@reclaimprotocol/client 0.1.0 → 0.1.2

package/src/types/openapi.gen.ts

@@ -31,7 +31,10 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Get the homepage */
+        /**
+         * Discover home — search a website to verify
+         * @description Default home page. A website-first search: the visitor types a website and picks one to continue to `/site/{domain}`, where they choose what data to prove. Renders popular websites below the search.
+         */
         get: operations["Index"];
         put?: never;
         post?: never;
@@ -102,6 +105,212 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/discover/websites": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Suggest websites for the Discover flow
+         * @description Website-first autocomplete that backs the Discover home page (`/`). Returns the distinct websites (one entry per domain) that have at least one verification the caller can see, ranked by relevance to `q`. Each entry carries the aggregated list of data points provable for that website. With no `q`, returns popular websites (most verifications first).
+         *
+         *     HTML / HTMX callers receive a fragment list (swapped into the search dropdown); JSON / SDK callers receive the suggestions document.
+         */
+        get: operations["DiscoverWebsites"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/site/{domain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Website landing & data-point selection page
+         * @description SEO landing page for a website, and the data-point selection step of the Discover flow. Lists every data point Reclaim can currently prove for `{domain}` (aggregated across all verifications the caller can see) so a visitor can pick what to verify and continue. Organic search traffic ("verify github username") and the in-app `/` → website-select flow converge on this single canonical URL.
+         *
+         *     HTML callers receive the full page; when `q` is present and the request is an HTMX request, only the filtered data-point list fragment is returned. JSON / SDK callers receive the website's data points as a document.
+         */
+        get: operations["SitePage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/site/{domain}/panel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Discover summary panel fragment (htmx)
+         * @description HTMX-only fragment for the Discover site page. The data-point form fires this on every selection change (checkbox / mode / source pin), carrying the whole selection in the query string. Returns the summary panel aside (the swap target) plus an out-of-band swap of the Advanced source picker.
+         */
+        get: operations["SitePanel"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/site/{domain}/build": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Build page — providers, try, and integration guide for a selection
+         * @description The step after data-point selection on `/site/{domain}`. Given the selected data points (plus optional pinned sources, provided values, and a resolution `mode`), shows which existing verification providers cover the selection, a member-only "Try verification" action, and a ready-to-paste integration guide. The whole selection travels in the query string so the page is server-rendered and back-navigable.
+         */
+        get: operations["SiteBuild"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/site/{domain}/try": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a SANDBOX test verification session for the selection
+         * @description Creates a real SANDBOX verification session under the signed-in member's personal organization for the selected data points, so they can test the flow on `/v/{sessionId}` without registering a callback subscription. Requires a signed-in member (session cookie); the provider set is recomputed server-side from the selection.
+         */
+        post: operations["SiteBuildTry"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/site/{domain}/repair": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Failure-aware "Repair with an AI coding agent" wizard fragment
+         * @description Body of the build page's repair dialog, lazy-loaded after a sandbox Try fails so the agent prompt includes the REAL failure (which provider(s) failed + the error reason, read from the session's event log) and the resolved provider set. HTML / HTMX fragment.
+         */
+        get: operations["SiteBuildRepair"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/site/{domain}/alternative": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Re-resolve excluding a failed provider, else hand off to repair
+         * @description After a sandbox Try fails, reads which provider(s) failed from the session analytics and re-resolves the selection with them excluded. If the rest still cover it, responds with an `HX-Redirect` to the build page (failed providers excluded — the alternative set). Otherwise emits an `openRepair` HX-Trigger so the client opens the repair wizard.
+         */
+        get: operations["SiteBuildAlternative"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/discover/teach": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * “Teach our agent” instructions for a missing website / data point
+         * @description Returns the "Teach our agent" panel shown when a website or data point a user wants does not exist yet: steps to install the Reclaim MCP server plus a ready-to-copy prompt, templated with the requested `domain` and (optionally) `dataPoint`, that instructs an agent to author the missing verification. HTML / HTMX only (a dialog fragment).
+         */
+        get: operations["DiscoverTeachAgent"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/discover/resolve": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Resolve a website + data points to verification providers
+         * @description Provider resolution: given a website and the data points the user wants their users to prove, return the smallest set of existing providers whose data points COVER the selection (greedy combine), the `requiredContext` inputs the consumer must supply, and any `uncovered` points no provider exposes yet (`needsCreation` is true then — author a provider with the agent tools). When the chosen providers can be fused into one (same start page, no clashing page scripts) `merge.mergeable` is true.
+         *
+         *     Agent flow: pick a website (`GET /discover/data-points` lists what's verifiable there), confirm the data points with the user, call this to get the `providers` + `requiredContext`, collect those context values from the user, then `POST /verifications/sessions` with `providers` (pass every id) and `context` to mint a verification.
+         */
+        get: operations["DiscoverResolve"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/discover/data-points": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the verifiable data points on a website
+         * @description The data points existing providers can prove on a website — the menu to pick from before `GET /discover/resolve`. Optionally filter by `q`.
+         */
+        get: operations["DiscoverDataPoints"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/providers/{providerId}/preview.png": {
         parameters: {
             query?: never;
@@ -393,6 +602,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v/{sessionId}/dispose": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Dispose the session's remote browser
+         * @description Tears down the Popcorn remote-browser session backing this verification and cancels any in-flight run. Called by the verification page's "close" button (and safe to call after a session is already terminal — the dispose is idempotent). Popcorn sessions are a scarce, expensive resource, so freeing them promptly rather than waiting for their TTL matters. Same model as the status fragment: possession of the session id; no body.
+         */
+        post: operations["DisposeVerificationSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v/{sessionId}/sse": {
         parameters: {
             query?: never;
@@ -564,8 +793,7 @@ export interface paths {
         delete?: never;
         options?: never;
         head?: never;
-        /** Update the authenticated user's profile */
-        patch: operations["UpdateMe"];
+        patch?: never;
         trace?: never;
     };
     "/users/{userId}": {
@@ -641,7 +869,11 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        get?: never;
+        /**
+         * List organization members, optionally filtered by email
+         * @description Returns the organization's members, optionally filtered by an email substring (`q`). Renders the members-list fragment for the org page's live filter; same visibility as the org page.
