@reclaimprotocol/client 0.1.27 → 0.1.28

package/src/result.ts

@@ -2,27 +2,36 @@
  * Consumer-side handling of a delivered callback. Two entry points:
  *  - {@link verifyResult}: the offline primitive — decrypt + decode + optional
  *    ES256K signature check (caller-supplied key) + `reclaimSessionId` nonce.
- *  - {@link verifyResultFull}: the full async verification — discovers the
- *    Verification Client's key via JWKS, verifies the top-level JWS, checks
- *    `reclaimSessionId`/`aud`/`exp`, and verifies each result's nested attestor
- *    proof + `content_hash` (see ./attestor-proof.ts and ./jwks.ts).
+ *  - {@link verifyResultFull}: the recommended server-side verification —
+ *    resolves a registered issuer, discovers the Verification Client's key
+ *    via JWKS, checks
+ *    `reclaimSessionId`/`aud` and any legacy `exp`, and passes every exact
+ *    legacy proof to the in-package, legacy-compatible `verifyProof` verifier.
  *
  * See docs/verification-session.md → "Verification by Consumer".
  */
 import { sha256 } from '@noble/hashes/sha2.js'
-import { keccak_256 } from '@noble/hashes/sha3.js'
 import { decrypt as eciesDecrypt, encrypt as eciesEncrypt } from 'eciesjs'
 import type { components } from './types/openapi.gen.ts'
-import { type NestedProofOutcome, verifyNestedProof } from './attestor-proof.ts'
-import { canonicalJson } from './canonical.ts'
 import type { DecryptionKey } from './enckeys.ts'
-import { b64url, base64urlToBytes, bytesToHex, hexToBytes } from './encoding.ts'
+import { b64url, base64urlToBytes, hexToBytes } from './encoding.ts'
 import {
-	fetchJwks,
+	fetchReclaimJwks,
 	type Jwk,
 	jwkToUncompressedPublicKey,
-	selectKey,
+	selectVerificationResultKey,
 } from './jwks.ts'
+import {
+	type LegacyProof,
+	type LegacyVerifyProofOptions,
+	type ProofHashRequirement,
+	verifyProof,
+} from './legacy-proof.ts'
+import {
+	type BuilderProofRecipe,
+	proofHashesFromBuilderRecipe,
+} from './proof-recipe.ts'
+import type { TrustedData } from './proof-types.ts'
 import { addressFromUncompressedPubkey, secp } from './secp.ts'
 
 export interface Jws {
@@ -224,27 +233,65 @@ export function verifyJwsSignature(jws: Jws, signerPublicKey: string): boolean {
 	})
 }
 
-/** Content hash binding extracted parameters — MUST mirror the Verification
- *  Client's `contentHash` exactly (keccak256 of the RFC 8785 canonical JSON,
- *  via the shared `canonicalJson`). */
-function contentHash(params: Record<string, string>): string {
-	const canonical = canonicalJson(params)
-	return '0x' + bytesToHex(keccak_256(new TextEncoder().encode(canonical)))
-}
-
 export interface VerifyResultFullOptions {
+	/** Builder session id. Alias for `expectedReclaimSessionId`. */
+	sessionId?: string
 	/** The `reclaimSessionId` the consumer expects (mismatch fails). */
 	expectedReclaimSessionId?: string
 	/** The consumer's `orgId`; the result's `aud` must match it. */
 	expectedAud?: string
 	/** Allowlist of trusted attestor ETH addresses (lowercased compared). */
 	attestorAddresses?: string[]
+	/** One explicitly trusted Verification Client issuer. */
+	issuer?: string
+	/** Alias for `issuer`. */
+	trustedIssuer?: string
+	/** Explicitly trusted Verification Client issuers. */
+	issuers?: string[]
+	/** Alias for `issuers`, retained for security-focused callers. */
+	trustedIssuers?: string[]
+	/** Resolve registered issuer URLs for the signed session's client id. */
+	resolveIssuers?: (verificationClientId: string) =>
+		Promise<readonly string[]> | readonly string[]
+	/** Alias for `resolveIssuers`. */
+	issuerResolver?: (verificationClientId: string) =>
+		Promise<readonly string[]> | readonly string[]
+	/** Registered issuer URLs keyed by `verificationClientId`. */
+	issuersByVerificationClientId?: Record<string, string[]>
+	/** Explicit trusted JWKS URL. This value must come from your registry. */
+	jwksUrl?: string
+	/** Trusted JWKS URLs keyed by `verificationClientId`. */
+	jwksUrlsByVerificationClientId?: Record<string, string>
+	/** Resolve a registered JWKS URL for the signed session's client id. */
+	resolveJwksUrl?: (verificationClientId: string) =>
+		Promise<string | undefined> | string | undefined
+	/** Legacy-compatible proof validation options applied to all proofs. */
+	proofValidation?: LegacyVerifyProofOptions
+	/** Alias for `proofValidation`. */
+	proofVerification?: LegacyVerifyProofOptions
+	/** Per-provider overrides for sessions containing different providers. */
+	proofValidationByProviderId?: Record<string, LegacyVerifyProofOptions>
+	/** Legacy-compatible hash requirements, for the common simple case. */
+	hashes?: ProofHashRequirement[]
+	/** Resolved Builder recipes, used to derive strict proof hashes offline. */
+	proofRecipes?: BuilderProofRecipe[]
+	/** Resolve a Builder session and its immutable, resolved recipes. */
+	resolveSession?: (
+		sessionId: string,
+	) => Promise<{ recipes: BuilderProofRecipe[] }>
+		| { recipes: BuilderProofRecipe[] }
 	/** Override the VC signer key instead of JWKS discovery via header `iss`. */
 	signerPublicKey?: string
 	/** Injectable fetch (for JWKS); defaults to global `fetch`. */
 	fetchImpl?: typeof fetch
-	/** Override "now" (unix seconds) for `exp` checks. */
+	/** Override "now" (Unix seconds) when checking a legacy result's `exp`. */
 	now?: number
+	/**
+	 * Accept a legacy Builder result that contains an expired `exp` claim.
+	 * New Builder results don't include `exp`; use this only while consuming
+	 * older stored results whose signatures and proofs must remain verifiable.
+	 */
+	ignoreExpiration?: boolean
 }
 
 export interface ResultProofOutcome {
@@ -254,6 +301,10 @@ export interface ResultProofOutcome {
 	proofValid: boolean
 	reason?: string
 	attestorAddress?: string
+	/** Trusted only when `proofValid` is true. */
+	data?: TrustedData
+	/** Provider-supplied data. It isn't cryptographically validated. */
+	publicData?: unknown
 }
 
 export interface VerifyResultFullOutcome extends VerifyResultOutcome {
@@ -292,11 +343,12 @@ export class ResultVerificationError extends Error {
 }
 
 /**
- * Full consumer verification: discovers the Verification Client's signing key
- * via JWKS (header `iss`/`kid`), verifies the top-level JWS, checks
- * `reclaimSessionId`/`aud`/`exp`, then verifies each result's nested attestor
- * proof and its `content_hash`. Network access (JWKS) makes this async; use
- * {@link verifyResult} for the offline primitive.
+ * Full consumer verification: resolves a trusted, registered issuer before
+ * using JWKS (header `iss`/`kid`), verifies the top-level JWS, checks
+ * `reclaimSessionId`/`aud` and any legacy `exp`, then verifies each exact
+ * legacy proof.
+ * Network access (JWKS and optional provider resolution) makes this async.
+ * Use {@link verifyResult} for the offline primitive.
  */
 export async function verifyResultFull(
 	jws: Jws,
@@ -304,6 +356,7 @@ export async function verifyResultFull(
 ): Promise<VerifyResultFullOutcome> {
 	const payload = decodeJwsPayload(jws)
 	const reclaimSessionId = payload.reclaimSessionId as string | undefined
+	let jwksAttestorAddresses: string[] = []
 	/** Throw with the full invalid outcome — verification never *returns* an
 	 *  invalid result. */
 	const fail = (
@@ -319,7 +372,8 @@ export async function verifyResultFull(
 		})
 	}
 
-	// 1. Resolve the VC signer key: explicit override, else JWKS via header iss.
+	// 1. Resolve the VC signer key. Never use the signed header's `iss` as a
+	// network destination until it has matched an explicit or registered issuer.
 	let signerPublicKey = opts.signerPublicKey
 	let header: Record<string, unknown> = {}
 	const sig0 = jws.signatures[0]
@@ -334,13 +388,55 @@ export async function verifyResultFull(
 	}
 
 	if(!signerPublicKey) {
+		const verificationClientId = getVerificationClientId(payload) ?? ''
+		let configuredIssuers: string[]
+		try {
+			configuredIssuers = await resolveTrustedIssuers(
+				opts,
+				verificationClientId,
+			)
+		} catch{
+			return fail('issuer-resolution-failed')
+		}
+
+		if(!configuredIssuers.length) {
+			return fail('issuer-not-configured')
+		}
+
 		const iss = String(header.iss ?? '')
 		if(!iss) {
 			return fail('no-issuer')
 		}
 
-		const keys = await fetchJwks(iss, opts.fetchImpl)
-		const jwk = selectKey(keys, String(header.kid ?? ''))
+		const trustedIssuer = configuredIssuers.find((candidate) => (
+			normalizeIssuer(candidate) === normalizeIssuer(iss)
+		))
+		if(!trustedIssuer) {
+			return fail('issuer-not-trusted')
+		}
+
+		let keys: Jwk[]
+		try {
+			const jwksUrl = await resolveTrustedJwksUrl(
+				opts,
+				verificationClientId,
+			)
+			const registry = await fetchReclaimJwks(
+				jwksUrl
+					?? `${trustedIssuer.replace(/\/+$/, '')}/.well-known/jwks.json`,
+				opts.fetchImpl,
+			)
+			keys = registry.keys
+			jwksAttestorAddresses = registry['x-reclaim-attestors'] ?? []
+		} catch{
+			return fail('jwks-fetch-failed')
+		}
+
+		const jwk = selectVerificationResultKey(
+			keys,
+			String(header.kid ?? ''),
+			verificationClientId,
+		)
 		if(!jwk) {
 			return fail('signer-key-not-found')
 		}
@@ -352,11 +448,18 @@ export async function verifyResultFull(
 		return fail('bad-signature')
 	}
 
-	// 2. Freshness / audience / expiry.
 	if(
-		opts.expectedReclaimSessionId &&
-		reclaimSessionId !== opts.expectedReclaimSessionId
+		typeof payload.iss === 'string'
+		&& typeof header.iss === 'string'
+		&& normalizeIssuer(payload.iss) !== normalizeIssuer(header.iss)
 	) {
+		return fail('issuer-mismatch')
+	}
+
+	// 2. Session binding, audience, and optional legacy result expiry.
+	const expectedResultSessionId = opts.sessionId
+		?? opts.expectedReclaimSessionId
+	if(expectedResultSessionId && reclaimSessionId !== expectedResultSessionId) {
 		return fail('reclaimSessionId-mismatch')
 	}
 
@@ -365,79 +468,311 @@ export async function verifyResultFull(
 	}
 
 	const now = opts.now ?? Math.floor(Date.now() / 1000)
-	if(typeof payload.exp === 'number' && payload.exp < now) {
+	if(
+		!opts.ignoreExpiration
+		&& typeof payload.exp === 'number'
+		&& payload.exp < now
+	) {
 		return fail('expired')
 	}
 
