@reclaimprotocol/client 0.1.0-dev.1

package/lib/types/openapi.gen.d.ts

@@ -0,0 +1,3989 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+export interface paths {
+    "/components_demo": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get demo components
+         * @description Retrieve a list of demo components for testing purposes. Only available in development environment.
+         */
+        get: operations["ComponentsDemo"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get the homepage */
+        get: operations["Index"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Search verifications
+         * @description Search published Reclaim verifications by domain or data point. A verification is the recipe an end-user follows to prove something about themselves (e.g. "I have N followers on Twitter"). Returns a list of matches. Call this BEFORE `create_provider` — most popular domains already have a public verification you can reuse.
+         *     Catalog page listing all verifications. Returns a paginated list of verifications the caller can see. Public verifications are visible to everyone; private verifications are only visible to org members.
+         */
+        get: operations["Providers"];
+        put?: never;
+        /**
+         * Create a verification
+         * @description Create a new Reclaim verification. Use this only after `providers` returned nothing useful for the domain. The caller must be an active member of the target organization.
+         *     Creates a new verification in the specified organization. `visibility` is coerced to `PRIVATE` at creation regardless of what's sent; the author may toggle to `PUBLIC` later via `PATCH /providers/{id}`. While `PRIVATE`, versions go to the go live freely; once `PUBLIC`, non-admin versions need admin review. See `Provider.visibility`.
+         *     The server also seeds an initial `0.1.0` version on the `draft` branch in the same transaction so the verification is immediately editable. Its `initialUrl` defaults to `https://<domain>`; all other version fields fall back to their schema-declared defaults (structured verification, empty requests, empty web settings). `Provider.latestVersion` stays `null` until the draft is promoted to the live channel.
+         */
+        post: operations["CreateProvider"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/setup": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Suggest verification fields from a domain/URL scrape
+         * @description Pre-flight for `POST /providers`. Accepts a URL or bare
+         *     domain, scrapes the page head with a short timeout, and
+         *     returns suggested values (`title`, `slug`, `iconUrl`, brand
+         *     name) that the caller can review, edit, and submit to
+         *     `POST /providers`.
+         *
+         *     - HTML / HTMX callers receive the step-2 form HTML
+         *       pre-filled with the suggestions (swapped into the
+         *       create-verification dialog body).
+         *     - JSON / SDK / agent callers receive the same suggestions
+         *       as a JSON document so they can build their own UI or
+         *       submit the create request directly.
+         *
+         *     The scrape is best-effort: empty / failing responses simply
+         *     produce no suggestions for the affected fields.
+         */
+        post: operations["SetupProviderCreate"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/preview.png": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the verification's OG preview image
+         * @description Returns the 1200x630 PNG used in `<meta property="og:image">` for this verification (`Provider.previewImageUrl` points at this route). Rendered server-side on first read, then cached by the standard HTTP cache. The URL is keyed off the verification's preview ETag so it changes whenever the image-affecting fields change (title, iconUrl, effective primaryDataPoint — see `Provider.previewImageUrl`).
+         */
+        get: operations["ProviderPreviewImage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/og/explore.png": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Explore-card OG image
+         * @description 1200×630 PNG used as `og:image` on the homepage and the providers listing.
+         */
+        get: operations["ExplorePreviewImage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Admin dashboard (Reclaim staff)
+         * @description Admin landing. Returns 403 for non-admin callers (admin = `@reclaimprotocol.org` email; see PRD-1 §3.4).
+         */
+        get: operations["AdminHome"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/providers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * All verifications (admin-only)
+         * @description Admin only. Lists all verifications across all organizations. Supports filtering by visibility, status, and free-text search on title/domain/slug.
+         */
+        get: operations["AdminProviders"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/orgs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * All workspaces (admin-only)
+         * @description Admin only. Lists all organizations. Search matches workspace name or any member's email address.
+         */
+        get: operations["AdminOrgs"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** User search (admin-only) */
+        get: operations["AdminUsers"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/reviews": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Pending review queue (admin-only)
+         * @description Admin only. Lists all provider versions currently awaiting review (branch = 'in_review'). Use DecideProviderVersionReview to approve or reject each version.
+         */
+        get: operations["AdminReviews"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/themes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** All themes (admin-only) */
+        get: operations["AdminThemes"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/transfer": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Transfer a verification to a different workspace
+         * @description Admin-only. Moves the verification's `orgId` to the supplied workspace; preserves slug, versions, members. SQL function `builder.transfer_provider` enforces the admin gate and target existence atomically.
+         */
+        post: operations["TransferProvider"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/sitemap.xml": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Catalog sitemap
+         * @description XML sitemap listing every publicly-listable provider. Crawlers use it to discover the catalog. The renderer for crawlers (see `system-and-journeys.md`) lives outside the builder, but the sitemap is cheap to serve from the same SQL.
+         */
+        get: operations["Sitemap"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/robots.txt": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** robots.txt */
+        get: operations["Robots"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/openapi.yaml": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the OpenAPI specification (YAML)
+         * @description Returns the OpenAPI 3.0 specification document for this API, with external `$ref`s preserved relative to the spec root. Useful for feeding into API tooling and SDK generators.
+         */
+        get: operations["OpenApiSpec"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/docs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * View the API reference (Scalar UI)
+         * @description Renders an interactive API reference for this service using Scalar, backed by the OpenAPI spec served at `/openapi.yaml`.
+         */
+        get: operations["Docs"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/login": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Sign-in page
+         * @description HTML sign-in form. Submits to `POST /auth/login` via HTMX; the response sets a session cookie and an `HX-Redirect` header to `next` (if provided) or `/me`.
+         */
+        get: operations["LoginPage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/logout": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Sign out (clears session cookie) */
+        post: operations["Logout"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/auth/login": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Dummy sign-in
+         * @description **Dummy** sign-in. Returns a token for the supplied email, creating the user (and their personal org) if it doesn't exist. Verifies nothing. Replaced before production; the real auth scheme is not yet chosen.
+         */
+        post: operations["Login"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get the authenticated user */
+        get: operations["GetMe"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /** Update the authenticated user's profile */
+        patch: operations["UpdateMe"];
+        trace?: never;
+    };
+    "/users/{userId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a user's profile
+         * @description Returns a user record. Visible to: the user themselves, or any member of an organization the subject also belongs to.
+         */
+        get: operations["GetUser"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/orgs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List organizations the caller belongs to */
+        get: operations["ListOrgs"];
+        put?: never;
+        /**
+         * Create an organization
+         * @description Creates a new `ORG`-kind organization with the caller as its first `OWNER`. The personal org is created automatically at user signup and is not created via this endpoint.
+         */
+        post: operations["CreateOrg"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/orgs/{orgId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get an organization */
+        get: operations["GetOrg"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete a shared organization
+         * @description Owner only. `PERSONAL` organizations cannot be deleted independently of their owning user; deleting a personal org happens implicitly via `DELETE /me`.
+         */
+        delete: operations["DeleteOrg"];
+        options?: never;
+        head?: never;
+        /**
+         * Update an organization
+         * @description Owner only.
+         */
+        patch: operations["UpdateOrg"];
+        trace?: never;
+    };
+    "/orgs/{orgId}/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Invite a member to an organization
+         * @description Owner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an email is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` on first sign-in by the invited email. `PERSONAL` organizations reject this call (409). In the current milestone the email is not actually dispatched — the invite is auto-claimed when the invitee next signs in.
+         */
+        post: operations["AddOrgMember"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/orgs/{orgId}/members/{memberId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove a member or revoke an invite
+         * @description Removes an active member or revokes a pending invite. An owner can act on any row; any active member can remove themselves (leave). The last `ACTIVE` `OWNER` cannot leave or be removed.
+         */
+        delete: operations["RemoveOrgMember"];
+        options?: never;
+        head?: never;
+        /**
+         * Change a member's role in an organization
+         * @description Owner only. Works for both `PENDING` invites and `ACTIVE` members. The last `ACTIVE` `OWNER` cannot be demoted; at least one active owner must always remain (pending invites do not count).
+         */
+        patch: operations["UpdateOrgMember"];
+        trace?: never;
+    };
+    "/orgs/{orgId}/icon": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Upload (or replace) the organization's avatar
+         * @description Owner only. Accepts a single image file via multipart form (`file`). The server persists the bytes (currently in Postgres as a blob, see `images` table), updates the org's `iconUrl` to the public URL of the stored image, and returns the updated `Organization`.
+         */
+        put: operations["UpdateOrgIcon"];
+        post?: never;
+        /** Clear the organization's avatar */
+        delete: operations["DeleteOrgIcon"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/orgs/{orgId}/themes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List themes owned by an organization */
+        get: operations["ListThemes"];
+        put?: never;
+        /**
+         * Create a theme in an organization
+         * @description Caller must be a member of the organization.
+         */
+        post: operations["CreateTheme"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/orgs/{orgId}/themes/{themeId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a theme */
+        get: operations["GetTheme"];
+        put?: never;
+        post?: never;
+        /** Delete a theme */
+        delete: operations["DeleteTheme"];
+        options?: never;
+        head?: never;
+        /** Update a theme */
+        patch: operations["UpdateTheme"];
+        trace?: never;
+    };
+    "/orgs/{orgId}/credentials": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List credentials linked to an organization
+         * @description Returns every credential whose `orgId` equals the path parameter. Caller must be an active member of the org.
+         */
+        get: operations["ListOrgCredentials"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/orgs/{orgId}/billing": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the billing record for an organization
+         * @description Owner only. Returns `404` when no billing has been set; presence of the row is what promotes the org's credentials out of sandbox mode (see `Credential.mode`).
+         */
+        get: operations["GetOrgBilling"];
+        /**
+         * Add or update billing details for an organization
+         * @description Owner only. Upserts the billing row. The first successful call flips every credential linked to this org from `SANDBOX` to `PRODUCTION` (see `Credential.mode`). Subsequent calls update the contact fields without affecting credential mode.
+         */
+        put: operations["UpdateOrgBilling"];
+        post?: never;
+        /**
+         * Remove billing details for an organization
+         * @description Owner only. Deleting billing drops every credential linked to this org back to `SANDBOX` mode immediately.