+         */
+        get: operations["SearchOrgMembers"];
         put?: never;
         /**
          * Invite a member to an organization
@@ -739,7 +971,7 @@ export interface paths {
         patch: operations["UpdateTheme"];
         trace?: never;
     };
-    "/orgs/{orgId}/credential": {
+    "/orgs/{orgId}/keypair": {
         parameters: {
             query?: never;
             header?: never;
@@ -747,21 +979,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get the organization's encryption credential
-         * @description Returns the organization's single X25519 encryption credential — the public JWK the Builder uses to JWE-encrypt delivered results — or `404` when none is set (delivery is plaintext in that case). Authenticated by the org's `OrgToken` or a human `BearerAuth` session for an active member of the org.
+         * Get the organization's encryption keypair
+         * @description Returns the organization's single Ethereum (secp256k1) encryption keypair — its public JWK, derived eth address, and `canEncryptResult` flag — or `404` when none is set (the org is keyless ⇒ plaintext delivery). Authenticated by the org's `OrgToken` or a human `BearerAuth` session for an active member of the org.
          */
-        get: operations["GetOrgCredential"];
+        get: operations["GetOrgKeypair"];
         /**
-         * Set (or replace) the organization's encryption credential
-         * @description Upserts the organization's single X25519 encryption credential. The body carries the org's **encryption public JWK** (`{kty:'OKP', crv:'X25519', x}`); the matching private key never leaves the consumer. Replacing overwrites the single row. Once set, terminal results are delivered as a compact JWE encrypted to this key; clear it to revert to plaintext delivery. Authenticated by the org's `OrgToken` or a human `BearerAuth` session for an active member of the org.
+         * Set (or rotate) the organization's encryption keypair
+         * @description Upserts the organization's single Ethereum (secp256k1) encryption keypair. The body carries the org's **eth public key** — as an uncompressed hex string (`0x04`+128 hex) or a secp256k1 public JWK (`{kty:'EC', crv:'secp256k1', x, y}`) — and `canEncryptResult`. The matching private key never leaves the consumer. Setting overwrites the single row (and creates it for a keyless org). When `canEncryptResult` is true, terminal results are delivered as an ECIES ciphertext encrypted to this key; otherwise plaintext. Authenticated by the org's `OrgToken` or a human `BearerAuth` session for an active member of the org.
          */
-        put: operations["SetOrgCredential"];
+        put: operations["SetOrgKeypair"];
         post?: never;
         /**
-         * Clear the organization's encryption credential
-         * @description Removes the organization's encryption credential. After this, terminal results are delivered as plaintext until a new credential is set. Authenticated by the org's `OrgToken` or a human `BearerAuth` session for an active member of the org.
+         * Clear the organization's encryption keypair
+         * @description Removes the organization's encryption keypair (the org reverts to keyless ⇒ plaintext delivery, and loses its eth identity address) until a new keypair is set. Authenticated by the org's `OrgToken` or a human `BearerAuth` session for an active member of the org.
          */
-        delete: operations["DeleteOrgCredential"];
+        delete: operations["DeleteOrgKeypair"];
         options?: never;
         head?: never;
         patch?: never;
@@ -879,6 +1111,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/attach": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Device-pairing landing page
+         * @description Page where a user enters the 5-character pairing code shown by their CLI / MCP. Submitting the form (`?code=`) redirects to the canonical `/attach/{code}` page; an invalid code re-renders the form with an error.
+         */
+        get: operations["AttachLanding"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/attach/{code}": {
         parameters: {
             query?: never;
@@ -1195,9 +1447,9 @@ export interface paths {
          *     the presented `OrgToken` resolves to. The body is just `callbackUrl`
          *     and `events`. At least one subscription must exist for the org before a
          *     verification session can be created. Delivery is scoped by org: terminal
-         *     results are encrypted as a compact JWE to the org's encryption
-         *     credential when set (see `PUT /orgs/{orgId}/credential`), else delivered
-         *     as plaintext.
+         *     results are ECIES-encrypted to the org's eth public key when its
+         *     `canEncryptResult` is enabled (see `PUT /orgs/{orgId}/keypair`), else
+         *     delivered as plaintext.
          */
         post: operations["CreateCallbackSubscription"];
         delete?: never;
@@ -1391,8 +1643,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get the resolved provider recipe for a session
-         * @description Returns the resolved provider version's `initialUrl` + `requests` for this session — what the Verification Client needs to run it. Authorized for the Verification Client (`X-VC-Token` service token) or the session creator (authenticated by the consumer's `OrgToken`; the resolved org must match the session), so it works regardless of the provider's visibility (unlike `GetProvider`, which 404s on PRIVATE providers for non-members).
+         * Get the resolved provider recipes for a session
+         * @description Returns the session's resolved provider versions' recipes (`initialUrl` + `requests` per provider), in run order — what the Verification Client needs to run the session (each provider sequentially in one browser session). Authorized for the Verification Client (`X-VC-Token` service token) or the session creator (authenticated by the consumer's `OrgToken`; the resolved org must match the session), so it works regardless of the provider's visibility (unlike `GetProvider`, which 404s on PRIVATE providers for non-members).
          */
         get: operations["GetVerificationRecipe"];
         put?: never;
@@ -1501,7 +1753,7 @@ export interface paths {
         };
         /**
          * List callback encryption keys for a session
-         * @description Used by the Verification Client (X-VC-Token) after the terminal event: returns the session org's callback subscriptions that subscribe to that terminal event. Each item carries the org's `publicKeyJwk` (X25519) to JWE-encrypt the result to, or none (deliver plaintext).
+         * @description Used by the Verification Client (X-VC-Token) after the terminal event: returns the session org's callback subscriptions that subscribe to that terminal event. Each item carries the org's `publicKeyJwk` (secp256k1) to ECIES-encrypt the result to when the org's `canEncryptResult` is enabled, or none (deliver plaintext).
          */
         get: operations["ListSessionCallbackKeys"];
         put?: never;
@@ -1527,7 +1779,7 @@ export interface paths {
         put?: never;
         /**
          * Submit the signed, encrypted verification result
-         * @description Used by the Verification Client (X-VC-Token) to submit the result after a terminal event. The VC signs the JWS and JWE-encrypts it (ECDH-ES + A256GCM over X25519) to the org's encryption key (from the callback-keys endpoint); it submits one payload per subscription. The Builder stores each payload, enqueues it for the delivery worker (retry → DLQ), and never sees the plaintext. The Verification Client does not contact the Consumer.
