-HARDEN-SURFACES.md) will layer three
- * higher-level clients on top — `WitniumchainClient` (end-user),
- * `WitniumchainOrgClient` (org admin), `WitniumchainAdminClient`
- * (sysadmin) — with ergonomic helpers for signup, subscriptions,
- * delegated-key provisioning, Stripe Connect onboarding, etc.
+ * Stripe surface is intentionally Checkout + Customer Portal ONLY. Witnium is
+ * not a marketplace, so there is no Stripe Connect onboarding.
  *
  * Auth model — five distinct credentials, each used by a known subset of
  * routes. Configure whichever you'll actually use; methods that need a
@@ -5328,10 +9364,11 @@ type HealthReadyResponse = Res<'/health/ready', 'get'>;
  *                      does the canonical-message construction; you supply
  *                      only the public key + signing callback.
  *
- * Every request/response type is derived from the published OpenAPI spec.
- * A CI drift test in the accounts repo asserts the spec matches what the
- * deployed server serves; another asserts the regenerated SDK types match
- * the committed `src/generated/openapi.ts`.
+ * Every request/response type is derived from the published OpenAPI specs of
+ * both accounts and chain-api. A CI drift test in each repo asserts the spec
+ * matches what the deployed server serves; another asserts the regenerated
+ * SDK types match the committed `src/generated/accounts.ts` and
+ * `src/generated/chain.ts`.
  */
 
 interface SignedRequestSigner {
@@ -5403,12 +9440,48 @@ interface ProvisionDelegatedKeyResult {
     blockNumber?: number;
 }
 interface WitniumchainClientConfig {
-    /** Base URL, e.g. `https://auth.witniumchain.com`. Trailing slash optional. */
+    /** Accounts base URL, e.g. `https://auth.witniumchain.com`. Trailing slash optional. */
     baseUrl: string;
+    /**
+     * Chain-api base URL, e.g. `https://api.witniumchain.com`. Required only if you
+     * call chain-api read methods (`getWitness`, `getContractInfo`, etc.). Methods
+     * that need it will throw a clear `WitniumchainApiError` at call time if
+     * unconfigured. Same `accessToken` is reused — accounts mints OAuth tokens with
+     * `aud=https://api.witniumchain.com`, so they're valid against both services.
+     */
+    chainBaseUrl?: string;
     /** Session cookie value (the `wac_session` cookie's body, not the full header). */
     sessionCookie?: string;
-    /** OAuth 2.1 access token (Bearer JWT). */
+    /**
+     * OAuth 2.1 access token (Bearer JWT). The SDK treats this as in-memory
+     * mutable state — {@link WitniumchainClient.completeOAuthLogin} and
+     * {@link WitniumchainClient.refreshAccessToken} both update it; reads of
+     * `BearerJWT`-authed routes pick up the latest value. Pass an initial value
+     * if you already have one (e.g. server-side rendering); leave it unset and
+     * let `completeOAuthLogin` populate it from the OAuth flow.
+     */
     accessToken?: string;
+    /**
+     * OAuth client id of the registered application using this SDK. Required if
+     * you call {@link WitniumchainClient.beginOAuthLogin} OR
+     * {@link WitniumchainClient.refreshAccessToken}. Methods that need it will
+     * throw a clear `WitniumchainApiError` at call time when unconfigured.
+     *
+     * Registered via the org-admin OAuth-clients UI (Thread G of Phase AUTH).
+     */
+    oauthClientId?: string;
+    /**
+     * Storage adapter for the PKCE verifier between authorize redirect and
+     * token exchange. Defaults to a `globalThis.sessionStorage` wrapper —
+     * suitable for browser SPAs. Tests inject a Map-backed mock; non-browser
+     * callers (Node SSR, native apps with their own storage) supply their own.
+     *
+     * sessionStorage is the chosen default because it's tab-scoped (resilient
+     * to cross-tab interference) and cleared on tab close (no stale verifier
+     * persistence). It is NOT localStorage — that would survive tab close and
+     * is reachable from any same-origin script, weakening the XSS posture.
