@reclaimprotocol/client 0.1.29 → 0.1.32

package/lib/types/openapi.gen.d.ts

@@ -261,27 +261,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/site/{domain}/ai-provider": {
+    "/discover/teach": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
-        put?: never;
         /**
-         * Author an AI (llm) provider and go to its build screen
-         * @description Creates an `llm`-verification provider under an organization the signed-in member owns (their personal org by default), seeded with an extraction prompt for the selected/missing data points (and carrying the working response matches from the resolved structured providers). If `fromProviderId` is an editable draft the viewer owns, it versions THAT instead. Returns the build page's AI dialog body (the editable prompt + "Try with AI"). HTML / HTMX fragment.
+         * “Teach our agent” instructions for a missing website / data point
+         * @description Returns the "Teach our agent" panel shown when a website or data point a user wants does not exist yet: steps to install the Reclaim MCP server plus a ready-to-copy prompt, templated with the requested `domain` and (optionally) `dataPoint`, that instructs an agent to author the missing provider. HTML / HTMX only (a dialog fragment).
          */
-        post: operations["SiteAiProvider"];
+        get: operations["DiscoverTeachAgent"];
+        put?: never;
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/site/{domain}/try-ai": {
+    "/discover/agent-wizard": {
         parameters: {
             query?: never;
             header?: never;
@@ -291,30 +291,10 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Mint a SANDBOX test session for an AI (llm) provider
-         * @description Mints a sandbox verification session for the given AI provider's draft and opens it in the verification client. An edited `prompt` in the body is saved as a new draft build first (the "edit prompt / try again" loop). Requires a signed-in member.
-         */
-        post: operations["SiteTryAi"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/discover/teach": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * “Teach our agent” instructions for a missing website / data point
-         * @description Returns the "Teach our agent" panel shown when a website or data point a user wants does not exist yet: steps to install the Reclaim MCP server plus a ready-to-copy prompt, templated with the requested `domain` and (optionally) `dataPoint`, that instructs an agent to author the missing provider. HTML / HTMX only (a dialog fragment).
+         * Setup and prompt for the coding agent picked in the wizard
+         * @description Returns the last step of the "Build with an AI coding agent" wizard for the picked `agent`: how to attach the Reclaim MCP server, and the `basePrompt` with the optional `building` description appended. HTML / HTMX only (a fragment swapped into the open wizard).
          */
-        get: operations["DiscoverTeachAgent"];
-        put?: never;
-        post?: never;
+        post: operations["DiscoverAgentWizard"];
         delete?: never;
         options?: never;
         head?: never;
@@ -352,7 +332,7 @@ export interface paths {
         };
         /**
          * List the verifiable data points on a website
-         * @description The data points existing providers can prove on a website — the menu to pick from before `GET /discover/resolve`. Optionally filter by `q`.
+         * @description The data points existing providers can prove on a website — the menu to pick from before discover_resolve. Optionally filter by `q`.
          */
         get: operations["DiscoverDataPoints"];
         put?: never;
@@ -509,7 +489,7 @@ export interface paths {
         };
         /**
          * Pending review queue (admin-only)
-         * @description Admin only. Lists all provider versions currently awaiting review (branch = 'in_review'). Use DecideProviderVersionReview to approve or reject each version.
+         * @description Admin only. Lists all provider versions currently awaiting review (branch = 'in_review'). Use decide_provider_version_review to approve or reject each version.
          */
         get: operations["AdminReviews"];
         put?: never;
@@ -529,7 +509,7 @@ export interface paths {
         };
         /**
          * Explore verification sessions (admin-only)
-         * @description Admin only. Search verification sessions across all organizations — filter by `sessionId` (prefix match, at least 5 characters), `providerId`, `claimantClientId`, `orgId` (all exact match), `status`, and a `createdAfter`/`createdBefore` time range. Rows link to the org-scoped session detail page (admins can open any org's pages). Capped at 100, newest first.
+         * @description Admin only. Search verification sessions across all organizations — filter by `sessionId` (prefix match, at least 5 characters), `providerId` (id or slug), `claimantClientId`, `orgId` (all exact match), `status`, and a `createdAfter`/`createdBefore` time range. Rows link to the org-scoped session detail page (admins can open any org's pages). Newest first, 50 per page, with opaque cursor pagination.
          */
         get: operations["AdminSessions"];
         put?: never;
@@ -540,6 +520,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/analytics": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Usage, session, and revenue analytics (admin-only)
+         * @description Admin only. Aggregates across every organization over a date window: session outcomes by UTC day, device category, and claimant country; demand per provider, money in by month, and per-org consumption against the plan allowance (including closed periods, which the org-scoped usage endpoint never returns). Defaults to the last 30 days; narrow to one org with `orgId`.
+         */
+        get: operations["AdminAnalytics"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/callback-dlq": {
         parameters: {
             query?: never;
@@ -865,7 +865,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/admin/verification-clients": {
+    "/admin/feature-flags": {
         parameters: {
             query?: never;
             header?: never;
@@ -873,23 +873,23 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Registered verification clients (admin-only)
-         * @description Admin only. The registry of first-party callers (app SDK, web portals, zkFetch) allowed to drive verification sessions, each with its own token and quota pool.
+         * Verification Client feature flags (admin-only)
+         * @description Lists the current Builder-mode Verification Client flags and their ordered targeting rules. Only Reclaim staff can read or change this control plane. Verification Clients receive only the immutable, resolved snapshot stored on their session.
          */
-        get: operations["AdminVerificationClients"];
+        get: operations["AdminFeatureFlags"];
         put?: never;
         /**
-         * Register a verification client (admin-only)
-         * @description Admin only. Registers a Verification Client. The returned client UUID is the Builder-mode identity sent as `x-reclaim-vc-id` and is bound to sessions selected by this client's URL. Token fields in this response are retained only for legacy-client compatibility and are not used by Builder mode.
+         * Create a Verification Client feature flag (admin-only)
+         * @description Creates one typed flag and its complete ordered rule set. The change becomes available to newly created sessions immediately and creates an immutable audit revision. Existing session snapshots don't change.
          */
-        post: operations["CreateVerificationClient"];
+        post: operations["CreateFeatureFlag"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/admin/verification-clients/{clientId}/tokens": {
+    "/admin/feature-flags/{flagKey}": {
         parameters: {
             query?: never;
             header?: never;
@@ -897,33 +897,57 @@ export interface paths {
             cookie?: never;
         };
         get?: never;
-        put?: never;
         /**
-         * Issue a legacy verification-client token (admin)
-         * @description Legacy compatibility endpoint. Builder-mode clients use the registered UUID in `x-reclaim-vc-id` and do not need this token. Existing legacy clients may continue to rotate their credentials without affecting Builder-mode sessions.
+         * Replace a Verification Client feature flag (admin-only)
+         * @description Atomically replaces the definition and complete ordered rule set, increments the flag version, and records an immutable audit revision. Archive a flag to omit it from future session snapshots. Existing snapshots remain unchanged.
          */
-        post: operations["IssueVerificationClientToken"];
+        put: operations["UpdateFeatureFlag"];
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/admin/verification-clients/{clientId}/tokens/{tokenId}": {
+    "/admin/feature-flags/{flagKey}/revisions": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
+        /**
+         * Feature flag revision history (admin-only)
+         * @description Returns immutable snapshots newest first. The history is retained even after a flag is archived and is never served to Verification Clients.
+         */
+        get: operations["ListFeatureFlagRevisions"];
         put?: never;
         post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/verification-clients": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Registered verification clients (admin-only)
+         * @description Admin only. The registry of claimant-facing Verification Clients allowed to drive verification sessions. Builder identifies a client by its registered launch URL and assigns its quota pool.
+         */
+        get: operations["AdminVerificationClients"];
+        put?: never;
         /**
-         * Revoke one legacy verification-client token (admin-only)
-         * @description Legacy compatibility endpoint. Revokes one legacy token; this does not change the registered client's Builder-mode UUID or any session bound to that UUID.
+         * Register a verification client (admin-only)
+         * @description Admin only. Registers a Verification Client. The returned client UUID is the Builder-mode identity sent as `x-reclaim-vc-id` and is bound to sessions selected by this client's URL. Builder signs every result; Verification Clients don't have credentials or signing keys.
          */
-        delete: operations["RevokeVerificationClientToken"];
+        post: operations["CreateVerificationClient"];
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
@@ -939,7 +963,7 @@ export interface paths {
         get?: never;
         /**
          * Update a verification client (admin-only)
-         * @description Admin only. Updates the client's quota pool, claimant-facing base URL, exact trusted JWS `issuer`, or registered `jwksUri`. The issuer and JWKS URL are separate from the claimant URL. Consumers must use the registered issuer and JWKS URL, never values supplied in a result. Omitted fields keep their current values.
+         * @description Admin only. Updates the client's quota pool or claimant-facing base URL. Omitted fields keep their current values.
          */
         put: operations["UpdateVerificationClient"];
         post?: never;
@@ -949,27 +973,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/admin/verification-clients/{clientId}/keys": {
+    "/admin/site-banners": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
-        put?: never;
         /**
-         * Register a signing key for a verification client (admin-only)
-         * @description Admin only. Registers the PUBLIC half of the client's ES256K signing keypair — the private key never leaves the client. The key's ETH address becomes the JWS `kid` and is published in the builder's `/.well-known/jwks.json`, so consumers can verify the client's result signatures. A client may hold several active keys (zero-downtime rotation).