+         * @description Used by the Verification Client (X-VC-Token) to submit the result after a terminal event. The VC signs the JWS and, when the org's `canEncryptResult` is enabled, ECIES-encrypts it to the org's eth public key (from the callback-keys endpoint); it submits one payload per subscription. The Builder stores each payload, enqueues it for the delivery worker (retry → DLQ), and never sees the plaintext. The Verification Client does not contact the Consumer.
          */
         post: operations["SubmitVerificationResult"];
         delete?: never;
@@ -1618,18 +1870,18 @@ export interface webhooks {
          *     `timestamp` are *plaintext routing hints* so the consumer can
          *     route and dedupe before doing any crypto. Everything derived
          *     from the end-user (claims, extracted parameters, proofs,
-         *     context) is inside `data`: a compact JWE wrapping the signed JWS
-         *     result when the org has an encryption credential, else the
+         *     context) is inside `data`: an ECIES ciphertext wrapping the signed JWS
+         *     result when the org's `canEncryptResult` is enabled, else the
          *     plaintext signed JWS. The envelope is **not authenticated** —
          *     act only on the decrypted and signature-verified JWS contents,
          *     and check that its `reclaimSessionId` matches the session you
          *     expect.
          *
-         *     **Decrypting `data`.** When the org has registered an encryption
-         *     credential, `data` is a compact JWE (RFC 7516,
-         *     `ECDH-ES+A256GCM` over X25519); decrypt it with the matching
-         *     X25519 private key (e.g. `jose` `compactDecrypt`) to recover the
-         *     inner JWS. When no credential is set, `data` is the JWS directly.
+         *     **Decrypting `data`.** When the org's `canEncryptResult` is enabled,
+         *     `data` is an ECIES ciphertext (base64url, secp256k1 + AES-256-GCM);
+         *     decrypt it with the matching eth private key to recover the inner
+         *     JWS. When the org is keyless or the flag is off, `data` is the JWS
+         *     directly.
          *     The JWS is an RFC 7515 result in General JSON serialization
          *     (`alg: ES256K`); verify it against
          *     `GET /.well-known/jwks.json` (`kid` = the signer's ETH address).
@@ -1856,8 +2108,8 @@ export interface components {
             providers?: components["schemas"]["ProviderListItem"][];
             /** @description Themes owned by this organization. */
             themes?: components["schemas"]["Theme"][];
-            /** @description The organization's single X25519 encryption credential, if set. Only populated on the org-detail endpoint and only visible to active members. Absent ⇒ results are delivered as plaintext. */
-            credential?: components["schemas"]["OrgCredential"];
+            /** @description The organization's single Ethereum (secp256k1) encryption keypair, if set. Only populated on the org-detail endpoint and only visible to active members. Absent ⇒ the org is keyless and results are delivered as plaintext. */
+            keypair?: components["schemas"]["OrgKeypair"];
             /** @description Billing record attached to the org, if any. Owner-visible only; absent for members. Presence promotes the org to production mode. */
             billing?: components["schemas"]["OrgBilling"];
             createMetadata: components["schemas"]["ActorMetadata"];
@@ -1888,26 +2140,43 @@ export interface components {
              */
             status: components["schemas"]["EntityStatus"];
         };
-        /** @description An X25519 public key in JWK form (RFC 8037 OKP), used to JWE-encrypt delivered verification results. The matching private key never leaves the consumer. */
-        JwkX25519Public: {
+        /** @description A secp256k1 (Ethereum) public key in JWK form (`{kty:'EC', crv:'secp256k1', x, y}`), used to ECIES-encrypt delivered verification results and to identify the org. The matching private key never leaves the consumer. Same shape published by the signing JWKS. */
+        JwkSecp256k1Public: {
             /** @enum {string} */
-            kty: "OKP";
+            kty: "EC";
             /** @enum {string} */
-            crv: "X25519";
-            /** @description base64url-encoded public key bytes. */
+            crv: "secp256k1";
+            /** @description base64url-encoded X coordinate (32 bytes). */
             x: string;
-        };
-        /** @description An organization's single encryption credential: the X25519 public JWK the Builder uses to JWE-encrypt delivered results. One per org, replaceable via `PUT /orgs/{orgId}/credential`. Absent ⇒ results are delivered as plaintext. */
-        OrgCredential: {
-            publicKeyJwk: components["schemas"]["JwkX25519Public"];
-            /** @description Optional human-readable label set when the credential was stored. */
+            /** @description base64url-encoded Y coordinate (32 bytes). */
+            y: string;
+        };
+        /** @description An organization's single Ethereum (secp256k1) encryption keypair: the public JWK, its derived eth address (which also identifies the org), and the `canEncryptResult` toggle. One per org, set/rotated via `PUT /orgs/{orgId}/keypair`. Absent ⇒ the org is keyless (plaintext delivery). */
+        OrgKeypair: {
+            publicKeyJwk: components["schemas"]["JwkSecp256k1Public"];
+            /** @description Lowercase 0x eth address derived from the public key. */
+            ethAddress: string;
+            /** @description When true, terminal results are ECIES-encrypted to this key; when false (the default), they are delivered as plaintext. */
+            canEncryptResult: boolean;
+            /** @description Optional human-readable label set when the keypair was stored. */
             label?: string;
             createMetadata: components["schemas"]["ActorMetadata"];
             updateMetadata: components["schemas"]["ActorMetadata"];
         };
-        /** @description Body for `PUT /orgs/{orgId}/credential`. */
-        OrgCredentialRequest: {
-            publicKeyJwk: components["schemas"]["JwkX25519Public"];
+        OrgKeypairRequest: components["schemas"]["OrgKeypairHexRequest"] | components["schemas"]["OrgKeypairJwkRequest"];
+        /** @description Body for `PUT /orgs/{orgId}/keypair`. Carries the org's eth public key as an uncompressed hex string (`0x04` + 128 hex) — the eth-native form wallets/ethers emit. The matching private key never leaves the consumer. */
+        OrgKeypairHexRequest: {
+            /** @description Uncompressed secp256k1 public key, `0x04` + 128 hex. */
+            publicKey: string;
+            /** @default false */
+            canEncryptResult: boolean;
+            label?: string;
+        };
+        /** @description Body for `PUT /orgs/{orgId}/keypair`. Carries the org's eth public key as a secp256k1 public JWK. */
+        OrgKeypairJwkRequest: {
+            publicKeyJwk: components["schemas"]["JwkSecp256k1Public"];
+            /** @default false */
