@reclaimprotocol/agent 0.1.42 → 0.1.44

package/lib/mcp/api/operations.gen.d.ts

@@ -62,6 +62,14 @@ export declare const MCP_TOOLS: {
             openWorldHint: boolean;
         };
     };
+    CreateAiVerificationSession: {
+        description: string;
+        inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
+        orgTokenOnly: boolean;
+        annotations: {
+            openWorldHint: boolean;
+        };
+    };
     CreateCallbackSubscription: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
@@ -182,6 +190,15 @@ export declare const MCP_TOOLS: {
             openWorldHint: boolean;
         };
     };
+    GetAiVerificationSession: {
+        description: string;
+        inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
+        orgTokenOnly: boolean;
+        annotations: {
+            readOnlyHint: boolean;
+            openWorldHint: boolean;
+        };
+    };
     GetMe: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;

package/lib/mcp/api/operations.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:c3421d6bcf76).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:cbe3daf2a1f3).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -119,6 +119,7 @@ export const MCP_TOOLS = {
                                 "revenue",
                                 "usage",
                                 "goals",
+                                "ai-session-prompts",
                                 "tools",
                                 "agents",
                                 "funnel"
@@ -485,6 +486,113 @@ export const MCP_TOOLS = {
         }),
         annotations: { "openWorldHint": false },
     },
+    "CreateAiVerificationSession": {
+        description: "Start an AI verification session from a prompt\n\nStarts an AI verification session from a plain-language prompt and optional dataPoints/loginUrls; returns the session with verificationUrl to share with the user. Needs the org token and at least one callback subscription (409 otherwise). No provider or org keypair needed: Builder manages the AI app key. Poll with get_ai_verification_session or wait_for_ai_session.",
+        inputSchema: toZod({
+            "type": "object",
+            "properties": {
+                "params": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "query": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "body": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "description": "Body for `POST /verifications/ai-sessions`. Send a `prompt`, at least one entry in `dataPoints`, or both.",
+                    "properties": {
+                        "prompt": {
+                            "type": "string",
+                            "minLength": 0,
+                            "maxLength": 10000,
+                            "description": "What to verify, in plain language, such as \"verify I'm a student at Manipal University\". Required unless `dataPoints` has at least one item. Builder rejects a prompt that contains credentials, card numbers, instructions for the AI, or a sensitive claim. The prompt and the data point lines together can't exceed 10,000 characters."
+                        },
+                        "dataPoints": {
+                            "type": "array",
+                            "maxItems": 32,
+                            "description": "The values to verify. Required unless you send a `prompt`. Names must be unique, and at least one data point must be required (its `isOptional` is `false` or absent). When you send data points, Builder keeps them and adds only optional data points that the prompt implies. When you send none, Builder chooses the data points from the prompt. Every required data point must appear in the verified proofs. If one is missing, the session ends as `rejected` with `reasonCode` `missing-data-points`.",
+                            "items": {
+                                "type": "object",
+                                "additionalProperties": false,
+                                "required": [
+                                    "name",
+                                    "description"
+                                ],
+                                "properties": {
+                                    "name": {
+                                        "type": "string",
+                                        "maxLength": 64,
+                                        "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,63}$",
+                                        "description": "Name of the value, such as `username`. Starts with a letter or underscore, followed by up to 63 letters, digits, or underscores."
+                                    },
+                                    "description": {
+                                        "type": "string",
+                                        "minLength": 1,
+                                        "maxLength": 300,
+                                        "description": "What the value is and why it proves the claim."
+                                    },
+                                    "isOptional": {
+                                        "type": "boolean",
+                                        "description": "Defaults to `false`. If `true`, the claim can be proven without this value, and the proofs can omit it. If `false` or absent, the data point is required, and a session whose proofs omit it ends as `rejected` with `reasonCode` `missing-data-points`."
+                                    }
+                                }
+                            }
+                        },
+                        "loginUrls": {
+                            "type": "array",
+                            "maxItems": 10,
+                            "description": "Pages where the user signs in, such as `https://portal.example.edu/login`. Builder shows them first as candidates with source `caller`, and skips the web search. Each URL must use `http` or `https`, can't contain credentials, and must resolve to a public host.",
+                            "items": {
+                                "type": "string",
+                                "format": "uri",
+                                "maxLength": 2048
+                            }
+                        },