-	// 3. Per-provider, per-request nested attestor proof + content_hash binding.
-	// `results` is grouped by provider: [{ provider_id, resolved_version,
-	// requests: [...] }]. Every request across every provider must verify.
+	// 3. Verify every exact legacy proof carried by the signed result. The outer
+	// envelope groups proofs by provider, but it never changes the proof shape.
 	const providerResults = Array.isArray(payload.results)
 		? (payload.results as Record<string, unknown>[])
 		: []
 	const proofs: ResultProofOutcome[] = []
+	const proofGroups: {
+		providerId?: string
+		providerVersion?: string
+		proof: LegacyProof
+		outcomeIndex: number
+	}[] = []
 	for(const prov of providerResults) {
 		const providerId =
 			typeof prov.provider_id === 'string' ? prov.provider_id : undefined
+		const providerVersion = typeof prov.resolved_version === 'string'
+			? prov.resolved_version
+			: undefined
 		const requests = Array.isArray(prov.requests)
 			? (prov.requests as Record<string, unknown>[])
 			: []
 		for(const r of requests) {
 			const requestId =
 				typeof r.request_id === 'string' ? r.request_id : undefined
-			if(typeof r.proof !== 'string') {
+			if(!isLegacyProof(r.proof)) {
 				proofs.push({
 					providerId, requestId, proofValid: false, reason: 'proof-missing',
 				})
 				continue
 			}
 
-			const np: NestedProofOutcome = verifyNestedProof(r.proof, {
-				attestorAddresses: opts.attestorAddresses,
-			})
-			if(!np.valid) {
-				proofs.push({
-					providerId,
-					requestId,
-					proofValid: false,
-					reason: np.reason,
-					attestorAddress: np.attestorAddress,
-				})
-				continue
-			}
-
-			if(
-				typeof r.content_hash === 'string' &&
-				r.extracted_parameters &&
-				typeof r.extracted_parameters === 'object'
-			) {
-				const params = r.extracted_parameters as Record<string, string>
-				if(contentHash(params).toLowerCase() !== r.content_hash.toLowerCase()) {
-					proofs.push({
-						providerId,
-						requestId,
-						proofValid: false,
-						reason: 'content-hash-mismatch',
-						attestorAddress: np.attestorAddress,
-					})
-					continue
-				}
-			}
-
 			proofs.push({
 				providerId,
 				requestId,
 				proofValid: true,
-				attestorAddress: np.attestorAddress,
+				attestorAddress: r.proof.witnesses[0]?.id,
+			})
+			proofGroups.push({
+				providerId,
+				providerVersion,
+				proof: r.proof,
+				outcomeIndex: proofs.length - 1,
 			})
 		}
 	}
 
+	const verificationStatus = getVerificationStatus(payload)
+	if(verificationStatus === 'success' && !proofGroups.length) {
+		return fail('proof-missing', { proofs })
+	}
+
+	if(proofGroups.length) {
+		const expectedSessionId = expectedResultSessionId
+		const configuredProofValidation = opts.proofValidation
+			?? opts.proofVerification
+		const attestorAddresses = [...new Set([
+			...(configuredProofValidation?.attestorAddresses ?? []),
+			...(opts.attestorAddresses ?? []),
+			...jwksAttestorAddresses,
+		])]
+		const commonValidation = {
+			...configuredProofValidation,
+			...(opts.hashes ? { hashes: opts.hashes } : {}),
+			...(attestorAddresses.length
+				? { attestorAddresses }
+				: {}),
+			...(expectedSessionId
+				? { expectedSessionId }
+				: {}),
+		}
+		if(hasContentValidation(commonValidation)) {
+			await verifyLegacyProofGroup(proofGroups, commonValidation)
+		} else {
+			await verifyByResolvedRecipes(commonValidation, expectedSessionId)
+		}
+	}
+
 	if(!proofs.every((p) => p.proofValid)) {
 		return fail('invalid-proof', { proofs })
 	}
 