+            canEncryptResult: boolean;
             label?: string;
         };
         /** @description Response of `POST /orgs/{orgId}/token`. The plaintext `orgSecret` is shown **only once** here; the server stores only its HMAC. Use it as `Authorization: Bearer <orgSecret>` (the `OrgToken` scheme). */
@@ -1993,8 +2262,10 @@ export interface components {
             writeRedactionMode?: components["schemas"]["WriteRedactionMode"];
             /** @description Apply TLS configuration when creating the tunnel to the attestor. */
             additionalClientOptions?: components["schemas"]["AdditionalTlsClientOptions"];
-            /** @description A list of match conditions for the response. */
-            matches?: components["schemas"]["ResponseMatch"][];
+            /** @description Conditions the (redacted) response must satisfy for the proof to be valid. Each runs against the union of the portions revealed by `responseRedactions` (or the whole response when there are none). Mirrors attestor-core `responseMatches`. */
+            responseMatches?: components["schemas"]["ResponseMatch"][];
+            /** @description Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — NOT paired 1:1 with `responseMatches`. Mirrors attestor-core `responseRedactions`. */
+            responseRedactions?: components["schemas"]["ResponseRedaction"][];
         };
         /** @description A template for selecting request */
         RequestSelectionTemplate: components["schemas"]["RequestSelection"] & {
@@ -2042,11 +2313,9 @@ export interface components {
             type: "regex" | "contains";
             /** @description The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups. */
             value: string;
-            /** @description Optional extractor describing which portion of the response to pin to the proof. When absent, the match runs against the raw response body. */
-            extract?: components["schemas"]["ExtractDataSpecifier"];
         };
         /** @description Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. "HTTP/1.1 200 OK") */
-        ExtractDataSpecifier: {
+        ResponseRedaction: {
             /** @description expect an HTML response, and to contain a certain xpath for eg. "/html/body/div.a1/div.a2/span.a5" */
             xPath?: string;
             /** @description expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0' */
@@ -2222,6 +2491,43 @@ export interface components {
             primaryDataPoint?: string;
             dataPoints: string[];
         };
+        /** @description One website (distinct domain) in the Discover search results. Aggregates, across every verification the caller can see on that domain, the brand display fields and the union of provable data points. */
+        WebsiteSuggestion: {
+            /**
+             * Format: hostname
+             * @description Canonical root domain (e.g. `github.com`).
+             */
+            domain: string;
+            /** @description Display name for the website (scraped site name or derived from the domain). */
+            brandName: string;
+            /**
+             * Format: uri
+             * @description Favicon URL for the website.
+             */
+            iconUrl?: string;
+            /** @description Deduplicated names of every data point provable for this website. */
+            dataPoints: string[];
+            /** @description Number of verifications backing this website that the caller can see. */
+            providerCount: number;
+        };
+        /** @description Body for `POST /site/{domain}/try`. Only the verification `context` (values for the resolved providers' `requiredContext` inputs). The selection (dataPoints / mode / pins) travels in the query string. */
+        SiteBuildTryBody: {
+            /** @description Input key → value the consumer's app supplies. */
+            context?: {
+                [key: string]: string;
+            };
+        };
+        /** @description A single data point selectable on the `/site/{domain}` page, with how many visible verifications expose it and one example verification slug. */
+        DataPointItem: {
+            /** @description Data-point name (e.g. `username`, `followers_count`). */
+            name: string;
+            /** @description Human description of the data point, taken from the response match that declares it. Absent when no match supplies one. */
+            description?: string;
+            /** @description Number of visible verifications on the domain that expose this data point. */
+            providerCount: number;
+            /** @description Slug of one verification that exposes this data point. */
+            exampleProviderSlug?: string;
+        };
         InterceptorOptions: {
             /**
              * @description How traffic interception is implemented.
@@ -2412,12 +2718,16 @@ export interface components {
             /** @description Opaque bearer token. Send as `Authorization: Bearer <token>` on every authenticated request. */
             token: string;
         };
-        /** @description Caller-editable fields on the authenticated user. */
-        UpdateUserRequest: {
-            name?: string;
-        };
+        /** @description Body for `POST /orgs`. Explicitly-created orgs must declare their Ethereum (secp256k1) encryption public key — it identifies the org and, when `canEncryptResult` is enabled, encrypts delivered results. */
         CreateOrgRequest: {
             name: string;
+            /** @description The org's eth public key, uncompressed hex (`0x04` + 128 hex) — the eth-native form wallets/ethers emit. The matching private key never leaves the consumer. */
+            publicKey: string;
+            /**
+             * @description When true, terminal results are ECIES-encrypted to this key; when false (the default), they are delivered as plaintext.
+             * @default false
+             */
+            canEncryptResult: boolean;
         };
         UpdateOrgRequest: {
             name?: string;
@@ -2607,9 +2917,10 @@ export interface components {
          * @description Lifecycle event reported for a verification session. A healthy run
          *     proceeds through these in order; reading the gaps locates where a
          *     session stalled. Session-level terminal events trigger callback
-         *     delivery; request-level events are progress pings carrying a
-         *     `request_id` in their event data. New values may be added over time;
-         *     clients MUST tolerate unknown values in responses.
+         *     delivery; provider-/request-level events are progress pings carrying a
+         *     `provider_id` (and `request_id` for request-level ones) in their event
+         *     data. New values may be added over time; clients MUST tolerate unknown
+         *     values in responses.
          *
          *     - `session_pending`: Session created; awaiting the end-user.
          *
@@ -2618,6 +2929,10 @@ export interface components {
          *
          *     - `verification_client_ready`: The client initialized.
          *
+         *     - `verification_provider_started`: The client began verifying a provider
+         *       (`provider_id`/`resolved_version`/`ordinal` in `eventData`). One per
+         *       provider, in run order, for multi-provider sessions.
+         *
          *     - `request_matched`: The target request was captured on the provider
          *       site. Absent (after opened) ⇒ the user didn't complete the journey.
          *
@@ -2638,7 +2953,7 @@ export interface components {
          *     - `session_expired`: `expiresAt` passed before a terminal event.
          * @enum {string}
          */
-        VerificationEvent: "session_pending" | "verification_client_opened" | "verification_client_ready" | "request_matched" | "request_claim_created" | "request_claim_completed" | "request_claim_rejected" | "request_claim_failed" | "verification_success" | "verification_rejected" | "verification_error" | "session_expired";
+        VerificationEvent: "session_pending" | "verification_client_opened" | "verification_client_ready" | "verification_provider_started" | "request_matched" | "request_claim_created" | "request_claim_completed" | "request_claim_rejected" | "request_claim_failed" | "verification_success" | "verification_rejected" | "verification_error" | "session_expired";
         /**
          * @description Status of a verification session, derived from its events. New values
          *     may be added over time; clients MUST tolerate unknown values in
@@ -2675,7 +2990,7 @@ export interface components {
          * @enum {string}
          */
         CallbackDeliveryStatus: "pending" | "delivered" | "attempt_failed" | "failed";
-        /** @description A pre-registered destination for verification results, owned by an organization. A session's results go to every subscription on the session's org whose `events` include the terminal event. At least one subscription must exist for the org before a session can be created. Terminal results are encrypted as a compact JWE to the org's encryption credential when set (see `OrgCredential`), else delivered as plaintext. */
+        /** @description A pre-registered destination for verification results, owned by an organization. A session's results go to every subscription on the session's org whose `events` include the terminal event. At least one subscription must exist for the org before a session can be created. Terminal results are ECIES-encrypted to the org's eth public key when its `canEncryptResult` is enabled (see `OrgKeypair`), else delivered as plaintext. */
         CallbackSubscription: {
             /** Format: uuid */
             id: string;
@@ -2718,11 +3033,8 @@ export interface components {
              * @description UUID v7 session id (also echoed in context as `reclaimSessionId`).
              */
             id: string;
-            providerId: components["schemas"]["ProviderID"];
-            /** @description Version constraint requested by the Consumer (empty = latest). */
-            version?: string;
-            /** @description Exact version resolved at creation time. */
-            resolvedVersion: string;
+            /** @description The providers this session verifies, in run order. The Verification Client runs each (sequentially, in one browser session) and submits one combined result; all are required. */
+            providers: components["schemas"]["SessionProvider"][];
             /** @description The organization that owns this session. */
             orgId?: components["schemas"]["OrgID"];
             /**
@@ -2749,16 +3061,29 @@ export interface components {
             mode: components["schemas"]["CredentialMode"];
             sandboxLimits?: components["schemas"]["SandboxLimits"];
         };
-        /** @description Body for `POST /verifications/sessions`. Authenticated by the consumer's `OrgToken`. Carries no callback URLs — they come from the org's callback subscriptions. */
-        CreateVerificationSessionRequest: {
+        /** @description One provider a session verifies, with its resolved version. */
+        SessionProvider: {
+            providerId: components["schemas"]["ProviderID"];
+            /** @description Version constraint requested by the Consumer (empty = latest). */
+            version?: string;
+            /** @description Exact version resolved at creation time. */
+            resolvedVersion: string;
+        };
+        /** @description A provider (+ optional version) to verify in a session. */
+        SessionProviderInput: {
             providerId: components["schemas"]["ProviderID"];
             /** @description Semver constraint; empty resolves to the latest trunk version. */
             version?: string;
-            /** @description Consumer context. Validated against the resolved provider version's `requiredContext` JSON Schema (a 400 is returned on mismatch); extra fields are always allowed. Recipe requests reference these values as `{{context.<key>}}`. Echoed back (plus `reclaimSessionId`) in the result. */
+        };
+        /** @description Body for `POST /verifications/sessions`. Authenticated by the consumer's `OrgToken`. Carries no callback URLs — they come from the org's callback subscriptions. The one shared `context` is validated against every provider's `requiredContext`. */
+        CreateVerificationSessionRequest: {
+            /** @description Providers to verify, in run order. The Verification Client runs each sequentially in one browser session and submits one combined result; all are required. */
+            providers: components["schemas"]["SessionProviderInput"][];
+            /** @description Consumer context, shared by all providers. Validated against EACH resolved provider version's `requiredContext` JSON Schema (a 400 is returned on mismatch); extra fields are always allowed. Recipe requests reference these values as `{{context.<key>}}`. Echoed back (plus `reclaimSessionId`) in the result. */
             context: {
                 [key: string]: unknown;
             };
-            /** @description Must contain a `{sessionId}` placeholder. */
+            /** @description Must contain a `{sessionId}` placeholder. Must be an http(s) URL. */
             verificationClientUrl: string;
         };
         /** @description Body for `POST /verifications/sessions/{sessionId}/events`. Status ping only — never carries the proof (use the result endpoint for that). */
@@ -2802,7 +3127,7 @@ export interface components {
             /** @description The event that produced this delivery. */
             event: components["schemas"]["VerificationEvent"];
             timestamp: components["schemas"]["Timestamp"];
-            /** @description Payload interpreted per `event`. Terminal events: the signed result — a **compact JWE** (RFC 7516, `ECDH-ES+A256GCM` over X25519) wrapping the signed JWS when the org has an encryption credential (decrypt with the matching X25519 private key to recover the inner JWS), else the JWS directly; the inner JWS parses as the `Jws` schema with payload `VerificationResultPayload`. Non-terminal events: plaintext JSON `{ event, eventData }` (unsigned). */
+            /** @description Payload interpreted per `event`. Terminal events: the signed result — an **ECIES ciphertext** (base64url, secp256k1 + AES-256-GCM) wrapping the signed JWS when the org's `canEncryptResult` is enabled (decrypt with the matching eth private key to recover the inner JWS), else the JWS directly; the inner JWS parses as the `Jws` schema with payload `VerificationResultPayload`. Non-terminal events: plaintext JSON `{ event, eventData }` (unsigned). */
             data: string;
         };
         /** @description The decoded JWS payload of a delivered verification result (the JWS itself is the `Jws` schema, signed ES256K by the key published at `/.well-known/jwks.json`). Consumers MUST check `reclaimSessionId` against the session they created and `verification_session.status` for the outcome. `results` is present on success; `problem` (RFC 9457 shape) is set when the run failed. */
@@ -2821,8 +3146,13 @@ export interface components {
             verification_session: {
                 /** @enum {string} */
                 status: "success" | "rejected" | "error";
-                provider_id: components["schemas"]["ProviderID"];
-                resolved_version: string;
+                /** @description The providers verified in this session, in run order. */
+                providers: ({
+                    provider_id: components["schemas"]["ProviderID"];
+                    resolved_version: string;
+                } & {
+                    [key: string]: unknown;
+                })[];
                 /** Format: uuid */
                 org_id?: string | null;
                 /** Format: uuid */
@@ -2831,19 +3161,26 @@ export interface components {
             } & {
                 [key: string]: unknown;
             };
-            /** @description One entry per proven request (success only). */
+            /** @description One entry per verified provider (success only), in run order. Each carries that provider's proven requests. */
             results?: ({
-                request_id?: string;
-                url?: string;
-                method?: string;
-                extracted_parameters?: {
+                provider_id: components["schemas"]["ProviderID"];
+                resolved_version: string;
+                /** @description One entry per proven request for this provider. */
+                requests: ({
+                    request_id?: string;
+                    url?: string;
+                    method?: string;
+                    extracted_parameters?: {
+                        [key: string]: unknown;
+                    };
+                    content_hash?: string;
+                    identifier?: string;
+                    owner?: string;
+                    /** @description Base64url-encoded nested JWS (attestor proof). */
+                    proof?: unknown;
+                } & {
                     [key: string]: unknown;
-                };
-                content_hash?: string;
-                identifier?: string;
-                owner?: string;
-                /** @description Base64url-encoded nested JWS (attestor proof). */
-                proof?: unknown;
+                })[];
             } & {
                 [key: string]: unknown;
             })[];
@@ -2854,18 +3191,18 @@ export interface components {
         } & {
             [key: string]: unknown;
         };
-        /** @description A callback subscription's delivery key, returned to the Verification Client. When `publicKeyJwk` is present the VC JWE-encrypts the result (ECDH-ES + A256GCM over X25519) for that org; when absent the VC submits the plaintext signed JWS. */
+        /** @description A callback subscription's delivery key, returned to the Verification Client. When `publicKeyJwk` is present the VC ECIES-encrypts the result for that org (its `canEncryptResult` is enabled); when absent the VC submits the plaintext signed JWS. */
         CallbackKey: {
             /** Format: uuid */
             subscriptionId: string;
-            /** @description X25519 public JWK to JWE-encrypt the result to. Absent ⇒ deliver plaintext. */
-            publicKeyJwk?: components["schemas"]["JwkX25519Public"];
+            /** @description The org's secp256k1 (eth) public JWK to ECIES-encrypt the result to. Absent ⇒ deliver plaintext. */
+            publicKeyJwk?: components["schemas"]["JwkSecp256k1Public"];
         };
-        /** @description One result payload for one callback subscription. The Verification Client signs the JWS and, when the org has an encryption credential, JWE-encrypts it (ECDH-ES + A256GCM over X25519); otherwise it submits the plaintext JWS. Either way the payload is carried in `payload` and the Builder stores + delivers it as a blind relay. */
+        /** @description One result payload for one callback subscription. The Verification Client signs the JWS and, when the org's `canEncryptResult` is enabled, ECIES-encrypts it to the org's eth public key; otherwise it submits the plaintext JWS. Either way the payload is carried in `payload` and the Builder stores + delivers it as a blind relay. */
         CallbackDelivery: {
             /** Format: uuid */
             subscriptionId: string;
-            /** @description The signed result payload, as raw text (no base64) — a compact JWE (ECDH-ES + A256GCM over X25519) when the org has an encryption credential, otherwise the plaintext JWS JSON. Same raw form the callback envelope's `data` carries. */
+            /** @description The signed result payload, as raw text — an ECIES ciphertext (base64url) when the org's `canEncryptResult` is enabled, otherwise the plaintext JWS JSON. Same raw form the callback envelope's `data` carries. */
             payload: string;
         };
         /** @description Body for `POST /verifications/sessions/{sessionId}/result`. The Verification Client signs the JWS, encrypts it per callback subscription (keys fetched from the callback-keys endpoint), and submits one ciphertext per subscription. The Builder stores + delivers them; it never sees the plaintext result. */
@@ -3004,7 +3341,7 @@ export interface operations {
     Providers: {
         parameters: {
             query?: {
-                /** @description Free-text search across `title`, `description`, `domain`, `primaryDataPoint`, `dataPoints`, and the latest version's `initialUrl`. Matched case-insensitively; returns results ranked by relevance (e.g., data point matches rank higher than description matches). */
+                /** @description Free-text search across `title`, `description`, `domain`, `primaryDataPoint`, `dataPoints`, and the latest version's `initialUrl`. Matched case-insensitively; returns results ranked by relevance (e.g., data point matches rank higher than description matches). An empty value is treated as no query (the handler redirects to the bare catalog). */
                 q?: string;
                 /** @description Filter by tag. Repeat the parameter to OR multiple tags (a provider matching any of them is returned). Combined with `q` via AND. */
                 tag?: components["schemas"]["Tag"][];
@@ -3089,21 +3426,414 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    ProviderPreviewImage: {
+    DiscoverWebsites: {
         parameters: {
             query?: {
-                /** @description Cache buster. The server includes the current ETag here on the canonical URL; stale values still return the current image but without long cache headers. */
-                v?: string;
+                /** @description Free-text query matched against website domain, data points, brand title, and description. Omit for the popular-websites list. */
+                q?: string;
             };
             header?: never;
-            path: {
-                providerId: components["schemas"]["ProviderID"];
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description PNG bytes */
+            /** @description Website suggestions. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["WebsiteSuggestion"][];
+                    };
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SitePage: {
+        parameters: {
+            query?: {
+                /** @description Case-insensitive substring filter on data-point names. Empty = no filter, so clearing the box doesn't need a client workaround. */
+                q?: string;
+                /** @description Currently selected data-point names — from a deep-link (the provider page's "Use provider") or the form's own htmx round-trips. Repeat to pass several; renders the summary panel and pre-checks the boxes. */
+                dataPoints?: string[];
+                /** @description Resolution mode reflected in the Continue URL. */
+                mode?: "list" | "combine";
+                /** @description Source pins from the form: `pins[<dataPoint>]=id,id`. Maps each data-point name to a comma-joined list of preferred providerIds (empty = Auto). */
+                pins?: {
+                    [key: string]: string;
+                };
+            };
+            header?: never;
+            path: {
+                /** @description Website domain (e.g. `github.com`). Normalized server-side (scheme / `www.` / port / path stripped). */
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The website's provable data points. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** Format: hostname */
+                        domain: string;
+                        brandName: string;
+                        /** Format: uri */
+                        iconUrl?: string;
+                        dataPoints: components["schemas"]["DataPointItem"][];
+                    };
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SitePanel: {
+        parameters: {
+            query?: {
+                /** @description Selected data-point names. Repeat to pass several. */
+                dataPoints?: string[];
+                /** @description Resolution mode reflected in the Continue URL. */
+                mode?: "list" | "combine";
+                /** @description Source pins from the form: `pins[<dataPoint>]=id,id`. Maps each data-point name to a comma-joined list of preferred providerIds (empty = Auto). */
+                pins?: {
+                    [key: string]: string;
+                };
+                /** @description The data-point filter input rides along in the form submit; accepted and ignored here (the panel doesn't filter). */
+                q?: string;
+            };
+            header?: never;
+            path: {
+                /** @description Website domain (normalized server-side). */
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The summary-panel fragment. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SiteBuild: {
+        parameters: {
+            query: {
+                /** @description Selected data-point names. Repeat to pass several. */
+                dataPoints: string[];
+                /** @description `combine` (default) minimizes to the fewest providers (set-cover); `ai` is a forward-compat alias that currently resolves like combine. */
+                mode?: "combine" | "ai";
+                /** @description Source pins: `pins[<dataPoint>]=id,id`. Maps each data-point name to a comma-joined list of preferred providerIds. Omit for Auto. */
+                pins?: {
+                    [key: string]: string;
+                };
+                /** @description Data-point names the consumer opts to SUPPLY themselves (as verification `context`) instead of having a provider prove — shrinks the provider set. Repeat to pass several. Only names that are a provider input are honoured. Subset of `dataPoints`. */
+                provided?: string[];
+                /** @description ProviderIds to EXCLUDE from resolution (set after a sandbox Try fails, so a different provider / merge is picked). Repeat to pass several. */
+                exclude?: components["schemas"]["ProviderID"][];
+            };
+            header?: never;
+            path: {
+                /** @description Website domain (normalized server-side). */
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The build page. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SiteBuildTry: {
+        parameters: {
+            query: {
+                /** @description Selected data-point names. Repeat to pass several. */
+                dataPoints: string[];
+                /** @description Resolution mode (`combine` default | `list`). */
+                mode?: "combine" | "ai";
+                /** @description Source pins: `pins[<dataPoint>]=id,id`. Maps each data-point name to a comma-joined list of preferred providerIds. */
+                pins?: {
+                    [key: string]: string;
+                };
+                /** @description Data-point names the consumer supplies themselves (as `context`) instead of proving. Repeat to pass several. Subset of `dataPoints`. */
+                provided?: string[];
+                /** @description ProviderIds to exclude from resolution. Repeat to pass several. */
+                exclude?: components["schemas"]["ProviderID"][];
+            };
+            header?: never;
+            path: {
+                /** @description Website domain (normalized server-side). */
+                domain: string;
+            };
+            cookie?: never;
+        };
+        /** @description The verification `context` — values for the resolved providers' requiredContext inputs (the build page's input fields). The selection itself travels in the query string. */
+        requestBody?: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["SiteBuildTryBody"];
+                "application/json": components["schemas"]["SiteBuildTryBody"];
+            };
+        };
+        responses: {
+            /** @description Session created. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationSession"];
+                };
+            };
+            401: components["responses"]["ProblemResponse"];
+            /** @description One or more selected data points are not covered by any provider. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description Sandbox verification quota exceeded. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SiteBuildRepair: {
+        parameters: {
+            query: {
+                /** @description The failing sandbox session whose analytics seed the prompt. */
+                sessionId: components["schemas"]["SessionID"];
+                dataPoints?: string[];
+                mode?: "combine" | "ai";
+                provided?: string[];
+                pins?: {
+                    [key: string]: string;
+                };
+                exclude?: components["schemas"]["ProviderID"][];
+            };
+            header?: never;
+            path: {
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The repair wizard fragment. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SiteBuildAlternative: {
+        parameters: {
+            query: {
+                /** @description The failing sandbox session to analyze. */
+                sessionId: components["schemas"]["SessionID"];
+                dataPoints?: string[];
+                mode?: "combine" | "ai";
+                provided?: string[];
+                pins?: {
+                    [key: string]: string;
+                };
+                exclude?: components["schemas"]["ProviderID"][];
+            };
+            header?: never;
+            path: {
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No alternative — a fragment + `openRepair` HX-Trigger. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            /** @description Alternative found — `HX-Redirect` to the build page. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DiscoverTeachAgent: {
+        parameters: {
+            query?: {
+                /** @description Website the user wanted to verify data from. */
+                domain?: string;
+                /** @description Specific data point the user could not find. */
+                dataPoint?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DiscoverResolve: {
+        parameters: {
+            query: {
+                /** @description Website domain (normalized server-side). */
+                domain: string;
+                /** @description Selected data-point names. Repeat to pass several. */
+                dataPoints: string[];
+                /** @description Resolution mode. `combine` (default) uses the fewest providers; `ai` is a forward-compat alias that resolves like combine for now. */
+                mode?: "combine" | "ai";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Resolved providers (possibly none). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description The first resolved provider's id, if any — a convenience for the common single-provider case. */
+                        providerId?: components["schemas"]["ProviderID"];
+                        /** @description True when some selected data point has no provider (see `uncovered`) — a new provider must be authored. */
+                        needsCreation: boolean;
+                        providers: {
+                            providerId: components["schemas"]["ProviderID"];
+                            slug: string;
+                            /** @description The selected data points this provider covers. */
+                            dataPoints: string[];
+                            /** @description Recent verification health for this provider (last 30 days). Present only when there is enough history (a minimum number of attempts) to be meaningful; absent for new or rarely-used providers. Used to break ranking ties between providers covering the same data points. */
+                            reliability?: {
+                                /**
+                                 * Format: float
+                                 * @description Fraction of recent sessions that started this provider and completed its claim without failure.
+                                 */
+                                recentSuccessRate: number;
+                                /** @description Number of recent sessions that started this provider (the sample size behind `recentSuccessRate`). */
+                                attempts: number;
+                            };
+                        }[];
+                        /** @description Selected data points no existing provider exposes. */
+                        uncovered: string[];
+                        /** @description Inputs the consumer must supply at verification time (passed as session `context`). Collect these from the user. */
+                        requiredContext: {
+                            key: string;
+                            required: boolean;
+                            description?: string;
+                        }[];
+                        /** @description Whether the resolved providers fuse into one. Informational — `POST /verifications/sessions` already accepts the whole `providers` array. */
+                        merge: {
+                            mergeable: boolean;
+                            /** @description True when merging removes duplicate requests to the same endpoint (saved overfetch). */
+                            dedupedSomeRequests?: boolean;
+                        };
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    DiscoverDataPoints: {
+        parameters: {
+            query: {
+                /** @description Website domain (normalized server-side). */
+                domain: string;
+                /** @description Case-insensitive filter over data-point names. */
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Verifiable data points (possibly none). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        dataPoints: {
+                            name: string;
+                            description?: string;
+                            providerCount: number;
+                        }[];
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ProviderPreviewImage: {
+        parameters: {
+            query?: {
+                /** @description Cache buster. The server includes the current ETag here on the canonical URL; stale values still return the current image but without long cache headers. */
+                v?: string;
+            };
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description PNG bytes */
             200: {
                 headers: {
                     "Cache-Control"?: string;
@@ -3476,6 +4206,27 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    DisposeVerificationSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Dispose requested. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     VerificationSessionSse: {
         parameters: {
             query?: never;
@@ -3656,31 +4407,6 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    UpdateMe: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["UpdateUserRequest"];
-            };
-        };
-        responses: {
-            /** @description Updated */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["User"];
-                };
-            };
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
     GetUser: {
         parameters: {
             query?: never;
@@ -3760,7 +4486,10 @@ export interface operations {
     };
     GetOrg: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Which section to show (server-rendered tab); unknown values fall back to the first. */
+                tab?: "connect" | "providers" | "members" | "themes" | "sessions" | "billing";
+            };
             header?: never;
             path: {
                 orgId: components["schemas"]["OrgID"];
@@ -3833,6 +4562,32 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    SearchOrgMembers: {
+        parameters: {
+            query?: {
+                /** @description Case-insensitive email substring to filter by. */
+                q?: string;
+            };
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The members-list fragment. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     AddOrgMember: {
         parameters: {
             query?: never;
@@ -4106,7 +4861,7 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    GetOrgCredential: {
+    GetOrgKeypair: {
         parameters: {
             query?: never;
             header?: never;
@@ -4123,7 +4878,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["OrgCredential"];
+                    "application/json": components["schemas"]["OrgKeypair"];
                 };
             };
             403: components["responses"]["ForbiddenResponse"];
@@ -4131,7 +4886,7 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SetOrgCredential: {
+    SetOrgKeypair: {
         parameters: {
             query?: never;
             header?: never;
@@ -4142,7 +4897,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["OrgCredentialRequest"];
+                "application/json": components["schemas"]["OrgKeypairRequest"];
             };
         };
         responses: {
@@ -4152,7 +4907,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["OrgCredential"];
+                    "application/json": components["schemas"]["OrgKeypair"];
                 };
             };
             400: components["responses"]["ProblemResponse"];
@@ -4160,7 +4915,7 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    DeleteOrgCredential: {
+    DeleteOrgKeypair: {
         parameters: {
             query?: never;
             header?: never;
@@ -4381,6 +5136,29 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    AttachLanding: {
+        parameters: {
+            query?: {
+                /** @description A submitted pairing code; redirects to `/attach/{code}`. */
+                code?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            /** @description Redirect to the canonical `/attach/{code}` URL. */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     AttachPage: {
         parameters: {
             query?: never;
@@ -5238,9 +6016,18 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        initialUrl: string;
-                        requests: {
-                            [key: string]: unknown;
+                        /** @description One recipe per session provider, in run order. */
+                        recipes: {
+                            providerId: components["schemas"]["ProviderID"];
+                            resolvedVersion: string;
+                            initialUrl: string;
+                            /** @description The version's webSettings geoLocation template (`{{DYNAMIC_GEO}}` / '' / ISO code), applied to this provider's requests. */
+                            geoLocation?: string;
+                            /** @description The version's webSettings.jsUserScripts — page JavaScript the Verification Client installs to run before every page load (before navigating to initialUrl), to drive login/navigation so the target requests fire. */
+                            jsUserScripts?: string;
+                            requests: {
+                                [key: string]: unknown;
+                            }[];
                         }[];
                     };
                 };
@@ -5384,7 +6171,7 @@ export interface operations {
                             /** Format: uuid */
                             subscriptionId: string;
                             event: components["schemas"]["VerificationEvent"];
-                            /** @description The result payload, as raw text (no base64): a compact JWE (RFC 7516, ECDH-ES+A256GCM over X25519) wrapping the signed result JWS when the org has an encryption credential, else the plaintext signed JWS JSON. */
+                            /** @description The result payload, as raw text: an ECIES ciphertext (base64url) wrapping the signed result JWS when the org's `canEncryptResult` is enabled, else the plaintext signed JWS JSON. */
                             payload: string;
                             deliveryStatus: components["schemas"]["CallbackDeliveryStatus"];
                             createdAt: components["schemas"]["Timestamp"];