+     */
+    verifierStorage?: PkceVerifierStorage;
     /** Organisation API key (`wcorg_live_…`). */
     orgApiKey?: string;
     /** System-admin token (`Authorization: Bearer <ADMIN_TOKEN>`). */
@@ -5420,11 +9493,72 @@ interface WitniumchainClientConfig {
     /** Alternate fetch implementation (e.g. for tests). Default `globalThis.fetch`. */
     fetch?: typeof fetch;
 }
+/**
+ * Arguments to {@link WitniumchainClient.beginOAuthLogin}. The OAuth client id
+ * is sourced from `WitniumchainClientConfig.oauthClientId` at construction —
+ * not repeated here — so the same client can drive multiple authorize calls
+ * (e.g. retry on user cancellation) without rethreading the id every time.
+ */
+interface BeginOAuthLoginArgs {
+    /**
+     * Where the authorization server should redirect after the user authenticates.
+     * Must exactly match one of the redirect URIs registered for the OAuth client.
+     * Stored alongside the PKCE verifier so {@link WitniumchainClient.completeOAuthLogin}
+     * can rebuild the canonical token-exchange request without the caller having
+     * to thread the same URI through twice.
+     */
+    redirectUri: string;
+    /**
+     * OAuth scopes to request. Default: `['openid', 'profile', 'email']` — the
+     * standard OIDC sign-in trio. Pass a wider list if the caller's tokens need
+     * additional scopes (e.g. `witnesses:write`); the authorization server
+     * filters out scopes the user isn't allowed to grant.
+     */
+    scope?: readonly string[];
+    /**
+     * Custom OAuth `state` value. Default: a freshly-generated 32-byte URL-safe
+     * random. Passing a custom value is useful when the caller needs to round-
+     * trip application-level context through the redirect (e.g. "which page was
+     * the user on before login"); the value is otherwise treated as opaque.
+     */
+    state?: string;
+    /**
+     * Standard OIDC `prompt` parameter. `'login'` forces the AS to re-prompt for
+     * credentials even if the user has a live session; `'none'` asks for silent
+     * SSO (returns `login_required` if not possible). Default: unset.
+     */
+    prompt?: 'login' | 'none';
+}
+interface BeginOAuthLoginResult {
+    /** URL to redirect the user to. The caller does `window.location.assign(...)`. */
+    authorizationUrl: string;
+    /**
+     * The state value bound to this login attempt. Same as the `state` passed
+     * in (if any) or a freshly generated one. {@link WitniumchainClient.completeOAuthLogin}
+     * validates that the state in the callback URL matches a value it issued.
+     */
+    state: string;
+}
+interface OAuthTokenSnapshot {
+    /** OAuth Bearer access token. */
+    accessToken: string;
+    /** Unix seconds at which the access token expires. */
+    expiresAt: number;
+}
 declare class WitniumchainClient {
     private readonly baseUrl;
+    private readonly chainBaseUrl;
     private readonly cfg;
     private readonly timeout;
     private readonly fetchImpl;
+    private accessToken;
+    private refreshToken;
+    private hasRefreshCookie;
+    private readonly oauthClientId;
+    private pendingLogins;
+    private readonly verifierStorage;
+    private discoveryCache;
+    private refreshInFlight;
     /** Subscriptions / billing helpers. See {@link Subscriptions}. */
     readonly subscriptions: Subscriptions;
     /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -5433,6 +9567,8 @@ declare class WitniumchainClient {
     readonly keys: SigningKeys;
     /** OAuth session management. Accessed as `client.oauth.sessions.*`. */
     readonly oauth: OauthNamespace;
+    /** MFA self-management. Accessed as `client.mfa.totp.*` and `client.mfa.recoveryCodes.*`. */
+    readonly mfa: MfaNamespace;
     constructor(config: WitniumchainClientConfig);
     /**
      * Convenience alias for {@link getAccount} — returns the authenticated
@@ -5440,6 +9576,17 @@ declare class WitniumchainClient {
      */
     me(): Promise<AccountResponse>;
     signup(body: SignupRequest): Promise<SignupResponse>;
+    /**
+     * Self-serve org creation (Phase RBAC Thread D). One public call that
+     * creates the admin user, the org, the org-admin membership, and deploys
+     * the contract with the caller's client-generated `ownerPublicKey` +
+     * `initialSigningPublicKey`. Witnium never sees the private bytes.