+         * Site-wide top banners editor (admin-only)
+         * @description Admin only. The announcement bar and scrolling ticker shown above/below the dashboard header on every non-claimant-facing page — never on a verification or share page. Returns the raw admin-authored HTML source (not the rendered subset): this is the editor's own read, and must round-trip the exact stored source, or every save would re-encode and progressively corrupt the content. There is no public equivalent of this endpoint — Builder renders these banners server-side when composing the dashboard layout.
          */
-        post: operations["AddVerificationClientKey"];
+        get: operations["AdminSiteBanners"];
+        put?: never;
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/admin/verification-clients/{clientId}/keys/{keyId}": {
+    "/admin/announcement-bar": {
         parameters: {
             query?: never;
             header?: never;
@@ -977,13 +1001,33 @@ export interface paths {
             cookie?: never;
         };
         get?: never;
-        put?: never;
+        /**
+         * Save the announcement bar (admin-only)
+         * @description Full replacement of the singleton announcement bar row. Disabled by default; saving does not itself enable it — `enabled` is just another field in the replacement. `linkUrl`, when set, must be an `https:` URL: the whole bar becomes a clickable link.
+         */
+        put: operations["UpdateAnnouncementBar"];
         post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/scrolling-banner": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
         /**
-         * Revoke one verification-client signing key (admin-only)
-         * @description Admin only. Revokes a single signing key by id; its kid drops out of the aggregated JWKS immediately while the client's other keys keep working.
+         * Save the scrolling ticker (admin-only)
+         * @description Full replacement of the singleton scrolling-ticker row. An enabled ticker with zero `items` renders nothing on the dashboard — it does not show an empty coloured strip.
          */
-        delete: operations["RevokeVerificationClientKey"];
+        put: operations["UpdateScrollingBanner"];
+        post?: never;
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
@@ -1000,7 +1044,7 @@ export interface paths {
         put?: never;
         /**
          * Transfer a provider to a different workspace
-         * @description Admin-only. Moves the provider's `orgId` to the supplied workspace; preserves slug, versions, members. SQL function `builder.transfer_provider` enforces the admin gate and target existence atomically.
+         * @description Admin-only. Moves a provider to a different organization, preserving its slug, versions, and members. Fails if the target organization does not exist.
          */
         post: operations["TransferProvider"];
         delete?: never;
@@ -1046,6 +1090,57 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/share/{client}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Uniform claimant-facing share route for a Verification Client
+         * @description One `{origin}/share/{client}` shape for all six built-in Verification Clients' registered `uri` (see `register_verification_client` / `builtin-clients.ts`'s `clientUrl()`) — an admin table with one consistent scheme instead of a mix of real pages and bare attribution labels. What each branch actually does differs, because the six clients are not alike:
+         *     - `builder` — `302`s to `/v/{sessionId}` (preserving `api`/`diag`).
+         *       Builder's own remote-browser page is unchanged; this is one extra
+         *       redirect hop in front of it, accepted for registry uniformity.
+         *     - `verifier-app` — the QR / App Clip / deep-link / store-fallback
+         *       launcher page (what `GET /s` served before this route existed).
+         *       The session id lives in the QUERY, not the path:
+         *       `ReclaimVerificationLink.fromUri` (reclaim-inapp-sdk
+         *       `lib/src/data/verification_mode.dart`) requires a `sessionId` query
+         *       parameter and the app reads this URL off the clipboard after a
+         *       deferred install, so a path-form id would pass its first gate and
+         *       throw at the second. Renders instantly with no DB round trip — its
+         *       client script imports `@reclaimprotocol/client/launch` and runs the
+         *       same device-detection + App Clip / deep-link / QR launcher any
+         *       consumer's own page would.
+         *     - `portals` — `302`s to the portal (`?api=2&sessionId=…` appended),
+         *       the same computation a consumer's own page would run through the
+         *       launcher, done server-side instead.
+         *     - `reclaim-browser-extension` — a handoff page: probes for the
+         *       extension via `postMessage` and starts the verification in it.
+         *       Terminal state is generic ("submitted, close this tab") — this page
+         *       cannot poll for the real outcome, which still only arrives at the
+         *       consumer's callback.
+         *     - `inapp-sdk` — a static informational page. This URL is never
+         *       fetched by a real integration (the add-to-app module and in-app SDK
+         *       read `api`/`sessionId`/`diag` off the query string as an opaque
+         *       carrier, never the path/host), so this exists only so a stray GET
+         *       doesn't 404.
+         *     - `zkfetch` — a static informational page. zkFetch has no claimant
+         *       step; nothing ever redirects a browser here by design.
+         *
+         *     Sets `Referrer-Policy: no-referrer`, so a `sessionId` never rides along in a `Referer` header to wherever a client eventually redirects.
+         */
+        get: operations["SharePage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v/{sessionId}": {
         parameters: {
             query?: never;
@@ -1199,7 +1294,7 @@ export interface paths {
         };
         /**
          * JWKS for verifying signed verification results
-         * @description JSON Web Key Set (RFC 7517) exposing the public keys that sign verification result JWS payloads (ES256K / secp256k1). Consumers fetch this to verify a delivered result. `kid` is the signer's ETH address. Result keys carry a namespaced purpose and Verification Client owner. The top-level `x-reclaim-attestors` extension lists trusted EIP-191 attestor signer addresses; an address is a public-key hash, not a JWK. Aggregates the in-process Verification Client signing key (`VC_SIGNING_PRIVATE_KEY`) with every registered verification client's active signing keys, so results signed by the builder or by any registered client verify against this one endpoint.
+         * @description JSON Web Key Set (RFC 7517) exposing the public keys that sign verification result JWS payloads (ES256K / secp256k1). Consumers fetch this to verify a delivered result. `kid` is the signer's ETH address. Result keys carry a namespaced Builder-managed purpose. The top-level `x-reclaim-attestors` extension lists trusted EIP-191 attestor signer addresses; an address is a public-key hash, not a JWK. The top-level `x-reclaim-attestor-image-digests` extension lists the trusted Confidential Space attestor container images. The Reclaim extensions are application-specific JWK Set members allowed by RFC 7517 section 5; generic JWKS consumers ignore members they don't know. Publishes Builder's managed result-signing key (`BUILDER_SIGNING_PRIVATE_KEY`). Claimant-facing Verification Clients never hold result-signing keys.
          */
         get: operations["JwksJson"];
         put?: never;
@@ -1210,6 +1305,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/.well-known/apple-app-site-association": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Apple App Site Association for universal links
+         * @description Apple's file (deliberately no `.json` extension — Apple's CDN requires exactly this path) letting the Reclaim Verifier app and its App Clip claim `/s` universal links under this origin. Apple's CDN fetches it directly over HTTPS, unauthenticated, and never follows a redirect. The app ids are configurable (`APPLE_APP_ID`, `APPLE_APP_CLIP_ID`) so a sandbox Builder on another origin can publish its own, or none. Only a domain the shipped app actually lists in its entitlements (`applinks:` / `appclips:`) can ever claim a link this way, whatever this document says.
+         */
+        get: operations["AppleAppSiteAssociation"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/.well-known/assetlinks.json": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Android Digital Asset Links for app links
+         * @description Digital Asset Links file Android's Package Manager fetches over HTTPS to verify the Reclaim Verifier app's `autoVerify` intent filter for this host (path `/s`). The package name and signing-certificate fingerprints are configurable (`ANDROID_PACKAGE_NAME`, `ANDROID_SIGNING_CERT_FINGERPRINTS`) so a sandbox Builder on another origin can publish its own, or none. Only a domain the shipped app's manifest actually declares can ever claim a link this way, whatever this document says.
+         */
+        get: operations["AssetLinksJson"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/openapi.yaml": {
         parameters: {
             query?: never;
@@ -2042,7 +2177,7 @@ export interface paths {
         put?: never;
         /**
          * Create a provider contribution campaign
-         * @description Create a draft public-contribution campaign. A campaign stays private until its requirements are versioned and a maintainer opens it.
+         * @description Create a draft public-contribution campaign. A campaign stays private until its requirements are versioned and a maintainer opens it. A provider has at most one campaign; creating a second returns 409.
          */
         post: operations["CreateProviderContributionCampaign"];
         delete?: never;
@@ -2106,7 +2241,7 @@ export interface paths {
         put?: never;
         /**
          * Add a contribution review comment
-         * @description Add an append-only maintainer comment to the review history.
+         * @description Add an append-only comment to the review history. Comments default to `PUBLIC` visibility and cannot contain links, email addresses, long numbers, identifiers, tokens, or credentials.
          */
         post: operations["AddProviderContributionComment"];
         delete?: never;
@@ -2473,6 +2608,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/orgs/{orgId}/providers/used": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the providers an organization uses
+         * @description Returns the providers with at least one verification session in the organization, ordered by session count then most recent use, one page at a time. Optionally filter by `q`. Caller must be an active member of the org or present its org token. Opaque cursor pagination.
+         */
+        get: operations["ListOrgUsedProviders"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/orgs/{orgId}/sessions": {
         parameters: {
             query?: never;
@@ -2482,7 +2637,7 @@ export interface paths {
         };
         /**
          * List an organization's verification sessions
-         * @description Returns verification sessions created under the organization, newest first. Optionally filter by `sessionId` (prefix match, at least 5 characters), `providerId`, `status`, `resolvedVersion`, `claimantClientId`, and a `createdAfter`/`createdBefore` time range. Caller must be an active member of the org. Opaque cursor pagination.
