@reclaimprotocol/client 0.1.26 → 0.1.28

package/src/types/openapi.gen.ts

@@ -86,6 +86,38 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/providers/import/devtools": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Import a provider from devtools
+         * @description Import the latest version of a public provider from the legacy devtools
+         *     service. Use this when moving an existing provider to Builder instead
+         *     of recreating it.
+         *
+         *     The import preserves the legacy provider UUID. The server reads the
+         *     current configuration from
+         *     `https://api.reclaimprotocol.org/api/providers/{providerId}` and
+         *     translates it to the Builder schema.
+         *
+         *     If the provider already exists in the seeded anonymous catalog, the
+         *     import assigns that record to the target organization and adds the
+         *     imported version idempotently. A provider owned by another Builder
+         *     organization returns `409`.
+         */
+        post: operations["ImportDevtoolsProvider"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/discover/websites": {
         parameters: {
             query?: never;
@@ -596,7 +628,7 @@ export interface paths {
         get?: never;
         /**
          * Edit a billing plan's app-only settings (admin-only)
-         * @description Admin only. Plans are authored in the Stripe Dashboard (product, price, pricing); this edits only the app-only settings Stripe doesn't own (pool limits, overage, grace, presentation, visibility) by writing them to the linked Stripe Product's metadata and re-syncing. Partial update — omitted fields keep their value. `status: ARCHIVED` deactivates the Stripe Product (orgs on it keep their reference); `visibility` toggles public/private.
+         * @description Admin only. Plans are authored in the Stripe Dashboard (product, price, pricing); this edits only the app-only settings Stripe doesn't own (pool limits, overage, use allowances, billing timing, presentation, visibility) by writing them to the linked Stripe Product's metadata and re-syncing. Partial update — omitted fields keep their value. `status: ARCHIVED` deactivates the Stripe Product (orgs on it keep their reference); `visibility` toggles public/private.
          */
         put: operations["UpdateBillingPlan"];
         post?: never;
@@ -710,7 +742,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/admin/orgs/{orgId}/billing/grace": {
+    "/admin/orgs/{orgId}/billing/allowance": {
         parameters: {
             query?: never;
             header?: never;
@@ -720,10 +752,10 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Extend an org's payment grace period (admin-only)
-         * @description Admin only. Set the deadline after which an overdue org falls back to free-plan limits. Use to grant more time while a customer sorts out a failed payment.
+         * Set an org's payment-failure allowance (admin-only)
+         * @description Admin only. Set the absolute number of additional uses available to an overdue org for each usage pool. Values replace the current allowance, so retrying the request is safe. A successful payment clears the allowance.
          */
-        post: operations["SetOrgGrace"];
+        post: operations["SetOrgPaymentAllowance"];
         delete?: never;
         options?: never;
         head?: never;
@@ -741,7 +773,7 @@ export interface paths {
         put?: never;
         /**
          * Grant prepaid credits to an org (admin-only)
-         * @description Admin only. Add credit to an org's wallet. PROMOTIONAL is goodwill (no payment, no invoice); PURCHASE records money paid out of band (wire, crypto) and raises a real Stripe invoice the customer can download; ADJUSTMENT is a correction, for example, writing off overage consumed during a grace window.
+         * @description Admin only. Add credit to an org's wallet. PROMOTIONAL is goodwill (no payment, no invoice); PURCHASE records money paid out of band (wire, crypto) and raises a real Stripe invoice the customer can download; ADJUSTMENT is a correction, for example, writing off overage consumed while a use allowance was active.
          */
         post: operations["AdminGrantOrgCredit"];
         delete?: never;
@@ -770,7 +802,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/admin/orgs/{orgId}/credits/grace": {
+    "/admin/orgs/{orgId}/credits/allowance": {
         parameters: {
             query?: never;
             header?: never;
@@ -780,10 +812,10 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Extend an org's credit grace period (admin-only)
-         * @description Admin only. Set the deadline after which the org's overage stops for want of credit. Separate from the payment grace period: this one caps overage only — the plan's included allowance keeps working — and does not mark the subscription past due.
+         * Set an org's credit-exhaustion allowance (admin-only)
+         * @description Admin only. Set the absolute number of additional overage uses available after prepaid credits are exhausted, for each usage pool. Values replace the current allowance, so retrying the request is safe. The plan's included allowance keeps working, and a top-up clears this allowance.
          */
-        post: operations["SetOrgCreditGrace"];
+        post: operations["SetOrgCreditAllowance"];
         delete?: never;
         options?: never;
         head?: never;
@@ -849,7 +881,7 @@ export interface paths {
         put?: never;
         /**
          * Register a verification client (admin-only)
-         * @description Admin only. Registers a client and issues its token. The plaintext token is returned ONCE in this response and never stored — only its HMAC lands in the database.
+         * @description Admin only. Registers a Verification Client. The returned client UUID is the Builder-mode identity sent as `x-reclaim-vc-id` and is bound to sessions selected by this client's URL. Token fields in this response are retained only for legacy-client compatibility and are not used by Builder mode.
          */
         post: operations["CreateVerificationClient"];
         delete?: never;
@@ -868,8 +900,8 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Issue an additional token for a verification client (admin)
-         * @description Admin only. Adds a new token to the client; existing tokens keep working (a client may hold several live tokens, for example, one per deployment or for zero-downtime rotation). The plaintext is returned ONCE — only its HMAC is stored.
+         * Issue a legacy verification-client token (admin)
+         * @description Legacy compatibility endpoint. Builder-mode clients use the registered UUID in `x-reclaim-vc-id` and do not need this token. Existing legacy clients may continue to rotate their credentials without affecting Builder-mode sessions.
          */
         post: operations["IssueVerificationClientToken"];
         delete?: never;
@@ -889,8 +921,8 @@ export interface paths {
         put?: never;
         post?: never;
         /**
-         * Revoke one verification-client token (admin-only)
-         * @description Admin only. Revokes a single token by id; it stops working immediately while the client's other tokens are unaffected.
+         * Revoke one legacy verification-client token (admin-only)
+         * @description Legacy compatibility endpoint. Revokes one legacy token; this does not change the registered client's Builder-mode UUID or any session bound to that UUID.
          */
         delete: operations["RevokeVerificationClientToken"];
         options?: never;
@@ -908,7 +940,7 @@ export interface paths {
         get?: never;
         /**
          * Update a verification client (admin-only)
-         * @description Admin only. Updates the client's quota pool, base URL (its JWS `iss` identity), or self-hosted `jwksUri`. Omitted fields keep their current values.
+         * @description Admin only. Updates the client's quota pool, claimant-facing base URL, exact trusted JWS `issuer`, or registered `jwksUri`. The issuer and JWKS URL are separate from the claimant URL. Consumers must use the registered issuer and JWKS URL, never values supplied in a result. Omitted fields keep their current values.
          */
         put: operations["UpdateVerificationClient"];
         post?: never;
@@ -1046,7 +1078,7 @@ export interface paths {
         put?: never;
         /**
          * Report the claimant's client id
-         * @description The verification page posts the browser-generated `claimantClientId` (UUID v4, persisted in localStorage) here; it is recorded as a `verification_client_opened` event so the session can track the claimant across verifications.
+         * @description The verification page posts its browser-generated claimant id and a bounded browser/device snapshot. The id is persisted in localStorage so the session can track the same claimant across verifications.
          */
         post: operations["ReportClaimant"];
         delete?: never;
@@ -1168,7 +1200,7 @@ export interface paths {
         };
         /**
          * JWKS for verifying signed verification results
-         * @description JSON Web Key Set (RFC 7517) exposing the public keys that sign verification result JWS payloads (ES256K / secp256k1). Consumers fetch this to verify a delivered result. `kid` is the signer's ETH address. Aggregates the in-process Verification Client signing key (`VC_SIGNING_PRIVATE_KEY`) with every registered verification client's active signing keys, so results signed by the builder or by any registered client verify against this one endpoint.
+         * @description JSON Web Key Set (RFC 7517) exposing the public keys that sign verification result JWS payloads (ES256K / secp256k1). Consumers fetch this to verify a delivered result. `kid` is the signer's ETH address. Result keys carry a namespaced purpose and Verification Client owner. The top-level `x-reclaim-attestors` extension lists trusted EIP-191 attestor signer addresses; an address is a public-key hash, not a JWK. Aggregates the in-process Verification Client signing key (`VC_SIGNING_PRIVATE_KEY`) with every registered verification client's active signing keys, so results signed by the builder or by any registered client verify against this one endpoint.
          */
         get: operations["JwksJson"];
         put?: never;
@@ -1801,7 +1833,7 @@ export interface paths {
         };
         /**
          * Prepaid credit balance for an organization
-         * @description Owner only. The org's prepaid credit wallet, which funds usage beyond the plan allowance: what is left to spend, and whether overage is inside or past its grace window. Always returns a body — an org that never topped up reads as zero.
+         * @description Owner only. The org's prepaid credit wallet, which funds usage beyond the plan allowance: what is left to spend, and each pool's remaining credit-exhaustion allowance. Always returns a body — an org that never topped up reads as zero.
          */
         get: operations["GetOrgCredits"];
         put?: never;
@@ -1952,6 +1984,138 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/contribute/{publicId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * View a public contribution campaign
+         * @description Render the volunteer brief for an open public contribution campaign. The response includes the exact approved requirements, consent copy, and fixed US routing policy. It never includes provider recipes, browser credentials, or prior volunteer values.
+         */
+        get: operations["GetPublicContributionCampaign"];
+        put?: never;
+        /**
+         * Start a public contribution attempt
+         * @description Start one field-scoped volunteer attempt after the volunteer accepts the campaign consent. HTML callers are redirected to the contribution resume page; JSON callers receive the sanitized attempt handle. The service pins the attempt to the campaign's US proxy policy.
+         */
+        post: operations["CreatePublicContributionAttempt"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/contribute/{publicId}/feedback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Submit scoped volunteer feedback
+         * @description Submit bounded feedback using the attempt capability. The capability is scoped to one campaign and attempt and cannot read account data or change a provider. Feedback is sanitized before it is added to the maintainer review queue.
+         */
+        post: operations["SubmitPublicContributionFeedback"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/contributions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Review provider contributions
+         * @description Show contribution campaigns, attempts, version history, comments, and bounded event summaries for a provider. The caller must be an active member of the provider's organization. Raw volunteer values are never returned.
+         */
+        get: operations["ListProviderContributionCampaigns"];
+        put?: never;
+        /**
+         * Create a provider contribution campaign
+         * @description Create a draft public-contribution campaign. A campaign stays private until its requirements are versioned and a maintainer opens it.
+         */
+        post: operations["CreateProviderContributionCampaign"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/contributions/{campaignId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Change contribution campaign status
+         * @description Apply a legal campaign transition. Opening requires a public provider and a current immutable requirement revision.
+         */
+        post: operations["SetProviderContributionCampaignStatus"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update a contribution campaign
+         * @description Update an editable draft or paused campaign.
+         */
+        patch: operations["UpdateProviderContributionCampaign"];
+        trace?: never;
+    };
+    "/providers/{providerId}/contributions/{campaignId}/requirements": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add a contribution requirement revision
+         * @description Append a new immutable requirement revision to a draft or paused campaign. Requirement keys are the only fields volunteers may prove.
+         */
+        post: operations["CreateProviderContributionRequirementRevision"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/providers/{providerId}/contributions/{campaignId}/comments": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add a contribution review comment
+         * @description Add an append-only maintainer comment to the review history.
+         */
+        post: operations["AddProviderContributionComment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/providers/{providerId}": {
         parameters: {
             query?: never;
@@ -2043,7 +2207,11 @@ export interface paths {
         put?: never;
         /**
          * Create a new provider version
-         * @description Creates a new version of the provider. The starting branch
+         * @description Creates a new immutable semantic version of the provider. Provider
+         *     authoring clients must create another version for every content change;
+         *     they must not edit a previously created version in place. Use a patch
+         *     bump by default, or use a major/minor bump or exact higher version when
+         *     the user directs it. The starting branch
          *     depends on the provider's `visibility` and the caller's role:
          *
          *     - `PRIVATE` provider (any caller): the live channel (no review).
@@ -2277,7 +2445,7 @@ export interface paths {
         put?: never;
         /**
          * Register a callback subscription on an organization
-         * @description Registers a destination for verification results on the organization. Caller must be an active member of the org. The body is just `callbackUrl` and `events`; delivery is scoped to the org and encrypted as a compact JWE to the org's encryption credential when set, else delivered as plaintext.
+         * @description Registers a destination for verification results on the organization. Caller must be an active member of the org. The body is just `callbackUrl` and `events`; delivery is scoped to the org and encrypted as an ECIES ciphertext (base64url) to the org's encryption credential when set, else delivered as plaintext.