+     *
+     * Returns `{ orgId, userId, contractAddress, contractVersion,
+     * emailVerifyToken }`. The verify token is also emailed; it's echoed here
+     * for UIs that prefer to render the verify link themselves.
+     */
+    createOrg(body: CreateOrgRequest): Promise<CreateOrgResponse>;
     verifyEmail(token: string): Promise<VerifyEmailResponse>;
     login(body: LoginRequest): Promise<LoginResponse>;
     logout(): Promise<LogoutResponse>;
@@ -5464,9 +9611,9 @@ declare class WitniumchainClient {
     revokeDelegatedKey(id: string): Promise<RevokeDelegatedKeyResponse>;
     sign(body: SignRequest, requestId?: string): Promise<SignResponse>;
     provisionContract(body: ProvisionContractRequest): Promise<ProvisionContractResponse>;
-    addSigningKey(body: AddSigningKeyRequest): Promise<AddSigningKeyResponse>;
-    revokeSigningKey(body: RevokeSigningKeyRequest): Promise<RevokeSigningKeyResponse>;
-    pauseContract(body: PauseRequest): Promise<PauseResponse>;
+    addSigningKey(body: AddSigningKeyRequest$1): Promise<AddSigningKeyResponse>;
+    revokeSigningKey(body: RevokeSigningKeyRequest$1): Promise<RevokeSigningKeyResponse>;
+    pauseContract(body: PauseRequest$1): Promise<PauseResponse>;
     unpauseContract(body: UnpauseRequest): Promise<UnpauseResponse>;
     proposeWitness(contractAddress: string, body: ProposeWitnessRequest, idempotencyKey?: string): Promise<ProposeWitnessResponse>;
     signWitness(contractAddress: string, witnessId: string, body: SignWitnessRequest): Promise<SignWitnessResponse>;
@@ -5479,13 +9626,141 @@ declare class WitniumchainClient {
     revokeWitnessV5(contractAddress: string, witnessId: string, body: RevokeWitnessV5Request, idempotencyKey?: string): Promise<RevokeWitnessV5Response>;
     getAccount(): Promise<AccountResponse>;
     getLedger(): Promise<LedgerResponse>;
+    enrollTotp(): Promise<TotpEnrollResponse>;
+    confirmTotp(body: TotpConfirmRequest): Promise<TotpConfirmResponse>;
+    disableTotp(): Promise<TotpDisableResponse>;
+    regenerateRecoveryCodes(): Promise<RecoveryCodesRegenerateResponse>;
     listOauthSessions(): Promise<ListOauthSessionsResponse>;
     revokeOauthSession(jti: string): Promise<void>;
     revokeAllOauthSessions(): Promise<void>;
     healthLive(): Promise<HealthLiveResponse>;
     healthReady(): Promise<HealthReadyResponse>;
+    getContractInfo(contractAddress: string): Promise<ContractInfoResponse>;
+    getContractVerification(contractAddress: string): Promise<VerifyContractResponse>;
+    listWitnessesV5(contractAddress: string, params?: {
+        dataId?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<ListWitnessesResponse>;
+    getWitnessV5(contractAddress: string, witnessId: string): Promise<GetChainWitnessResponse>;
+    getContractTransaction(contractAddress: string, txHash: string): Promise<GetContractTransactionResponse>;
+    getTransaction(txHash: string): Promise<GetTransactionResponse>;
+    getWalletBalance(address: string): Promise<GetWalletBalanceResponse>;
+    getDashboardContract(): Promise<DashboardContractResponse>;
+    getDashboardWitnesses(params?: {
+        from?: number;
+        to?: number;
+        timeLock?: 'locked' | 'none';
+        limit?: number;
+        offset?: number;
+    }): Promise<DashboardWitnessesResponse>;
+    /**
+     * Build the authorization-server URL for the start of an OAuth login flow.