+                        "isEmailVerificationAllowed": {
+                            "type": "boolean",
+                            "description": "Defaults to `false`. If `true`, the share page offers the user a choice to verify using email instead of signing in. If you omit it, the page doesn't offer that choice."
+                        },
+                        "context": {
+                            "type": "object",
+                            "maxProperties": 50,
+                            "additionalProperties": true,
+                            "description": "Values you already know, such as `{\"fullName\": \"Asha Rao\"}`. Builder merges them over the values the prompt states and returns the result in `context`. Must not contain `attestationNonce` or `attestationNonceData`; bind those after you create the session. Also must not contain `reclaimSessionId`, `extractedParameters`, or `builderSessionId`. Omit if you have none."
+                        },
+                        "verificationClientUrl": {
+                            "type": "string",
+                            "description": "Base URL of the registered verification client the user verifies with, as for `POST /verifications/sessions`. Builder charges this client's quota pool. If you omit it, Builder uses the default (`portals`) client.",
+                            "maxLength": 2000,
+                            "pattern": "^https?://"
+                        },
+                        "geoLocation": {
+                            "type": "string",
+                            "description": "ISO 3166-1 alpha-2 country code, such as `IN`. Builder searches the web from this country (Google's `gl` parameter), so portals for that country rank first. If you omit it, the search has no country preference.",
+                            "minLength": 2,
+                            "maxLength": 2,
+                            "pattern": "^[A-Za-z]{2}$"
+                        }
+                    }
+                },
+                "orgToken": {
+                    "type": "string",
+                    "pattern": "^rorg_",
+                    "maxLength": 200,
+                    "description": "The organization API key (`rorg_…`) this call authenticates with: from `issue_org_token`, or the app's RECLAIM_ORG_SECRET. Defaults to the MCP server's RECLAIM_ORG_SECRET. Never echo it back to the user."
+                }
+            },
+            "required": [
+                "params",
+                "query",
+                "body"
+            ],
+            "additionalProperties": false
+        }),
+        orgTokenOnly: true,
+        annotations: { "openWorldHint": false },
+    },
     "CreateCallbackSubscription": {
         description: "Register a callback subscription\n\nRegisters a destination for verification results on the organization\nthe presented `OrgToken` resolves to. At least one subscription must\nexist for the org before you can create a verification session.\nDelivery is scoped by org: terminal results are ECIES-encrypted to the\norg's eth public key when its `canEncryptResult` is enabled (see\n`PUT /orgs/{orgId}/keypair`), else delivered as plaintext.\n\nTo receive results at a URL, send `callbackUrl` and `events`. Builder\nPOSTs each delivery to that URL.\n\nTo read results without a public URL during local development, send\n`deliveryMode: \"pull\"`. Builder keeps the deliveries and you read them\nwith `GET /verifications/callback-events`. A pull subscription is a\n90-second lease: it receives events and satisfies the session-creation\ncheck only while the lease is unexpired. Send the same request about\nevery 30 seconds to renew it, and call\n`POST /verifications/callback-listener/release` when you stop. Production\nneeds a webhook subscription. An org has at most one pull subscription.\nIf it already exists, Builder renews it and returns it with status 200.\nIf the body includes `events`, they replace the subscription's events;\nif it omits them, the existing events are kept.\n",
         inputSchema: toZod({
@@ -5274,6 +5382,48 @@ export const MCP_TOOLS = {
         }),
         annotations: { "readOnlyHint": true, "openWorldHint": false },
     },
+    "GetAiVerificationSession": {
+        description: "Get what an AI verification session's prompt resolved to\n\nGets what the AI session's lookup found: status resolving|ready|started|failed, candidates (login pages), merged dataPoints, error. Use get_verification_session for the overall outcome.",
+        inputSchema: toZod({
+            "type": "object",
+            "properties": {
+                "params": {
+                    "type": "object",
+                    "properties": {
+                        "sessionId": {
+                            "type": "string",
+                            "format": "uuid",
+                            "description": "Verification session id (UUID v7 when supported). Also echoed in the result payload as `reclaimSessionId`."
+                        }
+                    },
+                    "required": [
+                        "sessionId"
+                    ],
+                    "additionalProperties": false
+                },
+                "query": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "body": {
+                    "type": "object"
+                },
+                "orgToken": {
+                    "type": "string",
+                    "pattern": "^rorg_",
+                    "maxLength": 200,
+                    "description": "The organization API key (`rorg_…`) this call authenticates with: from `issue_org_token`, or the app's RECLAIM_ORG_SECRET. Defaults to the MCP server's RECLAIM_ORG_SECRET. Never echo it back to the user."
+                }
+            },
+            "required": [
+                "params",
+                "query"
+            ],
+            "additionalProperties": false
+        }),
+        orgTokenOnly: true,
+        annotations: { "readOnlyHint": true, "openWorldHint": false },
+    },
     "GetMe": {
         description: "Get the authenticated user\n\nGets the authenticated caller's own profile: id, email, and name. Requires a signed-in user session, not an OrgToken. Use it to confirm who the current credentials belong to.",
         inputSchema: toZod({