 	return { valid: true, payload, reclaimSessionId, proofs }
+
+	async function verifyLegacyProofGroup(
+		group: typeof proofGroups,
+		validation: LegacyVerifyProofOptions,
+	) {
+		const legacyOutcome = await verifyProof(
+			group.map(({ proof }) => proof),
+			validation,
+		)
+		if(legacyOutcome.valid) {
+			for(const [index, item] of group.entries()) {
+				proofs[item.outcomeIndex].data = legacyOutcome.data?.[index]
+				proofs[item.outcomeIndex].publicData =
+					legacyOutcome.publicData?.[index]
+			}
+
+			return
+		}
+
+		for(const { outcomeIndex } of group) {
+			proofs[outcomeIndex].proofValid = false
+			proofs[outcomeIndex].reason = legacyOutcome.reason
+		}
+	}
+
+	async function verifyByResolvedRecipes(
+		common: LegacyVerifyProofOptions,
+		expectedSessionId: string | undefined,
+	) {
+		let recipes = opts.proofRecipes
+		if(!recipes && expectedSessionId && opts.resolveSession) {
+			try {
+				const resolved = await opts.resolveSession(expectedSessionId)
+				recipes = resolved.recipes
+			} catch{
+				return fail('session-resolution-failed', { proofs })
+			}
+		}
+
+		const groups = Map.groupBy(proofGroups, proofGroupKey)
+		if(recipes && !recipeGroupsMatch(recipes, groups)) {
+			markInvalid(proofGroups, 'recipe-mismatch')
+			return fail('invalid-proof', { proofs })
+		}
+
+		for(const group of groups.values()) {
+			await verifyResolvedGroup(group, recipes, common)
+		}
+	}
+
+	async function verifyResolvedGroup(
+		group: typeof proofGroups,
+		recipes: BuilderProofRecipe[] | undefined,
+		common: LegacyVerifyProofOptions,
+	) {
+		const providerId = group[0]?.providerId
+		const providerVersion = group[0]?.providerVersion
+		const providerValidation = providerId
+			? opts.proofValidationByProviderId?.[providerId]
+			: undefined
+		const recipe = recipes?.find((candidate) => (
+			candidate.providerId === providerId
+			&& candidate.resolvedVersion === providerVersion
+		))
+		let hashes: ProofHashRequirement[] | undefined
+		if(recipe) {
+			try {
+				hashes = proofHashesFromBuilderRecipe(
+					recipe,
+					group.map(({ proof }) => proof),
+				)
+			} catch{
+				markInvalid(group, 'recipe-hash-failed')
+				return
+			}
+		}
+
+		await verifyLegacyProofGroup(group, {
+			...common,
+			...(recipe
+				? { hashes }
+				: providerId
+					? { providerId, providerVersion }
+					: {}),
+			...providerValidation,
+		})
+	}
+
+	function markInvalid(group: typeof proofGroups, reason: string) {
+		for(const { outcomeIndex } of group) {
+			proofs[outcomeIndex].proofValid = false
+			proofs[outcomeIndex].reason = reason
+		}
+	}
+}
+
+function hasContentValidation(config: LegacyVerifyProofOptions): boolean {
+	return Boolean(
+		config.hashes
+		|| config.providerId
+		|| config.dangerouslyDisableContentValidation,
+	)
+}
+
+function proofGroupKey(group: {
+	providerId?: string
+	providerVersion?: string
+}) {
+	return `${group.providerId ?? ''}\u0000${group.providerVersion ?? ''}`
+}
+
+function recipeGroupsMatch(
+	recipes: BuilderProofRecipe[],
+	groups: ReadonlyMap<string, unknown>,
+) {
+	const expected = new Set(recipes.map((recipe) => (
+		`${recipe.providerId}\u0000${recipe.resolvedVersion}`
+	)))
+	return expected.size === groups.size
+		&& [...groups.keys()].every((key) => expected.has(key))
+}
+
+function isLegacyProof(value: unknown): value is LegacyProof {
+	if(!value || typeof value !== 'object' || Array.isArray(value)) {
+		return false
+	}
+
+	const proof = value as Record<string, unknown>
+	return typeof proof.identifier === 'string'
+		&& !!proof.claimData
+		&& typeof proof.claimData === 'object'
+		&& Array.isArray(proof.signatures)
+		&& Array.isArray(proof.witnesses)
+		&& 'extractedParameterValues' in proof
+}
+
+function getVerificationStatus(payload: Record<string, unknown>) {
+	const session = payload.verification_session
+	if(!session || typeof session !== 'object' || Array.isArray(session)) {
+		return undefined
+	}
+
+	const status = (session as Record<string, unknown>).status
+	return typeof status === 'string' ? status : undefined
+}
+
+function normalizeIssuer(issuer: string): string {
+	return issuer.trim().replace(/\/+$/, '').toLowerCase()
+}
+
+function getVerificationClientId(
+	payload: Record<string, unknown>,
+): string | undefined {
+	if(typeof payload.verificationClientId === 'string') {
+		return payload.verificationClientId
+	}
+
+	if(typeof payload.verification_client_id === 'string') {
+		return payload.verification_client_id
+	}
+
+	const session = payload.verification_session
+	if(!session || typeof session !== 'object' || Array.isArray(session)) {
+		return undefined
+	}
+
+	const sessionRecord = session as Record<string, unknown>
+	const id = sessionRecord.verificationClientId
+		?? sessionRecord.verification_client_id
+	return typeof id === 'string' ? id : undefined
+}
+
+async function resolveTrustedIssuers(
+	opts: VerifyResultFullOptions,
+	verificationClientId: string | undefined,
+): Promise<string[]> {
+	const explicit = [
+		opts.issuer,
+		opts.trustedIssuer,
+		...(opts.issuers ?? []),
+		...(opts.trustedIssuers ?? []),
+	].filter((issuer): issuer is string => typeof issuer === 'string')
+	if(explicit.length) {
+		return [...new Set(explicit.map(normalizeIssuer))]
+	}
+
+	if(!verificationClientId) {
+		return []
+	}
+
+	const registered =
+		opts.issuersByVerificationClientId?.[verificationClientId] ?? []
+	const resolve = opts.resolveIssuers ?? opts.issuerResolver
+	const resolved = resolve
+		? await resolve(verificationClientId)
+		: []
+	return [...new Set([...registered, ...resolved].map(normalizeIssuer))]
+}
+
+async function resolveTrustedJwksUrl(
+	opts: VerifyResultFullOptions,
+	verificationClientId: string | undefined,
+): Promise<string | undefined> {
+	if(opts.jwksUrl) {
+		return opts.jwksUrl
+	}
+
+	if(!verificationClientId) {
+		return undefined
+	}
+
+	const registered = opts.jwksUrlsByVerificationClientId?.[
+		verificationClientId
+	]
+	return registered ?? await opts.resolveJwksUrl?.(verificationClientId)
 }
 
 /** Decrypt-and-verify in one step. */

package/src/routes.gen.ts

@@ -1,12 +1,13 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
 // from packages/app/openapi.yaml.
-// Run `npm run openapi:typegen --workspace=packages/client`
+// Run `npm run openapi:gen --workspace=packages/app`
 // to regenerate. Do not edit by hand.
 
 export const ROUTES = {
 	"AcceptOrgInvite": {"method":"post","path":"/orgs/{orgId}/invite"},
 	"ActivateFixWithAiRepair": {"method":"post","path":"/v/{sessionId}/fix-with-ai/activate"},
 	"AddOrgMember": {"method":"post","path":"/orgs/{orgId}/members"},
+	"AddProviderContributionComment": {"method":"post","path":"/providers/{providerId}/contributions/{campaignId}/comments"},
 	"AddStaffMember": {"method":"post","path":"/admin/staff"},
 	"AddVerificationClientKey": {"method":"post","path":"/admin/verification-clients/{clientId}/keys"},
 	"AdminBillingPlans": {"method":"get","path":"/admin/billing/plans"},
@@ -25,6 +26,7 @@ export const ROUTES = {
 	"AdminUsers": {"method":"get","path":"/admin/users"},
 	"AdminVerificationClients": {"method":"get","path":"/admin/verification-clients"},
 	"AdminVoidOrgCredit": {"method":"post","path":"/admin/orgs/{orgId}/credits/{grantId}/void"},
+	"BindVerificationSessionTeeNonce": {"method":"put","path":"/verifications/sessions/{sessionId}/tee-nonce"},
 	"CancelBillingSubscription": {"method":"delete","path":"/orgs/{orgId}/billing/subscription"},
 	"CancelPublicListingRequest": {"method":"post","path":"/providers/{providerId}/versions/{version}/cancel-review"},
 	"ChangeOrgPlan": {"method":"post","path":"/orgs/{orgId}/billing/change-plan"},
@@ -40,7 +42,10 @@ export const ROUTES = {
 	"CreateOrg": {"method":"post","path":"/orgs"},
 	"CreateOrgCallbackSubscription": {"method":"post","path":"/orgs/{orgId}/callback-subscriptions"},
 	"CreateProvider": {"method":"post","path":"/providers"},
+	"CreateProviderContributionCampaign": {"method":"post","path":"/providers/{providerId}/contributions"},
+	"CreateProviderContributionRequirementRevision": {"method":"post","path":"/providers/{providerId}/contributions/{campaignId}/requirements"},
 	"CreateProviderVersion": {"method":"post","path":"/providers/{providerId}/versions"},
+	"CreatePublicContributionAttempt": {"method":"post","path":"/contribute/{publicId}"},
 	"CreateTheme": {"method":"post","path":"/orgs/{orgId}/themes"},
 	"CreateVerificationClient": {"method":"post","path":"/admin/verification-clients"},
 	"CreateVerificationSession": {"method":"post","path":"/verifications/sessions"},
@@ -74,8 +79,10 @@ export const ROUTES = {
 	"GetProvider": {"method":"get","path":"/providers/{providerId}"},
 	"GetProviderBySlug": {"method":"get","path":"/providers/{providerId}/{slug}"},
 	"GetProviderVersion": {"method":"get","path":"/providers/{providerId}/versions/{version}"},
+	"GetPublicContributionCampaign": {"method":"get","path":"/contribute/{publicId}"},
 	"GetTheme": {"method":"get","path":"/orgs/{orgId}/themes/{themeId}"},
 	"GetUser": {"method":"get","path":"/users/{userId}"},
+	"GetVerificationFunnel": {"method":"get","path":"/orgs/{orgId}/verification-funnel"},
 	"GetVerificationRecipe": {"method":"get","path":"/verifications/sessions/{sessionId}/recipe"},
 	"GetVerificationResult": {"method":"get","path":"/verifications/sessions/{sessionId}/result"},
 	"GetVerificationSession": {"method":"get","path":"/verifications/sessions/{sessionId}"},
@@ -92,6 +99,7 @@ export const ROUTES = {
 	"ListOrgTokens": {"method":"get","path":"/orgs/{orgId}/token"},