+     *
+     * Generates a fresh PKCE verifier + challenge, stashes the verifier in the
+     * configured {@link PkceVerifierStorage} under the `state` key, and returns
+     * the URL the caller should redirect the user to. Side-effects:
+     *
+     *   - sessionStorage gets a PKCE entry under `witniumchain.pkce.<state>`.
+     *   - The client instance remembers the `redirectUri` for this `state`
+     *     so {@link completeOAuthLogin} can rebuild the matching token request
+     *     without the caller threading the URI through twice.
+     *
+     * The caller is responsible for the redirect itself
+     * (`window.location.assign(result.authorizationUrl)`); the SDK doesn't
+     * touch `window` directly so SSR + non-browser callers are not broken.
+     */
+    beginOAuthLogin(args: BeginOAuthLoginArgs): Promise<BeginOAuthLoginResult>;
+    /**
+     * Exchange an authorization-code callback for an access token.
+     *
+     * Reads `code` and `state` from the callback URL, validates the state
+     * against a stored verifier, exchanges the code at the token endpoint,
+     * and stores the access token (and refresh token) in the client's
+     * in-memory state. Returns the access token + its expiry for callers
+     * who want to display the session or schedule a proactive refresh.
+     *
+     * Throws (without consuming the verifier) when the callback URL is
+     * missing `code` or `state`, or when the state has no matching verifier
+     * — the latter happens when the user opens an old/forged callback URL,
+     * or when sessionStorage was cleared between authorize and callback.
+     *
+     * The caller is responsible for stripping `code` and `state` from the
+     * browser URL afterwards (`window.history.replaceState`) so a refresh
+     * doesn't re-trigger the exchange against an already-consumed code.
+     */
+    completeOAuthLogin(callbackUrl: string | URL): Promise<OAuthTokenSnapshot>;
+    /**
+     * Refresh the access token. Sends `grant_type=refresh_token` to the token
+     * endpoint with the in-memory refresh token, and updates `accessToken`
+     * (and the rotated refresh token) on success.
+     *
+     * Concurrent callers — including the 401-retry interceptor inside `req()`
+     * fanning out N parallel calls — share a single in-flight refresh promise:
+     * refresh tokens rotate on use, so issuing two concurrent refreshes would
+     * race and one would 401 with `invalid_grant`.
+     *
+     * Throws `WitniumchainApiError` if the refresh token is missing (the SDK
+     * was constructed without one and `completeOAuthLogin` was never called)
+     * or if the AS rejects the refresh (token revoked / expired). On rejection
+     * the in-memory tokens are cleared so subsequent BearerJWT calls fail fast
+     * instead of retrying with a now-invalid token.
+     */
+    refreshAccessToken(): Promise<OAuthTokenSnapshot>;
+    /**
+     * End the OAuth session.
+     *
+     * Clears the in-memory access + refresh tokens. Best-effort revocation of
+     * the server-side session would require a server endpoint that accepts a
+     * Bearer-token-authenticated DELETE (today's `/v1/oauth/sessions` requires
+     * the first-party `wac_session` cookie, see oauth-sessions.controller.ts).
+     * That endpoint will arrive with Phase AUTH Thread E; until then,
+     * `signOut` clears local state only and the access token's natural TTL
+     * (currently 60 min) bounds residual risk if the refresh token is also
+     * dropped — which it is, here.
+     */
+    signOut(): void;
+    private verifierStorageOrDefault;
+    private fetchDiscovery;
+    private postTokenEndpoint;
+    private persistTokenResponse;
+    private refreshAccessTokenInternal;
     private req;
-    private buildUrl;
+    /**
+     * Decide whether a non-2xx response on a `BearerJWT` route should trigger
+     * a refresh + single retry. Returns false (no retry) when:
+     *
+     *   - this call IS the retry — never recurse,
+     *   - the auth mode isn't BearerJWT — refresh only helps Bearer tokens,
+     *   - the status isn't 401 — refresh doesn't unstick 403/404/500/etc,
+     *   - we don't have a refresh token in memory — nothing to refresh with,
+     *   - the response body doesn't look like an expired-token signal.
+     *
+     * On a positive answer, the method ALSO performs the refresh in-line:
+     * the caller just gets back `true` and replays the original request,
+     * which picks up the freshly-rotated `accessToken` via `applyAuth`.