          */
         post: operations["CreateOrgCallbackSubscription"];
         delete?: never;
@@ -2348,6 +2516,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/orgs/{orgId}/verification-funnel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the verification funnel
+         * @description Returns observed lifecycle-milestone counts for sessions created in the half-open interval [createdAfter, createdBefore). SESSION mode counts a session once. PROVIDER mode counts each session-provider execution. Optional interaction milestones can be absent because of telemetry loss, so do not treat every missing optional event as claimant drop-off.
+         */
+        get: operations["GetVerificationFunnel"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/verifications/sessions": {
         parameters: {
             query?: never;
@@ -2368,11 +2556,14 @@ export interface paths {
          *         curl -X POST $BASE/verifications/sessions \
          *           -H "Authorization: Bearer $ORG_TOKEN" \
          *           -H 'Content-Type: application/json' \
-         *           -d '{"providerId":"…","context":{},
-         *                "verificationClientUrl":"'$BASE'/v/{sessionId}"}'
+         *           -d '{"providers":[{"providerId":"…","version":"^1.2.0"}],"context":{},
+         *                "verificationClientUrl":"https://verify.example.com/"}'
          *
          *     Fails with `409 Conflict` if the organization has no callback
          *     subscription (there would be nowhere to deliver the result).
+         *     A quota or credit refusal returns `402` or `429` with
+         *     `event: billing_required` and `sessionId`; Builder has atomically
+         *     recorded that minimal terminal session and its analytics event.
          */
         post: operations["CreateVerificationSession"];
         delete?: never;
@@ -2391,7 +2582,8 @@ export interface paths {
         /**
          * Get a verification session
          * @description Returns the session. Authenticated by the consumer's `OrgToken` (or the
-         *     VC service token); the resolved org must match the session's.
+         *     session-bound Verification Client id); the resolved org must match the
+         *     session's.
          *
          *     Reading `status`:
          *     - `pending` — created, not yet finished; the end-user can still
@@ -2428,7 +2620,7 @@ export interface paths {
         };
         /**
          * Get the resolved provider recipes for a session
-         * @description Returns the session's resolved provider versions' recipes (`initialUrl` + `requests` per provider), in run order — what the Verification Client needs to run the session (each provider sequentially in one browser session). Authorized for the Verification Client (`X-VC-Token` service token) or the session creator (authenticated by the consumer's `OrgToken`; the resolved org must match the session), so it works regardless of the provider's visibility (unlike `GetProvider`, which 404s on PRIVATE providers for non-members).
+         * @description Returns the session's resolved provider versions' recipes (`initialUrl` + `requests` per provider), in run order — what the Verification Client needs to run the session (each provider sequentially in one browser session). Authorized for the Verification Client (`x-reclaim-vc-id`) or the session creator (authenticated by the consumer's `OrgToken`; the resolved org must match the session), so it works regardless of the provider's visibility (unlike `GetProvider`, which 404s on PRIVATE providers for non-members).
          */
         get: operations["GetVerificationRecipe"];
         put?: never;
@@ -2439,6 +2631,41 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/verifications/sessions/{sessionId}/tee-nonce": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Bind a legacy-compatible TEE nonce to a verification session
+         * @description Registers the legacy-compatible TEE nonce after a session is created.
+         *     Authenticate with the owning organization's `OrgToken`. The request is
+         *     additionally authenticated by an EIP-191 `personal_sign` signature
+         *     produced by the organization verification key over this exact UTF-8
+         *     message (with no newline):
+         *
+         *     `RECLAIM_BUILDER_TEE_BINDING_V1:{organizationId}:{sessionId}:{applicationId}:{timestamp}:{attestationVersion}:{attestationNonce}`
+         *
+         *     `applicationId` must be the Ethereum address of the registered
+         *     organization verification key (case-insensitive comparison; its exact
+         *     request spelling is preserved because it is part of the legacy nonce).
+         *     `attestationNonce` and `attestationNonceData` are subsequently exposed
+         *     in the session's `context`, so a Verification Client can forward them
+         *     unchanged to the legacy attestor. Repeating the exact binding succeeds;
+         *     a conflicting binding, terminal session, or a session that has started
+         *     proof generation returns `409 Conflict`.
+         */
+        put: operations["BindVerificationSessionTeeNonce"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/verifications/sessions/{sessionId}/events": {
         parameters: {
             query?: never;
@@ -2449,7 +2676,7 @@ export interface paths {
         /**
          * Get the event log for a session
          * @description Returns the append-only event log. Readable by the Verification Client
-         *     (`X-VC-Token`) or the session creator (authenticated by the consumer's
+         *     (`x-reclaim-vc-id`) or the session creator (authenticated by the consumer's
          *     `OrgToken`; the resolved org must match the session).
          *
          *     This log is the primary tool for diagnosing a stuck or failed session.
@@ -2472,7 +2699,7 @@ export interface paths {
          *     Failure detail lives in `eventData` on `request_claim_failed`,
          *     `request_claim_rejected`, `verification_error`, and
          *     `verification_rejected` — inspect it for the reason. Request-level
-         *     events also carry a `request_id` in `eventData`. Pair with
+         *     events also carry a `requestId` in `eventData`. Pair with
          *     `get_verification_session` (status/expiry) and
          *     `list_verification_deliveries` (callback health) for the full picture.
          */
@@ -2480,7 +2707,7 @@ export interface paths {
         put?: never;
         /**
          * Report a verification status event
-         * @description Used by the Verification Client (authenticated with the `X-VC-Token` service token) to report status pings (opened, ready, per-request progress, and terminal events). Never carries the proof — the signed result is submitted via the result endpoint.
+         * @description Used by the session's Verification Client, identified by the `x-reclaim-vc-id` header, to report status pings (opened, ready, per-request progress, and terminal events). Never carries the proof — the signed result is submitted via the result endpoint.
          */
         post: operations["ReportVerificationEvent"];
         delete?: never;
@@ -2489,6 +2716,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/verifications/sessions/{sessionId}/claimant": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update claimant details
+         * @description Updates the session's latest diagnostic claimant and device snapshot. The Builder captures the request's Reclaim client headers, HTTP user agent, and peer IP separately from client-reported values. These details never affect proof validity. The x-reclaim-vc-id must match the registered Verification Client selected at session creation.
+         */
+        patch: operations["PatchVerificationClaimant"];
+        trace?: never;
+    };
     "/verifications/sessions/{sessionId}/deliveries": {
         parameters: {
             query?: never;
@@ -2504,7 +2751,7 @@ export interface paths {
          *     (or the agent) answer "did my callback arrive, and if not, why?"
          *     without org-dashboard access. Only meaningful after the session
          *     reaches a terminal status (no deliveries exist before then). Auth
-         *     mirrors the events GET: the Verification Client service token, or the
+         *     mirrors the events GET: the session-bound Verification Client id, or the
          *     consumer's `OrgToken` (the resolved org must match the session).
          *
          *     Reading `deliveryStatus` per entry:
@@ -2537,7 +2784,7 @@ export interface paths {
         };
         /**
          * List callback encryption keys for a session
-         * @description Used by the Verification Client (X-VC-Token) after the terminal event: returns the session org's callback subscriptions that subscribe to that terminal event. Each item carries the org's `publicKeyJwk` (secp256k1) to ECIES-encrypt the result to when the org's `canEncryptResult` is enabled, or none (deliver plaintext).
+         * @description Used by the Verification Client (x-reclaim-vc-id) after the terminal event: returns the session org's callback subscriptions that subscribe to that terminal event. Each item carries the org's `publicKeyJwk` (secp256k1) to ECIES-encrypt the result to when the org's `canEncryptResult` is enabled, or none (deliver plaintext).
          */
         get: operations["ListSessionCallbackKeys"];
         put?: never;
@@ -2557,13 +2804,13 @@ export interface paths {
         };
         /**
          * Get the stored encrypted result(s) for a session
-         * @description Returns the stored result payload(s) the Verification Client stored for this session — one item per callback subscription. Readable by the Verification Client (X-VC-Token) or the consumer who created the session (authenticated by the consumer's `OrgToken`; the resolved org must match). A pull-based companion to the push delivery: when the org has an encryption credential the Builder relays a compact JWE that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted.
+         * @description Returns the stored result payload(s) the Verification Client stored for this session — one item per callback subscription. Readable by the Verification Client (x-reclaim-vc-id) or the consumer who created the session (authenticated by the consumer's `OrgToken`; the resolved org must match). A pull-based companion to the push delivery: when the org has an encryption credential the Builder relays an ECIES ciphertext (base64url) that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted. Treat every returned payload as untrusted until `verifyResultFull` succeeds with the session's registered issuer and JWKS URL.
          */
         get: operations["GetVerificationResult"];
         put?: never;
         /**
          * Submit the signed, encrypted verification result
-         * @description Used by the Verification Client (X-VC-Token) to submit the result after a terminal event. The VC signs the JWS and, when the org's `canEncryptResult` is enabled, ECIES-encrypts it to the org's eth public key (from the callback-keys endpoint); it submits one payload per subscription. The Builder stores each payload, enqueues it for the delivery worker (retry → DLQ), and never sees the plaintext. The Verification Client does not contact the Consumer.
+         * @description Used by the Verification Client (x-reclaim-vc-id) to submit the result after a terminal event. The VC signs the JWS and, when the org's `canEncryptResult` is enabled, ECIES-encrypts it to the org's eth public key (from the callback-keys endpoint); it submits one payload per subscription. The Builder stores each payload, enqueues it for the delivery worker (retry → DLQ), and never sees the plaintext. The Verification Client does not contact the Consumer.
          */
         post: operations["SubmitVerificationResult"];
         delete?: never;
@@ -2758,11 +3005,8 @@ export interface components {
          * @description Stable id for a callback subscription.
          */
         SubscriptionID: string;
-        /** @description The verification client id claiming the session. */
-        ReportClaimantRequest: {
-            /** Format: uuid */
-            claimantClientId: string;
-        };
+        /** @description Browser claimant snapshot produced by the built-in Verification Client. */
+        ReportClaimantRequest: components["schemas"]["ClaimantDetails"];
         /**
          * @description Live-derived operating mode of an organization.
          *
@@ -2805,6 +3049,10 @@ export interface components {
              * @description URI reference identifying this specific occurrence (often the request id or a log link). Useful for cross-referencing with server logs.
              */
             instance?: string;
+            /** @description Optional machine-readable lifecycle event for this problem. */
+            event?: string;
+            /** @description Minimal terminal session recorded for a post-validation billing or quota refusal. Present with `event: billing_required`. */
+            sessionId?: components["schemas"]["SessionID"];
         };
         /**
          * @description The visibility of the entity.
@@ -2938,8 +3186,10 @@ export interface components {
              */
             status: components["schemas"]["EntityStatus"];
         };
-        /** @description A single piece of consent copy. Currently a plain string (no per-locale map yet — unlike reclaim-portal's `TextByLocale`, which this may grow into later). */
-        ConsentText: string;
+        /** @description A single piece of consent copy. Use a string for one language, or a locale map compatible with Verification Clients' `TextByLocale`. Locale lookup tries an exact locale, its base language, `en`, then the first entry. */
+        ConsentText: string | {
+            [key: string]: string;
+        };
         /** @description A full-screen consent prompt shown once, before the end-user is navigated to the provider's site — mirrors reclaim-portal's `ConsentInfo`. Absent on the owning `Theme` ⇒ no consent screen is shown for that org's sessions. */
         ConsentInfo: {
             title?: components["schemas"]["ConsentText"];
@@ -2948,6 +3198,190 @@ export interface components {
             disclaimer?: components["schemas"]["ConsentText"];
             continueButtonLabel?: components["schemas"]["ConsentText"];
         };
+        ThemeImageAlignment: {
+            /** @default 0 */
+            x: number;
+            /** @default 0 */
+            y: number;
+        };
+        ThemeImageOptions: {
+            alignment?: components["schemas"]["ThemeImageAlignment"];
+            /** Format: int64 */
+            backgroundColor?: number;
+            /** @default 1 */
+            opacity: number;
+            /**
+             * @default cover
+             * @enum {string}
+             */
+            fit: "cover" | "scale_down";
+            /**
+             * @deprecated
+             * @description Deprecated legacy client field retained for theme compatibility.