+         */
+        delete: operations["DeleteOrgBilling"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Link a credential to an organization
+         * @description Links an ETH credential to an organization — registering it directly, or attaching an already-known one (matched by `address`). The private key MUST NOT leave the client — only the derived address and uncompressed public key are sent. `orgId` is required and the caller must be allowed to edit it. Idempotent for the same `(address, orgId)`. (Anonymous credentials live client-side; they are only stored here once linked.)
+         */
+        post: operations["LinkCredential"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials/by-address/{address}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Look up a credential by its lowercase ETH address
+         * @description Companion to `GET /credentials/{credentialId}`. The MCP / CLI knows the credential by its address (the public handle the user actually types) rather than by its UUID id, so this shortcut returns the same `Credential` shape keyed on the address. Visibility rules mirror `GetCredential`: anonymous credentials are world-readable; linked credentials are visible only to active members of the owning org. Bumps `lastUsedAt` so the dashboard shows liveness.
+         */
+        get: operations["GetCredentialByAddress"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials/{credentialId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a credential
+         * @description Returns the credential row. Visibility: anyone can fetch an anonymous (`orgId` null) credential by id; linked credentials are visible only to active members of the owning org.
+         */
+        get: operations["GetCredential"];
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a credential
+         * @description Soft-revokes the credential (sets `revokedAt`). Allowed for the creating user (anonymous credentials), an active OWNER of the owning org (linked credentials), or a Reclaim admin. Revoked credentials cannot be used for verification and cannot be re-linked.
+         */
+        delete: operations["RevokeCredential"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials/auth/challenge": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Issue a sign-in challenge for a credential
+         * @description Future endpoint. Returns a short-lived nonce the client signs with its private key (EIP-4361 / SIWE message). The signed nonce is then exchanged via `POST /credentials/auth/verify` for a bearer token. Currently returns `501 Not Implemented`.
+         */
+        post: operations["CredentialAuthChallenge"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials/auth/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify a signed challenge and exchange for a bearer token
+         * @description Future endpoint. Verifies that `signature` over the issued challenge recovers an address matching a registered (and non-revoked) credential, then returns a short-lived bearer token bound to that credential. Currently returns `501 Not Implemented`.
+         */
+        post: operations["CredentialAuthVerify"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials/attach/sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Open a device-pairing session to authorize a device
+         * @description Opens a short-lived (15-minute) device-pairing session. The CLI / MCP needs a bearer token to make authenticated API calls: the human opens `attachUrl`, signs in, and taps "Authorize this device". On confirmation the CLI receives a 2-day auth token via `GetAttachSession` polling. Linking a credential to an org is a separate step (`POST /credentials`) and is not part of pairing.
+         */
+        post: operations["CreateAttachSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials/attach/sessions/{code}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Poll a pairing session
+         * @description Anonymous poll endpoint used by the CLI / MCP while it waits for the human to complete the dashboard step. Once `status` is `LINKED`, the response includes a `token` (2-day bearer token) the CLI / MCP can use for authenticated API calls. Expired or unknown codes return `404`.
+         */
+        get: operations["GetAttachSession"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/credentials/attach/sessions/{code}/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm a pairing session and authorize the device
+         * @description Called by the dashboard once the user has typed the code and clicked "Authorize this device". Server verifies the session is still `PENDING`, issues a 2-day bearer token for the signed-in user, and flips the session to `LINKED`.
+         */
+        post: operations["ConfirmAttachSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/attach/{code}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Device-pairing page pre-filled with a code
+         * @description Same as `GET /attach`, but the form arrives pre-filled with `code`. The link the CLI / MCP shows points here so users only copy a single URL.
+         */
+        get: operations["AttachPage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/images/{imageId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Serve the bytes of a stored image
+         * @description Returns the raw bytes of the uploaded image with the original `Content-Type`. The URL is content-addressed (by image id) so the response is immutable — long `Cache-Control: max-age` is applied. Images are referenced via parent records (e.g. `Organization.iconUrl`).
+         */
+        get: operations["GetImage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a verification
+         * @description Fetch a single Reclaim verification by id. Returns every field needed
+         *     to integrate it into a flow: domain, the live version (initialUrl + requests),
+         *     and the data points it can prove. Use `providers` first if you only
+         *     have a query string.
+         *
+         *     Returns the verification record.
+         *
+         *     **Canonical URL.** For SEO and stable sharing, the canonical
+         *     HTML URL for a verification is `/providers/{providerId}/{slug}`
+         *     (see `GetProviderBySlug`). HTML callers (`Accept: text/html`)
+         *     that hit this route — which omits the slug — receive a `301`
+         *     redirect to the slugged URL. JSON callers
+         *     (`Accept: application/json`) receive the body directly without
+         *     redirect; the slug is on the response.
+         */
+        get: operations["GetProvider"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete a verification
+         * @description Owner of the verification's organization only. Soft-archives the verification (sets `status` to `ARCHIVED`) so historical references remain resolvable. Supports optimistic concurrency via `If-Match`.
+         */
+        delete: operations["DeleteProvider"];
+        options?: never;
+        head?: never;
+        /**
+         * Update a verification
+         * @description Update a Reclaim verification's metadata. Partial PATCH — pass only fields you want to change. The caller must be an active member of the owning organization. To change the verification's recipe (initialUrl, requests, …) cut a new version via the dashboard. Use `seo` to control how the verification appears in search results and social shares; omit a subfield to keep the server default.
+         *     Caller must be a member of the verification's owning organization. `id`, `orgId`, and `slug` are immutable. Supports optimistic concurrency via `If-Match`.
+         */
+        patch: operations["UpdateProvider"];
+        trace?: never;
+    };
+    "/providers/{providerId}/{slug}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a verification (canonical slugged URL)
+         * @description Canonical HTML URL for a verification. The slug in the path is
+         *     primarily an SEO and link-readability affordance — the
+         *     verification is resolved by `providerId`.
+         *
+         *     - If `slug` matches the verification's current slug, returns the
+         *       resource (HTML or JSON per `Accept`).
+         *     - If `slug` does not match (e.g. the verification was renamed since
+         *       the URL was minted), HTML callers receive a `301` redirect
+         *       to this same route with the *current* slug. JSON callers
+         *       receive the resource directly with `200` regardless of slug
+         *       correctness; SDKs should read the canonical slug off the
+         *       response.
+         *
+         *     Mutating operations (`PATCH` / `DELETE`) are only on
+         *     `/providers/{providerId}` — they don't need a canonical URL.
+         */
+        get: operations["GetProviderBySlug"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/versions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a verification's versions
+         * @description Lists versions visible to the caller. Non-public branches (`ai`, `draft`, `in_review`, `rejected`) are only visible to members of the verification's owning organization.
+         */
+        get: operations["ListProviderVersions"];
+        put?: never;
+        /**
+         * Create a new verification version
+         * @description Creates a new version of the verification. The starting branch
+         *     depends on the verification's `visibility` and the caller's role:
+         *
+         *     - `PRIVATE` verification (any caller): the live channel (no review).
+         *
+         *     - `PUBLIC` verification, admin caller (Reclaim staff): the live channel
+         *       (no review).
+         *
+         *     - `PUBLIC` verification, non-admin caller: `draft` (or `ai` if
+         *       authored by the AI assistant). Must pass review (see
+         *       `POST /providers/{id}/versions/{version}/review`) before
+         *       reaching the live channel.
+         */
+        post: operations["CreateProviderVersion"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/versions/{version}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a specific verification version */
+        get: operations["GetProviderVersion"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete a verification version
+         * @description Soft-archives a version on the `draft`, `ai`, or `rejected` branch — sets `status` to `ARCHIVED` so history is preserved. Trunk (live) and `in_review` versions cannot be archived this way; archive the parent verification instead. Supports optimistic concurrency via `If-Match`.
+         */
+        delete: operations["DeleteProviderVersion"];
+        options?: never;
+        head?: never;
+        /**
+         * Update a verification version
+         * @description Mutable only while the version is on the `draft` or `rejected` branch. Versions on `in_review` or the live channel reject all writes here. Caller must be a member of the verification's owning organization. Supports optimistic concurrency via `If-Match`.
+         */
+        patch: operations["UpdateProviderVersion"];
+        trace?: never;
+    };
+    "/providers/{providerId}/versions/{version}/review": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Submit a verification version for review
+         * @description Submits a verification version (currently on the `draft` or `rejected` branch) for admin review. On success the version's branch transitions to `in_review`. Callable by any authenticated member of the verification's owning org. Meaningful only on `PUBLIC` verifications — on `PRIVATE` verifications new versions go to the live channel directly and never need review.
+         */
+        post: operations["SubmitProviderVersionForReview"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/versions/{version}/review-decision": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Record a decision on a verification version review
+         * @description Admin only (Reclaim staff). Approves or rejects a verification version currently on the `in_review` branch. `APPROVED` clears the branch tag and promotes the version to the live channel; `REJECTED` moves it to the `rejected` branch where the author can address feedback and resubmit. A rejected version stays rejected — the author either fixes and resubmits, or abandons it.
+         *     Until RBAC is designed, "admin" is detected via the user's email domain (`@reclaimprotocol.org`). Non-admin callers receive a 403.
+         */
+        post: operations["DecideProviderVersionReview"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/versions/{version}/publish": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Publish a draft version directly (PRIVATE providers only)
+         * @description Publishes a verification version on the `draft` branch directly to the live channel (trunk). Only allowed for PRIVATE providers — PUBLIC providers must use the review flow (`POST .../review` → admin decision). On success the version's branch transitions from `draft` to `null` (trunk/live).
+         */
+        post: operations["PublishProviderVersion"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/request-public": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Request public listing for a PRIVATE provider
+         * @description Submits a PRIVATE provider's latest trunk version for admin review. When approved, the provider's visibility becomes PUBLIC and all future versions require review before going live. Fails if the provider is already PUBLIC or has no live versions.
+         */
+        post: operations["RequestPublicListing"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/make-private": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Change a PUBLIC provider back to PRIVATE
+         * @description Changes a PUBLIC provider's visibility to PRIVATE. Unlike the reverse (PRIVATE → PUBLIC), this does not require review since it restricts rather than expands access. Existing live versions remain but are no longer publicly listed.
+         */
+        post: operations["MakePrivate"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/versions/{version}/cancel-review": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Cancel a pending public listing review request
+         * @description Cancels a pending public listing request by moving the version from `in_review` back to `draft`. Only org members can cancel their own review requests. This allows users to withdraw a request before admin review if they change their mind.
