@reclaimprotocol/client 0.1.26 → 0.1.28

package/lib/result.js

@@ -2,20 +2,20 @@
  * Consumer-side handling of a delivered callback. Two entry points:
  *  - {@link verifyResult}: the offline primitive — decrypt + decode + optional
  *    ES256K signature check (caller-supplied key) + `reclaimSessionId` nonce.
- *  - {@link verifyResultFull}: the full async verification — discovers the
- *    Verification Client's key via JWKS, verifies the top-level JWS, checks
- *    `reclaimSessionId`/`aud`/`exp`, and verifies each result's nested attestor
- *    proof + `content_hash` (see ./attestor-proof.ts and ./jwks.ts).
+ *  - {@link verifyResultFull}: the recommended server-side verification —
+ *    resolves a registered issuer, discovers the Verification Client's key
+ *    via JWKS, checks
+ *    `reclaimSessionId`/`aud` and any legacy `exp`, and passes every exact
+ *    legacy proof to the in-package, legacy-compatible `verifyProof` verifier.
  *
  * See docs/verification-session.md → "Verification by Consumer".
  */
 import { sha256 } from '@noble/hashes/sha2.js';
-import { keccak_256 } from '@noble/hashes/sha3.js';
 import { decrypt as eciesDecrypt, encrypt as eciesEncrypt } from 'eciesjs';
-import { verifyNestedProof } from "./attestor-proof.js";
-import { canonicalJson } from "./canonical.js";
-import { b64url, base64urlToBytes, bytesToHex, hexToBytes } from "./encoding.js";
-import { fetchJwks, jwkToUncompressedPublicKey, selectKey, } from "./jwks.js";
+import { b64url, base64urlToBytes, hexToBytes } from "./encoding.js";
+import { fetchReclaimJwks, jwkToUncompressedPublicKey, selectVerificationResultKey, } from "./jwks.js";
+import { verifyProof, } from "./legacy-proof.js";
+import { proofHashesFromBuilderRecipe, } from "./proof-recipe.js";
 import { addressFromUncompressedPubkey, secp } from "./secp.js";
 /**
  * ECIES-encrypt `plaintext` for the holder of `publicJwk` (the org's secp256k1
@@ -134,13 +134,6 @@ export function verifyJwsSignature(jws, signerPublicKey) {
         }
     });
 }
-/** Content hash binding extracted parameters — MUST mirror the Verification
- *  Client's `contentHash` exactly (keccak256 of the RFC 8785 canonical JSON,
- *  via the shared `canonicalJson`). */
-function contentHash(params) {
-    const canonical = canonicalJson(params);
-    return '0x' + bytesToHex(keccak_256(new TextEncoder().encode(canonical)));
-}
 /**
  * Thrown by {@link verifyResult} / {@link verifyResultFull} (and therefore
  * `reclaim.results.verify`/`receive`) when a result fails verification. Carries
@@ -165,15 +158,17 @@ export class ResultVerificationError extends Error {
     }
 }
 /**
- * Full consumer verification: discovers the Verification Client's signing key
- * via JWKS (header `iss`/`kid`), verifies the top-level JWS, checks
- * `reclaimSessionId`/`aud`/`exp`, then verifies each result's nested attestor
- * proof and its `content_hash`. Network access (JWKS) makes this async; use
- * {@link verifyResult} for the offline primitive.
+ * Full consumer verification: resolves a trusted, registered issuer before
+ * using JWKS (header `iss`/`kid`), verifies the top-level JWS, checks
+ * `reclaimSessionId`/`aud` and any legacy `exp`, then verifies each exact
+ * legacy proof.
+ * Network access (JWKS and optional provider resolution) makes this async.
+ * Use {@link verifyResult} for the offline primitive.