+     * Refresh failures are swallowed here (the caller falls through to the
+     * regular error path); `refreshAccessTokenInternal` already cleared the
+     * in-memory tokens so the retry won't have anything to send.
+     */
+    private shouldRefreshAndRetry;
+    /**
+     * Same decision as `shouldRefreshAndRetry` but for the JSON-parsed path,
+     * where we have the body. Adds one extra gate: only retry when the parsed
+     * body looks like a "token expired" signal (`error: 'token_expired'` per
+     * the AUTH plan, or `error: 'invalid_token'` per RFC 6750 §3.1). A 401
+     * with any other `error` label is a real authn/authz failure that refresh
+     * won't fix — surface it instead of burning a refresh token.
+     */
+    private shouldRefreshAndRetryParsed;
+    /**
+     * Resolve which base URL to call. Default is accounts (`baseUrl`). When a
+     * method opts into 'chain', `chainBaseUrl` must be configured — throw at call
+     * time with a clear message rather than fall back silently to accounts (no
+     * defaults: a wrong base URL is a real bug and would mask itself as a 404).
+     */
+    private resolveBaseUrl;
+    private buildPathWithQuery;
     private applyAuth;
     private parseApiError;
     private toApiError;
@@ -5561,8 +9836,8 @@ declare class SigningKeys {
      * WitniumchainClient.getAccount} and returns the `signingKeys` slice.
      */
     list(): Promise<AccountResponse['signingKeys']>;
-    add(body: AddSigningKeyRequest): Promise<AddSigningKeyResponse>;
-    revoke(body: RevokeSigningKeyRequest): Promise<RevokeSigningKeyResponse>;
+    add(body: AddSigningKeyRequest$1): Promise<AddSigningKeyResponse>;
+    revoke(body: RevokeSigningKeyRequest$1): Promise<RevokeSigningKeyResponse>;
 }
 /** `client.oauth.sessions.*` — list and revoke active OAuth sessions. */
 declare class OauthNamespace {
@@ -5576,6 +9851,48 @@ declare class OauthSessions {
     revoke(jti: string): Promise<void>;
     revokeAll(): Promise<void>;
 }
+/**
+ * `client.mfa.*` — TOTP and recovery-code self-management for the
+ * authenticated user. The split into `mfa.totp.*` and `mfa.recoveryCodes.*`
+ * mirrors the server-side controller structure and matches the AUTH plan's
+ * D8 SDK surface (`client.mfa.totp.enroll/confirm/disable` +
+ * `client.mfa.recoveryCodes.regenerate`).
+ */
+declare class MfaNamespace {
+    readonly totp: MfaTotp;
+    readonly recoveryCodes: MfaRecoveryCodes;
+    constructor(client: WitniumchainClient);
+}
+declare class MfaTotp {
+    private readonly client;
+    constructor(client: WitniumchainClient);
+    /**
+     * Start enrolment. Returns the secret + otpauth URL — render the URL as a
+     * QR code in your dashboard (any QR library will do; the SDK doesn't bundle
+     * one). The enrolment is NOT yet a usable second factor: call
+     * {@link confirm} with the first 6-digit code from the authenticator app
+     * to activate it AND receive the recovery codes.
+     */
+    enroll(): Promise<TotpEnrollResponse>;
+    /**
+     * Confirm enrolment with the first user-supplied code. Returns the 10
+     * single-use recovery codes — show them to the user ONCE; the server never
+     * returns them again. Throws `WitniumchainApiError` with status 400 when
+     * the code is invalid or the enrolment is already confirmed.
+     */
+    confirm(code: string): Promise<TotpConfirmResponse>;
+    /** Disable TOTP, wiping both the secret and all recovery codes. */
+    disable(): Promise<TotpDisableResponse>;
+}
+declare class MfaRecoveryCodes {
+    private readonly client;
+    constructor(client: WitniumchainClient);
+    /**
+     * Issue a fresh set of 10 recovery codes, invalidating the prior ones.
+     * Same as `confirm` — codes are returned ONCE and never readable again.