+         */
+        post: operations["CancelPublicListingRequest"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /** @example <html><body><h1>Hello, World!</h1></body></html> */
+        HtmlContent: string;
+        /** Format: uuid */
+        UserID: string;
+        /** Format: date-time */
+        Timestamp: string;
+        /** Format: uuid */
+        ProviderID: string;
+        /** Format: uuid */
+        OrgID: string;
+        /** Format: uuid */
+        ThemeID: string;
+        /**
+         * Format: uuid
+         * @description Stable id for an `OrganizationMember` row. Used as the path component for member operations because pending invites do not yet have an associated `userId`.
+         */
+        MemberID: string;
+        /**
+         * Format: uuid
+         * @description Stable id for a `Credential` row.
+         */
+        CredentialID: string;
+        /** @description Lowercase Ethereum address (no EIP-55 mixed-case checksum). The client derives this from the public key via keccak-256 of the uncompressed pubkey minus the `0x04` prefix, taking the last 20 bytes. The server re-validates the format on insert but does not re-derive from the public key — that match is the client's responsibility. */
+        EthAddress: string;
+        /**
+         * @description Live-derived operating mode of a credential.
+         *
+         *     - `SANDBOX`: default. A credential is in sandbox iff it is
+         *       **either** not linked to any org **or** linked to an org
+         *       without a billing record. Sandbox is informational only —
+         *       there is no quota or usage tracking today.
+         *
+         *     - `PRODUCTION`: linked to an org that has billing on file.
+         *
+         *     - `REVOKED`: credential has been revoked and cannot be used.
+         *
+         *     Mode is recomputed at read time from
+         *     `(orgId, organizationHasBilling, revokedAt)` — it is never
+         *     stored as a column.
+         * @enum {string}
+         */
+        CredentialMode: "SANDBOX" | "PRODUCTION" | "REVOKED";
+        /** @description Five-character device-pairing code. The CLI / MCP shows this to the user, who types it into the dashboard's `/attach` page to confirm the link. Always uppercase alphanumeric; chars `O`/`0` and `I`/`1` are excluded to avoid ambiguity when copied from a terminal. */
+        AttachCode: string;
+        /**
+         * @description Lifecycle state of a `CredentialAttachSession`.
+         *
+         *     - `PENDING`: session created by the CLI / MCP, waiting for the
+         *       dashboard user to confirm.
+         *     - `LINKED`: dashboard user confirmed; the device is authorized
+         *       and a bearer `token` has been issued. Terminal state.
+         *     - `EXPIRED`: session passed its `expiresAt` without a confirm.
+         *       Terminal state — the CLI / MCP must open a fresh session.
+         * @enum {string}
+         */
+        AttachStatus: "PENDING" | "LINKED" | "EXPIRED";
+        /** @description RFC 9457 Problem Details for HTTP APIs. Returned by JSON callers with `Content-Type: application/problem+json`. HTML callers receive an error page with the same HTTP status instead of this body. */
+        Problem: {
+            /**
+             * Format: uri-reference
+             * @description URI reference identifying the problem type. Defaults to `about:blank`, in which case `title` MUST be the standard HTTP reason phrase.
+             * @default about:blank
+             */
+            type: string;
+            /** @description Short, human-readable summary of the problem type. */
+            title?: string;
+            /** @description HTTP status code generated by the origin server. */
+            status?: number;
+            /** @description Human-readable explanation specific to this occurrence. Not a substitute for `type` — clients machine-read `type`, humans read `detail`. */
+            detail?: string;
+            /**
+             * Format: uri-reference
+             * @description URI reference identifying this specific occurrence (often the request id or a log link). Useful for cross-referencing with server logs.
+             */
+            instance?: string;
+        };
+        /**
+         * @description The visibility of the entity.
+         *
+         *     - `PRIVATE`: Only the owner can see the entity.
+         *
+         *     - `PUBLIC`: Anyone can see the entity.
+         * @enum {string}
+         */
+        EntityVisibility: "PRIVATE" | "PUBLIC";
+        /**
+         * @description The status of the entity.
+         *
+         *     - `ACTIVE`: The entity is active.
+         *
+         *     - `ARCHIVED`: The entity is archived.
+         * @enum {string}
+         */
+        EntityStatus: "ACTIVE" | "ARCHIVED";
+        /**
+         * @description - `PERSONAL`: Auto-provisioned at user signup. Exactly one
+         *       `OWNER`, no other members.
+         *
+         *     - `ORG`: Explicitly created via `POST /orgs`. Multiple
+         *       members, always ≥ 1 active `OWNER`.
+         * @enum {string}
+         */
+        OrganizationKind: "PERSONAL" | "ORG";
+        /** @description A free-form label attached to an entity for grouping and filtering in listings. Must start and end with an alphanumeric character; only ASCII letters, digits, spaces, and hyphens are allowed between. */
+        Tag: string;
+        ActorMetadata: {
+            id: components["schemas"]["UserID"];
+            doneAt: components["schemas"]["Timestamp"];
+            /** @description Free-form notes from actor describing this change */
+            notes?: string;
+        };
+        /** @description A registered user of the platform. Every newly created user is automatically granted a personal organization (see `Organization.kind = PERSONAL`) whose id is exposed here as `personalOrgId`. */
+        User: {
+            id: components["schemas"]["UserID"];
+            /**
+             * Format: email
+             * @description User's verified email address. Used as the login identifier.
+             */
+            email: string;
+            /** @description Timestamp of when the user's email was verified. */
+            emailVerifiedAt?: components["schemas"]["Timestamp"];
+            /** @description Display name of the user. */
+            name: string;
+            /** @description ID of the user's auto-created personal organization. This organization is provisioned the moment the user is created and cannot be deleted independently of the user. */
+            personalOrgId: components["schemas"]["OrgID"];
+            createMetadata: components["schemas"]["ActorMetadata"];
+            updateMetadata: components["schemas"]["ActorMetadata"];
+        };
+        /**
+         * @description Role a user holds in an organization. `OWNER` can invite, promote, demote, and remove members, and delete the org. `MEMBER` has read/write access to resources owned by the org but cannot manage membership. `PERSONAL` orgs have exactly one `OWNER` and reject all member-mutating operations.
+         * @enum {string}
+         */
+        OrganizationMemberRole: "OWNER" | "MEMBER";
+        /** @description A row in an organization's member list. Covers both pending invites and active members; distinguish via `status`. The invitee does not need to be a registered user when the invite is created — they are invited by email. Once they sign in for the first time the row is upgraded to `ACTIVE` and `userId` / `joinedAt` are populated. `id` is the stable handle used in member-mutating endpoints. */
+        OrganizationMember: {
+            id: components["schemas"]["MemberID"];
+            /** @description Set once the invitee has a `User` record and the invite is `ACTIVE`. Absent for `PENDING` invites whose email does not yet match a registered user. */
+            userId?: components["schemas"]["UserID"];
+            /**
+             * Format: email
+             * @description Email the invite was sent to. Stable for the lifetime of the row; it is the natural identifier of the invitee before they have a `userId`.
+             */
+            email: string;
+            role: components["schemas"]["OrganizationMemberRole"];
+            /**
+             * @description - `PENDING`: invite issued, not yet accepted.
+             *     - `ACTIVE`: invite accepted; the row represents an active
+             *       member of the organization.
+             * @enum {string}
+             */
+            status: "PENDING" | "ACTIVE";
+            /** @description Timestamp the invite was issued. */
+            invitedAt: components["schemas"]["Timestamp"];
+            /** @description Timestamp the invite was accepted. Absent while `status` is `PENDING`. */
+            joinedAt?: components["schemas"]["Timestamp"];
+        };
+        /** @description A workspace that owns providers and other resources. Every user gets exactly one `PERSONAL` organization on signup; additional `ORG` organizations can be created and have multiple members. */
+        Organization: {
+            id: components["schemas"]["OrgID"];
+            /** @description Display name of the organization. For `PERSONAL` orgs this defaults to the owner's name and may be edited by the owner. */
+            name: string;
+            /** @description Whether this is a user's personal org or a shared org. */
+            kind: components["schemas"]["OrganizationKind"];
+            /**
+             * Format: uri
+             * @description Public URL for the org avatar. Set via `PUT /orgs/{orgId}/icon` (multipart upload) or cleared via `DELETE /orgs/{orgId}/icon`. Bytes are persisted server-side and served from `/images/{imageId}`.
+             */
+            iconUrl?: string;
+            /** @description Marker for system-managed singleton orgs. `'reclaim-staff'` identifies the auto-membership org that every `@reclaimprotocol.org` user is enrolled into on login (PRD-1 §3). Absent on normal user-created orgs. Names, status, and lifecycle of system-managed orgs are server-protected — clients cannot rename, archive, or delete them. */
+            readonly systemId?: string;
+            /** @description All users with a role in this organization. Always contains at least one `OWNER`. `PERSONAL` orgs contain exactly one member. */
+            members: components["schemas"]["OrganizationMember"][];
+            /** @description Providers owned by this organization. */
+            providers?: components["schemas"]["ProviderListItem"][];
+            /** @description Themes owned by this organization. */
+            themes?: components["schemas"]["Theme"][];
+            /** @description Ethereum credentials linked to this organization. Only populated on the org-detail endpoint and only visible to active members. */
+            credentials?: components["schemas"]["Credential"][];
+            /** @description Billing record attached to the org, if any. Owner-visible only; absent for members. Presence promotes every linked credential out of sandbox mode. */
+            billing?: components["schemas"]["OrgBilling"];
+            createMetadata: components["schemas"]["ActorMetadata"];
+            updateMetadata: components["schemas"]["ActorMetadata"];
+            /**
+             * @description Status of the org.
+             * @default ACTIVE
+             */
+            status: components["schemas"]["EntityStatus"];
+        };
+        /** @description A visual theme owned by an organization. Customizes the **end-user verification UX** rendered inside apps that integrate the Reclaim client SDK — brand colors, logos, and copy shown to end-users while they verify. Not applied to the builder UI itself. */
+        Theme: {
+            id: components["schemas"]["ThemeID"];
+            /** @description Organization that owns this theme. */
+            orgId: components["schemas"]["OrgID"];
+            /** @description Human-readable name of the theme. */
+            label: string;
+            /**
+             * Format: uri
+             * @description URL to a square icon image used to represent this theme.