  */
 export async function verifyResultFull(jws, opts = {}) {
     const payload = decodeJwsPayload(jws);
     const reclaimSessionId = payload.reclaimSessionId;
+    let jwksAttestorAddresses = [];
     /** Throw with the full invalid outcome — verification never *returns* an
      *  invalid result. */
     const fail = (reason, extra = {}) => {
@@ -185,7 +180,8 @@ export async function verifyResultFull(jws, opts = {}) {
             ...extra,
         });
     };
-    // 1. Resolve the VC signer key: explicit override, else JWKS via header iss.
+    // 1. Resolve the VC signer key. Never use the signed header's `iss` as a
+    // network destination until it has matched an explicit or registered issuer.
     let signerPublicKey = opts.signerPublicKey;
     let header = {};
     const sig0 = jws.signatures[0];
@@ -198,12 +194,37 @@ export async function verifyResultFull(jws, opts = {}) {
         }
     }
     if (!signerPublicKey) {
+        const verificationClientId = getVerificationClientId(payload) ?? '';
+        let configuredIssuers;
+        try {
+            configuredIssuers = await resolveTrustedIssuers(opts, verificationClientId);
+        }
+        catch {
+            return fail('issuer-resolution-failed');
+        }
+        if (!configuredIssuers.length) {
+            return fail('issuer-not-configured');
+        }
         const iss = String(header.iss ?? '');
         if (!iss) {
             return fail('no-issuer');
         }
-        const keys = await fetchJwks(iss, opts.fetchImpl);
-        const jwk = selectKey(keys, String(header.kid ?? ''));
+        const trustedIssuer = configuredIssuers.find((candidate) => (normalizeIssuer(candidate) === normalizeIssuer(iss)));
+        if (!trustedIssuer) {
+            return fail('issuer-not-trusted');
+        }
+        let keys;
+        try {
+            const jwksUrl = await resolveTrustedJwksUrl(opts, verificationClientId);
+            const registry = await fetchReclaimJwks(jwksUrl
+                ?? `${trustedIssuer.replace(/\/+$/, '')}/.well-known/jwks.json`, opts.fetchImpl);
+            keys = registry.keys;
+            jwksAttestorAddresses = registry['x-reclaim-attestors'] ?? [];
+        }
+        catch {
+            return fail('jwks-fetch-failed');
+        }
+        const jwk = selectVerificationResultKey(keys, String(header.kid ?? ''), verificationClientId);
         if (!jwk) {
             return fail('signer-key-not-found');
         }
@@ -212,78 +233,248 @@ export async function verifyResultFull(jws, opts = {}) {
     if (!verifyJwsSignature(jws, signerPublicKey)) {
         return fail('bad-signature');
     }
-    // 2. Freshness / audience / expiry.
-    if (opts.expectedReclaimSessionId &&
-        reclaimSessionId !== opts.expectedReclaimSessionId) {
+    if (typeof payload.iss === 'string'
+        && typeof header.iss === 'string'
+        && normalizeIssuer(payload.iss) !== normalizeIssuer(header.iss)) {
+        return fail('issuer-mismatch');
+    }
+    // 2. Session binding, audience, and optional legacy result expiry.
+    const expectedResultSessionId = opts.sessionId
+        ?? opts.expectedReclaimSessionId;
+    if (expectedResultSessionId && reclaimSessionId !== expectedResultSessionId) {
         return fail('reclaimSessionId-mismatch');
     }
     if (opts.expectedAud && payload.aud !== opts.expectedAud) {
         return fail('aud-mismatch');
     }
     const now = opts.now ?? Math.floor(Date.now() / 1000);
-    if (typeof payload.exp === 'number' && payload.exp < now) {
+    if (!opts.ignoreExpiration
+        && typeof payload.exp === 'number'
+        && payload.exp < now) {
         return fail('expired');
     }
-    // 3. Per-provider, per-request nested attestor proof + content_hash binding.
-    // `results` is grouped by provider: [{ provider_id, resolved_version,
-    // requests: [...] }]. Every request across every provider must verify.