package/lib/mcp/instructions.js

@@ -39,6 +39,7 @@ const SHARED_TOPIC_FILES = {
 /** Detailed topics that exist only in Builder mode. */
 const BUILDER_TOPIC_FILES = {
     'contributions': 'community-contributions.md',
+    'ai-sessions': 'ai-sessions.md',
     'integration': 'verification-client-integration.md',
 };
 /** One line per topic, shown in the `how_it_works` index so a caller can pick
@@ -67,6 +68,9 @@ const TOPIC_SUMMARIES = {
         + 'providers, and going live.',
     'discover': 'Reusing existing providers: finding, resolving, copying one '
         + 'that needs changes, and creating a verification session.',
+    'ai-sessions': 'The first route for a backend integration: prove a claim '
+        + 'about a user\'s account with create_ai_verification_session, no '
+        + 'provider or capture. Setup, backend code, and when to fall back.',
     'integration': 'After start_integration: org key and keypair, callback '
         + '(local proxy_callback_events or deployed webhook), frontend and '
         + 'backend over the HTTP session API, js-sdk projects, trying a '

package/lib/mcp/tools/agent/publish.js

@@ -278,7 +278,14 @@ export function createVersionFromCaptureTool(client, attachRef, kept) {
                         },
                         interceptorSettings: {
                             type: 'string',
-                            description: 'Free-form JSON config for the chosen interceptor.',
+                            description: 'Free-form JSON config for the chosen interceptor, '
+                                + 'as a JSON object string. For HAWKEYE in the '
+                                + 'in-app SDK: {"interceptionMethod": PROXY | '
+                                + 'GETTER_SETTER | DIRECT_REPLACEMENT}, plus '
+                                + 'optional disableFormIntercept and '
+                                + 'delayFormSubmitForFetch. Try GETTER_SETTER when '
+                                + 'the in-app page stalls but Portals works; see '
+                                + 'topic interception.',
                         },
                         isDocumentRequestReplayEnabled: {
                             type: 'boolean',

package/lib/mcp/tools/agent/start-integration.d.ts

@@ -5,6 +5,7 @@ interface StartIntegrationArgs {
     userRequest?: string;
     orgId?: string;
     providerIds?: string[];
+    route?: 'ai-session' | 'provider';
 }
 /**
  * Returns the plan a coding agent follows to add Reclaim verification to the

package/lib/mcp/tools/agent/start-integration.js

@@ -11,7 +11,10 @@ export function startIntegrationTool() {
     return defineTool({
         name: 'start_integration',
         description: 'Returns a step-by-step plan for adding Reclaim verification to the '
-            + 'current codebase: sign in to Builder, attach the browser, capture, '
+            + 'current codebase. Recommends Builder AI sessions first: no '
+            + 'provider to build, just a prompt and data points. Use route '
+            + '"provider" to fall back to provider authoring, which is what '
+            + 'this describes: sign in to Builder, attach the browser, capture, '
             + 'and prove the provider first, then set up the app (session route, '
             + 'callback, Verify button, local event proxy) after the proof or '
             + 'while waiting on the developer, bootstrapping from the '
@@ -46,7 +49,15 @@ export function startIntegrationTool() {
                     type: 'array',
                     maxItems: 10,
                     items: { type: 'string' },
-                    description: 'Existing provider IDs to use. Omit to build a new provider.',
+                    description: 'Existing provider IDs to use. Implies route "provider".',
+                },
+                route: {
+                    type: 'string',
+                    enum: ['ai-session', 'provider'],
+                    description: '"ai-session" (default when providerIds is empty) plans a '
+                        + 'Builder AI session. "provider" (default with providerIds) '
+                        + 'plans provider authoring; use it as the fallback when an '
+                        + 'AI session cannot prove the claim.',
                 },
             },
         },
@@ -63,7 +74,13 @@ export function renderStartIntegration(args) {
         orgId: args.orgId,
         providerIds,
     };
-    const template = readFileSync(fileURLToPath(new URL('../../../../skill/start-integration.md', import.meta.url)), 'utf8');
+    // An explicit route wins, so 'ai-session' ignores providerIds.
+    const route = args.route
+        ?? (providerIds ? 'provider' : 'ai-session');
+    const file = route === 'ai-session'
+        ? 'start-ai-session-integration.md'
+        : 'start-integration.md';
+    const template = readFileSync(fileURLToPath(new URL(`../../../../skill/${file}`, import.meta.url)), 'utf8');
     return template
         // Keep a conditional block only when its input was given (or not given).
         .replace(/<!-- (if|ifnot):(\w+) -->\n([\s\S]*?)<!-- endif -->\n/g, (_, kind, name, body) => {