+             */
+            iconUrl?: string;
+            createMetadata: components["schemas"]["ActorMetadata"];
+            updateMetadata: components["schemas"]["ActorMetadata"];
+            /**
+             * @description Status of the theme.
+             * @default ACTIVE
+             */
+            status: components["schemas"]["EntityStatus"];
+        };
+        /** @description A client-generated Ethereum credential registered with the builder. Identified by its lowercase ETH `address` — the only field stored server-side. The private key NEVER leaves the client and the public key is never sent (the address is derived from the key client-side). A credential is either anonymous (`orgId` absent) or linked to exactly one organization. Linking is one-way: a linked credential cannot be moved to a different org — revoke and reissue instead. */
+        Credential: {
+            id: components["schemas"]["CredentialID"];
+            address: components["schemas"]["EthAddress"];
+            /** @description Organization this credential is linked to. Absent for anonymous credentials. */
+            orgId?: components["schemas"]["OrgID"];
+            /** @description Optional human-readable label set at issue time (e.g. "Mobile app", "CI server"). Helps the dashboard distinguish multiple credentials in the same org. */
+            label?: string;
+            mode: components["schemas"]["CredentialMode"];
+            /** @description Timestamp of revocation, if revoked. */
+            revokedAt?: components["schemas"]["Timestamp"];
+            /** @description Last verification attempt (success or quota-reject). */
+            lastUsedAt?: components["schemas"]["Timestamp"];
+            createMetadata: components["schemas"]["ActorMetadata"];
+        };
+        /** @description Billing record attached to an organization. Presence of this record is the single signal that promotes every credential linked to the org out of `SANDBOX` and into `PRODUCTION` mode. Today the fields are dummy contact info — the real payment-processor integration is a future PR and will extend this shape additively. */
+        OrgBilling: {
+            orgId: components["schemas"]["OrgID"];
+            /**
+             * Format: email
+             * @description Billing contact email.
+             */
+            contactEmail: string;
+            /** @description Billing contact name (person or company). */
+            contactName: string;
+            createMetadata: components["schemas"]["ActorMetadata"];
+            updateMetadata: components["schemas"]["ActorMetadata"];
+        };
+        ProviderVersionRef: {
+            major: number;
+            minor: number;
+            patch: number;
+            /**
+             * @description Branch (lifecycle stage) of this provider version.
+             *
+             *     - `ai`: changes authored by the AI assistant live on this branch.
+             *
+             *     - `draft`: a human is actively editing the version.
+             *
+             *     - `in_review`: the author has submitted the version to be made
+             *       public and it is awaiting review. On approval the branch tag
+             *       is cleared (the version is promoted to the live channel and becomes
+             *       public).
+             *
+             *     - `rejected`: review concluded with a rejection. When the author
+             *       addresses the feedback the branch transitions back to
+             *       `in_review`.
+             * @enum {string}
+             */
+            branch?: "ai" | "draft" | "in_review" | "rejected";
+            /** @description Build number for the provider version */
+            buildNumber?: number;
+        };
+        /**
+         * @description Mirrors the Fetch API `RequestCredentials` value used when issuing the request — controls whether cookies and auth headers are sent.
+         * @enum {string}
+         */
+        WebCredentialsType: "omit" | "same-origin" | "include";
+        /** @description Geographic location (e.g. ISO country code or {{DYNAMIC_GEO}} to use user's geo location) the verification should appear to originate from. */
+        Geolocation: string;
+        /** @description A matcher for one HTTP request in observed traffic, together with the response constraints that must hold for a Reclaim proof over that request to be valid. Used by interceptors, in-page injections, and LLM agents. */
+        RequestSelection: {
+            /** @description The URL or generic path of the HTTP request. */
+            url: string;
+            /**
+             * @description The HTTP method used for the request.
+             * @enum {string}
+             */
+            method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+            /** @description Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`. */
+            requestBodyTemplate?: string;
+            /**
+             * @description Credentials mode to use when issuing the request. If not provided, defaults to `include`.
+             * @default include
+             */
+            credentials: components["schemas"]["WebCredentialsType"];
+            /** @description How the matched bytes should be redacted from the transcript before it is sent to the attestor. */
+            writeRedactionMode?: components["schemas"]["WriteRedactionMode"];
+            /** @description Apply TLS configuration when creating the tunnel to the attestor. */
+            additionalClientOptions?: components["schemas"]["AdditionalTlsClientOptions"];
+            /** @description A list of match conditions for the response. */
+            matches?: components["schemas"]["ResponseMatch"][];
+        };
+        /** @description A template for selecting request */
+        RequestSelectionTemplate: components["schemas"]["RequestSelection"] & {
+            /**
+             * @description If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.
+             * @default true
+             */
+            multiple: boolean;
+            /**
+             * @description If true, a request is required to match with this template. If not requests matches this template in proof, then validation fails.
+             * @default true
+             */
+            required: boolean;
+        };
+        /**
+         * @description How the matched portion of the response should be redacted before the transcript is handed to the attestor.
+         *     - `zk`: redact using a zero-knowledge proof over the original
+         *       bytes.
+         *
+         *     - `key-update`: redact by performing a TLS key update so the
+         *       attestor never observes the matched bytes in cleartext.
+         * @enum {string}
+         */
+        WriteRedactionMode: "zk" | "key-update";
+        /** @description Apply TLS configuration when creating the tunnel to the attestor. */
+        AdditionalTlsClientOptions: {
+            /** @description TLS protocol versions the client is allowed to negotiate. */
+            supportedProtocolVersions?: ("TLS1_2" | "TLS1_3")[];
+        };
+        /** @description Specifies a rule to match against a string in response to validate proof content. */
+        ResponseMatch: {
+            /**
+             * @description If true, the match condition is optional and won't fail if absent
+             * @default false
+             */
+            isOptional: boolean;
+            /** @description The description of the field that is extracted using this match rule */
+            description?: string;
+            /** @description The order in which the field should be displayed to user in UI */
+            order?: number;
+            /**
+             * @description The matching mechanism to use value as against response. Typically regex or simple string containment
+             * @enum {string}
+             */
+            type: "regex" | "contains";
+            /** @description The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups. */
+            value: string;
+            /** @description Optional extractor describing which portion of the response to pin to the proof. When absent, the match runs against the raw response body. */
+            extract?: components["schemas"]["ExtractDataSpecifier"];
+        };
+        /** @description Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. "HTTP/1.1 200 OK") */
+        ExtractDataSpecifier: {
+            /** @description expect an HTML response, and to contain a certain xpath for eg. "/html/body/div.a1/div.a2/span.a5" */
+            xPath?: string;
+            /** @description expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0' */
+            jsonPath?: string;
+            /** @description select a regex match from the response */
+            regex?: string;
+            /**
+             * @description If provided, the value inside will be hashed instead of being redacted. Useful for cases where the data inside is an identifiying piece of information that you don't want to reveal to the attestor, eg. an email address.
+             *     If the hash function produces more bytes than the original value, the hash will be truncated.
+             *     Eg. if hash is enabled, the original value is "hello", and hashed is "a1b2c", then the attestor will only see "a1b2c".
+             *     Note: if a regex with named groups is provided, only the named groups will be hashed.
+             * @enum {string}
+             */
+            hash?: "oprf" | "oprf-mpc" | "oprf-raw";
+        };
+        /**
+         * @description A provider represents a website or service for which Reclaim can produce verifiable claims. Owned by an organization, addressable at a single canonical `domain`, identified by a globally-unique `slug`, and configured through one or more `ProviderVersion`s.
+         *     `title` may be omitted; when absent the dashboard renders the chain `seo.titleOverride ?? title ?? seoSuggestions.title` so a server-derived name still appears.
+         */
+        Provider: {
+            readonly id: components["schemas"]["ProviderID"];
+            /** @description Organization that owns this provider. */
+            orgId: components["schemas"]["OrgID"];
+            /**
+             * Format: hostname
+             * @description Canonical root domain of the provider (e.g. `google.com`) — no scheme, no port, no path. Clients may submit a `www.` prefix; the server normalizes it away before storage.
+             */
+            domain: string;
+            /** @description URL-safe identifier for the provider. Lowercase letters, digits and hyphens only; globally unique across all providers. */
+            slug: string;
+            /** @description The title of the provider as displayed on the detail page. */
+            title?: string;
+            /** @description Description of the provider. Rendered on the detail page and used by SEO renderers as the `<meta name="description">` / OG description (truncated as needed). Plain text; no markup. */
+            description?: string;
+            /**
+             * Format: uri
+             * @description Author-set icon URL for the provider, shown in listings,
+             *     pickers, and headers. **Optional** — when omitted, the
+             *     dashboard falls back to `seoSuggestions.iconUrl`, which
+             *     resolves to the server's cached favicon (downloaded from
+             *     Google's S2 service into the `images` table) or, if that
+             *     cache hasn't filled yet, to Google's S2 URL directly.
+             *
+             *     The scraper never overwrites an author-set value.
+             */
+            iconUrl?: string;
+            /**
+             * Format: uri
+             * @description URL to a 1200x630 Open Graph preview card for this
+             *     provider, suitable for `<meta property="og:image">` and
+             *     Twitter Card tags. Server-rendered by the builder
+             *     (Satori → SVG → Resvg → PNG) and cached at a stable
+             *     URL. Asset storage (CDN or DB-served blob) is internal;
+             *     clients only see this URL.
+             *
+             *     - `null` until the first render completes — clients MUST
+             *       NOT assume the field is populated immediately after
+             *       `POST /providers`. Render may be inline-on-first-read
+             *       or async.
+             *
+             *     - Invalidated on change to `title`, `iconUrl`, or the
+             *       effective `primaryDataPoint` (override from `seo`, else
+             *       `seoSuggestions`, which itself updates when a new
+             *       version reaches the live channel).
+             *
+             *     - Treat the URL as opaque. The builder may change the URL
+             *       or swap the bytes behind it; clients tolerate either
+             *       and rely on standard HTTP caching.
+             */
+            readonly previewImageUrl?: string;
+            readonly createMetadata: components["schemas"]["ActorMetadata"];
+            readonly updateMetadata: components["schemas"]["ActorMetadata"];
+            /** @description The latest version of this provider. */
+            readonly latestVersion?: components["schemas"]["ProviderVersionRef"];
+            /**
+             * @description Author-controlled. Toggleable via `PATCH /providers/{id}`;
+             *     coerced to `PRIVATE` on creation.