+    // 3. Verify every exact legacy proof carried by the signed result. The outer
+    // envelope groups proofs by provider, but it never changes the proof shape.
     const providerResults = Array.isArray(payload.results)
         ? payload.results
         : [];
     const proofs = [];
+    const proofGroups = [];
     for (const prov of providerResults) {
         const providerId = typeof prov.provider_id === 'string' ? prov.provider_id : undefined;
+        const providerVersion = typeof prov.resolved_version === 'string'
+            ? prov.resolved_version
+            : undefined;
         const requests = Array.isArray(prov.requests)
             ? prov.requests
             : [];
         for (const r of requests) {
             const requestId = typeof r.request_id === 'string' ? r.request_id : undefined;
-            if (typeof r.proof !== 'string') {
+            if (!isLegacyProof(r.proof)) {
                 proofs.push({
                     providerId, requestId, proofValid: false, reason: 'proof-missing',
                 });
                 continue;
             }
-            const np = verifyNestedProof(r.proof, {
-                attestorAddresses: opts.attestorAddresses,
-            });
-            if (!np.valid) {
-                proofs.push({
-                    providerId,
-                    requestId,
-                    proofValid: false,
-                    reason: np.reason,
-                    attestorAddress: np.attestorAddress,
-                });
-                continue;
-            }
-            if (typeof r.content_hash === 'string' &&
-                r.extracted_parameters &&
-                typeof r.extracted_parameters === 'object') {
-                const params = r.extracted_parameters;
-                if (contentHash(params).toLowerCase() !== r.content_hash.toLowerCase()) {
-                    proofs.push({
-                        providerId,
-                        requestId,
-                        proofValid: false,
-                        reason: 'content-hash-mismatch',
-                        attestorAddress: np.attestorAddress,
-                    });
-                    continue;
-                }
-            }
             proofs.push({
                 providerId,
                 requestId,
                 proofValid: true,
-                attestorAddress: np.attestorAddress,
+                attestorAddress: r.proof.witnesses[0]?.id,
+            });
+            proofGroups.push({
+                providerId,
+                providerVersion,
+                proof: r.proof,
+                outcomeIndex: proofs.length - 1,
             });
         }
     }
+    const verificationStatus = getVerificationStatus(payload);
+    if (verificationStatus === 'success' && !proofGroups.length) {
+        return fail('proof-missing', { proofs });
+    }
+    if (proofGroups.length) {
+        const expectedSessionId = expectedResultSessionId;
+        const configuredProofValidation = opts.proofValidation
+            ?? opts.proofVerification;
+        const attestorAddresses = [...new Set([
+                ...(configuredProofValidation?.attestorAddresses ?? []),
+                ...(opts.attestorAddresses ?? []),
+                ...jwksAttestorAddresses,
+            ])];
+        const commonValidation = {
+            ...configuredProofValidation,
+            ...(opts.hashes ? { hashes: opts.hashes } : {}),
+            ...(attestorAddresses.length
+                ? { attestorAddresses }
+                : {}),
+            ...(expectedSessionId
+                ? { expectedSessionId }
+                : {}),
+        };
+        if (hasContentValidation(commonValidation)) {
+            await verifyLegacyProofGroup(proofGroups, commonValidation);
+        }
+        else {
+            await verifyByResolvedRecipes(commonValidation, expectedSessionId);
+        }
+    }
     if (!proofs.every((p) => p.proofValid)) {
         return fail('invalid-proof', { proofs });