package/lib/mcp/tools/verification/build.js

@@ -1,6 +1,7 @@
 import { proxyCallbackEventsTool } from "./proxy-callback-events.js";
 import { readCallbackEventsTool } from "./read-callback-events.js";
 import { verificationResultTool } from "./result.js";
+import { waitForAiSessionTool } from "./wait-for-ai-session.js";
 /**
  * Builder-mode verification tools: higher-level orchestrations over the
  * generated API surface. `get_verification_result` authenticates with the org
@@ -18,5 +19,6 @@ export function buildVerificationTools() {
         verificationResultTool(),
         readCallbackEventsTool(),
         proxyCallbackEventsTool(),
+        waitForAiSessionTool(),
     ];
 }

package/lib/mcp/tools/verification/wait-for-ai-session.d.ts

@@ -0,0 +1,46 @@
+import { type RegisteredTool } from '../../server.ts';
+type LookupStatus = 'resolving' | 'ready' | 'started' | 'failed';
+type Lookup = {
+    status: LookupStatus;
+    error?: {
+        title?: string;
+        status?: number;
+        detail?: string;
+    };
+    dataPoints?: {
+        name: string;
+        isOptional: boolean;
+    }[];
+    candidates?: {
+        loginUrl: string;
+        source: string;
+        confidence: number;
+    }[];
+};
+type SessionState = {
+    status: string;
+    callbackDeliveryStatus?: string;
+    verificationUrl?: string;
+};
+type SessionEvent = {
+    event: string;
+    eventData?: Record<string, unknown>;
+};
+/** The three reads the tool needs. Injectable for tests. */
+export type AiSessionApi = {
+    getLookup(sessionId: string): Promise<Lookup>;
+    getSession(sessionId: string): Promise<SessionState>;
+    listEvents(sessionId: string): Promise<SessionEvent[]>;
+};
+type Deps = {
+    createApi?: (orgToken?: string) => AiSessionApi;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+};
+/**
+ * `wait_for_ai_session` — polls an AI verification session (lookup, session
+ * status, and recent events) until something notable happens, and returns a
+ * compact, value-free summary with a `next` step and a fallback verdict.
+ */
+export declare function waitForAiSessionTool(deps?: Deps): RegisteredTool;
+export {};