+             *
+             *     - `PRIVATE`: only org members see the provider. New
+             *       versions go to the live channel on save — no review.
+             *
+             *     - `PUBLIC`: catalog-visible (subject to the listing rule
+             *       in PRD-2 §6). New versions from non-admin authors must
+             *       pass admin review before reaching the live channel; the
+             *       previously-live version stays live until then.
+             *       Admin-authored versions go to the live channel directly even
+             *       while `PUBLIC`.
+             *
+             *     Toggling `PUBLIC` → `PRIVATE` hides the provider from
+             *     the public listing immediately. Versions already on
+             *     `draft` / `in_review` / `rejected` stay where they are —
+             *     the provider's visibility at version-creation time
+             *     decides the review path, and a later toggle does not
+             *     retroactively un-gate non-live versions.
+             * @default PRIVATE
+             */
+            visibility: components["schemas"]["EntityVisibility"];
+            /**
+             * @description Status of the provider.
+             * @default ACTIVE
+             */
+            status: components["schemas"]["EntityStatus"];
+            /**
+             * @description Labels attached to the provider. Used for grouping and filtering providers in listings.
+             * @default []
+             */
+            tags: components["schemas"]["Tag"][];
+            /** @description Author-set SEO fields. See `ProviderSeo` for the merge rule with `seoSuggestions`. */
+            seo?: components["schemas"]["ProviderSeo"];
+            /** @description Read-only server-derived SEO defaults, paired with `seo`. See `ProviderSeoSuggestions`. */
+            seoSuggestions: components["schemas"]["ProviderSeoSuggestions"];
+            /** @description Read-only pre-resolved SEO surface. The server applies the documented override chain (`seo.*Override` → row value → `seoSuggestions.*`) and exposes the result here so HTML renderers, JSON-LD, sitemap, and OG cards read one source. */
+            effectiveSeo: components["schemas"]["ProviderEffectiveSeo"];
+        };
+        /**
+         * @description Card-shape projection of a `Provider` used by catalog listings (`GET /providers`, `Organization.providers`). Differs from `Provider` in three ways:
+         *
+         *     1. `title` is pre-resolved via the SEO fallback chain (`seo.titleOverride` → row `title` → scraped site name → `derive_brand_name(domain)`) and is always present here, whereas `Provider.title` is optional.
+         *
+         *     2. The `seo`, `seoSuggestions`, and `effectiveSeo` surfaces are omitted — the catalog query intentionally skips the SEO subqueries so each tile stays cheap.
+         *
+         *     3. The owning organization's display fields (`orgName`, `orgIconUrl`) are inlined so a listing renderer does not need a second lookup.
+         */
+        ProviderListItem: {
+            readonly id: components["schemas"]["ProviderID"];
+            /** @description Organization that owns this provider. */
+            orgId: components["schemas"]["OrgID"];
+            /**
+             * Format: hostname
+             * @description Canonical root domain of the provider (e.g. `google.com`).
+             */
+            domain: string;
+            /** @description URL-safe identifier for the provider. */
+            slug: string;
+            /** @description Pre-resolved display title. Never null — the server walks the SEO fallback chain server-side so renderers don't have to. */
+            title: string;
+            description?: string;
+            /**
+             * Format: uri
+             * @description Effective icon URL — the author-set value if present, otherwise the cached / live S2 favicon for `domain`.
+             */
+            iconUrl?: string;
+            /**
+             * Format: uri
+             * @description URL to the 1200×630 OG preview card. Absent until the first render completes. See `Provider.previewImageUrl` for the cache invalidation rules.
+             */
+            readonly previewImageUrl?: string;
+            /** @default PRIVATE */
+            visibility: components["schemas"]["EntityVisibility"];
+            /** @default ACTIVE */
+            status: components["schemas"]["EntityStatus"];
+            /** @default [] */
+            tags: components["schemas"]["Tag"][];
+            /** @description The latest version of this provider, if any. */
+            readonly latestVersion?: components["schemas"]["ProviderVersionRef"];
+            /** @description Display name of the owning organization. */
+            orgName: string;
+            /**
+             * Format: uri
+             * @description Avatar URL of the owning organization, if set.
+             */
+            orgIconUrl?: string;
+            readonly createMetadata: components["schemas"]["ActorMetadata"];
+            readonly updateMetadata: components["schemas"]["ActorMetadata"];
+        };
+        /** @description Pre-resolved SEO values for a provider. Always present. Renderers should prefer these over `seo` / `seoSuggestions` when the un-decorated brand surface is what's needed (use `brandName`) or when the SEO-decorated title is needed (use `title`). */
+        ProviderEffectiveSeo: {
+            title: string;
+            description: string;
+            brandName: string;
+            /** Format: uri */
+            brandUrl: string;
+            primaryDataPoint?: string;
+            dataPoints: string[];
+        };
+        InterceptorOptions: {
+            /**
+             * @description How traffic interception is implemented.
+             * @enum {string}
+             */
+            interceptorType: "HAWKEYE" | "MSWJS" | "CDP";
+            /**
+             * @description Whether the main document request is replayed via the attestor
+             * @default false
+             */
+            isDocumentRequestReplayEnabled: boolean;
+            /** @description Free-form configuration passed through to the interceptor implementation selected by `interceptorType`. Keys and value shapes are defined by the chosen interceptor. */
+            interceptorSettings?: string;
+        };
+        /** @description Options that influence how the portal verification client behaves. */
+        PortalClientOptions: {
+            /**
+             * @description When true, network traffic from the portal client and attestation is routed through a proxy.
+             * @default false
+             */
+            useProxy: boolean;
+            /** @description User-agent string used for web verification. */
+            userAgent?: components["schemas"]["UserAgentString"];
+        };
+        /** @description Options that influence how the in-app verification client behaves. */
+        InAppClientOptions: {
+            interceptorOptions?: components["schemas"]["InterceptorOptions"];
+            /** @description User-agent strings used for in-app verification on each platform. */
+            userAgents?: components["schemas"]["PlatformUserAgents"];
+        };
+        /** @description Options that influence how the web verification client behaves. */
+        ClientOptions: {
+            portal?: components["schemas"]["PortalClientOptions"];
+            inapp?: components["schemas"]["InAppClientOptions"];
+        };
+        /** @description User-agent string used for platform verification. */
+        UserAgentString: string;
+        /** @description User-agent strings keyed by platform. */
+        PlatformUserAgents: {
+            /** @description User-agent used for Android verification. */
+            android?: components["schemas"]["UserAgentString"];
+            /** @description User-agent used for iOS verification. */
+            ios?: components["schemas"]["UserAgentString"];
+        };
+        /** @description Settings used by the web-based verification client. */
+        ProviderWebSettings: {
+            /**
+             * @description Geographic location (e.g. ISO country code or {{DYNAMIC_GEO}} to use user's geo location) the verification should appear to originate from.
+             * @default {{DYNAMIC_GEO}}
+             */
+            geoLocation: components["schemas"]["Geolocation"];
+            clientOptions?: components["schemas"]["ClientOptions"];
+            /** @description JavaScript snippets injected into the page which runs before every page load. `window.Reclaim.` APIs are available to these scripts to request actions to the client like claim creation. */
+            jsUserScripts?: string;
+        };
+        /** @description Map of parameter names needed (optional or required) to use this provider to their human-readable descriptions/labels. Values are plain strings shown alongside the field in dashboards and prompts. */
+        ProviderRequiredParameters: {
+            [key: string]: string;
+        };
+        /**
+         * @description How a provider version verifies a claim. `structured` uses the explicit match rules on this version (the `matches` / `allowedJsMatches` and related settings). `llm` defers the verification decision to a language model and requires `prompt` to be set.
+         * @enum {string}
+         */
+        VerificationType: "llm" | "structured";
+        /**
+         * @description Author-set SEO fields. All optional.
+         *
+         *     Each field is paired with a server-derived default of the
+         *     same name on `Provider.seoSuggestions`. Renderers pick the
+         *     effective value per field:
+         *
+         *         effective.<field> = seo.<field> ?? seoSuggestions.<field>
+         *
+         *     Set a field here to override; leave it unset to let the
+         *     default win. Both objects are returned on every
+         *     `GET /providers/{id}` — the builder does not pre-merge.
+         */
+        ProviderSeo: {
+            /**
+             * Format: uri
+             * @description Canonical homepage of the brand (e.g. `https://google.com`). Used in brand-link cards and JSON-LD.
+             */
+            brandUrl?: string;
+            /** @description Headline data point — the single most-important variable this provider can verify (e.g. `subscriber count`). Used in the provider's SEO title. */
+            primaryDataPoint?: string;
+            /** @description Full list of data points this provider can verify. */
+            dataPoints?: string[];
+            /** @description Replaces the renderer's composed `<title>` / OG title. Use when the default composition reads awkwardly. */
+            titleOverride?: string;
+            /** @description Replaces the renderer's composed `<meta name="description">` / OG description. */
+            descriptionOverride?: string;
+        };
+        /**
+         * @description Server-derived SEO defaults. Used by renderers wherever the
+         *     author-set value (on `Provider.title` / `Provider.iconUrl` /
+         *     `Provider.seo`) is unset.
+         *
+         *     How each value is computed:
+         *
+         *     - `brandUrl` ← `https://{provider.domain}`.
+         *
+         *     - `title` ← the latest scraped `<title>` / `og:site_name`
+         *       from the provider's domain (or `initialUrl` of the live
+         *       version when present); otherwise the domain-derived brand
+         *       name via `builder.derive_brand_name(domain)` — e.g.
+         *       `github.com` → `"Github"`.
+         *
+         *     - `iconUrl` ← the cached `/images/{uuid}` once the favicon
+         *       download from Google's S2 service has landed; otherwise
+         *       the live S2 URL
+         *       (`https://www.google.com/s2/favicons?domain=<host>&sz=128`).
+         *       Always present.
+         *
+         *     - `primaryDataPoint` ← name of the first data point declared
+         *       on the provider's latest live version — either a regex named
+         *       group `(?P<name>…)` or a `contains` template variable
+         *       `{{name}}`.
+         *
+         *     - `dataPoints` ← deduplicated list of all data-point names on
+         *       the provider's latest live version, from both regex named
+         *       groups and `{{name}}` template variables.
+         *
+         *     Recomputed when a new version is added to the live channel
+         *     or the server-side scrape runs. Read-only; clients MUST NOT
+         *     submit this field.