+             * @default false
+             */
+            spin: boolean;
+        };
+        ThemeImage: {
+            /** Format: uri */
+            url?: string;
+            options?: components["schemas"]["ThemeImageOptions"];
+        };
+        ThemeColorOrImage: {
+            /** Format: int64 */
+            color?: number;
+            image?: components["schemas"]["ThemeImage"];
+        };
+        ThemeBorder: {
+            /** Format: int64 */
+            color?: number;
+            width?: number;
+            radius?: number;
+        };
+        ThemeButton: {
+            /** @enum {string} */
+            style: "filled" | "outlined";
+            border?: components["schemas"]["ThemeBorder"];
+            /** Format: int64 */
+            backgroundColor?: number;
+            /** Format: int64 */
+            foregroundColor?: number;
+        };
+        ThemeParameterStyle: {
+            /** @enum {string} */
+            displayStyle?: "compact" | "dividerSeparated";
+            /** Format: int64 */
+            dividerColor?: number;
+            borderStyle?: components["schemas"]["ThemeBorder"];
+            /** @default true */
+            isValueShown: boolean;
+        };
+        ThemeColorScheme: {
+            /** Format: int64 */
+            themeColor?: number;
+            /** Format: int64 */
+            surfaceColor?: number;
+            /** Format: int64 */
+            onSurfaceColor?: number;
+        };
+        VerificationReviewScreenTheme: {
+            fieldVerifyingIcon?: components["schemas"]["ThemeImage"];
+            fieldVerifiedIcon?: components["schemas"]["ThemeImage"];
+            /** Format: int64 */
+            providerToAppLoaderColor?: number;
+            providerToAppLoader?: components["schemas"]["ThemeColorOrImage"];
+            verificationCompleteIcon?: components["schemas"]["ThemeImage"];
+            verifyScreenAppIcon?: components["schemas"]["ThemeImage"];
+            verificationFailedIcon?: components["schemas"]["ThemeImage"];
+        };
+        VerificationVisualTheme: {
+            background?: components["schemas"]["ThemeColorOrImage"];
+            backgroundBlurStrength?: number;
+            /** Format: int64 */
+            backgroundBlurColor?: number;
+            parameterStyle?: components["schemas"]["ThemeParameterStyle"];
+            colorScheme?: components["schemas"]["ThemeColorScheme"];
+            doneIcon?: components["schemas"]["ThemeImage"];
+            appImageOptions?: components["schemas"]["ThemeImageOptions"];
+            loading?: components["schemas"]["ThemeColorOrImage"];
+            cardElevation?: number;
+            /** Format: int64 */
+            cardColor?: number;
+            /** Format: int64 */
+            onCardColor?: number;
+            /** Format: int64 */
+            sessionChipSurfaceColor?: number;
+            /** Format: int64 */
+            sessionChipOnSurfaceColor?: number;
+            /** Format: int64 */
+            termsNoticeColor?: number;
+            /** Format: int64 */
+            hyperlinkColor?: number;
+            /**
+             * Format: int64
+             * @deprecated
+             * @description Deprecated alias for `hyperlinkColor`.
+             */
+            hyperlinkColorInt?: number;
+            verificationReviewScreenTheme?: components["schemas"]["VerificationReviewScreenTheme"];
+            consentViewIcon?: components["schemas"]["ThemeImage"];
+            consentDisclaimerIcon?: components["schemas"]["ThemeImage"];
+            submissionConsentDisclaimerIcon?: components["schemas"]["ThemeImage"];
+            consentContinueButtonTheme?: {
+                /** Format: int64 */
+                backgroundColor?: number;
+                /** Format: int64 */
+                foregroundColor?: number;
+            };
+            verifyAnotherWayStyle?: {
+                headerActionButtonStyle?: components["schemas"]["ThemeButton"];
+                failedActionButtonStyle?: components["schemas"]["ThemeButton"];
+            };
+        };
+        /** @description Cross-client presentation fields used by the in-app SDK and Portal. Clients apply supported visual fields and ignore fields that don't belong to their UI surface. */
+        VerificationClientTheme: {
+            /**
+             * @default light
+             * @enum {string}
+             */
+            themeMode: "dark" | "light" | "system";
+            theme?: components["schemas"]["VerificationVisualTheme"];
+            darkTheme?: components["schemas"]["VerificationVisualTheme"];
+            returnToAppMessage?: {
+                success?: string;
+                failure?: string;
+            };
+            dataSharedMessage?: {
+                savedAndShared?: string;
+                shared?: string;
+                whatWasShared?: string;
+            };
+            /** Format: uri */
+            potentialFailureReasonsLink?: string;
+            secureAndPrivateText?: string;
+            canShowLoadingOnPageChange?: boolean;
+            submitButtonLabel?: components["schemas"]["ConsentText"];
+            cancelButtonLabel?: components["schemas"]["ConsentText"];
+            extraTranslations?: {
+                [key: string]: components["schemas"]["ConsentText"];
+            };
+            portalInfo?: {
+                header?: {
+                    description?: components["schemas"]["ConsentText"];
+                    /** Format: uri */
+                    descriptionLink?: string;
+                };
+                verificationReviewInfo?: {
+                    /** @enum {string} */
+                    displayStyle?: "comfortablyStartAligned";
+                    placeholderFields?: {
+                        label?: components["schemas"]["ConsentText"];
+                        hashed?: boolean;
+                        order?: number;
+                    }[];
+                    gettingStarted?: components["schemas"]["ThemeStatusInfo"];
+                    pageLoading?: components["schemas"]["ThemeStatusInfo"];
+                    lookingForInformation?: components["schemas"]["ThemeStatusInfo"];
+                    validatingInformation?: components["schemas"]["ThemeStatusInfo"];
+                    validationComplete?: components["schemas"]["ThemeStatusInfo"];
+                    validatingFailed?: components["schemas"]["ThemeStatusInfo"];
+                    /** @default false */
+                    skipGettingStartedOverlay: boolean;
+                    /** @default false */
+                    skipPageLoadingOverlay: boolean;
+                    /** @default false */
+                    skipCompletionOverlay: boolean;
+                };
+                submissionConsent?: components["schemas"]["ConsentText"];
+                verifyAnotherWayLabel?: components["schemas"]["ConsentText"];
+                /** Format: uri */
+                verifyAnotherWayLink?: string;
+            };
+        };
+        ThemeStatusInfo: {
+            title?: components["schemas"]["ConsentText"];
+            subtitle?: components["schemas"]["ConsentText"];
+        };
         /** @description A visual theme owned by an organization. Customizes the **end-user verification UX** rendered inside apps that integrate the Reclaim client SDK — brand colors, logos, and copy shown to end-users while they verify. Not applied to the builder UI itself. */
         Theme: {
             id: components["schemas"]["ThemeID"];
@@ -2960,8 +3394,11 @@ export interface components {
              * @description URL to a square icon image used to represent this theme.
              */
             iconUrl?: string;
+            /** @description Preferred locale for localized theme copy. Verification Clients fall back to the claimant locale when this is absent. */
+            preferredLocale?: string;
             /** @description Optional full-screen consent prompt — see `ConsentInfo`. Absent ⇒ the Verification Client shows no consent screen and proceeds straight to the provider's site. */
             consent?: components["schemas"]["ConsentInfo"];
+            clientTheme?: components["schemas"]["VerificationClientTheme"];
             /**
              * Format: uri
              * @description Org-specific Terms of Service URL, shown as a footer notice (not a blocking screen) during verification — matches reclaim-portal's / reclaim-inapp-sdk's `termsAndConditionLink`. Absent ⇒ clients fall back to the default Reclaim Terms of Service URL.
@@ -3070,6 +3507,7 @@ export interface components {
             plan?: string;
             subscriptionStatus?: components["schemas"]["BillingSubscriptionStatus"];
             billingMode: components["schemas"]["BillingMode"];
+            billingTiming?: components["schemas"]["BillingTiming"];
             stripeCustomerId?: string;
             /** Format: date-time */
             currentPeriodStart?: string;
@@ -3087,11 +3525,6 @@ export interface components {
              * @description When the scheduled downgrade takes effect (period end).
              */
             pendingPlanEffectiveAt?: string;
-            /**
-             * Format: date-time
-             * @description When an overdue (past_due) org loses paid limits and falls back to the free plan. Admin-extendable. This is the failed-card clock (plan graceDays) — the credit wallet has its own graceUntil, which only governs overage.
-             */
-            graceUntil?: string;
             createMetadata: components["schemas"]["ActorMetadata"];
             updateMetadata: components["schemas"]["ActorMetadata"];
         };
@@ -3114,6 +3547,7 @@ export interface components {
             periodCount?: number;
             pricePerPeriod?: number;
             currency?: string;
+            billingTiming?: components["schemas"]["BillingTiming"];
         };
         /** @description Email address to send a one-time sign-in code to. */
         RequestLoginOtpRequest: {
@@ -3144,13 +3578,23 @@ export interface components {
             /** @description Also cancel the org's subscription at period end after refunding. */
             cancel?: boolean;
         };
-        /** @description Set the deadline until which an org keeps paid access without payment — the failed-card clock. To extend an exhausted credit wallet instead, use `POST /admin/orgs/{orgId}/credits/grace`. */
-        SetOrgGraceRequest: {
-            /**
-             * Format: date-time
-             * @description Deadline as an RFC 3339 UTC date-time, for example `2026-08-21T23:59:00Z`. Access lasts until this instant, then the org drops to the free plan.
-             */
-            graceUntil: string;
+        /** @description Absolute payment-failure allowance for one usage pool. The value is replaced on every request, which makes retries safe. */
+        PoolPaymentFailureAllowance: {
+            pool: components["schemas"]["QuotaPool"];
+            /** @description Additional uses allowed after a plan payment fails. */
+            paymentFailureAllowance: number;
+        };
+        /** @description Absolute credit-exhaustion allowance for one usage pool. The value is replaced on every request, which makes retries safe. */
+        PoolCreditExhaustionAllowance: {
+            pool: components["schemas"]["QuotaPool"];
+            /** @description Additional overage uses allowed after credits run out. */
+            creditExhaustionAllowance: number;
+        };
+        SetOrgPaymentAllowanceRequest: {
+            pools: components["schemas"]["PoolPaymentFailureAllowance"][];
+        };
+        SetOrgCreditAllowanceRequest: {
+            pools: components["schemas"]["PoolCreditExhaustionAllowance"][];
         };
         /**
          * @description Mirrors Stripe subscription statuses, plus two app-level values: `canceling` (cancellation scheduled for period end — Stripe stays `active` until it deletes the subscription) and `manual` (admin-managed / alternate-payment orgs with no Stripe subscription).
@@ -3167,6 +3611,12 @@ export interface components {
          * @enum {string}
          */
         BillingMode: "STRIPE" | "MANUAL";
+        /**
+         * @description When the plan fee is collected for each billing cycle. UPFRONT charges before service begins (the default). POSTPAID lets the org use the plan during the cycle and invoices at the end of the cycle.
+         * @default UPFRONT
+         * @enum {string}
+         */
+        BillingTiming: "UPFRONT" | "POSTPAID";
         /**
          * @description How the resolver picks providers. `combine` (default) minimizes to the fewest providers (set-cover); `ai` is a forward-compat alias that currently resolves like combine.
          * @default combine
@@ -3184,6 +3634,8 @@ export interface components {
          *       "pool": "VERIFICATION",
          *       "includedLimit": 2000,
          *       "overageEnabled": true,
+         *       "paymentFailureAllowance": 100,
+         *       "creditExhaustionAllowance": 50,
          *       "overageRate": 0.5
          *     }
          */
@@ -3193,6 +3645,10 @@ export interface components {
             includedLimit: number;
             /** @description When true, usage past includedLimit keeps serving and bills as metered overage; when false the pool hard-stops at the limit. */
             overageEnabled: boolean;
+            /** @description Additional uses available in this pool after a plan payment fails. The allowance is measured in uses, not days. */
+            paymentFailureAllowance: number;
+            /** @description Additional overage uses available in this pool after prepaid credits run out. The allowance is measured in uses, not days. */
+            creditExhaustionAllowance: number;
             /** @description Per-unit overuse charge (from Stripe); absent until priced. */
             overageRate?: number;
             stripeMeterId?: string;
@@ -3201,6 +3657,10 @@ export interface components {
         PlanPoolInput: {
             pool: components["schemas"]["QuotaPool"];
             includedLimit: number;
+            /** @description Additional uses available after a plan payment fails. */
+            paymentFailureAllowance: number;
+            /** @description Additional overage uses available after credits run out. */
+            creditExhaustionAllowance: number;
             overageEnabled?: boolean;
         };
         /** @description One pool's usage against its limit for a billing period. */
@@ -3208,6 +3668,10 @@ export interface components {
             pool: components["schemas"]["QuotaPool"];
             used: number;
             includedLimit: number;
+            /** @description Effective additional uses allowed after a plan payment fails. */
+            paymentFailureAllowance: number;
+            /** @description Effective additional overage uses allowed after credits run out. */
+            creditExhaustionAllowance: number;
             overageEnabled?: boolean;
             /** @description Per-unit overage charge (from Stripe), so the org can see what usage past includedLimit costs. Absent until the pool is priced. */
             overageRate?: number;
@@ -3242,16 +3706,7 @@ export interface components {
             periodUnit?: "DAY" | "MONTH" | "YEAR";
             /** @description Number of periodUnit per cycle. */
             periodCount?: number;
-            /**
-             * @description Days an overdue org keeps paid limits before dropping to Free. Null = the global default (14); 0 = no grace at all, so the drop is immediate.
-             *     The failed-card clock: it starts when Stripe cannot collect the plan fee, and a successful payment clears it. On expiry the whole plan drops to free-plan limits — a hard cap with overage off. Distinct from creditGraceDays, the empty-wallet clock, which only caps overage. The two are independent and can overlap.
-             */
-            graceDays?: number | null;
-            /**
-             * @description Days an org keeps serving overage after its prepaid credit balance hits zero, before overage stops (the plan's included allowance keeps working). Null = the global default (10); 0 = no grace at all, so overage stops as soon as the wallet is empty.
-             *     The empty-wallet clock: it starts on the first overage charged against an empty wallet — never when a plan is applied — and any top-up clears it. On expiry only overage is refused (402); the plan itself is untouched. Distinct from graceDays, the failed-card clock, whose expiry drops the whole plan to free limits.
-             */
-            creditGraceDays?: number | null;
+            billingTiming: components["schemas"]["BillingTiming"];
             /** @description Contact-only lead tier — shown on the pricing page but not self-serve checkoutable; admins assign and bill it. Enterprise uses this. */
             contactOnly?: boolean;
             /**
@@ -3281,10 +3736,7 @@ export interface components {
             pools?: components["schemas"]["PlanPoolInput"][];
             visibility?: components["schemas"]["EntityVisibility"];
             status?: components["schemas"]["EntityStatus"];
-            /** @description Days overdue orgs keep paid limits before dropping to Free. Omit for the global default (14), or send 0 for no grace at all. The failed-card clock — cleared by a successful payment; on expiry the whole plan drops to free limits. See creditGraceDays for the separate empty-wallet clock. */
-            graceDays?: number | null;
-            /** @description Days an org keeps serving overage after its credits run out. Omit for the global default (10), or send 0 to stop overage as soon as the wallet is empty. The empty-wallet clock — cleared by any top-up; on expiry only overage stops, and the plan's included allowance keeps working. See graceDays for the separate failed-card clock. */
-            creditGraceDays?: number | null;
+            billingTiming?: components["schemas"]["BillingTiming"];
             /** @description Contact-only lead tier — shown but not self-serve checkoutable. */
             contactOnly?: boolean;
             /**
@@ -3303,10 +3755,7 @@ export interface components {
             stripeProductId: string;
             pools: components["schemas"]["PlanPoolInput"][];
             visibility?: components["schemas"]["EntityVisibility"];
-            /** @description Failed-card grace: days an overdue org keeps paid limits before dropping to Free. Omit for the global default (14), or send 0 for no grace at all. */
-            graceDays?: number | null;
-            /** @description Empty-wallet grace: days an org keeps serving overage after its credits run out, before overage stops (the plan's included allowance keeps working). Omit for the global default (10), or send 0 to stop overage as soon as the wallet is empty. A separate clock from graceDays. */
-            creditGraceDays?: number | null;
+            billingTiming?: components["schemas"]["BillingTiming"];
             contactOnly?: boolean;
             /** Format: uuid */
             orgId?: string;
@@ -3333,28 +3782,13 @@ export interface components {
         /** @description The org's prepaid credit wallet, which funds usage beyond its plan allowance. Credits are bought through Stripe (which owns the money as billing credit grants and applies them to the metered overage line when an invoice finalises); this projection is what governs service in real time. Always present — an org that never topped up reads as zero. */
         OrgCredit: {
             orgId: components["schemas"]["OrgID"];
-            /** @description Credit left to spend. Floors at zero — once empty, the grace window (not a negative balance) governs access, and anything consumed past zero settles on the next Stripe invoice. */
+            /** @description Credit left to spend. Floors at zero — once empty, the per-pool credit-exhaustion allowance governs overage access, and anything consumed past zero settles on the next Stripe invoice. */
             remaining: number;
             currency: string;
-            /** @description Spent since the last sync with Stripe. May exceed the synced balance while the org is inside its grace window; the excess appears on the next invoice. */
+            /** @description Spent since the last sync with Stripe. May exceed the synced balance while a credit-exhaustion allowance remains; the excess appears on the next invoice. */
             unbilledSpend?: number;
-            /**
-             * Format: date-time
-             * @description When the balance first hit zero. Null while funded.
-             */
-            exhaustedAt?: string | null;
-            /**
-             * Format: date-time
-             * @description When overage stops for want of credit. Admin-extendable; cleared by any top-up. This is the empty-wallet clock — not OrgBilling's same-named graceUntil, which is the failed-card one.
-             */
-            graceUntil?: string | null;
-            /**
-             * @description Effective length of this wallet's grace window — the org's own override, else its plan's creditGraceDays, else the global default (10).
-             *     Named graceDays rather than creditGraceDays because every field on this object is about credit. It is NOT the plan's graceDays, which is the unrelated failed-card window (default 14) and drops the whole plan to free limits when it expires.
-             */
-            graceDays: number;
-            /** @description True when the wallet is empty AND the grace window has elapsed, so requests beyond the plan allowance are refused with 402. The included allowance still works. */
-            graceExpired: boolean;
+            /** @description Remaining incident allowances, reported separately per pool. */
+            allowances: components["schemas"]["OrgPoolAllowance"][];
             /**
              * Format: date-time
              * @description When the balance was last read from Stripe.
@@ -3365,6 +3799,22 @@ export interface components {
             /** @description Credit consumed, as Stripe recorded it when invoices finalised — the money-out side. Read live from Stripe, newest first. Excludes this cycle's unbilled usage, which is `unbilledSpend`. */
             spend?: components["schemas"]["CreditSpend"][];
         };
+        /** @enum {string} */
+        QuotaAllowanceReason: "PAYMENT_FAILURE" | "CREDIT_EXHAUSTION";
+        OrgPoolAllowance: {
+            pool: components["schemas"]["QuotaPool"];
+            reason: components["schemas"]["QuotaAllowanceReason"];
+            planAllowance: number;
+            adminTotalAllowance?: number | null;
+            consumed: number;
+            remaining: number;
+            incidentId?: string;
+            /** Format: date-time */
+            incidentAt?: string;
+        };
+        OrgPoolAllowanceResult: {
+            items: components["schemas"]["OrgPoolAllowance"][];
+        };
         CreditGrant: {
             id: string;
             name?: string;
@@ -3400,22 +3850,12 @@ export interface components {
         GrantOrgCreditRequest: {
             amount: number;
             /**
-             * @description PROMOTIONAL = goodwill, no payment. PURCHASE = paid out of band; raises a Stripe invoice marked paid out-of-band. ADJUSTMENT = a correction, for example, writing off grace-window overage.
+             * @description PROMOTIONAL = goodwill, no payment. PURCHASE = paid out of band; raises a Stripe invoice marked paid out-of-band. ADJUSTMENT = a correction, for example, writing off overage.
              * @enum {string}
              */
             kind: "PROMOTIONAL" | "PURCHASE" | "ADJUSTMENT";
             note?: string;
         };
-        /** @description Give the deadline as an absolute graceUntil, or as extendDays from now. graceUntil wins if both are sent. This extends the empty-wallet clock (overage only); for a failed card use `POST /admin/orgs/{orgId}/billing/grace`. */
-        SetCreditGraceRequest: {
-            /**
-             * Format: date-time
-             * @description RFC 3339 UTC deadline after which overage stops.
-             */
-            graceUntil?: string;
-            /** @description Days from now, as a shorthand for graceUntil. */
-            extendDays?: number;
-        };
         /** @description One payment for a period — Stripe-sourced (webhooks) and admin-recorded MANUAL (alternate payments) entries share this shape. */
         BillingTransaction: {
             /** Format: uuid */
@@ -3495,7 +3935,7 @@ export interface components {
             periodEnd?: string;
             note?: string;
         };
-        /** @description Metadata for one live token of a verification client. Never includes the plaintext secret — only its display `last4`. Same shape as `OrgTokenMeta`: `createMetadata` (issuer + timestamp) plus a flat `lastUsedAt`. */
+        /** @description Legacy metadata for one live token of a verification client. Never includes the plaintext secret — only its display `last4`. Same shape as `OrgTokenMeta`: `createMetadata` (issuer + timestamp) plus a flat `lastUsedAt`. */
         VerificationClientTokenMeta: {
             /** Format: uuid */
             id: string;
@@ -3514,7 +3954,7 @@ export interface components {
             /** Format: date-time */
             createdAt: string;
         };
-        /** @description A registered first-party caller (app SDK, web portal, zkFetch) allowed to drive verification sessions. A client may hold several live tokens (`tokens` lists their metadata, never the secrets) and several active signing keys (`keys` — public halves; their kids are published in the builder's aggregated JWKS). */
+        /** @description A registered first-party caller (app SDK, web portal, zkFetch) allowed to drive verification sessions. Builder mode identifies it by this UUID and binds that identity to each session. The `tokens` fields are legacy compatibility metadata; Builder mode does not use them. The client may also hold active signing keys (`keys` — public halves; their kids are published in the builder's aggregated JWKS). */
         VerificationClient: {
             /** Format: uuid */
             id: string;
@@ -3522,12 +3962,17 @@ export interface components {
             pool: components["schemas"]["QuotaPool"];
             /**
              * Format: uri
-             * @description The client's base URL — where claimants are sent, and the client's JWS `iss` identity (consumers fetch `<iss>/.well-known/jwks.json` to verify its signatures).
+             * @description The claimant-facing base URL. This can be a web URL, app link, or deep link and is separate from the cryptographic issuer.
              */
             uri?: string;
             /**
              * Format: uri
-             * @description The client's self-hosted JWKS, when it manages its own keys. Informational — the builder never fetches or proxies it.
+             * @description Exact trusted JWS `iss` value registered for this client. Consumers must match signed results against this value before loading JWKS.
+             */
+            issuer: string;
+            /**
+             * Format: uri
+             * @description Registered JWKS URL for consumer-side result verification. For Builder-managed signing keys this is normally the Builder's aggregated `/.well-known/jwks.json`; a client may instead register a self-hosted URL. The Builder never fetches or proxies this URL.
              */
             jwksUri?: string;
             activeTokenCount: number;
@@ -3537,7 +3982,7 @@ export interface components {
             createMetadata?: components["schemas"]["ActorMetadata"];
             updateMetadata?: components["schemas"]["ActorMetadata"];
         };
-        /** @description Returned once by the register / issue-token endpoints — the only place a plaintext token ever appears. */
+        /** @description Legacy compatibility response from register / issue-token endpoints. Builder-mode callers use the registered client's UUID, not this token. */
         VerificationClientWithToken: {
             client: components["schemas"]["VerificationClient"];
             token: string;
@@ -3551,15 +3996,21 @@ export interface components {
              * @enum {string}
              */
             pool: "VERIFICATION" | "ZKFETCH";
-            /** @description Base URL claimants are directed to, and the client's JWS `iss` identity. A verification request's `verificationClientUrl` must exactly equal this. It may include a `{sessionId}` placeholder (substituted at session creation); otherwise the Builder appends the session id as a `?sessionId=` query parameter — same as create-verification-session expects. */
+            /** @description Base URL claimants are directed to. A verification request's `verificationClientUrl` must exactly equal this. The returned `verificationUrl` contains the session id and `api=2`; a dual-mode client uses that query value to select Builder mode. */
             uri: string;
-            /** @description Optional. The client's self-hosted JWKS URL, when it manages its own signing keys instead of registering them here. */
+            /** @description Exact JWS issuer for signed results. Set this separately when the claimant-facing URL is an app link or contains a session placeholder. Consumers compare it with the JWS header before using the registered JWKS URL. For compatibility, omission defaults to `uri`. */
+            issuer?: string;
+            /** @description Optional registered JWKS URL for consumers. Use the Builder's aggregated endpoint for Builder-managed keys, or a self-hosted endpoint when the client manages its own signing keys. */
             jwksUri?: string;
         };
         /** @description Fields to change on a registered client. Omitted fields keep their current values. */
         UpdateVerificationClientRequest: {
             pool?: components["schemas"]["QuotaPool"];
+            /** @description Claimant-facing base URL. A verification request must exactly equal this value. */
             uri?: string;
+            /** @description Exact trusted JWS `iss` value; separate from `uri` and `jwksUri`. */
+            issuer?: string;
+            /** @description Registered JWKS URL for consumers; never derive it from a signed payload. */
             jwksUri?: string;
         };
         /** @description The PUBLIC half of the client's ES256K signing keypair, as an uncompressed hex public key or a JWK. Exactly one of `publicKey` / `publicKeyJwk` is required; the private key never leaves the client. */
@@ -3592,7 +4043,7 @@ export interface components {
         StaffList: {
             items: components["schemas"]["StaffMember"][];
         };
-        /** @description Optional metadata for the token being issued. */
+        /** @description Legacy compatibility metadata for a token. Builder-mode clients use their registered UUID in `x-reclaim-vc-id` instead. */
         IssueVerificationClientTokenRequest: {
             /** @description A human note to tell tokens apart (for example, "prod-eu"). */
             label?: string;
@@ -3646,6 +4097,10 @@ export interface components {
             method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
             /** @description Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`. */
             requestBodyTemplate?: string;
+            /** @description Static HTTP request headers passed to the attestor. Header values may use the same `{{param}}` and `{{context.key}}` templates as the URL and request body. Cookies captured by the Verification Client are attached separately and don't need to be declared. */
+            headers?: {
+                [key: string]: string;
+            };
             /**
              * @description Credentials mode to use when issuing the request. If not provided, defaults to `include`.