package/lib/mcp/tools/verification/wait-for-ai-session.js

@@ -0,0 +1,228 @@
+import { isProblemError, ReclaimClient } from '@reclaimprotocol/client/api';
+import { apiUrl } from "../../../consts.js";
+import { defineTool } from "../../server.js";
+import { resolveOrgSecret } from "./result.js";
+const POLL_MS = 2000;
+const DEFAULT_TIMEOUT_S = 120;
+const MAX_TIMEOUT_S = 600;
+const MAX_EVENTS = 5;
+const FALLBACK_HINT = 'Retry once with adjusted `dataPoints` or `loginUrls`. '
+    + 'If that fails too, fall back to the provider route: call '
+    + '`start_integration` with `route: \'provider\'`.';
+/**
+ * `wait_for_ai_session` — polls an AI verification session (lookup, session
+ * status, and recent events) until something notable happens, and returns a
+ * compact, value-free summary with a `next` step and a fallback verdict.
+ */
+export function waitForAiSessionTool(deps = {}) {
+    const createApi = deps.createApi ?? defaultApi;
+    const sleep = deps.sleep ?? defaultSleep;
+    const now = deps.now ?? Date.now;
+    return defineTool({
+        name: 'wait_for_ai_session',
+        description: 'Waits for an AI verification session and returns a summary. '
+            + 'Polls every 2 seconds until the lookup is ready or failed, or '
+            + 'the session ends, or the timeout passes. Set `untilTerminal` to '
+            + 'keep waiting until the session ends, for example after you share '
+            + 'the verification URL. The result has the lookup state, the session '
+            + 'status, recent event types, and `next`: `share_url`, '
+            + '`waiting_for_user`, `waiting_for_lookup`, `done`, or `none`. '
+            + 'When `fallback.recommended` is true, follow its `reason`. '
+            + 'Authenticates with the org API key: `orgToken`, else '
+            + '`RECLAIM_ORG_SECRET`, else the key saved by `issue_org_token`.',
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId'],
+            properties: {
+                sessionId: {
+                    type: 'string',
+                    description: 'The session ID from `create_ai_verification_session`.',
+                },
+                timeoutSeconds: {
+                    type: 'integer',
+                    minimum: 1,
+                    maximum: MAX_TIMEOUT_S,
+                    description: `How long to wait. Default ${DEFAULT_TIMEOUT_S}, `
+                        + `maximum ${MAX_TIMEOUT_S}.`,
+                },
+                untilTerminal: {
+                    type: 'boolean',
+                    description: 'If true, return only when the session ends or '
+                        + 'the lookup fails, not when the lookup is ready.',
+                },
+                orgToken: {
+                    type: 'string',
+                    pattern: '^rorg_',
+                    maxLength: 200,
+                    description: 'The organization API key (`rorg_…`). Defaults to '
+                        + 'the MCP server\'s RECLAIM_ORG_SECRET, then the key saved by '
+                        + '`issue_org_token`. Never echo it back to the user.',
+                },
+            },
+        },
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async (args) => {
+        const api = createApi(args.orgToken);
+        const timeoutS = Math.min(Math.max(args.timeoutSeconds ?? DEFAULT_TIMEOUT_S, 1), MAX_TIMEOUT_S);
+        const deadline = now() + timeoutS * 1000;
+        let lookup = { status: 'resolving' };
+        let session = { status: 'pending' };
+        while (true) {
+            lookup = await tolerate(() => api.getLookup(args.sessionId), lookup);
+            session = await tolerate(() => api.getSession(args.sessionId), session);
+            const terminal = session.status !== 'pending';
+            const failed = lookup.status === 'failed';
+            const notable = !args.untilTerminal && lookup.status !== 'resolving';
+            const timedOut = now() >= deadline;
+            if (terminal || failed || notable || timedOut) {
+                const events = await tolerate(() => api.listEvents(args.sessionId), []);
+                const settled = terminal || failed || notable;
+                return summarize(lookup, session, events, timedOut && !settled);
+            }
+            await sleep(POLL_MS);
+        }
+    });
+}
+function summarize(lookup, session, events, timedOut) {
+    const recent = events.slice(-MAX_EVENTS).map((item) => {
+        const reasonCode = reasonCodeOf(item.eventData);
+        return reasonCode
+            ? { event: item.event, reasonCode }
+            : { event: item.event };
+    });
+    const reasonCodes = recent.flatMap((item) => ('reasonCode' in item ? [item.reasonCode] : []));
+    let next;
+    let fallbackReason;
+    if (lookup.status === 'failed') {
+        const status = lookup.error?.status;
+        const why = status === 404
+            ? 'No login page was found.'
+            : status === 422
+                ? 'The prompt is not a request Reclaim can verify.'
+                : status === 503
+                    ? 'The AI model or web search stayed unavailable.'
+                    : 'The lookup failed.';
+        next = 'none';
+        fallbackReason = `${why} ${FALLBACK_HINT}`;
+    }
+    else if (session.status === 'success') {
+        next = 'done';
+    }
+    else if (session.status === 'pending') {
+        next = lookup.status === 'ready'
+            ? 'share_url'
+            : lookup.status === 'started'
+                ? 'waiting_for_user'
+                : 'waiting_for_lookup';
+    }