+         */
+        ProviderSeoSuggestions: {
+            /** Format: uri */
+            brandUrl: string;
+            title: string;
+            /**
+             * Format: uri
+             * @description Suggested icon URL. Resolved server-side via
+             *     `provider_json()` to either:
+             *
+             *     - The cached favicon at `/images/{uuid}` — bytes
+             *       downloaded from Google's S2 service at create / version
+             *       time and stored in the `images` table. Preferred when
+             *       present so renders are local.
+             *     - Google's S2 URL directly
+             *       (`https://www.google.com/s2/favicons?domain=<host>&sz=128`)
+             *       when the cache hasn't filled yet, so the dashboard
+             *       always has something to show.
+             *
+             *     Always present — `domain` is required, so the fallback
+             *     URL is too. Authors can copy this into `Provider.iconUrl`
+             *     from the Edit dialog.
+             */
+            iconUrl: string;
+            primaryDataPoint?: string;
+            dataPoints?: string[];
+        };
+        ProviderVersion: {
+            providerId: components["schemas"]["ProviderID"];
+            version: components["schemas"]["ProviderVersionRef"];
+            /**
+             * Format: uri
+             * @description Initial URL to open at the start of the verification flow. On create or change, the server caches both a title hint (from the page's `<title>` / `og:site_name`) and a favicon (downloaded from Google's S2 service) keyed off this URL's hostname. Both feed `seoSuggestions` until the author accepts the suggestion on the provider detail page.
+             */
+            initialUrl: string;
+            createMetadata: components["schemas"]["ActorMetadata"];
+            /** @description Details about the changes that this version represents. */
+            updateMetadata: components["schemas"]["ActorMetadata"];
+            /** @description Details about the rejection of this version. This field is only present when the version branch is rejected. */
+            rejectionMetadata?: components["schemas"]["ActorMetadata"];
+            /** @default [] */
+            requests: components["schemas"]["RequestSelection"][];
+            /** @default [] */
+            allowedJsRequests: components["schemas"]["RequestSelectionTemplate"][];
+            /** @default structured */
+            readonly verificationType: components["schemas"]["VerificationType"];
+            /** @description The prompt used for LLM verification (only when verificationType is "llm"). */
+            readonly prompt?: string;
+            webSettings: components["schemas"]["ProviderWebSettings"];
+            requiredParameters?: components["schemas"]["ProviderRequiredParameters"];
+        };
+        /** @description **Dummy** login body. Email is accepted; password (if sent) is ignored. Replaced when real auth is chosen. */
+        LoginRequest: {
+            /** Format: email */
+            email: string;
+            /** @description Accepted but ignored. */
+            password?: string;
+            /** @description Post-login redirect path. Must start with `/`. Injected as a hidden field by the login page when `?next=` is in the URL (e.g. from `/attach/{code}`). HTMX callers redirect to this path via `HX-Redirect`; SDK callers ignore it. */
+            next?: string;
+        };
+        /** @description **Dummy** bearer credential. Opaque; the server resolves it to the authenticated user. Clients fetch identity via `GET /me`. */
+        AuthToken: {
+            /** @description Opaque bearer token. Send as `Authorization: Bearer <token>` on every authenticated request. */
+            token: string;
+        };
+        /** @description Caller-editable fields on the authenticated user. */
+        UpdateUserRequest: {
+            name?: string;
+        };
+        CreateOrgRequest: {
+            name: string;
+        };
+        UpdateOrgRequest: {
+            name?: string;
+            status?: components["schemas"]["EntityStatus"];
+            /**
+             * Format: uri
+             * @description Replace the org avatar URL directly. Most clients upload via `PUT /orgs/{orgId}/icon` and let the server write this field.
+             */
+            iconUrl?: string;
+        };
+        /** @description Body for inviting a member to an organization. The invitee does not need to be a registered user; an invite is created either way and an email is dispatched. */
+        AddOrgMemberRequest: {
+            /**
+             * Format: email
+             * @description Email to invite. Need not match an existing `User`.
+             */
+            email: string;
+            role: components["schemas"]["OrganizationMemberRole"];
+        };
+        TransferProviderRequest: {
+            /** @description New owning workspace. */
+            orgId: components["schemas"]["OrgID"];
+        };
+        CreateThemeRequest: {
+            label: string;
+            /** Format: uri */
+            iconUrl?: string;
+        };
+        UpdateThemeRequest: {
+            label?: string;
+            /** Format: uri */
+            iconUrl?: string;
+            status?: components["schemas"]["EntityStatus"];
+        };
+        /** @description Body of `POST /providers/setup`. Caller supplies the target `orgId` and either a bare domain (`github.com`) or a full URL (`https://github.com/login`); the server scrapes the page head and returns suggested provider fields. */
+        SetupProviderCreateRequest: {
+            orgId: components["schemas"]["OrgID"];
+            /** @description Either a bare domain (`github.com`) or a full URL (`https://github.com/login`). When a URL is provided the server still treats only the registered domain as the provider's `domain`; the path/query are discarded at this stage. */
+            urlOrDomain: string;
+        };
+        /** @description Suggestions returned by `POST /providers/setup`. Every field except `orgId` and `domain` is best-effort — `null`/absent when the scrape produced nothing usable. SDK / agent clients can merge these directly into a `CreateProviderRequest` (overriding any field the caller prefers to set explicitly). */
+        SetupProviderCreateResponse: {
+            orgId: components["schemas"]["OrgID"];
+            /**
+             * Format: hostname
+             * @description Normalized registered domain.
+             */
+            domain: string;
+            /** @description URL-safe slug suggestion derived from the domain (e.g. `news.ycombinator.com` → `news-ycombinator`). Callers should treat as a starting point and may edit before submit. */
+            slug: string;
+            /** @description Site title pulled from `og:site_name` / `og:title` / `<title>`. Absent when the scrape failed or returned no usable text — callers can fall back to `brandName`. */
+            title?: string;
+            /** @description Brand fallback derived from the domain when the scrape returned no title (e.g. `github.com` → `Github`). Always present. */
+            brandName: string;
+            /** @description Optional description suggestion. Currently always blank; present so callers can pre-populate the field once a description heuristic lands. Reserved for future use. */
+            description?: string;
+            /**
+             * Format: uri
+             * @description Live Google S2 favicon URL for the domain. Always present. The server downloads and caches the bytes after the provider is created via `POST /providers`; SDK clients can pass this through unchanged or replace with their own URL.
+             */
+            iconUrl: string;
+        };
+        /** @description `title` is optional — when omitted the dashboard renders `seoSuggestions.title` (server-derived from the scrape result or `derive_brand_name(domain)`). */
+        CreateProviderRequest: {
+            /** @description uuid identifier of the organization that will own the verification. */
+            orgId: components["schemas"]["OrgID"];
+            /**
+             * Format: hostname
+             * @description Canonical root domain (e.g. `github.com`). No scheme, no port, no path.
+             */
+            domain: string;
+            /** @description URL-safe identifier. Globally unique — pick something domain-specific like `github-followers`. */
+            slug: string;
+            /** @description Short headline shown to end-users. Defaults to a domain-derived brand name. */
+            title?: string;
+            description?: string;
+            /**
+             * Format: uri
+             * @description uri of the icon. Optional. If omitted, the server auto-populates from the first version's `initialUrl` (see `Provider.iconUrl`).
+             */
+            iconUrl?: string;
+            /**
+             * @description Initial visibility. Coerced to `PRIVATE` on creation; toggle later via `PATCH /providers/{id}` (see `Provider.visibility`).
+             * @default PRIVATE
+             */
+            visibility: components["schemas"]["EntityVisibility"];
+            /** @default [] */
+            tags: components["schemas"]["Tag"][];
+            /** @description Optional author SEO fields. `seoSuggestions` is server-derived and cannot be set. */
+            seo?: components["schemas"]["ProviderSeo"];
+        };
+        /** @description Partial update of an existing provider. Immutable fields (`id`, `orgId`, `slug`) are not accepted here. */
+        UpdateProviderRequest: {
+            /** Format: hostname */
+            domain?: string;
+            title?: string;
+            description?: string;
+            /**
+             * Format: uri
+             * @description uri of the icon
+             */
+            iconUrl?: string;
+            visibility?: components["schemas"]["EntityVisibility"];
+            status?: components["schemas"]["EntityStatus"];
+            tags?: components["schemas"]["Tag"][];
+            /** @description Author SEO fields. Send `null` for a subfield to clear that override and let `seoSuggestions` win again. */
+            seo?: components["schemas"]["ProviderSeo"];
+        };
+        /** @description Body for creating a new version of a provider. Every new version starts on the `draft` branch — see `CreateProviderVersion`. The request body never sets `branch` directly; going live is a separate, explicit step (publish for PRIVATE, submit-for-review → approve for PUBLIC). The version's `verificationType` is always `structured` and is not settable here; a `prompt` field is reserved for a future AI authoring flow and is also not accepted on this surface. */
+        CreateProviderVersionRequest: {
+            /**
+             * @description The version of this Provider upon creation. Clients typically omit this and let the dashboard's bump-suggestion compute it. When omitted, defaults to `0.1.0` for the very first version; otherwise the caller is expected to pass a value higher than the latest existing version.