+     */
+    regenerate(): Promise<RecoveryCodesRegenerateResponse>;
+}
 
 interface WitniumchainAdminClientConfig {
     /** Base URL, e.g. `https://auth.witniumchain.com`. Trailing slash optional. */
@@ -5621,6 +9938,66 @@ declare class WitniumchainAdminClient {
     adjustCredits(orgId: string, delta: number, note?: string): Promise<AdjustCreditsResponse>;
 }
 
+type Body<T> = T extends {
+    content: {
+        'application/json': infer J;
+    };
+} ? J : never;
+type Resp<T> = T extends {
+    content: {
+        'application/json': infer J;
+    };
+} ? J : never;
+type DeployContractRequest = Body<NonNullable<paths['/v5/contracts/deploy']['post']['requestBody']>>;
+type DeployContractResponse = Resp<paths['/v5/contracts/deploy']['post']['responses']['200']>;
+type AddSigningKeyRequest = Body<NonNullable<paths['/v5/contracts/{contractAddress}/keys']['post']['requestBody']>>;
+type OwnerOpResponse = Resp<paths['/v5/contracts/{contractAddress}/keys']['post']['responses']['200']>;
+type RevokeSigningKeyRequest = {
+    keyToRevoke: string;
+    ownerNonce: number;
+    ownerSignature: string;
+};
+type PauseRequest = {
+    ownerNonce: number;
+    ownerSignature: string;
+};
+interface WitniumchainChainAdminClientConfig {
+    /** chain-api base URL, e.g. https://api.witniumchain.com. Trailing slash optional. */
+    baseUrl: string;
+    /**
+     * Static bearer token (legacy `BEARER_TOKEN`). Mutually exclusive with
+     * `adminTokenProvider`. Phase RBAC checkpoint 3 retires this in favour of
+     * the provider.
+     */
+    adminToken?: string;
+    /**
+     * Async function that yields a fresh accounts-minted service-principal JWT
+     * with `aud=https://api.witniumchain.com/admin` + `role=org-admin` on each
+     * call. Implementations typically cache against the token's `exp`. Returned
+     * tokens MUST satisfy chain-api's DashboardJwtGuard.
+     */
+    adminTokenProvider?: () => Promise<string>;
+    /** Per-request timeout in milliseconds. Default 30000. */
+    timeout?: number;
+    /** Alternate fetch implementation, e.g. for tests. Default globalThis.fetch. */
+    fetch?: typeof fetch;
+}
+declare class WitniumchainChainAdminClient {
+    private readonly baseUrl;
+    private readonly adminToken;
+    private readonly adminTokenProvider;
+    private readonly timeout;
+    private readonly fetchImpl;
+    constructor(config: WitniumchainChainAdminClientConfig);
+    deployContract(body: DeployContractRequest): Promise<DeployContractResponse>;
+    addSigningKey(contractAddress: string, body: AddSigningKeyRequest): Promise<OwnerOpResponse>;
+    revokeSigningKey(contractAddress: string, body: RevokeSigningKeyRequest): Promise<OwnerOpResponse>;
+    pauseContract(contractAddress: string, body: PauseRequest): Promise<OwnerOpResponse>;
+    unpauseContract(contractAddress: string, body: PauseRequest): Promise<OwnerOpResponse>;
+    private resolveToken;
+    private req;
+}
+
 /**
  * WitniumchainOrgClient — org-admin facade over the accounts API.