              * @default include
@@ -3657,7 +4112,7 @@ export interface components {
             additionalClientOptions?: components["schemas"]["AdditionalTlsClientOptions"];
             /** @description Conditions the (redacted) response must satisfy for the proof to be valid. Each runs against the union of the portions revealed by `responseRedactions` (or the whole response when there are none). Mirrors attestor-core `responseMatches`. */
             responseMatches?: components["schemas"]["ResponseMatch"][];
-            /** @description Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — NOT paired 1:1 with `responseMatches`. Mirrors attestor-core `responseRedactions`. */
+            /** @description Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — not generally paired 1:1 with `responseMatches`. For legacy proof-hash optional-subset compatibility only, the redaction at the same index is treated as the pair for an optional `ResponseMatch`; this does not pair all redactions with matches. Mirrors attestor-core `responseRedactions`. */
             responseRedactions?: components["schemas"]["ResponseRedaction"][];
         };
         /** @description A template for selecting requests. Same matcher shape as `RequestSelection`, plus template flags (`multiple`/`required`) and optional `templateParams` expansion. */
@@ -3671,7 +4126,11 @@ export interface components {
             method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
             /** @description Template used to match or capture an outgoing request body. Template can use regex templates as placeholders. For example, to match an outgoing request body that contains a request ID, you can use the following template: `(?<requestId>.*)`. */
             requestBodyTemplate?: string;
-            /**
+            /** @description Static HTTP request headers passed to the attestor. Values may contain `{{param}}` and `{{context.key}}` templates. */
+            headers?: {
+                [key: string]: string;
+            };
+            /**
              * @description Credentials mode to use when issuing the request. If not provided, defaults to `include`.
              * @default include
              */
@@ -3682,7 +4141,7 @@ export interface components {
             additionalClientOptions?: components["schemas"]["AdditionalTlsClientOptions"];
             /** @description Conditions the (redacted) response must satisfy for the proof to be valid. Each runs against the union of the portions revealed by `responseRedactions` (or the whole response when there are none). Mirrors attestor-core `responseMatches`. */
             responseMatches?: components["schemas"]["ResponseMatch"][];
-            /** @description Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — NOT paired 1:1 with `responseMatches`. Mirrors attestor-core `responseRedactions`. */
+            /** @description Portions to select/reveal from the response, applied in order (xPath => jsonPath => regex). Done client-side; only the selected portions (plus the first response line) are sent to the attestor. An independent ordered list — not generally paired 1:1 with `responseMatches`. For legacy proof-hash optional-subset compatibility only, the redaction at the same index is treated as the pair for an optional `ResponseMatch`; this does not pair all redactions with matches. Mirrors attestor-core `responseRedactions`. */
             responseRedactions?: components["schemas"]["ResponseRedaction"][];
             /**
              * @description If true, the template is allowed for multiple requests. Useful for requests like paginated API calls.
@@ -3790,6 +4249,7 @@ export interface components {
              *     The scraper never overwrites an author-set value.
              */
             iconUrl?: string;
+            preferredLocale?: string;
             /**
              * Format: uri
              * @description URL to a 1200x630 Open Graph preview card for this
@@ -3887,6 +4347,8 @@ export interface components {
              * @description Effective icon URL — the author-set value if present, otherwise the cached / live S2 favicon for `domain`.
              */
             iconUrl?: string;
+            /** @description Omit to leave unchanged; pass `null` to clear. */
+            preferredLocale?: string | null;
             /**
              * Format: uri
              * @description URL to the 1200×630 OG preview card. Absent until the first render completes. See `Provider.previewImageUrl` for the cache invalidation rules.
@@ -4055,7 +4517,7 @@ export interface components {
             /** @description JavaScript snippets injected into the page which runs before every page load. `window.Reclaim.` APIs are available to these scripts to request actions to the client like claim creation. */
             jsUserScripts?: string;
         };
-        /** @description Optional JSON Schema describing the `context` a Consumer must supply when creating a verification session for this provider version. Only needed when the recipe expects Consumer-supplied values: those are referenced as `{{context.<key>}}` in recipe requests. Bare `{{parameterName}}` placeholders are provider parameters (extracted / not Consumer-supplied) and need no declaration here. The Builder validates `CreateVerificationSessionRequest.context` against this schema and rejects the request (400) on mismatch. Extra context fields are always allowed regardless of the schema (a root-level `additionalProperties: false` is ignored). Empty/absent accepts any context. */
+        /** @description Optional JSON Schema describing the `context` a Consumer must supply when creating a verification session for this provider version. Only needed when the recipe expects Consumer-supplied values: those are referenced as `{{context.<key>}}` in recipe requests. Bare `{{parameterName}}` placeholders are normally provider parameters extracted from claimant traffic. For old DevTools recipes, Builder-mode Verification Clients seed a missing bare `parameterName` from a same-named scalar session context field when the recipe doesn't use `{{context.parameterName}}`; an explicit parameter always wins. New recipes should use the explicit `{{context.<key>}}` form. Bare parameters need no declaration here. Builder-owned `reclaimSessionId` and `attestationNonce` remain context-only. The Builder validates `CreateVerificationSessionRequest.context` against this schema and rejects the request (400) on mismatch. Extra context fields are always allowed regardless of the schema (a root-level `additionalProperties: false` is ignored). Empty/absent accepts any context. */
         ProviderRequiredContext: {
             [key: string]: unknown;
         };
@@ -4206,7 +4668,9 @@ export interface components {
             label: string;
             /** Format: uri */
             iconUrl?: string;
+            preferredLocale?: string;
             consent?: components["schemas"]["ConsentInfo"];
+            clientTheme?: components["schemas"]["VerificationClientTheme"];
             /** Format: uri */
             termsAndConditionLink?: string;
             /** Format: uri */
@@ -4217,7 +4681,11 @@ export interface components {
             /** Format: uri */
             iconUrl?: string;
             /** @description Omit to leave unchanged; pass `null` to clear. */
+            preferredLocale?: string | null;
+            /** @description Omit to leave unchanged; pass `null` to clear. */
             consent?: components["schemas"]["ConsentInfo"] | null;
+            /** @description Omit to leave unchanged; pass `null` to clear. */
+            clientTheme?: components["schemas"]["VerificationClientTheme"] | null;
             /**
              * Format: uri
              * @description Omit to leave unchanged; pass `null` to clear.
@@ -4258,6 +4726,12 @@ export interface components {
              */
             iconUrl: string;
         };
+        ImportDevtoolsProviderRequest: {
+            /** @description Organization that will own the imported provider. */
+            orgId: components["schemas"]["OrgID"];
+            /** @description Legacy devtools provider UUID to import unchanged. */
+            providerId: components["schemas"]["ProviderID"];
+        };
         /** @description `title` is optional — when omitted the dashboard renders `seoSuggestions.title` (server-derived from the scrape result or `derive_brand_name(domain)`). */
         CreateProviderRequest: {
             /** @description uuid identifier of the organization that will own the provider. */
@@ -4306,6 +4780,159 @@ export interface components {
             /** @description Author SEO fields. Send `null` for a subfield to clear that override and let `seoSuggestions` win again. */
             seo?: components["schemas"]["ProviderSeo"];
         };
+        /**
+         * Format: uuid
+         * @description Internal campaign identifier. Never expose it to volunteers.
+         */
+        ContributionID: string;
+        /**
+         * Format: uuid
+         * @description Shareable public campaign identifier.
+         */
+        ContributionPublicID: string;
+        /**
+         * Format: uuid
+         * @description Opaque field-scoped attempt identifier.
+         */
+        ContributionAttemptID: string;
+        /** @enum {string} */
+        ContributionCampaignStatus: "DRAFT" | "OPEN" | "PAUSED" | "CLOSED";
+        /** @enum {string} */
+        ContributionAttemptStatus: "CREATED" | "ACTIVE" | "PROPOSED" | "COMPLETED" | "FAILED" | "CANCELLED" | "STALE";
+        /** @enum {string} */
+        ContributionSensitivity: "PUBLIC" | "PERSONAL" | "SENSITIVE";
+        ContributionRequirement: {
+            key: string;
+            title: string;
+            description?: string;
+            sensitivity?: components["schemas"]["ContributionSensitivity"];
+            requiredClaims?: string[];
+            requiredOutputs?: string[];
+        };
+        ContributionRequirements: {
+            fields: components["schemas"]["ContributionRequirement"][];
+        };
+        ContributionCampaign: {
+            id: components["schemas"]["ContributionID"];
+            publicId: components["schemas"]["ContributionPublicID"];
+            providerId: components["schemas"]["ProviderID"];
+            status: components["schemas"]["ContributionCampaignStatus"];
+            title: string;
+            description: string;
+            consentText: string;
+            /** @enum {string} */
+            fixedCountry: "US";
+            /** @enum {boolean} */
+            proxyRequired: true;
+            allowedHosts: string[];
+            allowedPathPrefixes: string[];
+            templateResolvedVersion: string;
+            currentRevision?: number;
+            createdAt?: components["schemas"]["Timestamp"];
+        };
+        PublicContributionCampaign: {
+            id: components["schemas"]["ContributionPublicID"];
+            providerId: components["schemas"]["ProviderID"];
+            title: string;
+            description: string;
+            consentText: string;
+            /** @enum {string} */
+            fixedCountry: "US";
+            /** @enum {boolean} */
+            proxyRequired: true;
+            allowedHosts?: string[];
+            allowedPathPrefixes?: string[];
+            templateVersion?: string;
+            revision: number;
+            requirements: components["schemas"]["ContributionRequirements"];
+        };
+        ContributionRequirementRevision: {
+            campaignId: components["schemas"]["ContributionID"];
+            revision: number;
+            requirements: components["schemas"]["ContributionRequirements"];
+            createdAt?: components["schemas"]["Timestamp"];
+        };
+        ContributionAttempt: {
+            id: components["schemas"]["ContributionAttemptID"];
+            campaignId: components["schemas"]["ContributionPublicID"];
+            revision: number;
+            fieldKey: string;
+            baseVersion: string;
+            templateVersion: string;
+            status: components["schemas"]["ContributionAttemptStatus"];
+            proposedVersion?: string;
+            startedAt?: components["schemas"]["Timestamp"];
+            proposedAt?: components["schemas"]["Timestamp"];
+            terminalAt?: components["schemas"]["Timestamp"];
+        };
+        ContributionAttemptStart: {
+            attemptId: components["schemas"]["ContributionAttemptID"];
+            sessionId: components["schemas"]["SessionID"];
+            /** Format: uri */
+            verificationUrl: string;
+            /** @description Attempt-scoped capability for submitting bounded volunteer feedback. Store it only for the current contribution attempt. */
+            feedbackCapability: string;
+        };
+        ContributionComment: {
+            id: components["schemas"]["ContributionID"];
+            attemptId?: components["schemas"]["ContributionAttemptID"];
+            fieldKey?: string;
+            version?: string;
+            /** @enum {string} */
+            visibility: "MAINTAINER" | "PUBLIC";
+            body: string;
+            createdAt: components["schemas"]["Timestamp"];
+        };
+        ContributionReviewDocument: {
+            campaigns: components["schemas"]["ContributionCampaign"][];
+            attempts: components["schemas"]["ContributionAttempt"][];
+            history: {
+                [key: string]: unknown;
+            };
+        };
+        CreatePublicContributionAttemptRequest: {
+            fieldKey: string;
+            /** @enum {boolean} */
+            consent: true;
+        };
+        PublicContributionFeedbackRequest: {
+            attemptId: components["schemas"]["ContributionAttemptID"];
+            capability: string;
+            body: string;
+        };
+        CreateContributionCampaignRequest: {
+            title: string;
+            description: string;
+            consentText: string;
+            /** Format: uri */
+            initialUrl: string;
+            allowedHosts?: string[];
+            allowedPathPrefixes?: string[];
+            fieldKey: string;
+            fieldTitle: string;
+            fieldDescription?: string;
+            requiredClaims?: string[];
+            requiredOutputs?: string[];
+            sensitivity?: components["schemas"]["ContributionSensitivity"];
+        };
+        UpdateContributionCampaignRequest: components["schemas"]["CreateContributionCampaignRequest"];
+        SetContributionCampaignStatusRequest: {
+            status: components["schemas"]["ContributionCampaignStatus"];
+        };
+        CreateContributionRequirementRevisionRequest: {
+            requirements: components["schemas"]["ContributionRequirements"];
+        };
+        AddContributionCommentRequest: {
+            attemptId?: components["schemas"]["ContributionAttemptID"];
+            fieldKey?: string;
+            version?: string;
+            /**
+             * @default PUBLIC
+             * @enum {string}
+             */
+            visibility: "MAINTAINER" | "PUBLIC";
+            body: string;
+        };
         /** @description Body for creating a new version of a provider. Every new version starts on the `draft` branch — see `CreateProviderVersion`. The request body never sets `branch` directly; going live is a separate, explicit step (publish for PRIVATE, submit-for-review → approve for PUBLIC). `verificationType` defaults to `structured`; pass `llm` with a `prompt` to author an AI-verification provider. */
         CreateProviderVersionRequest: {
             /** @description Defaults to `structured` server-side when omitted; pass `llm` (with a `prompt`) to author an AI-verification provider. */
@@ -4313,7 +4940,7 @@ export interface components {
             /** @description Extraction prompt, used (and required) when `verificationType` is `llm`. Gated by the prompt guard before it is stored (docs/prompt-guard.md). */
             prompt?: string;
             /**
-             * @description The version of this Provider upon creation. Clients typically omit this and let the dashboard's bump-suggestion compute it. When omitted, defaults to `0.1.0` for the very first version; otherwise the caller is expected to pass a value higher than the latest existing version.