+             * @default {
+             *       "major": 0,
+             *       "minor": 1,
+             *       "patch": 0
+             *     }
+             */
+            version: components["schemas"]["ProviderVersionRef"];
+            /** Format: uri */
+            initialUrl: string;
+            /** @default [] */
+            requests: components["schemas"]["RequestSelection"][];
+            /** @default [] */
+            allowedJsRequests: components["schemas"]["RequestSelectionTemplate"][];
+            webSettings: components["schemas"]["ProviderWebSettings"];
+            requiredParameters?: components["schemas"]["ProviderRequiredParameters"];
+            /** @description Free-form change note recorded on `createMetadata`. */
+            notes?: string;
+        };
+        /** @description Partial update of a provider version. Mutable only while the version is on the `draft` or `rejected` branch; versions on `in_review` or the live channel reject all writes here. The semver does not change on update — `build_number` increments instead, giving callers a monotonic revision counter without touching the (major, minor, patch) PK. `verificationType` / `prompt` are not accepted; see `ProviderVersion` for why. */
+        UpdateProviderVersionRequest: {
+            /** Format: uri */
+            initialUrl?: string;
+            requests?: components["schemas"]["RequestSelection"][];
+            allowedJsRequests?: components["schemas"]["RequestSelectionTemplate"][];
+            webSettings?: components["schemas"]["ProviderWebSettings"];
+            requiredParameters?: components["schemas"]["ProviderRequiredParameters"];
+            /** @description Free-form change note recorded on `updateMetadata`. */
+            notes?: string;
+        };
+        /** @description Body for submitting a provider version for review. Transitions the version's branch from `draft` (or `rejected`) to `in_review`. */
+        ProviderVersionReviewSubmission: {
+            /** @description Optional note from the author to reviewers (changelog, areas to focus on, etc.). */
+            notes?: string;
+        };
+        /** @description Body for recording a decision on a provider version in `in_review`. On `APPROVED` the branch tag is cleared and the version is promoted to the live channel (becomes public). On `REJECTED` the branch becomes `rejected`. */
+        ProviderVersionReviewDecision: {
+            /** @enum {string} */
+            decision: "APPROVED" | "REJECTED";
+            /** @description Free-form rationale shown to the author. */
+            notes?: string;
+        };
+        /** @description Body for publishing a draft version directly to the live channel. Only allowed for PRIVATE providers. */
+        ProviderVersionPublishRequest: {
+            /** @description Optional publish note. */
+            notes?: string;
+        };
+        /** @description Body for visibility change requests (request public listing or make private). */
+        VisibilityChangeRequest: {
+            /** @description Optional note explaining the change. */
+            notes?: string;
+        };
+        /** @description Body for `POST /credentials`. Only the lowercase ETH `address` is sent — the private key MUST NOT leave the client, and the public key is not sent (the client derives the address from the key: keccak-256 of the uncompressed pubkey minus its `0x04` prefix, last 20 bytes, lowercase hex). */
+        LinkCredentialRequest: {
+            address: components["schemas"]["EthAddress"];
+            /** @description Organization to link this credential to. The caller must be allowed to edit it. Required — this endpoint is the link action; it never stores an org-less credential. */
+            orgId: components["schemas"]["OrgID"];
+            /** @description Optional human-readable label. */
+            label?: string;
+        };
+        /** @description Body for `PUT /orgs/{orgId}/billing`. */
+        UpdateOrgBillingRequest: {
+            /** Format: email */
+            contactEmail: string;
+            contactName: string;
+        };
+        /** @description Body for `POST /credentials/auth/challenge`. Identifies which credential is about to sign in so the server can issue a nonce bound to that address. */
+        CredentialAuthChallengeRequest: {
+            address: components["schemas"]["EthAddress"];
+        };
+        /** @description Server-issued challenge to be signed by the credential's private key. The shape is intentionally minimal; production deployments will likely return a full EIP-4361 message string the client signs verbatim. */
+        CredentialAuthChallenge: {
+            address: components["schemas"]["EthAddress"];
+            /** @description Opaque nonce. Client must sign exactly this value. */
+            nonce: string;
+            expiresAt: components["schemas"]["Timestamp"];
+        };
+        /** @description Body for `POST /credentials/auth/verify`. */
+        CredentialAuthVerifyRequest: {
+            address: components["schemas"]["EthAddress"];
+            nonce: string;
+            /** @description Hex-encoded `0x`-prefixed secp256k1 signature over the issued nonce (`r || s || v`, 65 bytes → 132 chars). */
+            signature: string;
+        };
+        /** @description Short-lived bearer token bound to a verified credential. The token is opaque to clients — pass it verbatim in the `Authorization: Bearer …` header on subsequent verification API calls. */
+        CredentialAuthToken: {
+            token: string;
+            address: components["schemas"]["EthAddress"];
+            expiresAt: components["schemas"]["Timestamp"];
+        };
+        /** @description Server-side state of a device-pairing session. The CLI / MCP polls this until `status` is `LINKED`, then reads `token` for authenticated API calls. */
+        CredentialAttachSession: {
+            code: components["schemas"]["AttachCode"];
+            status: components["schemas"]["AttachStatus"];
+            /** @description 2-day bearer token issued when `status` becomes `LINKED`. Use as `Authorization: Bearer <token>` for authenticated API calls. Cache in `~/.reclaim/session.json` for automatic re-use across CLI / MCP restarts. */
+            token?: string;
+            /**
+             * Format: uri
+             * @description Fully-qualified URL pointing at the dashboard's `/attach/{code}` page. Show to the user verbatim.
+             */
+            attachUrl: string;
+            expiresAt: components["schemas"]["Timestamp"];
+            createdAt: components["schemas"]["Timestamp"];
+        };
+        /** @description Body for `POST /credentials/attach/sessions/{code}/confirm`. No fields — authorizing the device only requires the signed-in session and the `code` in the path. */
+        ConfirmAttachSessionRequest: Record<string, never>;
+    };
+    responses: {
+        /** @description HTML response */
+        HTMLResponse: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "text/html": components["schemas"]["HtmlContent"];
+            };
+        };
+        /** @description Error response. JSON callers receive an RFC 9457 problem document; HTML callers receive a rendered error page. Status code is set by the origin server and reflected in the `Problem.status` field. */
+        ProblemResponse: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"];
+                "text/html": components["schemas"]["HtmlContent"];
+            };
+        };
+        /** @description The caller is authenticated but not authorized to perform this operation — most commonly because they are not an active member (or, for owner-only operations, an active OWNER) of the organization that owns the affected resource. Authorization is enforced in SQL via `user_can_edit_org` / `user_can_own_org`, so the server cannot leak whether the resource exists when the caller has no access. */
+        ForbiddenResponse: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/problem+json": components["schemas"]["Problem"];
+                "text/html": components["schemas"]["HtmlContent"];
+            };
+        };
+        /**
+         * @description 301 Moved Permanently. Returned to HTML callers that hit a
+         *     non-canonical URL for a resource that has a slug — e.g.
+         *     `/providers/{providerId}` with no slug, or
+         *     `/providers/{providerId}/{staleSlug}` after a rename. The
+         *     `Location` header points at the canonical URL with the
+         *     resource's current slug. JSON callers receive the resource
+         *     body directly (200) and do NOT see this status.
+         */
+        CanonicalRedirectResponse: {
+            headers: {
+                /** @description Canonical URL with the resource's current slug. */
+                Location: string;
+                [name: string]: unknown;
+            };
+            content?: never;
+        };
+    };
+    parameters: {
+        /** @description Semver string of the provider version, e.g. `1.4.2`. */
+        ProviderVersionPath: string;
+        /**
+         * @description Opaque `ETag` from a prior GET on the same resource. When
+         *     supplied, the server applies optimistic concurrency: the
+         *     mutation fails with `412 Precondition Failed` if the
+         *     resource has been modified since. Omit for last-write-wins.
+         */
+        IfMatch: string;
+    };
+    requestBodies: never;
+    headers: {
+        /**
+         * @description Opaque concurrency token for this resource. Pass back in
+         *     `If-Match` on a subsequent mutation to enable optimistic
+         *     concurrency control. Format is server-internal; clients
+         *     treat it as opaque.
+         */
+        ETag: string;
+    };
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    ComponentsDemo: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    Index: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    Providers: {
+        parameters: {
+            query?: {
+                /** @description Free-text search across `title`, `description`, `domain`, `primaryDataPoint`, `dataPoints`, and the latest version's `initialUrl`. Matched case-insensitively; returns results ranked by relevance (e.g., data point matches rank higher than description matches). */
+                q?: string;
+                /** @description Filter by tag. Repeat the parameter to OR multiple tags (a provider matching any of them is returned). Combined with `q` via AND. */
+                tag?: components["schemas"]["Tag"][];
+                /** @description Opaque cursor returned as `nextPageCursor` on a prior response. Pass it back as-is to fetch the next page; omit on the first request. Clients must not parse, modify, or fabricate cursors — the server reserves the encoding. */
+                cursor?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["ProviderListItem"][];
+                        nextPageCursor?: string;
+                    };
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateProvider: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateProviderRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["CreateProviderRequest"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                };
+            };
+            400: components["responses"]["ProblemResponse"];
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SetupProviderCreate: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetupProviderCreateRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["SetupProviderCreateRequest"];
+            };
+        };
+        responses: {
+            /** @description Suggestions. HTML callers receive the step-2 form HTML; JSON callers receive the suggestions document. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SetupProviderCreateResponse"];
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ProviderPreviewImage: {
+        parameters: {
+            query?: {
+                /** @description Cache buster. The server includes the current ETag here on the canonical URL; stale values still return the current image but without long cache headers. */
+                v?: string;
+            };
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description PNG bytes */
+            200: {
+                headers: {
+                    "Cache-Control"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "image/png": string;
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ExplorePreviewImage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description PNG bytes */
+            200: {
+                headers: {
+                    "Cache-Control"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "image/png": string;
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminHome: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminProviders: {
+        parameters: {
+            query?: {
+                /** @description Free-text search on title, domain, or slug. */
+                q?: string;
+                visibility?: components["schemas"]["EntityVisibility"];
+                status?: components["schemas"]["EntityStatus"];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                    "application/json": {
+                        items: {
+                            /** Format: uuid */
+                            id?: string;
+                            /** Format: uuid */
+                            orgId?: string;
+                            orgName?: string;
+                            orgIconUrl?: string;
+                            domain?: string;
+                            slug?: string;
+                            title?: string;
+                            description?: string;
+                            iconUrl?: string;
+                            visibility?: components["schemas"]["EntityVisibility"];
+                            status?: components["schemas"]["EntityStatus"];
+                            tags?: string[];
+                            /** Format: date-time */
+                            updatedAt?: string;
+                        }[];
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminOrgs: {
+        parameters: {
+            query?: {
+                /** @description Matches workspace name or any member's email. */
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                    "application/json": {
+                        items: {
+                            /** Format: uuid */
+                            id?: string;
+                            name?: string;
+                            /** @enum {string} */
+                            kind?: "PERSONAL" | "ORG";
+                            status?: components["schemas"]["EntityStatus"];
+                            iconUrl?: string;
+                            memberCount?: number;
+                            providerCount?: number;
+                            /** Format: date-time */
+                            createdAt?: string;
+                            /** Format: date-time */
+                            updatedAt?: string;
+                        }[];
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminUsers: {
+        parameters: {
+            query?: {
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminReviews: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                    "application/json": {
+                        items: {
+                            /** Format: uuid */
+                            providerId?: string;
+                            providerTitle?: string;
+                            providerSlug?: string;
+                            providerDomain?: string;
+                            orgName?: string;
+                            version?: {
+                                major?: number;
+                                minor?: number;
+                                patch?: number;
+                                branch?: string;
+                            };
+                            initialUrl?: string;
+                            verificationType?: string;
+                            /** Format: date-time */
+                            updatedAt?: string;
+                            updatedNotes?: string;
+                        }[];
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminThemes: {
+        parameters: {
+            query?: {
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    TransferProvider: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TransferProviderRequest"];
+            };
+        };
+        responses: {
+            /** @description Transferred */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    Sitemap: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/xml": string;
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    Robots: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    OpenApiSpec: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/yaml": string;
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    Docs: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    LoginPage: {
+        parameters: {
+            query?: {
+                /** @description URL to redirect to after successful sign-in. Must start with `/`. Defaults to `/me`. Used by `/attach/{code}` to return the user to the pairing page after they sign in. */
+                next?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    Logout: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Signed out */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    Login: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LoginRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["LoginRequest"];
+            };
+        };
+        responses: {
+            /** @description Authenticated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuthToken"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetMe: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["User"];
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateMe: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateUserRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["User"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: components["schemas"]["UserID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["User"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ListOrgs: {
+        parameters: {
+            query?: {
+                /** @description Opaque cursor returned as `nextPageCursor` on a prior response. Pass it back as-is to fetch the next page; omit on the first request. Clients must not parse, modify, or fabricate cursors — the server reserves the encoding. */
+                cursor?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["Organization"][];
+                        nextPageCursor?: string;
+                    };
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateOrg: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateOrgRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["CreateOrgRequest"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Organization"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetOrg: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Organization"];
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DeleteOrg: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateOrg: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateOrgRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["UpdateOrgRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Organization"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AddOrgMember: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AddOrgMemberRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["AddOrgMemberRequest"];
+            };
+        };
+        responses: {
+            /** @description Invite created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OrganizationMember"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    RemoveOrgMember: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+                memberId: components["schemas"]["MemberID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Removed. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateOrgMember: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+                memberId: components["schemas"]["MemberID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    role: components["schemas"]["OrganizationMemberRole"];
+                };
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OrganizationMember"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateOrgIcon: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "multipart/form-data": {
+                    /**
+                     * Format: binary
+                     * @description PNG, JPEG, WebP or GIF, ≤ 4 MB.