+    else {
+        next = 'none';
+        if (session.status === 'rejected') {
+            const code = reasonCodes.at(-1);
+            fallbackReason = `The session was rejected${code ? ` (${code})` : ''}. `
+                + FALLBACK_HINT;
+        }
+        else if (session.status === 'error' || session.status === 'expired') {
+            fallbackReason = `The session ended with status ${session.status}. `
+                + FALLBACK_HINT;
+        }
+    }
+    return {
+        lookup: {
+            status: lookup.status,
+            ...(lookup.candidates && {
+                candidates: lookup.candidates.map((item) => ({
+                    loginUrl: item.loginUrl,
+                    source: item.source,
+                    confidence: item.confidence,
+                })),
+            }),
+            ...(lookup.dataPoints && {
+                dataPoints: lookup.dataPoints.map((item) => ({
+                    name: item.name,
+                    isOptional: item.isOptional,
+                })),
+            }),
+            ...(lookup.error && {
+                error: {
+                    title: lookup.error.title,
+                    status: lookup.error.status,
+                    detail: lookup.error.detail,
+                },
+            }),
+        },
+        session: {
+            status: session.status,
+            callbackDeliveryStatus: session.callbackDeliveryStatus,
+            events: recent,
+        },
+        next,
+        ...(next === 'share_url' && session.verificationUrl
+            ? { verificationUrl: session.verificationUrl }
+            : {}),
+        ...(fallbackReason
+            ? { fallback: { recommended: true, reason: fallbackReason } }
+            : {}),
+        ...(timedOut ? { timedOut: true } : {}),
+    };
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function reasonCodeOf(data) {
+    const direct = data?.reasonCode;
+    if (typeof direct === 'string') {
+        return direct;
+    }
+    const problem = data?.problem;
+    if (problem && typeof problem === 'object' && 'reasonCode' in problem) {
+        return typeof problem.reasonCode === 'string'
+            ? problem.reasonCode
+            : undefined;
+    }
+    return undefined;
+}
+/** Keeps the last good value across transient errors (network, 5xx, 429). */
+async function tolerate(read, previous) {
+    try {
+        return await read();
+    }
+    catch (err) {
+        if (err instanceof TypeError) {
+            return previous;
+        }
+        if (isProblemError(err)) {
+            const code = err.output.statusCode;
+            if (code >= 500 || code === 429) {
+                return previous;
+            }
+        }
+        throw err;
+    }
+}
+function defaultApi(orgToken) {
+    const client = new ReclaimClient({
+        baseUrl: apiUrl(),
+        token: resolveOrgSecret(orgToken),
+    });
+    return {
+        async getLookup(sessionId) {
+            const res = await client.call('GetAiVerificationSession', {
+                params: { sessionId },
+            });
+            return res.data;
+        },
+        async getSession(sessionId) {
+            const res = await client.call('GetVerificationSession', {
+                params: { sessionId },
+            });
+            return res.data;
+        },
+        async listEvents(sessionId) {
+            const res = await client.call('ListVerificationEvents', {
+                params: { sessionId },
+            });
+            return res.data.items;
+        },
+    };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.42",
+	"version": "0.1.44",
 	"description": "Reclaim Protocol tools for AI coding agents. Reclaim lets your app verify data points about its users, such as a follower count, an account balance, or an order history. This package is the Reclaim MCP server: it gives your agent the tools to find, build, test, and fix data verification providers by capturing and replaying browser requests, drafting provider recipes, running zkTLS proofs, and publishing provider versions.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -84,7 +84,7 @@
 		"@noble/hashes": "^2.2.0",
 		"@puppeteer/browsers": "3.2.4",
 		"@reclaimprotocol/attestor-core": "^5.1.6",
-		"@reclaimprotocol/client": "0.1.42",
+		"@reclaimprotocol/client": "0.1.44",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",

package/skill/SKILL.builder.md

@@ -444,12 +444,21 @@ one, or doesn't know what a site supports. Otherwise build a new provider.
    question; don't guess.
 5. To try them: `create_verification_session({ providers: [{ providerId }, …],
    context, verificationClientUrl })` with EVERY resolved provider id and the
-   collected context. Topic `integration` ("Try a provider without an app")
+   collected context. A session opens only in the client it was created for:
+   for an in-app SDK or add-to-app host, pass
+   `https://build.reclaimprotocol.org/share/inapp-sdk`; omitted, it is a
+   Portal session. For a native app, read the README of the
+   [iOS SDK](https://github.com/reclaimprotocol/reclaim-inapp-ios-sdk#readme)
+   or the
+   [Android SDK](https://github.com/reclaimprotocol/reclaim-inapp-android-sdk#readme)
+   before writing app code. Topic `integration` ("Try a provider without an app")
    covers the callback and polling, and the integration steps.
 
 `merge.mergeable` only signals the set *could* collapse into one provider. Pass
 them all; the Builder runs them in one session.
 
+<!-- topic: ai-sessions -->
+
 <!-- topic: integration -->
 
 <!-- topic: never-do -->