     }
     return { valid: true, payload, reclaimSessionId, proofs };
+    async function verifyLegacyProofGroup(group, validation) {
+        const legacyOutcome = await verifyProof(group.map(({ proof }) => proof), validation);
+        if (legacyOutcome.valid) {
+            for (const [index, item] of group.entries()) {
+                proofs[item.outcomeIndex].data = legacyOutcome.data?.[index];
+                proofs[item.outcomeIndex].publicData =
+                    legacyOutcome.publicData?.[index];
+            }
+            return;
+        }
+        for (const { outcomeIndex } of group) {
+            proofs[outcomeIndex].proofValid = false;
+            proofs[outcomeIndex].reason = legacyOutcome.reason;
+        }
+    }
+    async function verifyByResolvedRecipes(common, expectedSessionId) {
+        let recipes = opts.proofRecipes;
+        if (!recipes && expectedSessionId && opts.resolveSession) {
+            try {
+                const resolved = await opts.resolveSession(expectedSessionId);
+                recipes = resolved.recipes;
+            }
+            catch {
+                return fail('session-resolution-failed', { proofs });
+            }
+        }
+        const groups = Map.groupBy(proofGroups, proofGroupKey);
+        if (recipes && !recipeGroupsMatch(recipes, groups)) {
+            markInvalid(proofGroups, 'recipe-mismatch');
+            return fail('invalid-proof', { proofs });
+        }
+        for (const group of groups.values()) {
+            await verifyResolvedGroup(group, recipes, common);
+        }
+    }
+    async function verifyResolvedGroup(group, recipes, common) {
+        const providerId = group[0]?.providerId;
+        const providerVersion = group[0]?.providerVersion;
+        const providerValidation = providerId
+            ? opts.proofValidationByProviderId?.[providerId]
+            : undefined;
+        const recipe = recipes?.find((candidate) => (candidate.providerId === providerId
+            && candidate.resolvedVersion === providerVersion));
+        let hashes;
+        if (recipe) {
+            try {
+                hashes = proofHashesFromBuilderRecipe(recipe, group.map(({ proof }) => proof));
+            }
+            catch {
+                markInvalid(group, 'recipe-hash-failed');
+                return;
+            }
+        }
+        await verifyLegacyProofGroup(group, {
+            ...common,
+            ...(recipe
+                ? { hashes }
+                : providerId
+                    ? { providerId, providerVersion }
+                    : {}),
+            ...providerValidation,
+        });
+    }
+    function markInvalid(group, reason) {
+        for (const { outcomeIndex } of group) {
+            proofs[outcomeIndex].proofValid = false;
+            proofs[outcomeIndex].reason = reason;
+        }
+    }
+}
+function hasContentValidation(config) {
+    return Boolean(config.hashes
+        || config.providerId
+        || config.dangerouslyDisableContentValidation);
+}
+function proofGroupKey(group) {
+    return `${group.providerId ?? ''}\u0000${group.providerVersion ?? ''}`;
+}
+function recipeGroupsMatch(recipes, groups) {
+    const expected = new Set(recipes.map((recipe) => (`${recipe.providerId}\u0000${recipe.resolvedVersion}`)));
+    return expected.size === groups.size
+        && [...groups.keys()].every((key) => expected.has(key));
+}
+function isLegacyProof(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const proof = value;
+    return typeof proof.identifier === 'string'
+        && !!proof.claimData
+        && typeof proof.claimData === 'object'
+        && Array.isArray(proof.signatures)
+        && Array.isArray(proof.witnesses)
+        && 'extractedParameterValues' in proof;
+}
+function getVerificationStatus(payload) {
+    const session = payload.verification_session;
+    if (!session || typeof session !== 'object' || Array.isArray(session)) {
+        return undefined;
+    }