 	"ListOrgTransactions": {"method":"get","path":"/orgs/{orgId}/billing/transactions"},
 	"ListOrgVerificationSessions": {"method":"get","path":"/orgs/{orgId}/sessions"},
+	"ListProviderContributionCampaigns": {"method":"get","path":"/providers/{providerId}/contributions"},
 	"ListProviderVersions": {"method":"get","path":"/providers/{providerId}/versions"},
 	"ListSessionCallbackKeys": {"method":"get","path":"/verifications/sessions/{sessionId}/callback-keys"},
 	"ListStaffMembers": {"method":"get","path":"/admin/staff"},
@@ -103,6 +111,7 @@ export const ROUTES = {
 	"MakePrivate": {"method":"post","path":"/providers/{providerId}/make-private"},
 	"OpenApiSpec": {"method":"get","path":"/openapi.yaml"},
 	"OrgInvitePage": {"method":"get","path":"/orgs/{orgId}/invite"},
+	"PatchVerificationClaimant": {"method":"patch","path":"/verifications/sessions/{sessionId}/claimant"},
 	"ProviderPreviewImage": {"method":"get","path":"/providers/{providerId}/preview.png"},
 	"Providers": {"method":"get","path":"/providers"},
 	"PublishProviderVersion": {"method":"post","path":"/providers/{providerId}/versions/{version}/publish"},
@@ -122,9 +131,10 @@ export const ROUTES = {
 	"Robots": {"method":"get","path":"/robots.txt"},
 	"SearchOrgMembers": {"method":"get","path":"/orgs/{orgId}/members"},
 	"SetDefaultBillingPlan": {"method":"post","path":"/admin/billing/plans/{planId}/default"},
-	"SetOrgCreditGrace": {"method":"post","path":"/admin/orgs/{orgId}/credits/grace"},
-	"SetOrgGrace": {"method":"post","path":"/admin/orgs/{orgId}/billing/grace"},
+	"SetOrgCreditAllowance": {"method":"post","path":"/admin/orgs/{orgId}/credits/allowance"},
 	"SetOrgKeypair": {"method":"put","path":"/orgs/{orgId}/keypair"},
+	"SetOrgPaymentAllowance": {"method":"post","path":"/admin/orgs/{orgId}/billing/allowance"},
+	"SetProviderContributionCampaignStatus": {"method":"post","path":"/providers/{providerId}/contributions/{campaignId}"},
 	"SetupBillingPlan": {"method":"post","path":"/admin/billing/plans/setup"},
 	"SetupProviderCreate": {"method":"post","path":"/providers/setup"},
 	"SiteAiProvider": {"method":"post","path":"/site/{domain}/ai-provider"},
@@ -140,6 +150,7 @@ export const ROUTES = {
 	"StripeWebhook": {"method":"post","path":"/billing/stripe/webhook"},
 	"SubmitConsent": {"method":"post","path":"/oauth/consent"},
 	"SubmitProviderVersionForReview": {"method":"post","path":"/providers/{providerId}/versions/{version}/review"},
+	"SubmitPublicContributionFeedback": {"method":"post","path":"/contribute/{publicId}/feedback"},
 	"SubmitVerificationResult": {"method":"post","path":"/verifications/sessions/{sessionId}/result"},
 	"TransferProvider": {"method":"post","path":"/providers/{providerId}/transfer"},
 	"UpdateBillingPlan": {"method":"put","path":"/admin/billing/plans/{planId}"},
@@ -147,6 +158,7 @@ export const ROUTES = {
 	"UpdateOrgIcon": {"method":"put","path":"/orgs/{orgId}/icon"},
 	"UpdateOrgMember": {"method":"patch","path":"/orgs/{orgId}/members/{memberId}"},
 	"UpdateProvider": {"method":"patch","path":"/providers/{providerId}"},
+	"UpdateProviderContributionCampaign": {"method":"patch","path":"/providers/{providerId}/contributions/{campaignId}"},
 	"UpdateProviderVersion": {"method":"patch","path":"/providers/{providerId}/versions/{version}"},
 	"UpdateTheme": {"method":"patch","path":"/orgs/{orgId}/themes/{themeId}"},
 	"UpdateVerificationClient": {"method":"put","path":"/admin/verification-clients/{clientId}"},