+             * @description The new semantic version. Provider-authoring clients should pass a value higher than every existing version: patch by default, or major/minor/exact as directed by the user. When omitted, the server defaults to `0.1.0`; omission is only safe for the first version because versions are immutable and must be unique.
              * @default {
              *       "major": 0,
              *       "minor": 1,
@@ -4369,46 +4996,10 @@ export interface components {
             notes?: string;
         };
         /**
-         * @description Lifecycle event reported for a verification session. A healthy run
-         *     proceeds through these in order; reading the gaps locates where a
-         *     session stalled. Session-level terminal events trigger callback
-         *     delivery; provider-/request-level events are progress pings carrying a
-         *     `provider_id` (and `request_id` for request-level ones) in their event
-         *     data. New values may be added over time; clients MUST tolerate unknown
-         *     values in responses.
-         *
-         *     - `session_pending`: Session created; awaiting the end-user.
-         *
-         *     - `verification_client_opened`: The end-user opened the link. Absent ⇒
-         *       the link was never opened.
-         *
-         *     - `verification_client_ready`: The client initialized.
-         *
-         *     - `verification_provider_started`: The client began verifying a provider
-         *       (`provider_id`/`resolved_version`/`ordinal` in `eventData`). One per
-         *       provider, in run order, for multi-provider sessions.
-         *
-         *     - `request_matched`: The target request was captured on the provider
-         *       site. Absent (after opened) ⇒ the user didn't complete the journey.
-         *
-         *     - `request_claim_created`: A proof claim was started.
-         *
-         *     - `request_claim_completed`: A proof claim finished.
-         *
-         *     - `request_claim_rejected`: A claim was rejected (detail in `eventData`).
-         *
-         *     - `request_claim_failed`: A claim errored (detail in `eventData`).
-         *
-         *     - `verification_success`: Terminal — verified. Triggers callback delivery.
-         *
-         *     - `verification_rejected`: Terminal — rejected (detail in `eventData`).
-         *
-         *     - `verification_error`: Terminal — errored (detail in `eventData`).
-         *
-         *     - `session_expired`: `expiresAt` passed before a terminal event.
+         * @description Canonical Builder lifecycle event. Names use lower snake case; metadata uses camel case. Provider events include providerId, resolvedVersion, and ordinal. Request events also include requestId. New values are additive, so clients must tolerate unknown response values. For field requirements and funnel semantics, see docs/verification-analytics-events.md.
          * @enum {string}
          */
-        VerificationEvent: "session_pending" | "verification_client_opened" | "verification_client_ready" | "verification_provider_started" | "request_matched" | "request_claim_created" | "request_claim_completed" | "request_claim_rejected" | "request_claim_failed" | "verification_success" | "verification_rejected" | "verification_error" | "session_expired";
+        VerificationEvent: "billing_required" | "session_pending" | "verification_client_opened" | "verification_client_ready" | "verification_client_warning" | "verification_client_visibility_shown" | "verification_client_visibility_hidden" | "verification_diagnostics_mode_changed" | "verification_cancelled" | "consent_viewed" | "consent_scrolled" | "consent_agreed" | "verification_browser_started" | "verification_browser_ready" | "verification_browser_reconnect_started" | "verification_browser_reconnected" | "verification_browser_failed" | "verification_provider_started" | "provider_config" | "provider_script_log" | "network_request_observed" | "verification_page_ready" | "verification_request_interceptor_ready" | "verification_provider_completed" | "auth_required" | "auth_submitted" | "auth_challenge_remains" | "auth_rejected" | "auth_submission_failed" | "auth_challenge_completed" | "auth_gate_not_detected" | "authenticated" | "user_interaction_started" | "user_input_started" | "user_interaction_summary" | "verification_inactivity_detected" | "request_matched" | "request_match_failed" | "request_claim_parameters_captured" | "request_claim_created" | "request_claim_retrying" | "request_claim_completed" | "request_claim_rejected" | "request_claim_failed" | "verification_proofs_completed" | "verification_result_submitting" | "verification_result_submission_failed" | "verification_success" | "verification_rejected" | "verification_error" | "session_expired";
         /**
          * @description Status of a verification session, derived from its events. New values
          *     may be added over time; clients MUST tolerate unknown values in
@@ -4422,11 +5013,13 @@ export interface components {
          *
          *     - `error`: Terminal — `verification_error` recorded.
          *
+         *     - `cancelled`: Terminal — `verification_cancelled` recorded.
+         *
          *     - `expired`: `expiresAt` passed before a terminal event; the end-user
          *       can no longer complete it.
          * @enum {string}
          */
-        VerificationStatus: "pending" | "success" | "rejected" | "error" | "expired";
+        VerificationStatus: "pending" | "success" | "rejected" | "error" | "cancelled" | "expired";
         /**
          * @description Delivery state of a callback. On a session this is the aggregate across
          *     all of its deliveries; on an individual delivery it is that delivery's
@@ -4454,25 +5047,22 @@ export interface components {
              * @description The organization that owns this callback subscription.
              */
             orgId: string;
-            /**
-             * Format: uri
-             * @description HTTPS endpoint that receives the result.
-             */
+            /** @description HTTP(S) endpoint that receives the event. It may contain `{{sessionId}}` and top-level session-context placeholders such as `{{orderId}}`. The Builder URI-encodes each value and stores the expanded URL when it creates the delivery. */
             callbackUrl: string;
-            /** @description Events this subscription wants delivered — any subset of `VerificationEvent`. Terminal events (`verification_success`, `verification_rejected`, `verification_error`) deliver the signed result; non-terminal events deliver a plaintext notification. */
+            /** @description Events this subscription wants delivered — any subset of `VerificationEvent`. Builder terminal events are `verification_success`, `verification_rejected`, `verification_error`, `verification_cancelled`, and `session_expired`. Terminal result deliveries contain the signed result when one is available; non-terminal events deliver a plaintext notification. */
             events: components["schemas"]["VerificationEvent"][];
             createdAt: components["schemas"]["Timestamp"];
             updatedAt: components["schemas"]["Timestamp"];
         };
         /** @description Body for `POST /verifications/callback-subscriptions`. The owning organization is resolved from the presented `OrgToken`; delivery is scoped to that org and encrypted to its credential when set. */
         CreateCallbackSubscriptionRequest: {
-            /** Format: uri */
+            /** @description Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys. */
             callbackUrl: string;
             events: components["schemas"]["VerificationEvent"][];
         };
         /** @description Body for `POST /orgs/{orgId}/callback-subscriptions`. The owning organization comes from the path; bearer-authenticated and gated on org membership. Delivery is scoped to the org and encrypted to its credential when set. */
         CreateOrgCallbackSubscriptionRequest: {
-            /** Format: uri */
+            /** @description Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys. */
             callbackUrl: string;
             events: components["schemas"]["VerificationEvent"][];
         };
@@ -4481,6 +5071,28 @@ export interface components {
             verificationsRemaining: number;
             resetsAt: components["schemas"]["Timestamp"];
         };
+        VerificationFunnel: {
+            /** @enum {string} */
+            mode: "SESSION" | "PROVIDER";
+            /** @enum {string} */
+            providerMatch: "ANY" | "ALL";
+            createdAfter: components["schemas"]["Timestamp"];
+            createdBefore: components["schemas"]["Timestamp"];
+            cohortCount: number;
+            steps: {
+                step: string;
+                observedCount: number;
+                conversionRate: number;
+            }[];
+        };
+        /** @description Minimal branding safe to show in a Verification Client. */
+        VerificationBrand: {
+            /** Format: uuid */
+            id: string;
+            name: string;
+            /** @description Optional absolute or Builder-hosted image URL. */
+            logoUrl?: string;
+        };
         /** @description A single verification a Consumer requests from an end-user. Created via the consumer's `OrgToken`; the org must already have at least one callback subscription. The result is submitted by the Verification Client and delivered by the Builder. */
         VerificationSession: {
             /**
@@ -4491,13 +5103,25 @@ export interface components {
             /** @description The providers this session verifies, in run order. The Verification Client runs each (sequentially, in one browser session) and submits one combined result; all are required. */
             providers: components["schemas"]["SessionProvider"][];
             /** @description The organization that owns this session. */
-            orgId?: components["schemas"]["OrgID"];
+            orgId: components["schemas"]["OrgID"];
+            /** @description Display-only application branding derived from the owning organization. Builder-mode Verification Clients use this instead of calling the legacy application-info API. It does not affect recipe execution or proof verification. */
+            application: components["schemas"]["VerificationBrand"];
             /**
              * Format: uuid
              * @description Set by the Verification Client once the claimant opens the link.
              */
             claimantClientId?: string | null;
-            /** @description The session-level LLM/AI-agent preference, echoed from creation. Absent when the creator omitted it — then each provider's `verificationType` decides (see the recipe endpoint's effective per-provider `preferAiAgent`). */
+            claimantDetails?: components["schemas"]["ClaimantDetails"];
+            claimantDetailsUpdatedAt?: components["schemas"]["Timestamp"];
+            /** @description Theme selected and snapshotted when this session was created. */
+            themeId?: components["schemas"]["ThemeID"];
+            /** @description Immutable organization theme snapshot for Verification Clients. Absent when the organization had no active theme at creation. */
+            theme?: components["schemas"]["Theme"];
+            /** @description Effective locale snapshotted for this session. The create-request override wins; otherwise Builder uses the selected theme locale. */
+            preferredLocale?: string;
+            /** @description When the organization-bound legacy TEE nonce context was first stored. The nonce data itself is present in `context` as `attestationNonce` and `attestationNonceData`. */
+            teeNonceBoundAt?: components["schemas"]["Timestamp"];
+            /** @description Legacy-only preference echoed for compatibility. Builder-mode clients run the structured recipe and do not enable AI or manual verification. */
             preferAiAgent?: boolean;
             /** @description Consumer context, validated against the provider version's required parameters. The Builder injects `reclaimSessionId` after validation. */
             context: {
@@ -4516,8 +5140,18 @@ export interface components {
              * Format: uuid
              * @description Id of the registered verification client whose base URL was used (see `verification_clients`).