+    const status = session.status;
+    return typeof status === 'string' ? status : undefined;
+}
+function normalizeIssuer(issuer) {
+    return issuer.trim().replace(/\/+$/, '').toLowerCase();
+}
+function getVerificationClientId(payload) {
+    if (typeof payload.verificationClientId === 'string') {
+        return payload.verificationClientId;
+    }
+    if (typeof payload.verification_client_id === 'string') {
+        return payload.verification_client_id;
+    }
+    const session = payload.verification_session;
+    if (!session || typeof session !== 'object' || Array.isArray(session)) {
+        return undefined;
+    }
+    const sessionRecord = session;
+    const id = sessionRecord.verificationClientId
+        ?? sessionRecord.verification_client_id;
+    return typeof id === 'string' ? id : undefined;
+}
+async function resolveTrustedIssuers(opts, verificationClientId) {
+    const explicit = [
+        opts.issuer,
+        opts.trustedIssuer,
+        ...(opts.issuers ?? []),
+        ...(opts.trustedIssuers ?? []),
+    ].filter((issuer) => typeof issuer === 'string');
+    if (explicit.length) {
+        return [...new Set(explicit.map(normalizeIssuer))];
+    }
+    if (!verificationClientId) {
+        return [];
+    }
+    const registered = opts.issuersByVerificationClientId?.[verificationClientId] ?? [];
+    const resolve = opts.resolveIssuers ?? opts.issuerResolver;
+    const resolved = resolve
+        ? await resolve(verificationClientId)
+        : [];
+    return [...new Set([...registered, ...resolved].map(normalizeIssuer))];
+}
+async function resolveTrustedJwksUrl(opts, verificationClientId) {
+    if (opts.jwksUrl) {
+        return opts.jwksUrl;
+    }
+    if (!verificationClientId) {
+        return undefined;
+    }
+    const registered = opts.jwksUrlsByVerificationClientId?.[verificationClientId];
+    return registered ?? await opts.resolveJwksUrl?.(verificationClientId);
 }
 /** Decrypt-and-verify in one step. */
 export function verifyResult(jws, opts = {}) {

package/lib/routes.gen.d.ts

@@ -11,6 +11,10 @@ export declare const ROUTES: {
         readonly method: "post";
         readonly path: "/orgs/{orgId}/members";
     };
+    readonly AddProviderContributionComment: {
+        readonly method: "post";
+        readonly path: "/providers/{providerId}/contributions/{campaignId}/comments";
+    };
     readonly AddStaffMember: {
         readonly method: "post";
         readonly path: "/admin/staff";
@@ -83,6 +87,10 @@ export declare const ROUTES: {
         readonly method: "post";
         readonly path: "/admin/orgs/{orgId}/credits/{grantId}/void";
     };
+    readonly BindVerificationSessionTeeNonce: {
+        readonly method: "put";
+        readonly path: "/verifications/sessions/{sessionId}/tee-nonce";
+    };
     readonly CancelBillingSubscription: {
         readonly method: "delete";
         readonly path: "/orgs/{orgId}/billing/subscription";
@@ -143,10 +151,22 @@ export declare const ROUTES: {
         readonly method: "post";
         readonly path: "/providers";
     };
+    readonly CreateProviderContributionCampaign: {
+        readonly method: "post";
+        readonly path: "/providers/{providerId}/contributions";
+    };
+    readonly CreateProviderContributionRequirementRevision: {
+        readonly method: "post";
+        readonly path: "/providers/{providerId}/contributions/{campaignId}/requirements";
+    };
     readonly CreateProviderVersion: {
         readonly method: "post";
         readonly path: "/providers/{providerId}/versions";
     };
+    readonly CreatePublicContributionAttempt: {
+        readonly method: "post";
+        readonly path: "/contribute/{publicId}";
+    };
     readonly CreateTheme: {
         readonly method: "post";
         readonly path: "/orgs/{orgId}/themes";
@@ -279,6 +299,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/providers/{providerId}/versions/{version}";
     };
+    readonly GetPublicContributionCampaign: {
+        readonly method: "get";
+        readonly path: "/contribute/{publicId}";
+    };
     readonly GetTheme: {
         readonly method: "get";
         readonly path: "/orgs/{orgId}/themes/{themeId}";
@@ -287,6 +311,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/users/{userId}";
     };
+    readonly GetVerificationFunnel: {
+        readonly method: "get";
+        readonly path: "/orgs/{orgId}/verification-funnel";
+    };
     readonly GetVerificationRecipe: {
         readonly method: "get";
         readonly path: "/verifications/sessions/{sessionId}/recipe";
@@ -299,6 +327,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/verifications/sessions/{sessionId}";
     };
+    readonly ImportDevtoolsProvider: {
+        readonly method: "post";
+        readonly path: "/providers/import/devtools";
+    };
     readonly Index: {
         readonly method: "get";
         readonly path: "/";
@@ -347,6 +379,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/orgs/{orgId}/sessions";
     };
+    readonly ListProviderContributionCampaigns: {
+        readonly method: "get";
+        readonly path: "/providers/{providerId}/contributions";
+    };
     readonly ListProviderVersions: {
         readonly method: "get";
         readonly path: "/providers/{providerId}/versions";
@@ -391,6 +427,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/orgs/{orgId}/invite";
     };
+    readonly PatchVerificationClaimant: {
+        readonly method: "patch";
+        readonly path: "/verifications/sessions/{sessionId}/claimant";
+    };
     readonly ProviderPreviewImage: {
         readonly method: "get";
         readonly path: "/providers/{providerId}/preview.png";
@@ -467,18 +507,22 @@ export declare const ROUTES: {
         readonly method: "post";
         readonly path: "/admin/billing/plans/{planId}/default";
     };
-    readonly SetOrgCreditGrace: {
-        readonly method: "post";
-        readonly path: "/admin/orgs/{orgId}/credits/grace";
-    };
-    readonly SetOrgGrace: {
+    readonly SetOrgCreditAllowance: {
         readonly method: "post";
-        readonly path: "/admin/orgs/{orgId}/billing/grace";
+        readonly path: "/admin/orgs/{orgId}/credits/allowance";
     };
     readonly SetOrgKeypair: {
         readonly method: "put";
         readonly path: "/orgs/{orgId}/keypair";
     };
+    readonly SetOrgPaymentAllowance: {
+        readonly method: "post";
+        readonly path: "/admin/orgs/{orgId}/billing/allowance";
+    };
+    readonly SetProviderContributionCampaignStatus: {
+        readonly method: "post";
+        readonly path: "/providers/{providerId}/contributions/{campaignId}";
+    };
     readonly SetupBillingPlan: {
         readonly method: "post";
         readonly path: "/admin/billing/plans/setup";
@@ -539,6 +583,10 @@ export declare const ROUTES: {
         readonly method: "post";
         readonly path: "/providers/{providerId}/versions/{version}/review";
     };
+    readonly SubmitPublicContributionFeedback: {
+        readonly method: "post";
+        readonly path: "/contribute/{publicId}/feedback";
+    };
     readonly SubmitVerificationResult: {
         readonly method: "post";
         readonly path: "/verifications/sessions/{sessionId}/result";
@@ -567,6 +615,10 @@ export declare const ROUTES: {
         readonly method: "patch";
         readonly path: "/providers/{providerId}";
     };
+    readonly UpdateProviderContributionCampaign: {
+        readonly method: "patch";
+        readonly path: "/providers/{providerId}/contributions/{campaignId}";
+    };
     readonly UpdateProviderVersion: {
         readonly method: "patch";
         readonly path: "/providers/{providerId}/versions/{version}";

package/lib/routes.gen.js

@@ -1,11 +1,12 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
 // from packages/app/openapi.yaml.
-// Run `npm run openapi:typegen --workspace=packages/client`
+// Run `npm run openapi:gen --workspace=packages/app`
 // to regenerate. Do not edit by hand.
 export const ROUTES = {
     "AcceptOrgInvite": { "method": "post", "path": "/orgs/{orgId}/invite" },
     "ActivateFixWithAiRepair": { "method": "post", "path": "/v/{sessionId}/fix-with-ai/activate" },
     "AddOrgMember": { "method": "post", "path": "/orgs/{orgId}/members" },
+    "AddProviderContributionComment": { "method": "post", "path": "/providers/{providerId}/contributions/{campaignId}/comments" },
     "AddStaffMember": { "method": "post", "path": "/admin/staff" },
     "AddVerificationClientKey": { "method": "post", "path": "/admin/verification-clients/{clientId}/keys" },
     "AdminBillingPlans": { "method": "get", "path": "/admin/billing/plans" },
@@ -24,6 +25,7 @@ export const ROUTES = {
     "AdminUsers": { "method": "get", "path": "/admin/users" },
     "AdminVerificationClients": { "method": "get", "path": "/admin/verification-clients" },
     "AdminVoidOrgCredit": { "method": "post", "path": "/admin/orgs/{orgId}/credits/{grantId}/void" },
+    "BindVerificationSessionTeeNonce": { "method": "put", "path": "/verifications/sessions/{sessionId}/tee-nonce" },
     "CancelBillingSubscription": { "method": "delete", "path": "/orgs/{orgId}/billing/subscription" },
     "CancelPublicListingRequest": { "method": "post", "path": "/providers/{providerId}/versions/{version}/cancel-review" },
     "ChangeOrgPlan": { "method": "post", "path": "/orgs/{orgId}/billing/change-plan" },
@@ -39,7 +41,10 @@ export const ROUTES = {
     "CreateOrg": { "method": "post", "path": "/orgs" },
     "CreateOrgCallbackSubscription": { "method": "post", "path": "/orgs/{orgId}/callback-subscriptions" },
     "CreateProvider": { "method": "post", "path": "/providers" },
+    "CreateProviderContributionCampaign": { "method": "post", "path": "/providers/{providerId}/contributions" },
+    "CreateProviderContributionRequirementRevision": { "method": "post", "path": "/providers/{providerId}/contributions/{campaignId}/requirements" },
     "CreateProviderVersion": { "method": "post", "path": "/providers/{providerId}/versions" },
+    "CreatePublicContributionAttempt": { "method": "post", "path": "/contribute/{publicId}" },
     "CreateTheme": { "method": "post", "path": "/orgs/{orgId}/themes" },
     "CreateVerificationClient": { "method": "post", "path": "/admin/verification-clients" },
     "CreateVerificationSession": { "method": "post", "path": "/verifications/sessions" },
@@ -73,11 +78,14 @@ export const ROUTES = {
     "GetProvider": { "method": "get", "path": "/providers/{providerId}" },
     "GetProviderBySlug": { "method": "get", "path": "/providers/{providerId}/{slug}" },
     "GetProviderVersion": { "method": "get", "path": "/providers/{providerId}/versions/{version}" },
+    "GetPublicContributionCampaign": { "method": "get", "path": "/contribute/{publicId}" },
     "GetTheme": { "method": "get", "path": "/orgs/{orgId}/themes/{themeId}" },
     "GetUser": { "method": "get", "path": "/users/{userId}" },
+    "GetVerificationFunnel": { "method": "get", "path": "/orgs/{orgId}/verification-funnel" },
     "GetVerificationRecipe": { "method": "get", "path": "/verifications/sessions/{sessionId}/recipe" },
     "GetVerificationResult": { "method": "get", "path": "/verifications/sessions/{sessionId}/result" },
     "GetVerificationSession": { "method": "get", "path": "/verifications/sessions/{sessionId}" },
+    "ImportDevtoolsProvider": { "method": "post", "path": "/providers/import/devtools" },
     "Index": { "method": "get", "path": "/" },
     "IssueOrgToken": { "method": "post", "path": "/orgs/{orgId}/token" },
     "IssueVerificationClientToken": { "method": "post", "path": "/admin/verification-clients/{clientId}/tokens" },
@@ -90,6 +98,7 @@ export const ROUTES = {
     "ListOrgTokens": { "method": "get", "path": "/orgs/{orgId}/token" },
     "ListOrgTransactions": { "method": "get", "path": "/orgs/{orgId}/billing/transactions" },
     "ListOrgVerificationSessions": { "method": "get", "path": "/orgs/{orgId}/sessions" },
+    "ListProviderContributionCampaigns": { "method": "get", "path": "/providers/{providerId}/contributions" },
     "ListProviderVersions": { "method": "get", "path": "/providers/{providerId}/versions" },
     "ListSessionCallbackKeys": { "method": "get", "path": "/verifications/sessions/{sessionId}/callback-keys" },
     "ListStaffMembers": { "method": "get", "path": "/admin/staff" },
@@ -101,6 +110,7 @@ export const ROUTES = {
     "MakePrivate": { "method": "post", "path": "/providers/{providerId}/make-private" },
     "OpenApiSpec": { "method": "get", "path": "/openapi.yaml" },
     "OrgInvitePage": { "method": "get", "path": "/orgs/{orgId}/invite" },
+    "PatchVerificationClaimant": { "method": "patch", "path": "/verifications/sessions/{sessionId}/claimant" },
     "ProviderPreviewImage": { "method": "get", "path": "/providers/{providerId}/preview.png" },
     "Providers": { "method": "get", "path": "/providers" },
     "PublishProviderVersion": { "method": "post", "path": "/providers/{providerId}/versions/{version}/publish" },
@@ -120,9 +130,10 @@ export const ROUTES = {
     "Robots": { "method": "get", "path": "/robots.txt" },
     "SearchOrgMembers": { "method": "get", "path": "/orgs/{orgId}/members" },
     "SetDefaultBillingPlan": { "method": "post", "path": "/admin/billing/plans/{planId}/default" },
-    "SetOrgCreditGrace": { "method": "post", "path": "/admin/orgs/{orgId}/credits/grace" },
-    "SetOrgGrace": { "method": "post", "path": "/admin/orgs/{orgId}/billing/grace" },
+    "SetOrgCreditAllowance": { "method": "post", "path": "/admin/orgs/{orgId}/credits/allowance" },
     "SetOrgKeypair": { "method": "put", "path": "/orgs/{orgId}/keypair" },
+    "SetOrgPaymentAllowance": { "method": "post", "path": "/admin/orgs/{orgId}/billing/allowance" },
+    "SetProviderContributionCampaignStatus": { "method": "post", "path": "/providers/{providerId}/contributions/{campaignId}" },
     "SetupBillingPlan": { "method": "post", "path": "/admin/billing/plans/setup" },
     "SetupProviderCreate": { "method": "post", "path": "/providers/setup" },
     "SiteAiProvider": { "method": "post", "path": "/site/{domain}/ai-provider" },
@@ -138,6 +149,7 @@ export const ROUTES = {
     "StripeWebhook": { "method": "post", "path": "/billing/stripe/webhook" },
     "SubmitConsent": { "method": "post", "path": "/oauth/consent" },
     "SubmitProviderVersionForReview": { "method": "post", "path": "/providers/{providerId}/versions/{version}/review" },
+    "SubmitPublicContributionFeedback": { "method": "post", "path": "/contribute/{publicId}/feedback" },
     "SubmitVerificationResult": { "method": "post", "path": "/verifications/sessions/{sessionId}/result" },
     "TransferProvider": { "method": "post", "path": "/providers/{providerId}/transfer" },
     "UpdateBillingPlan": { "method": "put", "path": "/admin/billing/plans/{planId}" },
@@ -145,6 +157,7 @@ export const ROUTES = {
     "UpdateOrgIcon": { "method": "put", "path": "/orgs/{orgId}/icon" },
     "UpdateOrgMember": { "method": "patch", "path": "/orgs/{orgId}/members/{memberId}" },
     "UpdateProvider": { "method": "patch", "path": "/providers/{providerId}" },
+    "UpdateProviderContributionCampaign": { "method": "patch", "path": "/providers/{providerId}/contributions/{campaignId}" },
     "UpdateProviderVersion": { "method": "patch", "path": "/providers/{providerId}/versions/{version}" },
     "UpdateTheme": { "method": "patch", "path": "/orgs/{orgId}/themes/{themeId}" },
     "UpdateVerificationClient": { "method": "put", "path": "/admin/verification-clients/{clientId}" },