+         * @description Returns verification sessions created under the organization, newest first. Optionally filter by `sessionId` (prefix match, at least 5 characters), `providerId` (id or slug), `status`, `resolvedVersion`, `claimantClientId`, and a `createdAfter`/`createdBefore` time range. Caller must be an active member of the org. Opaque cursor pagination.
          *
          *     Note: `status` filters on the stored column. A session that has passed `expiresAt` but has not yet been swept is reported as `expired` in its body while still stored as `pending`, so `status=expired` may not match such sessions until the sweep runs.
          */
@@ -2515,6 +2670,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/orgs/{orgId}/sessions/{sessionId}/retry-callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Retry this session's failed callback deliveries
+         * @description Re-enqueues every callback delivery for this session that hasn't succeeded, including ones already dead-lettered. The caller must be an active **OWNER** of the organization that owns the session — re-driving a delivery re-sends consumer data to the subscription's callback URL, so it isn't offered to every member who can read the page. Do this once the callback endpoint answers 2xx again; retrying while it's still failing only walks the delivery back through its retry schedule. Delivery is idempotent — an already-delivered row is skipped, so a repeated retry can't double-send. Returns to the session page so the deliveries list reflects the re-enqueued rows.
+         */
+        post: operations["RetryOrgSessionCallback"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/orgs/{orgId}/verification-funnel": {
         parameters: {
             query?: never;
@@ -2535,6 +2710,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/orgs/{orgId}/verification-analytics": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verification outcomes by day, device, and country
+         * @description Organization-scoped creation cohorts in UTC. Outcomes are current at query time. Unknown device and country values have their own buckets.
+         */
+        get: operations["GetOrgVerificationAnalytics"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/verifications/sessions": {
         parameters: {
             query?: never;
@@ -2580,9 +2775,9 @@ export interface paths {
         };
         /**
          * Get a verification session
-         * @description Returns the session. Authenticated by the consumer's `OrgToken` (or the
-         *     session-bound Verification Client id); the resolved org must match the
-         *     session's.
+         * @description Returns the session to its consumer. The `OrgToken` must resolve to the
+         *     session's organization. Claimant-facing Verification Clients use the
+         *     session-bound `/bootstrap` endpoint instead.
          *
          *     Reading `status`:
          *     - `pending` — created, not yet finished; the end-user can still
@@ -2619,7 +2814,7 @@ export interface paths {
         };
         /**
          * Get the resolved provider recipes for a session
-         * @description Returns the session's resolved provider versions' recipes (`initialUrl` + `requests` per provider), in run order — what the Verification Client needs to run the session (each provider sequentially in one browser session). Authorized for the Verification Client (`x-reclaim-vc-id`) or the session creator (authenticated by the consumer's `OrgToken`; the resolved org must match the session), so it works regardless of the provider's visibility (unlike `GetProvider`, which 404s on PRIVATE providers for non-members).
+         * @description Returns the session's resolved provider versions' recipes (`initialUrl` + `requests` per provider), in run order. The consumer's `OrgToken` must resolve to the session's organization. Claimant-facing Verification Clients use `/bootstrap`, which returns the session and recipes together.
          */
         get: operations["GetVerificationRecipe"];
         put?: never;
@@ -2630,6 +2825,88 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/verifications/sessions/{sessionId}/bootstrap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Bootstrap a Builder-mode Verification Client
+         * @description Returns the immutable session snapshot and its resolved provider recipes in one request. This is the entry point for claimant-facing `api=2` clients. It is served directly by Builder; legacy clients keep using the legacy backend. The registered `x-reclaim-vc-id` must match the client selected when the session was created.
+         */
+        get: operations["BootstrapVerificationClient"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verifications/sessions/{sessionId}/runtime-config": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Report client inputs and read the session's feature configuration
+         * @description Binds the inputs a Verification Client only learns at runtime — the claimant it is serving, and its own build — and returns this session's feature configuration.
+         *     Call it once, after bootstrap, when the claimant is actually in front of the client. Feature flag rules may target a client version or roll out to a percentage of claimants; neither can be evaluated when the session is created, because neither exists yet.
+         *     Both inputs are first-write-wins, and the configuration is recomputed only when one of them actually changes. Calling again with the same inputs returns the stored document unchanged, so this is safe to retry and a flag edited in the meantime cannot alter a verification already under way. The registered `x-reclaim-vc-id` must match the client selected when the session was created.
+         */
+        post: operations["ResolveVerificationRuntimeConfig"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verifications/sessions/{sessionId}/attestor-auth": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create session-bound attestor authorization
+         * @description Creates the legacy-compatible attestor authorization for this Builder session when `ATTESTOR_AUTH_PRIVATE_KEY` is configured. The request accepts no application secret or provider signature. An empty response means attestor authorization is disabled for this deployment.
+         */
+        post: operations["CreateVerificationAttestorAuth"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verifications/sessions/{sessionId}/results": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Submit exact proofs as a managed Builder result
+         * @description Accepts exact `Proof` objects from a claimant-facing `api=2` client. Builder atomically records the first terminal outcome, checks it against the submitted status, signs the outer Builder JWS with its managed key, optionally encrypts it for matching callback subscriptions, and enqueues delivery. Retrying the same terminal outcome is idempotent. This is the only result-submission endpoint; Verification Clients never receive signing or encryption keys.
+         */
+        post: operations["SubmitVerificationClientResult"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/verifications/sessions/{sessionId}/tee-nonce": {
         parameters: {
             query?: never;
@@ -2674,9 +2951,8 @@ export interface paths {
         };
         /**
          * Get the event log for a session
-         * @description Returns the append-only event log. Readable by the Verification Client
-         *     (`x-reclaim-vc-id`) or the session creator (authenticated by the consumer's
-         *     `OrgToken`; the resolved org must match the session).
+         * @description Returns the append-only event log to the session creator. The
+         *     consumer's `OrgToken` must resolve to the session's organization.
          *
          *     This log is the primary tool for diagnosing a stuck or failed session.
          *     A healthy run proceeds through this lifecycle (in order):
@@ -2684,8 +2960,9 @@ export interface paths {
          *     `session_pending` → `verification_client_opened` →
          *     `verification_client_ready` → `request_matched` →
          *     `request_claim_created` → `request_claim_completed` → terminal
-         *     (`verification_success` | `verification_rejected` | `verification_error`),
-         *     or `session_expired` if `expiresAt` passes first.
+         *     (`verification_success` | `verification_rejected` |
+         *     `verification_error` | `verification_cancelled`), or
+         *     `session_expired` if `expiresAt` passes first.
          *
          *     Read the gaps to locate where the flow stalled:
          *     - no `verification_client_opened` → the end-user never opened the link.
@@ -2730,7 +3007,7 @@ export interface paths {
         head?: never;
         /**
          * Update claimant details
-         * @description Updates the session's latest diagnostic claimant and device snapshot. The Builder captures the request's Reclaim client headers, HTTP user agent, and peer IP separately from client-reported values. These details never affect proof validity. The x-reclaim-vc-id must match the registered Verification Client selected at session creation.
+         * @description Updates the session's latest diagnostic claimant and device snapshot. The Builder captures the request's Reclaim client headers, HTTP user agent, and peer IP separately from client-reported values. These details never affect proof validity. The x-reclaim-vc-id must match the registered Verification Client selected at session creation. `claimantDetails.network` (the claimant's IP addresses) is stored only when the session's `diagnostics` field is true — see ClaimantDetails.network.
          */
         patch: operations["PatchVerificationClaimant"];
         trace?: never;
@@ -2750,8 +3027,8 @@ export interface paths {
          *     (or the agent) answer "did my callback arrive, and if not, why?"
          *     without org-dashboard access. Only meaningful after the session
          *     reaches a terminal status (no deliveries exist before then). Auth
-         *     mirrors the events GET: the session-bound Verification Client id, or the
-         *     consumer's `OrgToken` (the resolved org must match the session).
+         *     requires the consumer's `OrgToken`; the resolved organization must
+         *     match the session.
          *
          *     Reading `deliveryStatus` per entry:
          *     - `delivered` — the callback POST succeeded; nothing to do.
@@ -2774,7 +3051,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/verifications/sessions/{sessionId}/callback-keys": {
+    "/verifications/sessions/{sessionId}/result": {
         parameters: {
             query?: never;
             header?: never;
@@ -2782,10 +3059,10 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List callback encryption keys for a session
-         * @description Used by the Verification Client (x-reclaim-vc-id) after the terminal event: returns the session org's callback subscriptions that subscribe to that terminal event. Each item carries the org's `publicKeyJwk` (secp256k1) to ECIES-encrypt the result to when the org's `canEncryptResult` is enabled, or none (deliver plaintext).
+         * Get the stored encrypted result(s) for a session
+         * @description Returns the stored Builder-signed result payloads for this session — one item per callback subscription. Readable only by the consumer that created the session. The consumer's `OrgToken` must resolve to the session's organization. A pull-based companion to push delivery: when the organization enables encryption, Builder returns an ECIES ciphertext (base64url) that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted. Treat every returned payload as untrusted until `verifyResultFull` succeeds with the Builder issuer and JWKS URL.