              */
-            verificationClientId?: string;
-            /** @description Ready-to-share URL: the registered base URL with the session id attached by the Builder — substituted into a `{sessionId}` placeholder, or appended as a `?sessionId=…` query parameter. The Consumer should open this directly for their users. */
+            verificationClientId: string;
+            /**
+             * Format: uri
+             * @description Registered JWS issuer for this session. Consumers compare the signed result's `iss` with this value.
+             */
+            verificationClientIssuer: string;
+            /**
+             * Format: uri
+             * @description Registered JWKS URL for this session's Verification Client. Use this trusted value instead of constructing a URL from result data.
+             */
+            verificationClientJwksUrl: string;
+            /** @description Ready-to-share URL: the registered base URL with the session id attached by the Builder — substituted into a `{sessionId}` placeholder, or appended as a `?sessionId=…` query parameter. It always includes `api=2`, which selects Builder mode in dual-mode Verification Clients. The Consumer may append its own redirect query fields before opening the URL for the claimant; the Builder does not store or execute those redirects. */
             verificationUrl: string;
             createdAt: components["schemas"]["Timestamp"];
             /** @description When the session stops being completable. After this, a still- `pending` session becomes `expired` on the next sweep and the end-user can no longer finish it. */
@@ -4537,26 +5171,94 @@ export interface components {
         /** @description A provider (+ optional version) to verify in a session. */
         SessionProviderInput: {
             providerId: components["schemas"]["ProviderID"];
-            /** @description Semver constraint; empty resolves to the latest trunk version. */
+            /** @description Empty selects the latest active trunk version. An exact semantic version pins that version. Any other valid npm semantic-version range selects the highest active matching version. */
             version?: string;
         };
         /** @description Body for `POST /verifications/sessions`. Authenticated by the consumer's `OrgToken`. Carries no callback URLs — they come from the org's callback subscriptions. The one shared `context` is validated against every provider's `requiredContext`. */
         CreateVerificationSessionRequest: {
             /** @description Providers to verify, in run order. The Verification Client runs each sequentially in one browser session and submits one combined result; all are required. */
             providers: components["schemas"]["SessionProviderInput"][];
-            /** @description Consumer context, shared by all providers. Validated against EACH resolved provider version's `requiredContext` JSON Schema (a 400 is returned on mismatch); extra fields are always allowed. Recipe requests reference these values as `{{context.<key>}}`. Echoed back (plus `reclaimSessionId`) in the result. */
+            /** @description Consumer context, shared by all providers. Validated against EACH resolved provider version's `requiredContext` JSON Schema (a 400 is returned on mismatch); extra fields are always allowed. Recipe requests reference these values as `{{context.<key>}}`. To support old DevTools recipes, Builder-mode Verification Clients also use a same-named scalar context value to seed a missing bare `{{key}}` when the recipe doesn't use `{{context.key}}`; an explicit parameter takes precedence. Echoed back (plus `reclaimSessionId`) in the result. Builder-owned `reclaimSessionId` and `attestationNonce` remain context-only. */
             context: {
                 [key: string]: unknown;
             };
-            /** @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`builder`) client. The Builder attaches the session id — into a `{sessionId}` placeholder if the registered base has one, otherwise as a `?sessionId=…` query parameter — and returns the ready-to-share result as `verificationUrl`. A URL that is not a registered client's base is rejected with 400. */
+            /** @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`builder`) client. The Builder resolves and stores the registered client UUID, then returns the ready-to-share `verificationUrl` with the session id and `api=2`. A URL that is not a registered client's base is rejected with 400. Consumers append any client-owned redirect parameters after receiving the URL; Builder does not manage them. */
             verificationClientUrl?: string;
-            /** @description Optional. Whether the Verification Client is preferred (allowed) to run this session's providers with an LLM/AI agent instead of the structured recipe. Omit to default per provider from its `verificationType` (`llm` → agent preferred, `structured` → not). The recipe endpoint exposes the effective per-provider value as `preferAiAgent`. A preference, not a hard gate — clients without agent support run the structured recipe regardless. */
+            /** @description Optional active theme owned by the organization. When omitted, Builder snapshots the organization's most recently updated active theme. If the organization has no active theme, the Verification Client uses its default presentation. */
+            themeId?: components["schemas"]["ThemeID"];
+            /** @description Optional locale override for this verification session. It takes precedence over the organization theme's preferred locale. */
+            preferredLocale?: string;
+            /** @description Legacy-only preference. Builder mode runs the structured recipe and does not enable AI or manual verification. Omit this field for Builder-mode sessions; dual-mode clients may continue to interpret it only on their legacy path. */
             preferAiAgent?: boolean;
         };
+        /** @description Exact legacy TEE nonce inputs. Builder stores this unchanged in the session context after it verifies the signed binding request. */
+        AttestationNonceData: {
+            /** @description Ethereum application address derived from the organization private key. Its supplied casing is preserved for legacy nonce compatibility. */
+            applicationId: string;
+            sessionId: components["schemas"]["SessionID"];
+            /** @description Decimal Unix timestamp in milliseconds. */
+            timestamp: string;
+            /**
+             * @description Legacy SDK TEE attestation protocol version.
+             * @enum {string}
+             */
+            attestationVersion: "v3";
+        };
+        /** @description One immutable legacy TEE context, signed by the organization verification key. The signature is EIP-191 `personal_sign` over `RECLAIM_BUILDER_TEE_BINDING_V1:{organizationId}:{sessionId}:{applicationId}:{timestamp}:{attestationVersion}:{attestationNonce}`. */
+        BindVerificationSessionTeeNonceRequest: {
+            /** @description Either the current lowercase 64-hex hash nonce (without `0x`) or the older 65-byte EIP-191 signature nonce (`0x` plus 130 hex characters). Builder preserves either encoding unchanged. */
+            attestationNonce: string;
+            attestationNonceData: components["schemas"]["AttestationNonceData"];
+            /** @description EIP-191 65-byte secp256k1 signature, encoded as 0x-prefixed hex. */
+            signature: string;
+        };
+        /** @description Latest diagnostic claimant and device snapshot. Values are best-effort and never participate in proof verification. */
+        ClaimantDetails: {
+            /**
+             * Format: uuid
+             * @description Verification Client installation identifier. The Builder also stores it in the session's dedicated claimantClientId field.
+             */
+            claimantClientId: string;
+            claimantId?: string;
+            collectedAt?: components["schemas"]["Timestamp"];
+            apiClient?: string;
+            locale?: string;
+            httpUserAgent?: string;
+            client?: {
+                [key: string]: unknown;
+            };
+            device?: {
+                [key: string]: unknown;
+            };
+            operatingSystem?: {
+                [key: string]: unknown;
+            };
+            browser?: {
+                [key: string]: unknown;
+            };
+            viewport?: components["schemas"]["ClaimantDimensions"];
+            display?: components["schemas"]["ClaimantDimensions"];
+            network?: {
+                reportedPublicIp?: string;
+                serverObservedIp?: string;
+            };
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        ClaimantDimensions: {
+            width: number;
+            height: number;
+            /** @enum {string} */
+            unit: "css-px" | "logical-px" | "physical-px";
+        };
+        PatchVerificationClaimantRequest: components["schemas"]["ClaimantDetails"];
         /** @description Body for `POST /verifications/sessions/{sessionId}/events`. Status ping only — never carries the proof (use the result endpoint for that). */
         ReportEventRequest: {
             event: components["schemas"]["VerificationEvent"];
-            /** @description Extra detail (for example, `claimantClientId`, or `request_id` for request-level events). */
+            /** @description Client-observed event time. Omit it when the client cannot provide a trustworthy timestamp; the Builder then uses receive time. */
+            occurredAt?: components["schemas"]["Timestamp"];
+            /** @description Extra detail (for example, `claimantClientId`, or `requestId` for request-level events). */
             eventData?: {
                 [key: string]: unknown;
             };
@@ -4571,9 +5273,17 @@ export interface components {
             eventData?: {
                 [key: string]: unknown;
             };
+            organizationId: components["schemas"]["OrgID"];
+            /** Format: uuid */
+            verificationClientId: string;
+            providerId?: components["schemas"]["ProviderID"];
+            resolvedVersion?: string;
+            providerOrdinal?: number;
+            occurredAt: components["schemas"]["Timestamp"];
+            receivedAt: components["schemas"]["Timestamp"];
             createdAt: components["schemas"]["Timestamp"];
         };
-        /** @description RFC 7515 JWS in General (or Flattened) JSON serialization. The signed verification result produced by the Verification Client — this is what the `data` field of a `VerificationResultDelivery` decrypts to. Signed ES256K (RFC 8812) over SHA-256 of `<protected>.<payload>`; verify against `GET /.well-known/jwks.json`. Its decoded payload is `VerificationResultPayload`. */
+        /** @description RFC 7515 JWS in General (or Flattened) JSON serialization. The signed verification result produced by the Verification Client — this is what the `data` field of a `VerificationResultDelivery` decrypts to. Signed ES256K (RFC 8812) over SHA-256 of `<protected>.<payload>`. Verify it with the Verification Client's registered issuer and JWKS URL; never derive a JWKS URL from JWS data. Its decoded payload is `VerificationResultPayload`. */
         Jws: {
             /** @description base64url-encoded JSON payload. */
             payload: string;
@@ -4588,18 +5298,54 @@ export interface components {
                 signature: string;
             }[];
         };
-        /** @description The JSON envelope POSTed to a callback subscription's `callbackUrl` (see the `verificationResult` webhook). `sessionId`, `event` and `timestamp` are unauthenticated plaintext routing hints; branch on `event` for the shape of `data`. **Terminal events** carry the signed result — a compact JWE wrapping the signed JWS when the org has an encryption credential, else the plaintext signed JWS — act only on the signature-verified contents. **Non-terminal events** carry a plaintext, **unsigned** progress notification — advisory only; the signed terminal result is the source of truth. */
+        /** @description The JSON envelope POSTed to a callback subscription's `callbackUrl` (see the `verificationResult` webhook). `sessionId`, `event` and `timestamp` are unauthenticated plaintext routing hints; branch on `event` for the shape of `data`. **Terminal result events** carry the signed result — an ECIES ciphertext (base64url, secp256k1 + AES-256-GCM) wrapping the signed JWS when the org has an encryption credential, else the plaintext signed JWS — act only on the signature-verified contents. **Non-terminal events** carry a plaintext, **unsigned** progress notification — advisory only; the signed terminal result is the source of truth. */
         VerificationResultDelivery: {
             sessionId: components["schemas"]["SessionID"];
             /** @description The event that produced this delivery. */
             event: components["schemas"]["VerificationEvent"];
             timestamp: components["schemas"]["Timestamp"];
-            /** @description Payload interpreted per `event`. Terminal events: the signed result — an **ECIES ciphertext** (base64url, secp256k1 + AES-256-GCM) wrapping the signed JWS when the org's `canEncryptResult` is enabled (decrypt with the matching eth private key to recover the inner JWS), else the JWS directly; the inner JWS parses as the `Jws` schema with payload `VerificationResultPayload`. Non-terminal events: plaintext JSON `{ event, eventData }` (unsigned). */
+            /** @description Payload interpreted per `event`. Terminal result events: the signed result — an **ECIES ciphertext** (base64url, secp256k1 + AES-256-GCM) wrapping the signed JWS when the org's `canEncryptResult` is enabled (decrypt with the matching eth private key to recover the inner JWS), else the JWS directly; the inner JWS parses as the `Jws` schema with payload `VerificationResultPayload`. Non-terminal events: plaintext JSON `{ event, eventData }` (unsigned). */
             data: string;
         };
-        /** @description The decoded JWS payload of a delivered verification result (the JWS itself is the `Jws` schema, signed ES256K by the key published at `/.well-known/jwks.json`). Consumers MUST check `reclaimSessionId` against the session they created and `verification_session.status` for the outcome. `results` is present on success; `problem` (RFC 9457 shape) is set when the run failed. */
+        /** @description Exact `Proof` object emitted by a legacy Reclaim Verification Client. The Verification Client must preserve this object without renaming, wrapping, or dropping fields. Consumers pass it directly to `@reclaimprotocol/client` `verifyProof`, normally through `verifyResultFull`. Do not trust any proof field until verification succeeds. */
+        LegacyProof: {
+            identifier: string;
+            claimData: {
+                provider: string;
+                parameters: string;
+                owner: string;
+                /** Format: int64 */
+                timestampS: number;
+                context: string;
+                identifier: string;
+                /** Format: int64 */
+                epoch: number;
+            };
+            signatures: string[];
+            witnesses: ({
+                id: string;
+                url: string;
+                claimAttestation?: {
+                    [key: string]: unknown;
+                };
+            } & {
+                [key: string]: unknown;
+            })[];
+            /** @description Extraction values carried by the proof. Consumers trust only the values returned by `verifyProof` after successful verification. */
+            extractedParameterValues: unknown;
+            /** @description Provider-supplied data. This field isn't verified. */
+            publicData?: unknown;
+            /** Format: int64 */
+            taskId?: number;
+            teeAttestation?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        /** @description The decoded payload of a signature-verified delivered result (the JWS itself is the `Jws` schema, signed ES256K by a key at the registered Verification Client JWKS URL). Consumers must compare `iss` with the registered issuer and use the separately registered JWKS URL; never derive a fetch URL from payload data. Consumers must also check `reclaimSessionId` against the session they created and `verification_session.status` for the outcome. `results` is present on success; `problem` (RFC 9457 shape) is set when the run failed. */
         VerificationResultPayload: {
-            /** @description Verification Client issuer URL. */
+            /** @description Verification Client issuer URL. Compare this value with the registered issuer before fetching the separately registered JWKS. */
             iss: string;
             /** @description The session id (same as `reclaimSessionId`). */
             sub: string;
@@ -4607,12 +5353,21 @@ export interface components {
             aud: string;
             /** Format: int64 */
             iat: number;
-            /** Format: int64 */
-            exp: number;
+            /**
+             * Format: int64
+             * @deprecated
+             * @description Legacy delivery-expiry claim. New Builder results omit it so a stored signed result and its proofs can be verified later.
+             */
+            exp?: number;
             reclaimSessionId: components["schemas"]["SessionID"];
             verification_session: {
                 /** @enum {string} */
                 status: "success" | "rejected" | "error";
+                /**
+                 * Format: uuid
+                 * @description Registered Verification Client that signed this result. Use it to resolve the trusted issuer and JWKS configuration.
+                 */
+                verification_client_id: string;
                 /** @description The providers verified in this session, in run order. */
                 providers: ({
                     provider_id: components["schemas"]["ProviderID"];
@@ -4637,14 +5392,15 @@ export interface components {
                     request_id?: string;
                     url?: string;
                     method?: string;
+                    /** @description Signed-envelope diagnostic copy. Don't trust this copy; use the data returned by `verifyProof`. */
                     extracted_parameters?: {
                         [key: string]: unknown;
                     };
+                    /** @description Signed-envelope diagnostic hash. Proof validation uses the exact proof and the resolved recipe/provider. */
                     content_hash?: string;
                     identifier?: string;
                     owner?: string;
-                    /** @description Base64url-encoded nested JWS (attestor proof). */
-                    proof?: unknown;
+                    proof: components["schemas"]["LegacyProof"];
                 } & {
                     [key: string]: unknown;
                 })[];
@@ -4886,6 +5642,50 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    ImportDevtoolsProvider: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ImportDevtoolsProviderRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["ImportDevtoolsProviderRequest"];
+            };
+        };
+        responses: {
+            /** @description Imported */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Provider"];
+                };
+            };
+            /** @description The caller cannot edit the target organization. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description The provider UUID belongs to another Builder organization. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     DiscoverWebsites: {
         parameters: {
             query?: {
@@ -5966,7 +6766,7 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SetOrgGrace: {
+    SetOrgPaymentAllowance: {
         parameters: {
             query?: never;
             header?: never;
@@ -5977,18 +6777,18 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["SetOrgGraceRequest"];
-                "application/x-www-form-urlencoded": components["schemas"]["SetOrgGraceRequest"];
+                "application/json": components["schemas"]["SetOrgPaymentAllowanceRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["SetOrgPaymentAllowanceRequest"];
             };
         };
         responses: {
-            /** @description Grace updated */
+            /** @description Payment-failure allowance updated */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["OrgBilling"];
+                    "application/json": components["schemas"]["OrgPoolAllowanceResult"];
                 };
             };
             403: components["responses"]["ForbiddenResponse"];
@@ -6051,7 +6851,7 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SetOrgCreditGrace: {
+    SetOrgCreditAllowance: {
         parameters: {
             query?: never;
             header?: never;
@@ -6062,18 +6862,18 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["SetCreditGraceRequest"];
-                "application/x-www-form-urlencoded": components["schemas"]["SetCreditGraceRequest"];
+                "application/json": components["schemas"]["SetOrgCreditAllowanceRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["SetOrgCreditAllowanceRequest"];
             };
         };
         responses: {
-            /** @description Credit grace updated */
+            /** @description Credit-exhaustion allowance updated */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["OrgCredit"];
+                    "application/json": components["schemas"]["OrgPoolAllowanceResult"];
                 };
             };
             403: components["responses"]["ForbiddenResponse"];
@@ -6440,7 +7240,12 @@ export interface operations {
     };
     VerificationPage: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Exact `1` enables diagnostic mode for this launch. */
+                diag?: "1";
+                /** @description Internal marker added after the claimant accepts organization consent. */
+                consent?: "1";
+            };
             header?: never;
             path: {
                 sessionId: components["schemas"]["SessionID"];
@@ -6633,6 +7438,8 @@ export interface operations {
                         keys: {
                             [key: string]: unknown;
                         }[];
+                        /** @description Trusted EIP-191 proof signer addresses. Consumers compare locally recovered proof signers with this registry. */
+                        "x-reclaim-attestors"?: string[];
                     };
                 };
             };
@@ -7954,6 +8761,299 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    GetPublicContributionCampaign: {
+        parameters: {
+            query?: {
+                /** @description Opaque attempt handle used to show resume status. It is not an authorization credential and has no effect on the campaign scope. */
+                attempt?: components["schemas"]["ContributionAttemptID"];
+            };
+            header?: never;
+            path: {
+                publicId: components["schemas"]["ContributionPublicID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Public contribution brief. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                    "application/json": components["schemas"]["PublicContributionCampaign"];
+                };
+            };
+            /** @description Campaign not found, closed, or not publicly available. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreatePublicContributionAttempt: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                publicId: components["schemas"]["ContributionPublicID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["CreatePublicContributionAttemptRequest"];
+                "application/json": components["schemas"]["CreatePublicContributionAttemptRequest"];
+            };
+        };
+        responses: {
+            /** @description Started attempt for JSON callers. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContributionAttemptStart"];
+                };
+            };
+            /** @description Redirect to the field-scoped verification URL. */
+            303: {
+                headers: {
+                    Location?: string;
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Campaign or field not found, closed, or not public. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SubmitPublicContributionFeedback: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                publicId: components["schemas"]["ContributionPublicID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["PublicContributionFeedbackRequest"];
+                "application/json": components["schemas"]["PublicContributionFeedbackRequest"];
+            };
+        };
+        responses: {
+            /** @description Feedback accepted for JSON callers. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Feedback accepted; redirect to the attempt status. */
+            303: {
+                headers: {
+                    Location?: string;
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Campaign or capability not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ListProviderContributionCampaigns: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Campaigns and bounded contribution history. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                    "application/json": components["schemas"]["ContributionReviewDocument"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateProviderContributionCampaign: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["CreateContributionCampaignRequest"];
+                "application/json": components["schemas"]["CreateContributionCampaignRequest"];
+            };
+        };
+        responses: {
+            /** @description Draft campaign created. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContributionCampaign"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SetProviderContributionCampaignStatus: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                campaignId: components["schemas"]["ContributionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["SetContributionCampaignStatusRequest"];
+                "application/json": components["schemas"]["SetContributionCampaignStatusRequest"];
+            };
+        };
+        responses: {
+            /** @description Campaign status changed. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContributionCampaign"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            409: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateProviderContributionCampaign: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                campaignId: components["schemas"]["ContributionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["UpdateContributionCampaignRequest"];
+                "application/json": components["schemas"]["UpdateContributionCampaignRequest"];
+            };
+        };
+        responses: {
+            /** @description Campaign updated. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContributionCampaign"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateProviderContributionRequirementRevision: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                campaignId: components["schemas"]["ContributionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["CreateContributionRequirementRevisionRequest"];
+                "application/json": components["schemas"]["CreateContributionRequirementRevisionRequest"];
+            };
+        };
+        responses: {
+            /** @description Immutable requirement revision created. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContributionRequirementRevision"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AddProviderContributionComment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                providerId: components["schemas"]["ProviderID"];
+                campaignId: components["schemas"]["ContributionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": components["schemas"]["AddContributionCommentRequest"];
+                "application/json": components["schemas"]["AddContributionCommentRequest"];
+            };
+        };
+        responses: {
+            /** @description Comment added. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ContributionComment"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     GetProvider: {
         parameters: {
             query?: never;
@@ -8688,6 +9788,38 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    GetVerificationFunnel: {
+        parameters: {
+            query: {
+                providerIds?: components["schemas"]["ProviderID"][];
+                providerMatch?: "ANY" | "ALL";
+                mode?: "SESSION" | "PROVIDER";
+                /** @description Inclusive session creation time. */
+                createdAfter: components["schemas"]["Timestamp"];
+                /** @description Exclusive session creation time. */
+                createdBefore: components["schemas"]["Timestamp"];
+            };
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Funnel calculated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationFunnel"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     CreateVerificationSession: {
         parameters: {
             query?: never;
@@ -8719,7 +9851,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["Problem"];
                 };
             };
-            /** @description Overage paused — the organization is past its plan allowance, its prepaid credit balance is exhausted, and the credit grace period has ended (`event: credit_exhausted`). Requests within the plan allowance still succeed; add credits to resume overage. */
+            /** @description Overage paused — the organization is past its plan allowance, its prepaid credit balance is exhausted, and its per-pool credit-exhaustion allowance is depleted (`event: billing_required`). Requests within the plan allowance still succeed; add credits to resume overage. */
             402: {
                 headers: {
                     [name: string]: unknown;
@@ -8737,7 +9869,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["Problem"];
                 };
             };
-            /** @description Sandbox verification quota exceeded. */
+            /** @description Verification quota exceeded (`event: billing_required` with a terminal `sessionId`). */
             429: {
                 headers: {
                     [name: string]: unknown;
@@ -8794,17 +9926,19 @@ export interface operations {
                         /** @description One recipe per session provider, in run order. */
                         recipes: {
                             providerId: components["schemas"]["ProviderID"];
+                            /** @description Display-only provider branding. Verification Clients can use it in claimant-facing UI; it does not affect recipe execution or proof verification. */
+                            provider: components["schemas"]["VerificationBrand"];
                             resolvedVersion: string;
                             initialUrl: string;
-                            /** @description Effective LLM/AI-agent preference for THIS provider: the session's `preferAiAgent` when set at creation, else whether the provider version's `verificationType` is `llm`. A preference — a client without agent support runs the structured recipe regardless. */
+                            /** @description Legacy-only preference. Builder-mode sessions run the structured recipe and do not enable AI or manual verification. Dual-mode clients may use this value only on their legacy path. */
                             preferAiAgent: boolean;
                             /** @description The version's webSettings geoLocation template (`{{DYNAMIC_GEO}}` / `{{DYNAMIC_GEO_SECRET}}` / '' / ISO code), applied to this provider's requests. */
                             geoLocation?: string;
                             /** @description The version's webSettings.jsUserScripts — page JavaScript the Verification Client installs to run before every page load (before navigating to initialUrl), to drive login/navigation so the target requests fire. */
                             jsUserScripts?: string;
-                            requests: {
-                                [key: string]: unknown;
-                            }[];
+                            /** @description Browser client options from the resolved provider version. Verification Clients apply these options before opening the provider. */
+                            clientOptions?: components["schemas"]["ClientOptions"];
+                            requests: components["schemas"]["RequestSelection"][];
                             /** @description The version's allowedJsRequests — request-selection templates (with optional templateParams expansion) for requests fired by injected JS, which the Verification Client may additionally prove. */
                             allowedJsRequests?: components["schemas"]["RequestSelectionTemplate"][];
                         }[];
@@ -8815,6 +9949,62 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    BindVerificationSessionTeeNonce: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["BindVerificationSessionTeeNonceRequest"];
+            };
+        };
+        responses: {
+            /** @description TEE nonce bound (or the exact previous binding was replayed) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationSession"];
+                };
+            };
+            /** @description Invalid binding, signature, key relationship, or timestamp */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            /** @description Binding conflicts with the immutable session state */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description The organization has no registered verification key */
+            412: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     ListVerificationEvents: {
         parameters: {
             query?: never;
@@ -8867,6 +10057,35 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    PatchVerificationClaimant: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PatchVerificationClaimantRequest"];
+            };
+        };
+        responses: {
+            /** @description Claimant details updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationSession"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     ListVerificationDeliveries: {
         parameters: {
             query?: never;