@reclaimprotocol/agent 0.1.42 → 0.1.43

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.42",
+	"version": "0.1.43",
 	"description": "Reclaim Protocol tools for AI coding agents. Reclaim lets your app verify data points about its users, such as a follower count, an account balance, or an order history. This package is the Reclaim MCP server: it gives your agent the tools to find, build, test, and fix data verification providers by capturing and replaying browser requests, drafting provider recipes, running zkTLS proofs, and publishing provider versions.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -84,7 +84,7 @@
 		"@noble/hashes": "^2.2.0",
 		"@puppeteer/browsers": "3.2.4",
 		"@reclaimprotocol/attestor-core": "^5.1.6",
-		"@reclaimprotocol/client": "0.1.42",
+		"@reclaimprotocol/client": "0.1.43",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",

package/skill/SKILL.builder.md

@@ -444,7 +444,14 @@ one, or doesn't know what a site supports. Otherwise build a new provider.
    question; don't guess.
 5. To try them: `create_verification_session({ providers: [{ providerId }, …],
    context, verificationClientUrl })` with EVERY resolved provider id and the
-   collected context. Topic `integration` ("Try a provider without an app")
+   collected context. A session opens only in the client it was created for:
+   for an in-app SDK or add-to-app host, pass
+   `https://build.reclaimprotocol.org/share/inapp-sdk`; omitted, it is a
+   Portal session. For a native app, read the README of the
+   [iOS SDK](https://github.com/reclaimprotocol/reclaim-inapp-ios-sdk#readme)
+   or the
+   [Android SDK](https://github.com/reclaimprotocol/reclaim-inapp-android-sdk#readme)
+   before writing app code. Topic `integration` ("Try a provider without an app")
    covers the callback and polling, and the integration steps.
 
 `merge.mergeable` only signals the set *could* collapse into one provider. Pass

package/skill/verification-client-integration.md

@@ -98,6 +98,18 @@ legacy devtools mode), or migrate to the Builder HTTP API?"
    from `VerificationClient` in the SDK. Do not send an unregistered URL or
    call a legacy backend for an `api=2` session.
 
+   A session only works in the client it was created for: Builder fixes the
+   client at creation, and any other client gets
+   `403 x-reclaim-vc-id does not match this session`. For a mobile app using
+   the in-app SDK or the add-to-app module, create every session with
+   `verificationClientUrl` set to
+   `https://build.reclaimprotocol.org/share/inapp-sdk`
+   (`VerificationClient.inAppSdk`); the default Portal link won't open there.
+   For native iOS or Android apps, follow the
+   [iOS SDK README](https://github.com/reclaimprotocol/reclaim-inapp-ios-sdk#readme)
+   or the
+   [Android SDK README](https://github.com/reclaimprotocol/reclaim-inapp-android-sdk#readme).
+
    The hosted verification page streams the target site as an image, so text
    and DOM checks of that page come back empty. Check a session's progress
    with `list_verification_events` and `get_verification_session` instead.
@@ -164,6 +176,60 @@ curl -X POST https://build.reclaimprotocol.org/verifications/sessions \
   }'
 ```
 
+For an in-app SDK or add-to-app host, add the in-app SDK's client URL and pass
+the returned `verificationUrl` to the app's `startVerificationFromUrl`:
+
+```bash
+curl -X POST https://build.reclaimprotocol.org/verifications/sessions \
+  -H "authorization: Bearer $RECLAIM_ORG_SECRET" \
+  -H "content-type: application/json" \
+  -d '{
+    "providers": [
+      {
+        "providerId": "<your-provider-id>"
+      }
+    ],
+    "context": {
+      "userId": "abc"
+    },
+    "verificationClientUrl": "https://build.reclaimprotocol.org/share/inapp-sdk"
+  }'
+```
+
+With `@reclaimprotocol/client`:
+
+```js
+import { ReclaimVerification, VerificationClient } from '@reclaimprotocol/client'
+
+const reclaim = ReclaimVerification.create({
+  orgSecret: process.env.RECLAIM_ORG_SECRET,
+})
+
+const session = await reclaim.sessions.create({
+  providers: [{ providerId: '<your-provider-id>' }],
+  context: { userId: 'abc' },
+  // Required for the in-app SDK and add-to-app module. Omitted, Builder
+  // selects the Portal, and the app's requests get 403.
+  verificationClientUrl: VerificationClient.inAppSdk,
+})
+// Store session.id; hand session.verificationUrl to the app.
+```
+
+The app opens it with `startVerificationFromUrl(verificationUrl)`. If the
+backend returns fields instead of a link, it calls
+`startVerificationFromJson({ "api": "2", "sessionId": session.id })` with the
+same result. Add `"diag": "1"` only when `verificationUrl` contains `diag=1`;
+other keys are ignored.
+
+For a native app, read the SDK's README before writing app code. Each README
+has a Builder mode section covering installation, starting from a URL or
+JSON, and handling the result:
+
+- iOS (Swift):
+  [reclaim-inapp-ios-sdk](https://github.com/reclaimprotocol/reclaim-inapp-ios-sdk#readme)
+- Android (Kotlin/Java):
+  [reclaim-inapp-android-sdk](https://github.com/reclaimprotocol/reclaim-inapp-android-sdk#readme)
+
 Receive and verify the result on the callback route. This is the one place the
 client package is needed: