@reclaimprotocol/client 0.1.23 → 0.1.24

package/lib/types/openapi.gen.d.ts

@@ -32,15 +32,16 @@ export interface paths {
         };
         /**
          * Search providers
-         * @description Search published Reclaim providers by domain or data point. A provider is the recipe an end-user follows to prove something about themselves (e.g. "I have N followers on Twitter"). Returns a list of matches. Call this BEFORE `create_provider` — most popular domains already have a public provider you can reuse.
-         *     Catalog page listing all providers. Returns a paginated list of providers the caller can see. Public providers are visible to everyone; private providers are only visible to org members.
+         * @description Search Reclaim providers by domain or data point. A provider is the recipe an end-user follows to prove something about themselves, such as "I have N followers on Twitter".
+         *     Call this BEFORE `create_provider` — most popular domains already have a public provider you can reuse, and creating another one just stacks duplicates.
+         *     Returns a paginated list of the providers the caller can see: public providers to everyone, private providers only to members of the owning organization.
          */
         get: operations["Providers"];
         put?: never;
         /**
          * Create a provider
          * @description Create a new Reclaim provider. Use this only after `providers` returned nothing useful for the domain. The caller must be an active member of the target organization.
-         *     Creates a new provider in the specified organization. `visibility` is coerced to `PRIVATE` at creation regardless of what's sent; the author may toggle to `PUBLIC` later via `PATCH /providers/{id}`. While `PRIVATE`, versions go to the go live freely; once `PUBLIC`, non-admin versions need admin review. See `Provider.visibility`.
+         *     Creates a new provider in the specified organization. `visibility` is coerced to `PRIVATE` at creation regardless of what's sent; the author may toggle to `PUBLIC` later via `PATCH /providers/{id}`. While `PRIVATE`, versions go live freely; once `PUBLIC`, non-admin versions need admin review. See `Provider.visibility`.
          *     The server also seeds an initial `0.1.0` version on the `draft` branch in the same transaction so the provider is immediately editable. Its `initialUrl` defaults to `https://<domain>`; all other version fields fall back to their schema-declared defaults (a `structured` verificationType, empty requests, empty web settings). `Provider.latestVersion` stays `null` until the draft is promoted to the live channel.
          */
         post: operations["CreateProvider"];
@@ -410,6 +411,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/providers/{providerId}/fix-with-ai": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set AI repair eligibility for a provider (admin-only)
+         * @description Admin only. Sets whether failed verification sessions using this provider may offer the Fix with AI workflow. This is a desired-state, idempotent operation.
+         */
+        put: operations["AdminSetProviderFixWithAi"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/orgs": {
         parameters: {
             query?: never;
@@ -719,7 +740,7 @@ export interface paths {
         put?: never;
         /**
          * Grant prepaid credits to an org (admin-only)
-         * @description Admin only. Add credit to an org's wallet. PROMOTIONAL is goodwill (no payment, no invoice); PURCHASE records money paid out of band (wire, crypto) and raises a real Stripe invoice the customer can download; ADJUSTMENT is a correction, e.g. writing off overage consumed during a grace window.
+         * @description Admin only. Add credit to an org's wallet. PROMOTIONAL is goodwill (no payment, no invoice); PURCHASE records money paid out of band (wire, crypto) and raises a real Stripe invoice the customer can download; ADJUSTMENT is a correction, for example, writing off overage consumed during a grace window.
          */
         post: operations["AdminGrantOrgCredit"];
         delete?: never;
@@ -783,7 +804,7 @@ export interface paths {
         put?: never;
         /**
          * Grant staff to a user by email (admin-only)
-         * @description Admin only. Grants staff to an existing user by email, on ANY email domain (e.g. a contractor on gmail). The target must have signed in at least once so their app user exists; membership grants admin immediately. Idempotent.
+         * @description Admin only. Grants staff to an existing user by email, on ANY email domain (for example, a contractor on gmail). The target must have signed in at least once so their app user exists; membership grants admin immediately. Idempotent.
          */
         post: operations["AddStaffMember"];
         delete?: never;
@@ -847,7 +868,7 @@ export interface paths {
         put?: never;
         /**
          * Issue an additional token for a verification client (admin)
-         * @description Admin only. Adds a new token to the client; existing tokens keep working (a client may hold several live tokens, e.g. one per deployment or for zero-downtime rotation). The plaintext is returned ONCE — only its HMAC is stored.
+         * @description Admin only. Adds a new token to the client; existing tokens keep working (a client may hold several live tokens, for example, one per deployment or for zero-downtime rotation). The plaintext is returned ONCE — only its HMAC is stored.
          */
         post: operations["IssueVerificationClientToken"];
         delete?: never;
@@ -1093,6 +1114,50 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v/{sessionId}/fix-with-ai": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List AI repair actions for failed providers
+         * @description Returns an HTML recovery fragment containing one action per failed, admin-enabled provider in the terminal source session. Requires a signed-in member of the source session's billing organization.
+         */
+        get: operations["FixWithAiRecovery"];
+        put?: never;
+        /**
+         * Create or reopen a billed AI repair session
+         * @description Creates one idempotent repair attempt for the selected failed provider. The source organization is charged only when a new child is created. Repeated requests reopen a pending or successful child. After a child ends in error, rejection, or expiry, a later request creates a new, separately billed attempt. The server derives the exact failed version and repair prompt.
+         */
+        post: operations["CreateFixWithAiSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v/{sessionId}/fix-with-ai/activate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a pending AI repair after the verification page loads
+         * @description Idempotently queues a pending repair session. The server derives the claimant country from the request and publishes no browser credentials.
+         */
+        post: operations["ActivateFixWithAiRepair"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/.well-known/jwks.json": {
         parameters: {
             query?: never;
@@ -1875,7 +1940,7 @@ export interface paths {
         };
         /**
          * Serve the bytes of a stored image
-         * @description Returns the raw bytes of the uploaded image with the original `Content-Type`. The URL is content-addressed (by image id) so the response is immutable — long `Cache-Control: max-age` is applied. Images are referenced via parent records (e.g. `Organization.iconUrl`).
+         * @description Returns the raw bytes of the uploaded image with the original `Content-Type`. The URL is content-addressed (by image id) so the response is immutable — long `Cache-Control: max-age` is applied. Images are referenced via parent records, for example `Organization.iconUrl`.
          */
         get: operations["GetImage"];
         put?: never;
@@ -1943,7 +2008,7 @@ export interface paths {
          *
          *     - If `slug` matches the provider's current slug, returns the
          *       resource (HTML or JSON per `Accept`).
-         *     - If `slug` does not match (e.g. the provider was renamed since
+         *     - If `slug` does not match (for example, the provider was renamed since
          *       the URL was minted), HTML callers receive a `301` redirect
          *       to this same route with the *current* slug. JSON callers
          *       receive the resource directly with `200` regardless of slug
@@ -1971,7 +2036,7 @@ export interface paths {
         };
         /**
          * List a provider's versions
-         * @description Lists versions visible to the caller. Non-public branches (`ai`, `draft`, `in_review`, `rejected`) are only visible to members of the provider's owning organization.
+         * @description Lists versions visible to the caller. Non-public branches (`ai`, `draft`, `fixed`, `in_review`, `rejected`) are only visible to members of the provider's owning organization.
          */
         get: operations["ListProviderVersions"];
         put?: never;
@@ -2004,20 +2069,23 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Get a specific provider version */
+        /**
+         * Get a specific provider version
+         * @description Fetches one exact canonical version. Trunk is public when the provider is public. Non-trunk versions are visible to admins and members of the provider's organization. A member of the organization that paid for a successful AI repair may also read only the exact `fixed` version created by that repair.
+         */
         get: operations["GetProviderVersion"];
         put?: never;
         post?: never;
         /**
          * Delete a provider version
-         * @description Soft-archives a version on the `draft`, `ai`, or `rejected` branch — sets `status` to `ARCHIVED` so history is preserved. Trunk (live) and `in_review` versions cannot be archived this way; archive the parent provider instead. Supports optimistic concurrency via `If-Match`.
+         * @description Soft-archives a version on the `draft`, `ai`, or `rejected` branch — sets `status` to `ARCHIVED` so history is preserved. `fixed`, trunk (live), and `in_review` versions cannot be archived this way; archive the parent provider instead. Supports optimistic concurrency via `If-Match`.
          */
         delete: operations["DeleteProviderVersion"];
         options?: never;
         head?: never;
         /**
          * Update a provider version
-         * @description Mutable only while the version is on the `draft` or `rejected` branch. Versions on `in_review` or the live channel reject all writes here. Caller must be a member of the provider's owning organization. Supports optimistic concurrency via `If-Match`.
+         * @description Mutable only while the version is on the `draft` or `rejected` branch. Versions on `fixed`, `in_review`, or the live channel reject all writes here. Caller must be a member of the provider's owning organization. Supports optimistic concurrency via `If-Match`.
          */
         patch: operations["UpdateProviderVersion"];
         trace?: never;
@@ -2667,6 +2735,11 @@ export interface components {
          * @description Builder-managed remote browser session id.
          */
         AgentBrowserSessionID: string;
+        /** @description Optional allocation preferences for the authoring browser. */
+        CreateAgentBrowserSessionRequest: {
+            /** @description ISO 3166-1 alpha-2 country the browser should browse from. Popcorn owns the proxy itself and routes the whole session's egress through its own deployment-configured exit for this country; callers never supply a proxy URL or credentials. Omit for the deployment's default (direct) egress. If the deployment has no proxy configured, the browser is still allocated, just without the requested country. */
+            countryCode?: string;
+        };
         /** @description A short-lived Popcorn browser allocated for provider authoring. Treat `cdpUrl` and `apiUrl` as credentials: the local agent consumes them and must not display, persist, or share them. `liveViewUrl` is intentionally shareable with the volunteer operating the browser. */
         AgentBrowserSession: {
             id: components["schemas"]["AgentBrowserSessionID"];
@@ -2759,7 +2832,7 @@ export interface components {
          *
          *     - `ANONYMOUS`: System-managed, member-less org auto-created to
          *       anchor an unaffiliated ETH credential's org-level settings
-         *       (e.g. callback subscriptions). Created lazily and archived
+         *       (for example, callback subscriptions). Created lazily and archived
          *       when its credential is linked to a real organization. Never
          *       created or named by clients; has no members.
          * @enum {string}
@@ -2985,7 +3058,7 @@ export interface components {
             billingAddress?: components["schemas"]["BillingAddress"];
             /** @description Buyer tax / VAT id, shown on invoices. Synced from Stripe. */
             taxId?: string;
-            /** @description Stripe tax-id type paired with `taxId` (e.g. `eu_vat`, `in_gst`, `us_ein`). Synced from Stripe. */
+            /** @description Stripe tax-id type paired with `taxId` (for example, `eu_vat`, `in_gst`, `us_ein`). Synced from Stripe. */
             taxIdType?: string;
             /**
              * Format: uuid
@@ -3074,7 +3147,7 @@ export interface components {
         SetOrgGraceRequest: {
             /**
              * Format: date-time
-             * @description Deadline as an RFC 3339 UTC date-time (e.g. `2026-08-21T23:59:00Z`). Access lasts until this instant, then the org drops to the free plan.
+             * @description Deadline as an RFC 3339 UTC date-time, for example `2026-08-21T23:59:00Z`. Access lasts until this instant, then the org drops to the free plan.
              */
             graceUntil: string;
         };
@@ -3146,7 +3219,7 @@ export interface components {
             description?: string;
             /** @description Marks singleton well-known plans; `free` is the default plan for orgs with no purchase. */
             systemKey?: string;
-            /** @description Price per period in the plan's currency (e.g. 10.99). */
+            /** @description Price per period in the plan's currency (for example, 10.99). */
             pricePerPeriod: number;
             currency: string;
             pools: components["schemas"]["PlanPool"][];
@@ -3169,13 +3242,13 @@ export interface components {
             /** @description Number of periodUnit per cycle. */
             periodCount?: number;
             /**
-             * @description Days an overdue org keeps paid limits before dropping to Free. Null = the global default (14).
+             * @description Days an overdue org keeps paid limits before dropping to Free. Null = the global default (14); 0 = no grace at all, so the drop is immediate.
              *     The failed-card clock: it starts when Stripe cannot collect the plan fee, and a successful payment clears it. On expiry the whole plan drops to free-plan limits — a hard cap with overage off. Distinct from creditGraceDays, the empty-wallet clock, which only caps overage. The two are independent and can overlap.
              */
             graceDays?: number | null;
             /**
-             * @description Days an org keeps serving overage after its prepaid credit balance hits zero, before overage stops (the plan's included allowance keeps working). Null = the global default (10).
-             *     The empty-wallet clock: it starts when credit runs out while the org is spending beyond its allowance, and any top-up clears it. On expiry only overage is refused (402); the plan itself is untouched. Distinct from graceDays, the failed-card clock, whose expiry drops the whole plan to free limits.
+             * @description Days an org keeps serving overage after its prepaid credit balance hits zero, before overage stops (the plan's included allowance keeps working). Null = the global default (10); 0 = no grace at all, so overage stops as soon as the wallet is empty.
+             *     The empty-wallet clock: it starts on the first overage charged against an empty wallet — never when a plan is applied — and any top-up clears it. On expiry only overage is refused (402); the plan itself is untouched. Distinct from graceDays, the failed-card clock, whose expiry drops the whole plan to free limits.
              */
             creditGraceDays?: number | null;
             /** @description Contact-only lead tier — shown on the pricing page but not self-serve checkoutable; admins assign and bill it. Enterprise uses this. */
@@ -3187,9 +3260,9 @@ export interface components {
             orgId?: string;
             /** @description Highlights the card with the RECOMMENDED badge and accent border on the pricing page. */
             isRecommended?: boolean;
-            /** @description Pricing-page button text (e.g. "Start free →"). Falls back to a price-derived default when unset. */
+            /** @description Pricing-page button text (for example, "Start free →"). Falls back to a price-derived default when unset. */
             ctaLabel?: string;
-            /** @description CTA text shown to a signed-in viewer (e.g. "Upgrade →"). Falls back to ctaLabel, then the default, when unset. */
+            /** @description CTA text shown to a signed-in viewer (for example, "Upgrade →"). Falls back to ctaLabel, then the default, when unset. */
             ctaLabelAuthed?: string;
             /** @description Where the CTA links when it is not a self-serve checkout — a signed-out visitor or a contact-sales tier. http(s), mailto:, or a site-relative path. */
             ctaUrl?: string;
@@ -3207,9 +3280,9 @@ export interface components {
             pools?: components["schemas"]["PlanPoolInput"][];
             visibility?: components["schemas"]["EntityVisibility"];
             status?: components["schemas"]["EntityStatus"];
-            /** @description Days overdue orgs keep paid limits before dropping to Free. Omit for the global default (14). The failed-card clock — cleared by a successful payment; on expiry the whole plan drops to free limits. See creditGraceDays for the separate empty-wallet clock. */
+            /** @description Days overdue orgs keep paid limits before dropping to Free. Omit for the global default (14), or send 0 for no grace at all. The failed-card clock — cleared by a successful payment; on expiry the whole plan drops to free limits. See creditGraceDays for the separate empty-wallet clock. */
             graceDays?: number | null;
-            /** @description Days an org keeps serving overage after its credits run out. Omit for the global default (10). The empty-wallet clock — cleared by any top-up; on expiry only overage stops, and the plan's included allowance keeps working. See graceDays for the separate failed-card clock. */
+            /** @description Days an org keeps serving overage after its credits run out. Omit for the global default (10), or send 0 to stop overage as soon as the wallet is empty. The empty-wallet clock — cleared by any top-up; on expiry only overage stops, and the plan's included allowance keeps working. See graceDays for the separate failed-card clock. */
             creditGraceDays?: number | null;
             /** @description Contact-only lead tier — shown but not self-serve checkoutable. */
             contactOnly?: boolean;
@@ -3229,9 +3302,9 @@ export interface components {
             stripeProductId: string;
             pools: components["schemas"]["PlanPoolInput"][];
             visibility?: components["schemas"]["EntityVisibility"];
-            /** @description Failed-card grace: days an overdue org keeps paid limits before dropping to Free. Omit for the global default (14). */
+            /** @description Failed-card grace: days an overdue org keeps paid limits before dropping to Free. Omit for the global default (14), or send 0 for no grace at all. */
             graceDays?: number | null;
-            /** @description Empty-wallet grace: days an org keeps serving overage after its credits run out, before overage stops (the plan's included allowance keeps working). Omit for the global default (10). A separate clock from graceDays. */
+            /** @description Empty-wallet grace: days an org keeps serving overage after its credits run out, before overage stops (the plan's included allowance keeps working). Omit for the global default (10), or send 0 to stop overage as soon as the wallet is empty. A separate clock from graceDays. */
             creditGraceDays?: number | null;
             contactOnly?: boolean;
             /** Format: uuid */
@@ -3326,7 +3399,7 @@ export interface components {
         GrantOrgCreditRequest: {
             amount: number;
             /**
-             * @description PROMOTIONAL = goodwill, no payment. PURCHASE = paid out of band; raises a Stripe invoice marked paid out-of-band. ADJUSTMENT = a correction, e.g. writing off grace-window overage.
+             * @description PROMOTIONAL = goodwill, no payment. PURCHASE = paid out of band; raises a Stripe invoice marked paid out-of-band. ADJUSTMENT = a correction, for example, writing off grace-window overage.
              * @enum {string}
              */
             kind: "PROMOTIONAL" | "PURCHASE" | "ADJUSTMENT";
@@ -3390,6 +3463,9 @@ export interface components {
             /** @default STRIPE */
             billingMode: components["schemas"]["BillingMode"];
         };
+        AdminSetProviderFixWithAiRequest: {
+            enabled: boolean;
+        };
         /** @description Outcome of a plan change. */
         PlanChangeResult: {
             /**
@@ -3466,7 +3542,7 @@ export interface components {
             token: string;
         };
         CreateVerificationClientRequest: {
-            /** @description Lowercase handle (letters, digits, hyphens), e.g. `web-portal`. */
+            /** @description Lowercase handle (letters, digits, hyphens), for example, `web-portal`. */
             name: string;
             /**
              * @description Which quota pool this client draws from — verifications and zkFetches are separate allowances on every plan.
@@ -3490,7 +3566,7 @@ export interface components {
             /** @description Uncompressed secp256k1 public key (65 bytes, hex). */
             publicKey?: string;
             publicKeyJwk?: components["schemas"]["JwkSecp256k1Public"];
-            /** @description A human note to tell keys apart (e.g. "prod-eu"). */
+            /** @description A human note to tell keys apart (for example, "prod-eu"). */
             label?: string;
         };
         /** @description The email of an existing user to grant staff (any domain). */
@@ -3517,7 +3593,7 @@ export interface components {
         };
         /** @description Optional metadata for the token being issued. */
         IssueVerificationClientTokenRequest: {
-            /** @description A human note to tell tokens apart (e.g. "prod-eu"). */
+            /** @description A human note to tell tokens apart (for example, "prod-eu"). */
             label?: string;
         };
         ProviderVersionRef: {
@@ -3531,6 +3607,9 @@ export interface components {
              *
              *     - `draft`: a human is actively editing the version.
              *
+             *     - `fixed`: a proven AI repair. It remains pinned to its explicit
+             *       version and does not replace the live trunk version.
+             *
              *     - `in_review`: the author has submitted the version to be made
              *       public and it is awaiting review. On approval the branch tag
              *       is cleared (the version is promoted to the live channel and becomes
@@ -3541,7 +3620,7 @@ export interface components {
              *       `in_review`.
              * @enum {string}
              */
-            branch?: "ai" | "draft" | "in_review" | "rejected";
+            branch?: "ai" | "draft" | "fixed" | "in_review" | "rejected";
             /** @description Build number for the provider version */
             buildNumber?: number;
         };
@@ -3551,7 +3630,7 @@ export interface components {
          */
         WebCredentialsType: "omit" | "same-origin" | "include";
         /**
-         * @description Geographic location (e.g. ISO country code or {{DYNAMIC_GEO}} to use user's geo location) the verification should appear to originate from.
+         * @description Geographic location the verification should appear to originate from: a 2-letter ISO country code, or a parameter the attestor resolves at proof time. `{{DYNAMIC_GEO}}` and `{{DYNAMIC_GEO_SECRET}}` are the Verification Client's standard names for the end-user's own country — the `_SECRET` one is delivered as a secret param, so the attestor never learns which country the proof egressed from.
          * @default {{DYNAMIC_GEO}}
          */
         Geolocation: string;
@@ -3657,11 +3736,11 @@ export interface components {
             /** @description The pattern or value to look for in the response. When `type` is 'contains', supports template variable declaration using `{{variable}}` syntax. When `type` is 'regex', can be used to extract variables using regex named groups. */
             value: string;
         };
-        /** @description Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (i.e. "HTTP/1.1 200 OK") */
+        /** @description Which portions to select from a response. These are selected in order, xpath => jsonPath => regex * These redactions are done client side and only the selected portions are sent to the attestor. The attestor will only be able to see the selected portions alongside the first line of the HTTP response (that is, "HTTP/1.1 200 OK") */
         ResponseRedaction: {
             /** @description expect an HTML response, and to contain a certain xpath for eg. "/html/body/div.a1/div.a2/span.a5" */
             xPath?: string;
-            /** @description expect a JSON response, retrieve the item at this path using dot notation for e.g. 'email.addresses.0' */
+            /** @description expect a JSON response, retrieve the item at this path using dot notation, for example 'email.addresses.0'. */
             jsonPath?: string;
             /** @description select a regex match from the response */
             regex?: string;
@@ -3684,9 +3763,14 @@ export interface components {
             orgId: components["schemas"]["OrgID"];
             /**
              * Format: hostname
-             * @description Canonical root domain of the provider (e.g. `google.com`) — no scheme, no port, no path. Clients may submit a `www.` prefix; the server normalizes it away before storage.
+             * @description Canonical root domain of the provider (for example, `google.com`) — no scheme, no port, no path. Clients may submit a `www.` prefix; the server normalizes it away before storage.
              */
             domain: string;
+            /**
+             * @description Region this provider covers, for a site that serves a genuinely different product per country under a path prefix — `us` for `uber.com/us`, `en-gb` for `etihad.com/en-gb`. Null means the provider is not region-specific, which is right for most: a translation is not a region, so `binance.com/en` carries no region.
+             *     The server SUGGESTS a value from the live version's `initialUrl` when this is unset; the author confirms or overrides it here. Set it to null to clear a wrong suggestion and have the provider apply everywhere.
+             */
+            region?: string | null;
             /** @description URL-safe identifier for the provider. Lowercase letters, digits and hyphens only; globally unique across all providers. */
             slug: string;
             /** @description The title of the provider as displayed on the detail page. */
@@ -3749,7 +3833,8 @@ export interface components {
              *
              *     Toggling `PUBLIC` → `PRIVATE` hides the provider from
              *     the public listing immediately. Versions already on
-             *     `draft` / `in_review` / `rejected` stay where they are —
+             *     `ai` / `draft` / `fixed` / `in_review` / `rejected` stay where
+             *     they are —
              *     the provider's visibility at version-creation time
              *     decides the review path, and a later toggle does not
              *     retroactively un-gate non-live versions.
@@ -3788,7 +3873,7 @@ export interface components {
             orgId: components["schemas"]["OrgID"];
             /**
              * Format: hostname
-             * @description Canonical root domain of the provider (e.g. `google.com`).
+             * @description Canonical root domain of the provider (for example, `google.com`).
              */
             domain: string;
             /** @description URL-safe identifier for the provider. */
@@ -3838,7 +3923,7 @@ export interface components {
         WebsiteSuggestion: {
             /**
              * Format: hostname
-             * @description Canonical root domain (e.g. `github.com`).
+             * @description Canonical root domain (for example, `github.com`).
              */
             domain: string;
             /** @description Display name for the website (scraped site name or derived from the domain). */
@@ -3876,9 +3961,13 @@ export interface components {
             /** @description The edited extraction prompt for the AI provider. Gated by the prompt guard before it is stored (see docs/prompt-guard.md); the length here documents the same ceiling the guard enforces. */
             prompt?: string;
         };
+        /** @description Selects one failed provider from the source session. The server treats this only as selection input and re-derives authorization, failure, version, organization, and prompt. */
+        CreateFixWithAiSessionRequest: {
+            providerId: components["schemas"]["ProviderID"];
+        };
         /** @description A single data point selectable on the `/site/{domain}` page, with how many visible providers expose it, one example provider slug, and one `references` entry per provider describing how that provider proves it (what the site page's source picker offers as selectable options). */
         DataPointItem: {
-            /** @description Data-point name (e.g. `username`, `followers_count`). */
+            /** @description Data-point name (for example, `username`, `followers_count`). */
             name: string;
             /** @description Human description of the data point, taken from the response match that declares it. Absent when no match supplies one. */
             description?: string;
@@ -3957,7 +4046,7 @@ export interface components {
         /** @description Settings used by the web-based verification client. */
         ProviderWebSettings: {
             /**
-             * @description Geographic location (e.g. ISO country code or {{DYNAMIC_GEO}} to use user's geo location) the verification should appear to originate from.
+             * @description Geographic location (for example, ISO country code or {{DYNAMIC_GEO}} to use user's geo location) the verification should appear to originate from.
              * @default {{DYNAMIC_GEO}}
              */
             geoLocation: components["schemas"]["Geolocation"];
@@ -3990,10 +4079,10 @@ export interface components {
         ProviderSeo: {
             /**
              * Format: uri
-             * @description Canonical homepage of the brand (e.g. `https://google.com`). Used in brand-link cards and JSON-LD.
+             * @description Canonical homepage of the brand (for example, `https://google.com`). Used in brand-link cards and JSON-LD.
              */
             brandUrl?: string;
-            /** @description Headline data point — the single most-important variable this provider can verify (e.g. `subscriber count`). Used in the provider's SEO title. */
+            /** @description Headline data point — the single most-important variable this provider can verify (for example, `subscriber count`). Used in the provider's SEO title. */
             primaryDataPoint?: string;
             /** @description Full list of data points this provider can verify. */
             dataPoints?: string[];
@@ -4014,7 +4103,7 @@ export interface components {
          *     - `title` ← the latest scraped `<title>` / `og:site_name`
          *       from the provider's domain (or `initialUrl` of the live
          *       version when present); otherwise the domain-derived brand
-         *       name via `builder.derive_brand_name(domain)` — e.g.
+         *       name via `builder.derive_brand_name(domain)` — for example,
          *       `github.com` → `"Github"`.
          *
          *     - `iconUrl` ← the cached `/images/{uuid}` once the favicon
@@ -4154,11 +4243,11 @@ export interface components {
              * @description Normalized registered domain.
              */
             domain: string;
-            /** @description URL-safe slug suggestion derived from the domain (e.g. `news.ycombinator.com` → `news-ycombinator`). Callers should treat as a starting point and may edit before submit. */
+            /** @description URL-safe slug suggestion derived from the domain (for example, `news.ycombinator.com` → `news-ycombinator`). Callers should treat as a starting point and may edit before submit. */
             slug: string;
             /** @description Site title pulled from `og:site_name` / `og:title` / `<title>`. Absent when the scrape failed or returned no usable text — callers can fall back to `brandName`. */
             title?: string;
-            /** @description Brand fallback derived from the domain when the scrape returned no title (e.g. `github.com` → `Github`). Always present. */
+            /** @description Brand fallback derived from the domain when the scrape returned no title (for example, `github.com` → `Github`). Always present. */
             brandName: string;
             /** @description Optional description suggestion. Currently always blank; present so callers can pre-populate the field once a description heuristic lands. Reserved for future use. */
             description?: string;
@@ -4174,7 +4263,7 @@ export interface components {
             orgId: components["schemas"]["OrgID"];
             /**
              * Format: hostname
-             * @description Canonical root domain (e.g. `github.com`). No scheme, no port, no path.
+             * @description Canonical root domain (for example, `github.com`). No scheme, no port, no path.
              */
             domain: string;
             /** @description URL-safe identifier. Globally unique — pick something domain-specific like `github-followers`. */
@@ -4201,6 +4290,8 @@ export interface components {
         UpdateProviderRequest: {
             /** Format: hostname */
             domain?: string;
+            /** @description Confirm or override the provider's region. Send `null` to clear it so the provider applies to every region. See `Provider.region`. */
+            region?: string | null;
             title?: string;
             description?: string;
             /**
@@ -4240,7 +4331,7 @@ export interface components {
             /** @description Free-form change note recorded on `createMetadata`. */
             notes?: string;
         };
-        /** @description Partial update of a provider version. Mutable only while the version is on the `draft` or `rejected` branch; versions on `in_review` or the live channel reject all writes here. The semver does not change on update — `build_number` increments instead, giving callers a monotonic revision counter without touching the (major, minor, patch) PK. `verificationType` and `prompt` may be updated; omit either to carry the prior build's value forward. */
+        /** @description Partial update of a provider version. Mutable only while the version is on the `draft` or `rejected` branch; versions on `fixed`, `in_review`, or the live channel reject all writes here. The semver does not change on update — `build_number` increments instead, giving callers a monotonic revision counter without touching the (major, minor, patch) PK. `verificationType` and `prompt` may be updated; omit either to carry the prior build's value forward. */
         UpdateProviderVersionRequest: {
             /** Format: uri */
             initialUrl?: string;
@@ -4256,7 +4347,7 @@ export interface components {
         };
         /** @description Body for submitting a provider version for review. Transitions the version's branch from `draft` (or `rejected`) to `in_review`. */
         ProviderVersionReviewSubmission: {
-            /** @description Optional note from the author to reviewers (changelog, areas to focus on, etc.). */
+            /** @description Optional note from the author to reviewers (changelog, areas to focus on, and so on). */
             notes?: string;
         };
         /** @description Body for recording a decision on a provider version in `in_review`. On `APPROVED` the branch tag is cleared and the version is promoted to the live channel (becomes public). On `REJECTED` the branch becomes `rejected`. */
@@ -4464,7 +4555,7 @@ export interface components {
         /** @description Body for `POST /verifications/sessions/{sessionId}/events`. Status ping only — never carries the proof (use the result endpoint for that). */
         ReportEventRequest: {
             event: components["schemas"]["VerificationEvent"];
-            /** @description Extra detail (e.g. `claimantClientId`, or `request_id` for request-level events). */
+            /** @description Extra detail (for example, `claimantClientId`, or `request_id` for request-level events). */
             eventData?: {
                 [key: string]: unknown;
             };
@@ -4647,7 +4738,7 @@ export interface components {
         };
         /**
          * @description 301 Moved Permanently. Returned to HTML callers that hit a
-         *     non-canonical URL for a resource that has a slug — e.g.
+         *     non-canonical URL for a resource that has a slug — for example,
          *     `/providers/{providerId}` with no slug, or
          *     `/providers/{providerId}/{staleSlug}` after a rename. The
          *     `Location` header points at the canonical URL with the
@@ -4664,7 +4755,7 @@ export interface components {
         };
     };
     parameters: {
-        /** @description Semver string of the provider version, e.g. `1.4.2`. */
+        /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
         ProviderVersionPath: string;
         /**
          * @description Opaque `ETag` from a prior GET on the same resource. When
@@ -4709,7 +4800,7 @@ export interface operations {
     Providers: {
         parameters: {
             query?: {
-                /** @description Free-text search across `title`, `description`, `domain`, `primaryDataPoint`, `dataPoints`, and the latest version's `initialUrl`. Matched case-insensitively; returns results ranked by relevance (e.g., data point matches rank higher than description matches). An empty value is treated as no query (the handler redirects to the bare catalog). */
+                /** @description Free-text search across `title`, `description`, `domain`, `primaryDataPoint`, `dataPoints`, and the latest version's `initialUrl`. Matched case-insensitively; returns results ranked by relevance (for example, data point matches rank higher than description matches). An empty value is treated as no query (the handler redirects to the bare catalog). */
                 q?: string;
                 /** @description Filter by tag. Repeat the parameter to OR multiple tags (a provider matching any of them is returned). Combined with `q` via AND. */
                 tag?: components["schemas"]["Tag"][];
@@ -4828,6 +4919,8 @@ export interface operations {
             query?: {
                 /** @description Case-insensitive substring filter on data-point names. Empty = no filter, so clearing the box doesn't need a client workaround. */
                 q?: string;
+                /** @description Narrow the page to one region of a site that serves a different product per country (`us`, `en-gb`). Providers carrying no region are always included — they work wherever the visitor is. Omit for every region. See `GET /site/{domain}` region pills. */
+                region?: string;
                 /** @description Currently selected data-point names — from a deep-link (the provider page's "Use provider") or the form's own htmx round-trips. Repeat to pass several; renders the summary panel and pre-checks the boxes. */
                 dataPoints?: string[];
                 /** @description Resolution mode reflected in the Continue URL. Shares `ResolveMode` with `SiteBuild`: the site form's Advanced dropdown offers `ai`, so a narrower enum here 400s the panel on every change. */
@@ -4839,7 +4932,7 @@ export interface operations {
             };
             header?: never;
             path: {
-                /** @description Website domain (e.g. `github.com`). Normalized server-side (scheme / `www.` / port / path stripped). */
+                /** @description Website domain (for example, `github.com`). Normalized server-side (scheme / `www.` / port / path stripped). */
                 domain: string;
             };
             cookie?: never;
@@ -4853,6 +4946,14 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
+                        /** @description The region the response is narrowed to, when one was requested and the site is split by region. */
+                        region?: string;
+                        /** @description Every region this site is split into. Present only when there is more than one, since a single region is not a choice. */
+                        regions?: {
+                            key: string;
+                            label: string;
+                            providerCount: number;
+                        }[];
                         /** Format: hostname */
                         domain: string;
                         brandName: string;
@@ -4870,6 +4971,8 @@ export interface operations {
     SitePanel: {
         parameters: {
             query?: {
+                /** @description Narrow to one region of a site that serves a different product per country (`us`, `en-gb`). Providers carrying no region are always included. Omit for every region. */
+                region?: string;
                 /** @description Selected data-point names. Repeat to pass several. */
                 dataPoints?: string[];
                 /** @description Resolution mode reflected in the Continue URL. Shares `ResolveMode` with `SiteBuild`: the site form's Advanced dropdown offers `ai`, so a narrower enum here 400s the panel on every change. */
@@ -5380,6 +5483,7 @@ export interface operations {
                             visibility?: components["schemas"]["EntityVisibility"];
                             status?: components["schemas"]["EntityStatus"];
                             tags?: string[];
+                            fixWithAiEnabled?: boolean;
                             /** Format: date-time */
                             updatedAt?: string;
                         }[];
@@ -5389,6 +5493,34 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    AdminSetProviderFixWithAi: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminSetProviderFixWithAiRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["AdminSetProviderFixWithAiRequest"];
+            };
+        };
+        responses: {
+            /** @description AI repair eligibility updated. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     AdminOrgs: {
         parameters: {
             query?: {
@@ -6407,6 +6539,80 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    FixWithAiRecovery: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateFixWithAiSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["CreateFixWithAiSessionRequest"];
+                "application/json": components["schemas"]["CreateFixWithAiSessionRequest"];
+            };
+        };
+        responses: {
+            /** @description HTMX verification result fragment. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            /** @description The new or existing repair session. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationSession"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ActivateFixWithAiRepair: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The repair was queued or was already active. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            409: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     JwksJson: {
         parameters: {
             query?: never;
@@ -6754,7 +6960,11 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["CreateAgentBrowserSessionRequest"];
+            };
+        };
         responses: {
             /** @description Remote authoring browser created. */
             201: {
@@ -7956,7 +8166,7 @@ export interface operations {
             header?: never;
             path: {
                 providerId: components["schemas"]["ProviderID"];
-                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
                 version: components["parameters"]["ProviderVersionPath"];
             };
             cookie?: never;
@@ -7991,7 +8201,7 @@ export interface operations {
             };
             path: {
                 providerId: components["schemas"]["ProviderID"];
-                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
                 version: components["parameters"]["ProviderVersionPath"];
             };
             cookie?: never;
@@ -8029,7 +8239,7 @@ export interface operations {
             };
             path: {
                 providerId: components["schemas"]["ProviderID"];
-                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
                 version: components["parameters"]["ProviderVersionPath"];
             };
             cookie?: never;
@@ -8068,7 +8278,7 @@ export interface operations {
             header?: never;
             path: {
                 providerId: components["schemas"]["ProviderID"];
-                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
                 version: components["parameters"]["ProviderVersionPath"];
             };
             cookie?: never;
@@ -8098,7 +8308,7 @@ export interface operations {
             header?: never;
             path: {
                 providerId: components["schemas"]["ProviderID"];
-                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
                 version: components["parameters"]["ProviderVersionPath"];
             };
             cookie?: never;
@@ -8128,7 +8338,7 @@ export interface operations {
             header?: never;
             path: {
                 providerId: components["schemas"]["ProviderID"];
-                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
                 version: components["parameters"]["ProviderVersionPath"];
             };
             cookie?: never;
@@ -8232,7 +8442,7 @@ export interface operations {
             header?: never;
             path: {
                 providerId: components["schemas"]["ProviderID"];
-                /** @description Semver string of the provider version, e.g. `1.4.2`. */
+                /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
                 version: components["parameters"]["ProviderVersionPath"];
             };
             cookie?: never;
@@ -8499,7 +8709,7 @@ export interface operations {
                     "application/json": components["schemas"]["VerificationSession"];
                 };
             };
-            /** @description Invalid request — e.g. `context` failed a provider's `requiredContext`, or `verificationClientUrl` is not the base URL of a registered verification client. */
+            /** @description Invalid request — for example, `context` failed a provider's `requiredContext`, or `verificationClientUrl` is not the base URL of a registered verification client. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -8587,7 +8797,7 @@ export interface operations {
                             initialUrl: string;
                             /** @description Effective LLM/AI-agent preference for THIS provider: the session's `preferAiAgent` when set at creation, else whether the provider version's `verificationType` is `llm`. A preference — a client without agent support runs the structured recipe regardless. */
                             preferAiAgent: boolean;
-                            /** @description The version's webSettings geoLocation template (`{{DYNAMIC_GEO}}` / '' / ISO code), applied to this provider's requests. */
+                            /** @description The version's webSettings geoLocation template (`{{DYNAMIC_GEO}}` / `{{DYNAMIC_GEO_SECRET}}` / '' / ISO code), applied to this provider's requests. */
                             geoLocation?: string;
                             /** @description The version's webSettings.jsUserScripts — page JavaScript the Verification Client installs to run before every page load (before navigating to initialUrl), to drive login/navigation so the target requests fire. */
                             jsUserScripts?: string;
@@ -8705,7 +8915,7 @@ export interface operations {
                 };
             };
             404: components["responses"]["ProblemResponse"];
-            /** @description No subscription on the session's organization matches the terminal event — the result would be encrypted for zero keys and therefore undeliverable (e.g. the org deleted its last matching subscription mid-verification). Re-register a subscription and retry. */
+            /** @description No subscription on the session's organization matches the terminal event — the result would be encrypted for zero keys and therefore undeliverable (for example, the org deleted its last matching subscription mid-verification). Re-register a subscription and retry. */
             409: {
                 headers: {
                     [name: string]: unknown;