          */
-        get: operations["ListSessionCallbackKeys"];
+        get: operations["GetVerificationResult"];
         put?: never;
         post?: never;
         delete?: never;
@@ -2794,31 +3071,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/verifications/sessions/{sessionId}/result": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get the stored encrypted result(s) for a session
-         * @description Returns the stored result payload(s) the Verification Client stored for this session — one item per callback subscription. Readable by the Verification Client (x-reclaim-vc-id) or the consumer who created the session (authenticated by the consumer's `OrgToken`; the resolved org must match). A pull-based companion to the push delivery: when the org has an encryption credential the Builder relays an ECIES ciphertext (base64url) that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted. Treat every returned payload as untrusted until `verifyResultFull` succeeds with the session's registered issuer and JWKS URL.
-         */
-        get: operations["GetVerificationResult"];
-        put?: never;
-        /**
-         * Submit the signed, encrypted verification result
-         * @description Used by the Verification Client (x-reclaim-vc-id) to submit the result after a terminal event. The VC signs the JWS and, when the org's `canEncryptResult` is enabled, ECIES-encrypts it to the org's eth public key (from the callback-keys endpoint); it submits one payload per subscription. The Builder stores each payload, enqueues it for the delivery worker (retry → DLQ), and never sees the plaintext. The Verification Client does not contact the Consumer.
-         */
-        post: operations["SubmitVerificationResult"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/verifications/sessions/{sessionId}/retry-callback": {
+    "/verifications/sessions/{sessionId}/retry-callback": {
         parameters: {
             query?: never;
             header?: never;
@@ -2878,6 +3131,52 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/fetch/authorizations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Authorize a zkFetch call
+         * @description Mints a short-lived attestor authorization for a zkFetch caller and
+         *     charges the organization's `ZKFETCH` quota pool for it. Authenticated
+         *     by the consumer's `OrgToken`. Builder does not perform the fetch —
+         *     the caller opens its own attestor connection with the returned
+         *     token, fetches, and proves, exactly as `@reclaimprotocol/zk-fetch`
+         *     does today; Builder never sees the request beyond `host`.
+         *
+         *         curl -X POST $BASE/fetch/authorizations \
+         *           -H "Authorization: Bearer $ORG_TOKEN" \
+         *           -H 'Content-Type: application/json' \
+         *           -d '{"host":"api.github.com"}'
+         *
+         *     The quota deduction runs BEFORE anything is minted, so an org that
+         *     has exhausted its `ZKFETCH` pool is refused (`402`/`429`) and never
+         *     receives a usable token.
+         *
+         *     `host` is recorded for observability only — the minted token is
+         *     **not** restricted to it and today authorizes a proof against any
+         *     host, exactly like every other Builder-issued attestor token. Host
+         *     enforcement, if it ships, will be a server-side change rather than a
+         *     breaking one.
+         *
+         *     `expiresAt` is always about ten seconds after issuance. The attestor
+         *     checks expiry only once, at the auth handshake — never again for the
+         *     life of the connection — so this window only has to cover Builder
+         *     issuing the token and the caller opening its attestor connection; the
+         *     fetch and proof that follow are unaffected however long they take.
+         */
+        post: operations["CreateFetchAuthorization"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export interface webhooks {
     verificationResult: {
@@ -2965,6 +3264,10 @@ export interface components {
         ProviderID: string;
         /** Format: uuid */
         OrgID: string;
+        /** @description A verification client id used as a filter. Hyphens are ignored. */
+        VerificationClientIDFilter: string;
+        /** @description An organization id used as a filter. Hyphens are ignored, so it matches with or without them; an id that matches no organization returns nothing. */
+        OrgIDFilter: string;
         /** Format: uuid */
         ThemeID: string;
         /**
@@ -2999,13 +3302,29 @@ export interface components {
             readonly apiUrl?: string;
             expiresAt: components["schemas"]["Timestamp"];
         };
+        FetchAuthorizationRequest: {
+            /**
+             * Format: hostname
+             * @description Host the caller intends to fetch from, for example `api.github.com`. Recorded for observability only — see `POST /fetch/authorizations`.
+             */
+            host: string;
+        };
+        /** @description A short-lived attestor authorization for one zkFetch call. */
+        FetchAuthorization: {
+            /**
+             * Format: byte
+             * @description Base64-encoded legacy attestor authorization — the same form `POST /verifications/sessions/{sessionId}/attestor-auth` returns. Decode it back into the native `AuthenticationRequest` to open the attestor connection.
+             */
+            token: string;
+            expiresAt: components["schemas"]["Timestamp"];
+        };
         /**
          * Format: uuid
          * @description Stable id for a callback subscription.
          */
         SubscriptionID: string;
         /** @description Browser claimant snapshot produced by the built-in Verification Client. */
-        ReportClaimantRequest: components["schemas"]["ClaimantDetails"];
+        ReportClaimantRequest: components["schemas"]["ClaimantDetailsRequest"];
         /**
          * @description Live-derived operating mode of an organization.
          *
@@ -3140,6 +3459,10 @@ export interface components {
              * @description Email the invite was sent to. Stable for the lifetime of the row; it is the natural identifier of the invitee before they have a `userId`.
              */
             email: string;
+            /** @description The member's name. Absent while the invite is `PENDING` for an unregistered email. */
+            name?: string;
+            /** @description Up to two capital letters from the name, or from the email when there is no name. */
+            initials: string;
             role: components["schemas"]["OrganizationMemberRole"];
             /**
              * @description - `PENDING`: invite issued, not yet accepted.
@@ -3628,7 +3951,7 @@ export interface components {
          */
         QuotaPool: "VERIFICATION" | "ZKFETCH";
         /**
-         * @description A plan's config for one pool. Synced from Stripe; `overageRate` + `stripeMeterId` are display-only (Stripe rates the actual charge).
+         * @description A plan's config for one pool. Synced from Stripe. `overageRate` and `stripeMeterId` are display-only (Stripe rates the actual charge); `stripeOveragePriceId` is load-bearing — it is the subscription item that makes the rating happen.
          * @example {
          *       "pool": "VERIFICATION",
          *       "includedLimit": 2000,
@@ -3651,6 +3974,8 @@ export interface components {
             /** @description Per-unit overuse charge (from Stripe); absent until priced. */
             overageRate?: number;
             stripeMeterId?: string;
+            /** @description The pool's metered Price. Every subscription for this plan carries it as an item — without it Stripe has nothing to rate the pool's usage against, so overage serves without ever billing. */
+            stripeOveragePriceId?: string;
         };
         /** @description Editable pool config for the plan editor. Rate + meter are authored as the pool's metered Price in Stripe, so they aren't set here. */
         PlanPoolInput: {
@@ -3667,6 +3992,10 @@ export interface components {
             pool: components["schemas"]["QuotaPool"];
             used: number;
             includedLimit: number;
+            /** @description Included uses left this period; never below zero. */
+            remaining: number;
+            /** @description Share of `includedLimit` used, rounded down and capped at 100. */
+            percentUsed: number;
             /** @description Effective additional uses allowed after a plan payment fails. */
             paymentFailureAllowance: number;
             /** @description Effective additional overage uses allowed after credits run out. */
@@ -3706,6 +4035,8 @@ export interface components {
             /** @description Number of periodUnit per cycle. */
             periodCount?: number;
             billingTiming: components["schemas"]["BillingTiming"];
+            /** @description Smallest prepaid credit top-up an org on this plan may buy, in the plan's currency. Overage is funded from credit, so the floor keeps a top-up worth more than the fee on it. Absent = no minimum. */
+            minCreditPurchase?: number;
             /** @description Contact-only lead tier — shown on the pricing page but not self-serve checkoutable; admins assign and bill it. Enterprise uses this. */
             contactOnly?: boolean;
             /**
@@ -3736,6 +4067,8 @@ export interface components {
             visibility?: components["schemas"]["EntityVisibility"];
             status?: components["schemas"]["EntityStatus"];
             billingTiming?: components["schemas"]["BillingTiming"];
+            /** @description Smallest prepaid credit top-up an org on this plan may buy, in the plan's currency. Overage is funded from credit, so the floor keeps a top-up worth more than the fee on it. Absent = no minimum. */
+            minCreditPurchase?: number;
             /** @description Contact-only lead tier — shown but not self-serve checkoutable. */
             contactOnly?: boolean;
             /**
@@ -3755,6 +4088,8 @@ export interface components {
             pools: components["schemas"]["PlanPoolInput"][];
             visibility?: components["schemas"]["EntityVisibility"];
             billingTiming?: components["schemas"]["BillingTiming"];
+            /** @description Smallest prepaid credit top-up an org on this plan may buy, in the plan's currency. Overage is funded from credit, so the floor keeps a top-up worth more than the fee on it. Absent = no minimum. */
+            minCreditPurchase?: number;
             contactOnly?: boolean;
             /** Format: uuid */
             orgId?: string;
@@ -3764,6 +4099,74 @@ export interface components {
             ctaUrl?: string;
             accentColor?: string;
         };
+        /** @description One end of a date window: either a calendar date (`2026-09-01`, read as UTC midnight) or a full ISO date-time. The date-only form is what a native `<input type="date">` submits, so `format: date-time` alone would reject every filter the dashboard's own form sends. */
+        DateWindowBound: string;
+        /** @description Cross-org aggregates for the admin analytics page, over the requested window. */
+        AdminAnalytics: {
+            /**
+             * Format: date-time
+             * @description Window start, inclusive — the resolved value, not the input.
+             */
+            from: string;
+            /**
+             * Format: date-time
+             * @description Window end, exclusive.
+             */
+            to: string;
+            orgId?: components["schemas"]["OrgID"];
+            /** @description Session outcomes over the window. */
+            sessions: {
+                total: number;
+                succeeded: number;
+                /** @description Still open — excluded from the success-rate denominator, since a session created a minute ago is not a failure. */
+                pending: number;
+                /** @description `rejected`, `error`, `cancelled`, or `expired`. */
+                failed: number;
+                /** @description Distinct orgs that started at least one session. */
+                activeOrgs: number;
+            };
+            /** @description Demand per provider, busiest first. A session requesting several providers counts once under each, so these totals sum to more than `sessions.total`. */
+            byProvider: {
+                /** Format: uuid */
+                providerId: string;
+                providerTitle: string;
+                total: number;
+                succeeded: number;
+                failed: number;
+            }[];
+            verifications: components["schemas"]["VerificationAnalytics"];
+            /** @description Money in by calendar month, newest first. One row per (month, currency) — currencies are never summed together. */
+            revenue: {
+                /** @description The calendar month in UTC (`2026-09`). Deliberately not a timestamp: a month is a bucket, and shipping an instant invites it to be re-read in another timezone and land in the month next door. */
+                month: string;
+                currency: string;
+                paid: number;
+                /** @description Stored positive (the table forbids negatives) and subtracted to reach `net`. */
+                refunded: number;
+                /** @description paid − refunded; may be negative in a refund-heavy month. */
+                net: number;
+                planPaid?: number;
+                creditsPaid?: number;
+                txCount: number;
+            }[];
+            /** @description Per-org consumption per billing period, heaviest first. Includes closed periods. A period is listed when it OVERLAPS the window, and its counters cover the whole period, not just the overlap. */
+            usage: {
+                orgId: components["schemas"]["OrgID"];
+                orgName: string;
+                planName: string;
+                /** Format: date-time */
+                periodStart: string;
+                /** Format: date-time */
+                periodEnd: string;
+                /** @description This is the org's currently open period. */
+                isActive: boolean;
+                pools: {
+                    pool: components["schemas"]["QuotaPool"];
+                    used: number;
+                    includedLimit: number;
+                }[];
+            }[];
+        };
         /** @description The org's consumption this billing period against its plan's allowances, per pool. */
         OrgUsage: {
             orgId: components["schemas"]["OrgID"];
@@ -3771,6 +4174,7 @@ export interface components {
             planId: string;
             /** @description Plan display name. */
             plan?: string;
+            planTerms?: components["schemas"]["PlanSnapshot"];
             pools: components["schemas"]["OrgPoolUsage"][];
             /** Format: date-time */
             periodStart: string;
@@ -3784,6 +4188,8 @@ export interface components {
             /** @description Credit left to spend. Floors at zero — once empty, the per-pool credit-exhaustion allowance governs overage access, and anything consumed past zero settles on the next Stripe invoice. */
             remaining: number;
             currency: string;
+            /** @description Smallest top-up this org's plan allows, in the same currency. Enforced by the credit checkout; absent = no minimum. */
+            minPurchase?: number;
             /** @description Spent since the last sync with Stripe. May exceed the synced balance while a credit-exhaustion allowance remains; the excess appears on the next invoice. */
             unbilledSpend?: number;
             /** @description Remaining incident allowances, reported separately per pool. */
@@ -3934,26 +4340,185 @@ export interface components {
             periodEnd?: string;
             note?: string;
         };
-        /** @description Legacy metadata for one live token of a verification client. Never includes the plaintext secret — only its display `last4`. Same shape as `OrgTokenMeta`: `createMetadata` (issuer + timestamp) plus a flat `lastUsedAt`. */
-        VerificationClientTokenMeta: {
+        /**
+         * @description The stored and returned JSON type of a feature flag value.
+         * @enum {string}
+         */
+        FeatureFlagValueType: "BOOLEAN" | "STRING" | "NUMBER" | "JSON";
+        /** @description A native JSON value. The value must match `valueType`. The admin form may send a string representation of a boolean, number, object, or array; Builder normalizes it before storage. JSON values are limited to 32 KiB after normalization. */
+        FeatureFlagInputValue: boolean | string | number | {
+            [key: string]: unknown;
+        } | unknown[];
+        /** @description One first-match rule. Every supplied selector is an AND condition. A provider selector scopes the rule to that provider's turn rather than to the whole session — see `providerId`. At least one selector or rollout percentage is required. */
+        VerificationFeatureFlagRuleInput: {
+            /** @description Lower numbers run first. Priorities are unique within a flag. */
+            priority: number;
+            description?: string;
+            value: components["schemas"]["FeatureFlagInputValue"];
+            /** Format: uuid */
+            verificationClientId?: string;
+            organizationId?: components["schemas"]["OrgID"];
+            /** @description Matches while this provider is the one being verified. The value lands in `providerValues[providerId]`, not in the session-wide `values`, so it does not leak to the session's other providers. */
+            providerId?: components["schemas"]["ProviderID"];
+            /** @description Requires providerId and matches only that exact resolved version. */
+            resolvedVersion?: string;
+            /** @description Matches only this exact Verification Client build, as the client reports itself. The value is self-asserted and unauthenticated, so use it to steer a rollout, never as a security gate. A rule using it matches nothing until the client reports its version. */
+            clientVersion?: string;
+            /** @description Matches the normalized operating system reported in ordinary claimant details, such as android, ios, windows, macos, linux, or fuchsia. Matching is case-insensitive. The value is self-reported and unauthenticated, so use it to steer a rollout, never as a security gate. The rule does not match until claimant details report an operating system; diagnostics mode is not required. */
+            operatingSystem?: string;
+            /** @description Deterministic percentage keyed by flag key and CLAIMANT, so a claimant stays in the same cohort across retries and new sessions. A rule using it matches nothing until a claimant is known. Combining it with other selectors rolls out only within that matching group. */
+            rolloutPercentage?: number;
+        };
+        VerificationFeatureFlagRule: components["schemas"]["VerificationFeatureFlagRuleInput"] & {
             /** Format: uuid */
             id: string;
-            last4?: string;
-            label?: string;
+            createdAt: components["schemas"]["Timestamp"];
+        };
+        /** @description Current or historical admin configuration for one typed Builder-mode feature flag. Changes create a new immutable version; session snapshots contain only resolved values and evaluation metadata. */
+        VerificationFeatureFlag: {
+            key: string;
+            description: string;
+            valueType: components["schemas"]["FeatureFlagValueType"];
+            defaultValue: components["schemas"]["FeatureFlagInputValue"];
+            /** @description ACTIVE includes the flag in new session runtimeConfig snapshots. ARCHIVED means deprecated: Builder omits it from new sessions while existing immutable session snapshots remain unchanged. */
+            status: components["schemas"]["EntityStatus"];
+            version: number;
+            rules: components["schemas"]["VerificationFeatureFlagRule"][];
             createMetadata: components["schemas"]["ActorMetadata"];
-            /** Format: date-time */
-            lastUsedAt?: string;
+            updateMetadata: components["schemas"]["ActorMetadata"];
         };
-        /** @description Metadata for one active signing key of a verification client — the public half only. `ethAddress` is the JWS `kid` published in the builder's `/.well-known/jwks.json`. */
-        VerificationClientKeyMeta: {
+        /** @description One immutable, globally ordered feature flag revision. */
+        VerificationFeatureFlagRevision: {
+            globalRevision: number;
+            flagVersion: number;
+            changedAt: components["schemas"]["Timestamp"];
             /** Format: uuid */
-            id: string;
-            ethAddress: string;
-            label?: string;
-            /** Format: date-time */
-            createdAt: string;
+            changedBy?: string;
+            flag: components["schemas"]["VerificationFeatureFlag"];
+        };
+        CreateVerificationFeatureFlagRequest: {
+            key: string;
+            description: string;
+            valueType: components["schemas"]["FeatureFlagValueType"];
+            defaultValue: components["schemas"]["FeatureFlagInputValue"];
+            /** @description Omit to create the flag as deprecated. Use ACTIVE only after every enabled first-party client supports the flag. */
+            status?: components["schemas"]["EntityStatus"];
+            rules?: components["schemas"]["VerificationFeatureFlagRuleInput"][];
+        };
+        /** @description Complete replacement used to create the next immutable flag version. Send every field and the full desired rule set. */
+        UpdateVerificationFeatureFlagRequest: {
+            description: string;
+            valueType: components["schemas"]["FeatureFlagValueType"];
+            defaultValue: components["schemas"]["FeatureFlagInputValue"];
+            /** @description Set ARCHIVED to deprecate the flag. It is then omitted from new session snapshots without changing existing sessions. */
+            status: components["schemas"]["EntityStatus"];
+            rules: components["schemas"]["VerificationFeatureFlagRuleInput"][];
+        };
+        /**
+         * @description Which side of the dashboard header the strip renders on. Either strip can take either position, independently of the other.
+         * @enum {string}
+         */
+        BannerPosition: "above_header" | "below_header";
+        /** @description The two site-wide top banners, as raw admin-authored HTML — this is the admin editor's shape. Used only by the dashboard's own layout and the admin editor; there is no public equivalent. */
+        SiteBanners: {
+            announcement: components["schemas"]["AnnouncementBar"];
+            ticker: components["schemas"]["ScrollingBanner"];
+        };
+        /** @description A static, centered, one-line strip. Same shape for the admin GET (raw HTML) and the PUT request/response — the client always sends the complete object, so there's no partial-update case to reason about. */
+        AnnouncementBar: {
+            /** @description Both banners default to disabled; saving doesn't change this. */
+            enabled: boolean;
+            /** @description Raw HTML source. Only `<strong>`, `<em>`, `<u>`, `<br>`, and `<a href="https://…">` survive rendering — every other tag or attribute (a `<script>`, an `onclick`, a non-`https:` link) is escaped to inert text on the dashboard. This field is always the raw, unrendered source the admin typed. */
+            message: string;
+            /** @description When set, the whole bar becomes a clickable link. Must be an `https:` URL — checked by the route (not `format: uri` here), since an empty submitted value is normalized to null rather than rejected as a malformed URI. Null means plain text, no link. */
+            linkUrl: string | null;
+            position: components["schemas"]["BannerPosition"];
+            /** @description Hex color, for example "#00443D". */
+            bgColor: string;
+            /** @description Hex color, for example "#FFFFFF". */
+            textColor: string;
+            paddingTop: number;
+            paddingBottom: number;
+        };
+        /** @description An auto-scrolling marquee of short messages. Same shape for the admin GET (raw HTML) and the PUT request/response. */
+        ScrollingBanner: {
+            /** @description An enabled ticker with zero items renders nothing on the dashboard — not an empty coloured strip. */
+            enabled: boolean;
+            /** @description Short raw-HTML messages (same allowed tags as AnnouncementBar.message), looped/repeated continuously. May be empty. */
+            items: string[];
+            position: components["schemas"]["BannerPosition"];
+            /** @description Hex color, for example "#0B1F1C". */
+            bgColor: string;
+            /** @description Hex color, for example "#FFFFFF". */
+            textColor: string;
+            /** @description Seconds per scroll loop; lower is faster. */
+            speedSeconds: number;
+            paddingTop: number;
+            paddingBottom: number;
+        };
+        /** @description `ScrollingBanner` as an HTML form posts it: `items` is one message per line instead of an array. */
+        ScrollingBannerForm: {
+            enabled: boolean;
+            /** @description One raw-HTML message per line; at most 20 lines. */
+            items: string;
+            position: components["schemas"]["BannerPosition"];
+            bgColor: string;
+            textColor: string;
+            speedSeconds: number;
+            paddingTop: number;
+            paddingBottom: number;
+        };
+        VerificationFeatureFlagEvaluation: {
+            flagVersion: number;
+            /** @enum {string} */
+            source: "DEFAULT" | "RULE";
+            /** Format: uuid */
+            ruleId?: string;
+            rulePriority?: number;
+        };
+        /** @description Runtime inputs a Verification Client reports about itself and the claimant it is serving. Both request fields are optional: send whichever the client actually knows. The operating system is derived from ordinary claimant details. Sending neither simply returns the stored configuration. */
+        ResolveVerificationRuntimeConfigRequest: {
+            /**
+             * Format: uuid
+             * @description The claimant's stable, client-generated id — the same value reported to PatchVerificationClaimant. It is the subject a percentage rollout buckets on, which is what keeps a claimant in one cohort across retries and new sessions. First write wins.
+             */
+            claimantClientId?: string;
+            /** @description The Verification Client's own build, for rules targeting a specific version. Self-asserted and unauthenticated. First write wins. */
+            clientVersion?: string;
+        };
+        /** @description Builder-mode feature configuration for one session. Resolved when the session is created, then recomputed whenever a Verification Client first reports an input the flags depend on — a claimant id, its own version, or the claimant operating system. It is otherwise left alone, so editing a flag does not change a session after its known inputs have settled. Verification Clients use `values`; `evaluations` and `revision` make a session reproducible and diagnosable. Feature flags never replace proof, issuer, JWKS, attestor, TEE, or session-binding validation. */
+        VerificationRuntimeConfig: {
+            /** @constant */
+            schemaVersion: 1;
+            revision: number;
+            resolvedAt: components["schemas"]["Timestamp"];
+            /** @description The client-reported inputs this document was resolved against. Absent fields were unknown at the time, so any rule depending on them did not match. Reported so a client can tell whether the configuration already reflects what it knows. */
+            inputs?: {
+                /** Format: uuid */
+                claimantClientId?: string;
+                clientVersion?: string;
+                /** @description Normalized from ordinary claimant details. This is available whether or not diagnostics mode is enabled. */
+                operatingSystem?: string;
+            };
+            /** @description The session-wide answer, resolved as though no single provider were in play. A rule scoped to a provider never contributes here. */
+            values: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description Per-provider differences, keyed by provider id. Holds only the flags whose answer changes once that provider is the one being verified, so read `providerValues[currentProviderId]?.[key]` first and fall back to `values[key]`.
+             *     This is what makes a provider selector mean "this provider" rather than "the session contains this provider". The map is empty when no provider-specific rule changes the baseline; ignoring it altogether yields the session-wide baseline.
+             */
+            providerValues?: {
+                [key: string]: {
+                    [key: string]: unknown;
+                };
+            };
+            /** @description Why each flag resolved as it did, for the session-wide baseline. Provider overrides are not broken out here; `providerValues` says what changed, and the flag's rules say why. */
+            evaluations: {
+                [key: string]: components["schemas"]["VerificationFeatureFlagEvaluation"];
+            };
         };
-        /** @description A registered first-party caller (app SDK, web portal, zkFetch) allowed to drive verification sessions. Builder mode identifies it by this UUID and binds that identity to each session. The `tokens` fields are legacy compatibility metadata; Builder mode does not use them. The client may also hold active signing keys (`keys` — public halves; their kids are published in the builder's aggregated JWKS). */
+        /** @description A registered claimant-facing client. Builder identifies it by UUID, binds it to each selected session, and signs every result itself. */
         VerificationClient: {
             /** Format: uuid */
             id: string;
@@ -3961,31 +4526,12 @@ export interface components {
             pool: components["schemas"]["QuotaPool"];
             /**
              * Format: uri
-             * @description The claimant-facing base URL. This can be a web URL, app link, or deep link and is separate from the cryptographic issuer.
+             * @description The claimant-facing web or app-link URL.
              */
             uri?: string;
-            /**
-             * Format: uri
-             * @description Exact trusted JWS `iss` value registered for this client. Consumers must match signed results against this value before loading JWKS.
-             */
-            issuer: string;
-            /**
-             * Format: uri
-             * @description Registered JWKS URL for consumer-side result verification. For Builder-managed signing keys this is normally the Builder's aggregated `/.well-known/jwks.json`; a client may instead register a self-hosted URL. The Builder never fetches or proxies this URL.
-             */
-            jwksUri?: string;
-            activeTokenCount: number;
-            tokens: components["schemas"]["VerificationClientTokenMeta"][];
-            activeKeyCount: number;
-            keys: components["schemas"]["VerificationClientKeyMeta"][];
             createMetadata?: components["schemas"]["ActorMetadata"];
             updateMetadata?: components["schemas"]["ActorMetadata"];
         };
-        /** @description Legacy compatibility response from register / issue-token endpoints. Builder-mode callers use the registered client's UUID, not this token. */
-        VerificationClientWithToken: {
-            client: components["schemas"]["VerificationClient"];
-            token: string;
-        };
         CreateVerificationClientRequest: {
             /** @description Lowercase handle (letters, digits, hyphens), for example, `web-portal`. */
             name: string;
@@ -3997,28 +4543,12 @@ export interface components {
             pool: "VERIFICATION" | "ZKFETCH";
             /** @description Base URL claimants are directed to. A verification request's `verificationClientUrl` must exactly equal this. The returned `verificationUrl` contains the session id and `api=2`; a dual-mode client uses that query value to select Builder mode. */
             uri: string;
-            /** @description Exact JWS issuer for signed results. Set this separately when the claimant-facing URL is an app link or contains a session placeholder. Consumers compare it with the JWS header before using the registered JWKS URL. For compatibility, omission defaults to `uri`. */
-            issuer?: string;
-            /** @description Optional registered JWKS URL for consumers. Use the Builder's aggregated endpoint for Builder-managed keys, or a self-hosted endpoint when the client manages its own signing keys. */
-            jwksUri?: string;
         };
         /** @description Fields to change on a registered client. Omitted fields keep their current values. */
         UpdateVerificationClientRequest: {
             pool?: components["schemas"]["QuotaPool"];
             /** @description Claimant-facing base URL. A verification request must exactly equal this value. */
             uri?: string;
-            /** @description Exact trusted JWS `iss` value; separate from `uri` and `jwksUri`. */
-            issuer?: string;
-            /** @description Registered JWKS URL for consumers; never derive it from a signed payload. */
-            jwksUri?: string;
-        };
-        /** @description The PUBLIC half of the client's ES256K signing keypair, as an uncompressed hex public key or a JWK. Exactly one of `publicKey` / `publicKeyJwk` is required; the private key never leaves the client. */
-        AddVerificationClientKeyRequest: {
-            /** @description Uncompressed secp256k1 public key (65 bytes, hex). */
-            publicKey?: string;
-            publicKeyJwk?: components["schemas"]["JwkSecp256k1Public"];
-            /** @description A human note to tell keys apart (for example, "prod-eu"). */
-            label?: string;
         };
         /** @description The email of an existing user to grant staff (any domain). */
         AddStaffMemberRequest: {
@@ -4042,11 +4572,6 @@ export interface components {
         StaffList: {
             items: components["schemas"]["StaffMember"][];
         };
-        /** @description Legacy compatibility metadata for a token. Builder-mode clients use their registered UUID in `x-reclaim-vc-id` instead. */
-        IssueVerificationClientTokenRequest: {
-            /** @description A human note to tell tokens apart (for example, "prod-eu"). */
-            label?: string;
-        };
         ProviderVersionRef: {
             major: number;
             minor: number;
@@ -4318,6 +4843,20 @@ export interface components {
             /** @description Read-only pre-resolved SEO surface. The server applies the documented override chain (`seo.*Override` → row value → `seoSuggestions.*`) and exposes the result here so HTML renderers, JSON-LD, sitemap, and OG cards read one source. */
             effectiveSeo: components["schemas"]["ProviderEffectiveSeo"];
         };
+        /**
+         * @description How reliably runs produced a proof over the last 30 days: `healthy` from 70%, `degraded` from 40%, otherwise `failing`. Absent until there are enough runs to judge.
+         * @enum {string}
+         */
+        ProviderHealth: "healthy" | "degraded" | "failing";
+        OrgUsedProvider: {
+            id: components["schemas"]["ProviderID"];
+            name: string;
+            domain: string;
+            slug: string;
+            /** @description Sessions in the organization that ran this provider. */
+            sessions: number;
+            lastUsedAt: components["schemas"]["Timestamp"];
+        };
         /**
          * @description Card-shape projection of a `Provider` used by catalog listings (`GET /providers`, `Organization.providers`). Differs from `Provider` in three ways:
          *
@@ -4368,6 +4907,11 @@ export interface components {
              * @description Avatar URL of the owning organization, if set.
              */
             orgIconUrl?: string;
+            /** @description Percent of runs over the last 30 days that produced a proof. Absent until the provider has 5 runs. */
+            readonly successRate?: number;
+            readonly health?: components["schemas"]["ProviderHealth"];
+            /** @description Provider score from 0 to 100, from recent proofs, organizations using it, and how recently it was updated. See `Provider score` in the docs for the criteria. */
+            readonly score?: number;
             readonly createMetadata: components["schemas"]["ActorMetadata"];
             readonly updateMetadata: components["schemas"]["ActorMetadata"];
         };
@@ -4399,6 +4943,14 @@ export interface components {
             dataPoints: string[];
             /** @description Number of providers backing this website that the caller can see. */
             providerCount: number;
+            /** @description The tags most of this website's providers carry. */
+            tags?: components["schemas"]["Tag"][];
+            /** @description Highest `successRate` among the website's providers. Absent until one has enough runs. */
+            bestSuccessRate?: number;
+            /** @description `failing` when none of the rated providers is healthy or degraded, `degraded` when some are not healthy, otherwise `healthy`. */
+            health?: components["schemas"]["ProviderHealth"];
+            /** @description Number of rated providers that are degraded or failing. */
+            unhealthyProviderCount?: number;
         };
         /** @description Body for `POST /site/{domain}/try`. Only the verification `context` (values for the resolved providers' `requiredContext` inputs). The selection (dataPoints / mode / pins) travels in the query string. */
         SiteBuildTryBody: {
@@ -4407,22 +4959,16 @@ export interface components {
                 [key: string]: string;
             };
             orgId?: components["schemas"]["OrgID"];
-        };
-        /** @description Body for `POST /site/{domain}/ai-provider`. `orgId` is optional: which owned organization the AI provider is authored under (defaults to the member's personal organization, or their first owned org). `url` is required only when `domain` has no existing catalog data — the build page's confirm-URL step supplies it, and the draft is scaffolded under whatever domain that URL actually resolves to (which may differ from `domain`), not the unconfirmed search text the build page was first opened with. */
-        SiteAiProviderBody: {
-            orgId?: components["schemas"]["OrgID"];
-            /** @description Confirmed website URL, for a domain with no existing catalog data. Verified reachable before anything is created. */
-            url?: string;
+            /**
+             * @description Built-in Verification Client that runs the sandbox session. Defaults to `portals`. `inapp-sdk` and `zkfetch` are not offered: neither has a browser flow to try.
+             * @enum {string}
+             */
+            verificationClient?: "portals" | "verifier-app" | "reclaim-browser-extension" | "builder";
         };
         /** @description Body for `PUT /users/{userId}/org-limit`. An integer sets the limit; `null` (JSON) or an empty string (form) restores the default (3). */
         AdminSetUserOrgLimitBody: {
             limit?: number | string | null;
         };
-        /** @description Body for `POST /site/{domain}/try-ai`. An optional edited extraction prompt, saved as a new draft build before the sandbox session is minted. */
-        SiteTryAiBody: {
-            /** @description The edited extraction prompt for the AI provider. Gated by the prompt guard before it is stored (see docs/prompt-guard.md); the length here documents the same ceiling the guard enforces. */
-            prompt?: string;
-        };
         /** @description Selects one failed provider from the source session. The server treats this only as selection input and re-derives authorization, failure, version, organization, and prompt. */
         CreateFixWithAiSessionRequest: {
             providerId: components["schemas"]["ProviderID"];
@@ -4435,6 +4981,10 @@ export interface components {
             description?: string;
             /** @description Number of visible providers on the domain that expose this data point. */
             providerCount: number;
+            /** @description `PUBLIC` when any public provider exposes this data point, else `PRIVATE`. */
+            visibility?: components["schemas"]["EntityVisibility"];
+            /** @description The best health among the providers that expose it. */
+            health?: components["schemas"]["ProviderHealth"];
             /** @description Slug of one provider that exposes this data point. */
             exampleProviderSlug?: string;
             /** @description One entry per provider that exposes this data point — how it proves it. Two providers may be byte-identical here; they are still separate, separately pinnable sources (see the `pins` parameter). */
@@ -4505,6 +5055,46 @@ export interface components {
             /** @description User-agent used for iOS verification. */
             ios?: components["schemas"]["UserAgentString"];
         };
+        /** @description Copies one same-origin, script-readable cookie into a request header. The cookie value stays inside the verification client's browser. */
+        BrowserRequestCookieHeader: {
+            name: string;
+            cookieName: string;
+        };
+        /** @description A portal-only, provider-declared HTTP action for `window.Reclaim.browserRequest`. The claimant page supplies only the action id and declared primitive inputs; the recipe controls the HTTPS origin, request template, and returned fields. Other Verification Clients currently ignore this field. */
+        BrowserRequestAction: {
+            id: string;
+            /** Format: uri */
+            origin: string;
+            /** @description Origin-relative fallback path. */
+            path: string;
+            /** @description Optional origin-relative path/query template. Declared inputs use `{{name}}` and are URL-encoded. */
+            pathTemplate?: string;
+            /** @enum {string} */
+            method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+            /**
+             * @description `fetch` is the default. `navigate` supports GET only and performs a top-level navigation in the action's isolated browser page.
+             * @enum {string}
+             */
+            transport?: "fetch" | "navigate";
+            /** @description Browser User-Agent applied to the isolated action page before its first navigation. Use only when the target origin requires a specific browser identity. */
+            userAgent?: string;
+            /** @description Remove Chromium's automatic Origin header from a fetch action. Unsupported for navigate actions. */
+            omitOriginHeader?: boolean;
+            headers?: {
+                [key: string]: string;
+            };
+            /** @description Header values may interpolate declared `{{name}}` inputs. */
+            headersTemplate?: {
+                [key: string]: string;
+            };
+            /** @description JSON template whose `{{name}}` inputs are inserted as JSON literals. The rendered body is limited again at execution time. */
+            bodyTemplate?: string;
+            cookieValueHeader?: components["schemas"]["BrowserRequestCookieHeader"];
+            /** @description Return the bounded raw response body. */
+            includeBody?: boolean;
+            inputKeys?: string[];
+            responseFields?: string[];
+        };
         /** @description Settings used by the web-based verification client. */
         ProviderWebSettings: {
             /**
@@ -4515,6 +5105,8 @@ export interface components {
             clientOptions?: components["schemas"]["ClientOptions"];
             /** @description JavaScript snippets injected into the page which runs before every page load. `window.Reclaim.` APIs are available to these scripts to request actions to the client like claim creation. */
             jsUserScripts?: string;
+            /** @description Portal-only authenticated browser actions available to `jsUserScripts` through `window.Reclaim.browserRequest`. */
+            browserRequestActions?: components["schemas"]["BrowserRequestAction"][];
         };
         /** @description Optional JSON Schema describing the `context` a Consumer must supply when creating a verification session for this provider version. Only needed when the recipe expects Consumer-supplied values: those are referenced as `{{context.<key>}}` in recipe requests. Bare `{{parameterName}}` placeholders are normally provider parameters extracted from claimant traffic. For old DevTools recipes, Builder-mode Verification Clients seed a missing bare `parameterName` from a same-named scalar session context field when the recipe doesn't use `{{context.parameterName}}`; an explicit parameter always wins. New recipes should use the explicit `{{context.<key>}}` form. Bare parameters need no declaration here. Builder-owned `reclaimSessionId` and `attestationNonce` remain context-only. The Builder validates `CreateVerificationSessionRequest.context` against this schema and rejects the request (400) on mismatch. Extra context fields are always allowed regardless of the schema (a root-level `additionalProperties: false` is ignored). Empty/absent accepts any context. */
         ProviderRequiredContext: {
@@ -4797,7 +5389,7 @@ export interface components {
         /** @enum {string} */
         ContributionCampaignStatus: "DRAFT" | "OPEN" | "PAUSED" | "CLOSED";
         /** @enum {string} */
-        ContributionAttemptStatus: "CREATED" | "ACTIVE" | "PROPOSED" | "COMPLETED" | "FAILED" | "CANCELLED" | "STALE";
+        ContributionAttemptStatus: "CREATED" | "ACTIVE" | "PROPOSED" | "COMPLETED" | "FAILED" | "REJECTED" | "CANCELLED" | "STALE";
         /** @enum {string} */
         ContributionSensitivity: "PUBLIC" | "PERSONAL" | "SENSITIVE";
         ContributionRequirement: {
@@ -4807,7 +5399,7 @@ export interface components {
             sensitivity?: components["schemas"]["ContributionSensitivity"];
             requiredClaims?: string[];
             requiredOutputs?: string[];
-        };