  *
@@ -5693,4 +10070,4 @@ declare class WitniumchainApiError extends Error {
     });
 }
 
-export { type AccountResponse, type AccountType, type AddSigningKeyRequest, type AddSigningKeyResponse, type AdjustCreditsRequest, type AdjustCreditsResponse, type CheckoutRequest, type CheckoutResponse, type CreateOrganizationRequest, type CreateOrganizationResponse, type CreateUserRequest, type CreateUserResponse, DelegatedKeys, type FinalizeWitnessResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GetWitnessResponse, type HealthLiveResponse, type HealthReadyResponse, type LedgerResponse, type ListDelegatedKeysResponse, type ListOauthSessionsResponse, type ListUsersResponse, type LoginRequest, type LoginResponse, type LogoutResponse, OauthNamespace, OauthSessions, OrgUsers, type OwnerSigner, type PauseRequest, type PauseResponse, type PortalResponse, type PrepareDelegatedKeyRequest, type PreparedDelegatedKeyResponse, type ProposeWitnessRequest, type ProposeWitnessResponse, type ProvisionContractRequest, type ProvisionContractResponse, type ProvisionDelegatedKeyArgs, type ProvisionDelegatedKeyResult, type PublicOrgResponse, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDelegatedKeyResponse, type RevokeSigningKeyRequest, type RevokeSigningKeyResponse, type RevokeWitnessRequest, type RevokeWitnessResponse, type RotateApiKeyResponse, type SetAccountTypeRequest, type SetAccountTypeResponse, type SignRequest, type SignResponse, type SignWitnessRequest, type SignWitnessResponse, type SignedRequestSigner, SigningKeys, type SignupRequest, type SignupResponse, type SubmitDelegatedKeyRequest, type SubmitDelegatedKeyResponse, Subscriptions, type UnpauseRequest, type UnpauseResponse, type VerifyEmailResponse, type VerifyOrganizationResponse, WitniumchainAdminClient, type WitniumchainAdminClientConfig, WitniumchainApiError, WitniumchainClient, type WitniumchainClientConfig, WitniumchainOrgClient, type WitniumchainOrgClientConfig, type paths };
+export { type AccountResponse, type AccountType, type paths$1 as AccountsPaths, type AddSigningKeyRequest$1 as AddSigningKeyRequest, type AddSigningKeyResponse, type AdjustCreditsRequest, type AdjustCreditsResponse, type BeginOAuthLoginArgs, type BeginOAuthLoginResult, type paths as ChainPaths, type CheckoutRequest, type CheckoutResponse, type CreateOrgRequest, type CreateOrgResponse, type CreateOrganizationRequest, type CreateOrganizationResponse, type CreateUserRequest, type CreateUserResponse, DelegatedKeys, type FinalizeWitnessResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GetWitnessResponse, type HealthLiveResponse, type HealthReadyResponse, type LedgerResponse, type ListDelegatedKeysResponse, type ListOauthSessionsResponse, type ListUsersResponse, type LoginRequest, type LoginResponse, type LogoutResponse, MfaNamespace, MfaRecoveryCodes, MfaTotp, type OAuthTokenSnapshot, OauthNamespace, OauthSessions, OrgUsers, type OwnerSigner, type PauseRequest$1 as PauseRequest, type PauseResponse, type PkceVerifierStorage, type PortalResponse, type PrepareDelegatedKeyRequest, type PreparedDelegatedKeyResponse, type ProposeWitnessRequest, type ProposeWitnessResponse, type ProvisionContractRequest, type ProvisionContractResponse, type ProvisionDelegatedKeyArgs, type ProvisionDelegatedKeyResult, type PublicOrgResponse, type RecoveryCodesRegenerateResponse, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDelegatedKeyResponse, type RevokeSigningKeyRequest$1 as RevokeSigningKeyRequest, type RevokeSigningKeyResponse, type RevokeWitnessRequest, type RevokeWitnessResponse, type RotateApiKeyResponse, type SetAccountTypeRequest, type SetAccountTypeResponse, type SignRequest, type SignResponse, type SignWitnessRequest, type SignWitnessResponse, type SignedRequestSigner, SigningKeys, type SignupRequest, type SignupResponse, type SubmitDelegatedKeyRequest, type SubmitDelegatedKeyResponse, Subscriptions, type TotpConfirmRequest, type TotpConfirmResponse, type TotpDisableResponse, type TotpEnrollResponse, type UnpauseRequest, type UnpauseResponse, type VerifyEmailResponse, type VerifyOrganizationResponse, WitniumchainAdminClient, type WitniumchainAdminClientConfig, WitniumchainApiError, WitniumchainChainAdminClient, type WitniumchainChainAdminClientConfig, WitniumchainClient, type WitniumchainClientConfig, WitniumchainOrgClient, type WitniumchainOrgClientConfig, defaultVerifierStorage };