+                     */
+                    file: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Organization"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DeleteOrgIcon: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Cleared */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Organization"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ListThemes: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["Theme"][];
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateTheme: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateThemeRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["CreateThemeRequest"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Theme"];
+                };
+            };
+            400: components["responses"]["ProblemResponse"];
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetTheme: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+                themeId: components["schemas"]["ThemeID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Theme"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DeleteTheme: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+                themeId: components["schemas"]["ThemeID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateTheme: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+                themeId: components["schemas"]["ThemeID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateThemeRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["UpdateThemeRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Theme"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ListOrgCredentials: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["Credential"][];
+                    };
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetOrgBilling: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OrgBilling"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateOrgBilling: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateOrgBillingRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["UpdateOrgBillingRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OrgBilling"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DeleteOrgBilling: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    LinkCredential: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LinkCredentialRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["LinkCredentialRequest"];
+            };
+        };
+        responses: {
+            /** @description Credential registered or attached */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Credential"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            /** @description Address already registered under a different public key, the credential is revoked, or it is already linked to another organization. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetCredentialByAddress: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                address: components["schemas"]["EthAddress"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Credential"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetCredential: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                credentialId: components["schemas"]["CredentialID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Credential"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    RevokeCredential: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                credentialId: components["schemas"]["CredentialID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Revoked */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Credential"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CredentialAuthChallenge: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CredentialAuthChallengeRequest"];
+            };
+        };
+        responses: {
+            /** @description Challenge issued */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CredentialAuthChallenge"];
+                };
+            };
+            501: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CredentialAuthVerify: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CredentialAuthVerifyRequest"];
+            };
+        };
+        responses: {
+            /** @description Verified */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CredentialAuthToken"];
+                };
+            };
+            501: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateAttachSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Pairing session opened */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CredentialAttachSession"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetAttachSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                code: components["schemas"]["AttachCode"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Session state */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CredentialAttachSession"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ConfirmAttachSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                code: components["schemas"]["AttachCode"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["ConfirmAttachSessionRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["ConfirmAttachSessionRequest"];
+            };
+        };
+        responses: {
+            /** @description Device authorized */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CredentialAttachSession"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AttachPage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                code: components["schemas"]["AttachCode"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetImage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                imageId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Image bytes */
+            200: {
+                headers: {
+                    "Cache-Control"?: string;
+                    ETag?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "image/*": string;
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetProvider: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok (JSON callers, or HTML callers when content negotiation falls through). */
+            200: {
+                headers: {
+                    ETag: components["headers"]["ETag"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            301: components["responses"]["CanonicalRedirectResponse"];
+            /** @description Verification not found, or it is `PRIVATE` and the caller is not authorized to see it. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DeleteProvider: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opaque `ETag` from a prior GET on the same resource. When
+                 *     supplied, the server applies optimistic concurrency: the
+                 *     mutation fails with `412 Precondition Failed` if the
+                 *     resource has been modified since. Omit for last-write-wins.
+                 */
+                "If-Match"?: components["parameters"]["IfMatch"];
+            };
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Archived. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Precondition Failed. The supplied `If-Match` does not match the verification's current `ETag` — re-fetch and retry. */
+            412: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateProvider: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opaque `ETag` from a prior GET on the same resource. When
+                 *     supplied, the server applies optimistic concurrency: the
+                 *     mutation fails with `412 Precondition Failed` if the
+                 *     resource has been modified since. Omit for last-write-wins.
+                 */
+                "If-Match"?: components["parameters"]["IfMatch"];
+            };
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateProviderRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["UpdateProviderRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    ETag: components["headers"]["ETag"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            /** @description Precondition Failed. The supplied `If-Match` does not match the verification's current `ETag` — re-fetch and retry. */
+            412: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetProviderBySlug: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Verification slug. URL-safe identifier; lowercase letters, digits, and hyphens only. If stale, HTML callers get a 301 to the current slug. */
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok. Slug matched the provider's current slug. */
+            200: {
+                headers: {
+                    ETag: components["headers"]["ETag"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            301: components["responses"]["CanonicalRedirectResponse"];
+            /** @description Verification not found, or it is `PRIVATE` and the caller is not authorized to see it. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ListProviderVersions: {
+        parameters: {
+            query?: {
+                /** @description Opaque cursor returned as `nextPageCursor` on a prior response. Pass it back as-is to fetch the next page; omit on the first request. Clients must not parse, modify, or fabricate cursors — the server reserves the encoding. */
+                cursor?: string;
+            };
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["ProviderVersion"][];
+                        nextPageCursor?: string;
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateProviderVersion: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateProviderVersionRequest"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderVersion"];
+                };
+            };
+            400: components["responses"]["ProblemResponse"];
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    GetProviderVersion: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                version: components["parameters"]["ProviderVersionPath"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    ETag: components["headers"]["ETag"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderVersion"];
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DeleteProviderVersion: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opaque `ETag` from a prior GET on the same resource. When
+                 *     supplied, the server applies optimistic concurrency: the
+                 *     mutation fails with `412 Precondition Failed` if the
+                 *     resource has been modified since. Omit for last-write-wins.
+                 */
+                "If-Match"?: components["parameters"]["IfMatch"];
+            };
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                version: components["parameters"]["ProviderVersionPath"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Precondition Failed. The supplied `If-Match` does not match the version's current `ETag` — re-fetch and retry. */
+            412: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateProviderVersion: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Opaque `ETag` from a prior GET on the same resource. When
+                 *     supplied, the server applies optimistic concurrency: the
+                 *     mutation fails with `412 Precondition Failed` if the
+                 *     resource has been modified since. Omit for last-write-wins.
+                 */
+                "If-Match"?: components["parameters"]["IfMatch"];
+            };
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                version: components["parameters"]["ProviderVersionPath"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateProviderVersionRequest"];
+            };
+        };
+        responses: {
+            /** @description Updated */
+            200: {
+                headers: {
+                    ETag: components["headers"]["ETag"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderVersion"];
+                };
+            };
+            400: components["responses"]["ProblemResponse"];
+            403: components["responses"]["ForbiddenResponse"];
+            /** @description Precondition Failed. The supplied `If-Match` does not match the version's current `ETag` — re-fetch and retry. */
+            412: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SubmitProviderVersionForReview: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                version: components["parameters"]["ProviderVersionPath"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["ProviderVersionReviewSubmission"];
+                "application/x-www-form-urlencoded": components["schemas"]["ProviderVersionReviewSubmission"];
+            };
+        };
+        responses: {
+            /** @description Submitted for review */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderVersion"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DecideProviderVersionReview: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                version: components["parameters"]["ProviderVersionPath"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ProviderVersionReviewDecision"];
+                "application/x-www-form-urlencoded": components["schemas"]["ProviderVersionReviewDecision"];
+            };
+        };
+        responses: {
+            /** @description Decision recorded */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderVersion"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    PublishProviderVersion: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                version: components["parameters"]["ProviderVersionPath"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["ProviderVersionPublishRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["ProviderVersionPublishRequest"];
+            };
+        };
+        responses: {
+            /** @description Published to live channel */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderVersion"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    RequestPublicListing: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["VisibilityChangeRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["VisibilityChangeRequest"];
+            };
+        };
+        responses: {
+            /** @description Submitted for public listing review */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                };
+            };
+            /** @description Provider is already PUBLIC or has no live versions */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    MakePrivate: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["VisibilityChangeRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["VisibilityChangeRequest"];
+            };
+        };
+        responses: {
+            /** @description Visibility changed to PRIVATE */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                };
+            };
+            /** @description Provider is already PRIVATE */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CancelPublicListingRequest: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                version: components["parameters"]["ProviderVersionPath"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["VisibilityChangeRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["VisibilityChangeRequest"];
+            };
+        };
+        responses: {
+            /** @description Review request cancelled, version moved to draft */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProviderVersion"];
+                };
+            };
+            /** @description Version is not in_review or cannot be cancelled */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+}