+        } | unknown | unknown;
         ContributionRequirements: {
             fields: components["schemas"]["ContributionRequirement"][];
         };
@@ -4905,13 +5497,17 @@ export interface components {
             consentText: string;
             /** Format: uri */
             initialUrl: string;
-            allowedHosts?: string[];
-            allowedPathPrefixes?: string[];
+            /** @description Hosts volunteers may reach. A browser form sends one string with one host per line or comma separated. */
+            allowedHosts?: string[] | string;
+            /** @description Path prefixes volunteers may visit. A browser form sends one string with one path per line or comma separated. */
+            allowedPathPrefixes?: string[] | string;
             fieldKey: string;
             fieldTitle: string;
             fieldDescription?: string;
-            requiredClaims?: string[];
-            requiredOutputs?: string[];
+            /** @description Claim names the proof must output. A browser form sends one string with one name per line or comma separated. */
+            requiredClaims?: string[] | string;
+            /** @description Extra output names the proof must produce. A browser form sends one string with one name per line or comma separated. */
+            requiredOutputs?: string[] | string;
             sensitivity?: components["schemas"]["ContributionSensitivity"];
         };
         UpdateContributionCampaignRequest: components["schemas"]["CreateContributionCampaignRequest"];
@@ -5070,6 +5666,47 @@ export interface components {
             verificationsRemaining: number;
             resetsAt: components["schemas"]["Timestamp"];
         };
+        VerificationAnalytics: {
+            /** Format: date-time */
+            from: string;
+            /** Format: date-time */
+            to: string;
+            byDay: components["schemas"]["VerificationAnalyticsRow"][];
+            byDevice: components["schemas"]["VerificationAnalyticsRow"][];
+            byCountry: components["schemas"]["VerificationAnalyticsRow"][];
+            byBrowser: components["schemas"]["VerificationAnalyticsRow"][];
+            byOs: components["schemas"]["VerificationAnalyticsRow"][];
+            /** @description The busiest providers. A session requesting several providers counts once under each. */
+            byProvider: components["schemas"]["VerificationAnalyticsRow"][];
+            zkfetch?: components["schemas"]["ZkfetchAnalytics"];
+        };
+        /** @description zkFetch calls in the window. Left out of the report when it is scoped to a provider, since zkFetch calls have none. */
+        ZkfetchAnalytics: {
+            total: number;
+            /** @description Distinct hosts called, including those past `byHost`. */
+            hosts: number;
+            /** @description An active billing period grants a zkFetch allowance (any organization, when the report covers all of them). */
+            hasAllowance: boolean;
+            /** @description Every UTC day of the window, empty days included. */
+            byDay: components["schemas"]["ZkfetchAnalyticsRow"][];
+            /** @description The busiest hosts, lowercased. */
+            byHost: components["schemas"]["ZkfetchAnalyticsRow"][];
+        };
+        ZkfetchAnalyticsRow: {
+            /** @description UTC date or host. */
+            bucket: string;
+            total: number;
+        };
+        VerificationAnalyticsRow: {
+            /** @description UTC date, device category, ISO country code, browser, OS, provider id, or unknown. */
+            bucket: string;
+            /** @description Provider title, on `byProvider` rows only. */
+            title?: string;
+            total: number;
+            succeeded: number;
+            pending: number;
+            failed: number;
+        };
         VerificationFunnel: {
             /** @enum {string} */
             mode: "SESSION" | "PROVIDER";
@@ -5092,6 +5729,33 @@ export interface components {
             /** @description Optional absolute or Builder-hosted image URL. */
             logoUrl?: string;
         };
+        /** @description One immutable provider recipe resolved when the verification session was created. Version resolution never happens in a Verification Client. */
+        VerificationRecipe: {
+            providerId: components["schemas"]["ProviderID"];
+            provider: components["schemas"]["VerificationBrand"];
+            resolvedVersion: string;
+            /** Format: uri */
+            initialUrl: string;
+            /** @description Legacy-only preference. Builder clients always run the structured recipe and never enable AI or manual verification from this value. */
+            preferAiAgent: boolean;
+            geoLocation?: string;
+            jsUserScripts?: string;
+            clientOptions?: components["schemas"]["ClientOptions"];
+            requests: components["schemas"]["RequestSelection"][];
+            allowedJsRequests?: components["schemas"]["RequestSelectionTemplate"][];
+            /** @description Portal-only authenticated actions copied from this immutable version's web settings. */
+            browserRequestActions?: components["schemas"]["BrowserRequestAction"][];
+        };
+        VerificationRecipeList: {
+            /** @description One recipe per session provider, in run order. */
+            recipes: components["schemas"]["VerificationRecipe"][];
+        };
+        VerificationClientBootstrap: {
+            session: components["schemas"]["VerificationSession"];
+            recipes: components["schemas"]["VerificationRecipe"][];
+            /** @description Builder-mode feature configuration for this session, as resolved so far. Bootstrap reads the client's version from the `reclaim-api-client` header. A client that later learns a claimant id should call ResolveVerificationRuntimeConfig, which binds that input and returns the recomputed configuration. A client that does not send the header can report its version there too. Absent only for sessions created before this capability. */
+            runtimeConfig?: components["schemas"]["VerificationRuntimeConfig"];
+        };
         /** @description A single verification a Consumer requests from an end-user. Created via the consumer's `OrgToken`; the org must already have at least one callback subscription. The result is submitted by the Verification Client and delivered by the Builder. */
         VerificationSession: {
             /**
@@ -5110,6 +5774,8 @@ export interface components {
              * @description Set by the Verification Client once the claimant opens the link.
              */
             claimantClientId?: string | null;
+            /** @description The Verification Client build that served this session, read from the `reclaim-api-client` header it reported at bootstrap. Absent until a client has identified itself, and for clients that send no such header. Self-asserted, so treat it as diagnostic: it answers "which build was this?" and never authenticates anything. */
+            clientVersion?: string;
             claimantDetails?: components["schemas"]["ClaimantDetails"];
             claimantDetailsUpdatedAt?: components["schemas"]["Timestamp"];
             /** @description Theme selected and snapshotted when this session was created. */
@@ -5122,7 +5788,11 @@ export interface components {
             teeNonceBoundAt?: components["schemas"]["Timestamp"];
             /** @description Legacy-only preference echoed for compatibility. Builder-mode clients run the structured recipe and do not enable AI or manual verification. */
             preferAiAgent?: boolean;
-            /** @description Consumer context, validated against the provider version's required parameters. The Builder injects `reclaimSessionId` after validation. */
+            /** @description Whether this session was created with diagnostic mode enabled (see CreateVerificationSessionRequest.diagnostics). Set once at creation and never changes afterward. Gates whether Builder records claimant IP addresses and how much detail diagnostic events carry; the `diag` parameter on `verificationUrl` mirrors this value and is not itself authoritative. */
+            diagnostics: boolean;
+            /** @description Per-session redirect targets, echoed back unchanged (see CreateVerificationSessionRequest.launchOptions). Absent when never set. */
+            launchOptions?: components["schemas"]["VerificationLaunchOptions"];
+            /** @description Consumer context, validated against the provider version's required parameters. Verification Clients resolve scalar values as `{{context.key}}`, then `{{context_key}}`, then `{{key}}`; explicit parameters win. The Builder injects `reclaimSessionId` after validation. */
             context: {
                 [key: string]: unknown;
             };
@@ -5140,16 +5810,6 @@ export interface components {
              * @description Id of the registered verification client whose base URL was used (see `verification_clients`).
              */
             verificationClientId: string;
-            /**
-             * Format: uri
-             * @description Registered JWS issuer for this session. Consumers compare the signed result's `iss` with this value.
-             */
-            verificationClientIssuer: string;
-            /**
-             * Format: uri
-             * @description Registered JWKS URL for this session's Verification Client. Use this trusted value instead of constructing a URL from result data.
-             */
-            verificationClientJwksUrl: string;
             /** @description Ready-to-share URL: the registered base URL with the session id attached by the Builder — substituted into a `{sessionId}` placeholder, or appended as a `?sessionId=…` query parameter. It always includes `api=2`, which selects Builder mode in dual-mode Verification Clients. The Consumer may append its own redirect query fields before opening the URL for the claimant; the Builder does not store or execute those redirects. */
             verificationUrl: string;
             createdAt: components["schemas"]["Timestamp"];
@@ -5175,13 +5835,13 @@ export interface components {
         };
         /** @description Body for `POST /verifications/sessions`. Authenticated by the consumer's `OrgToken`. Carries no callback URLs — they come from the org's callback subscriptions. The one shared `context` is validated against every provider's `requiredContext`. */
         CreateVerificationSessionRequest: {
-            /** @description Providers to verify, in run order. The Verification Client runs each sequentially in one browser session and submits one combined result; all are required. */
+            /** @description Providers to verify, in run order. The Verification Client runs each sequentially in one browser session and submits one combined result; all are required. Provider version constraints are resolved only while this request is created; clients receive the exact immutable resolved versions and never resolve them again. */
             providers: components["schemas"]["SessionProviderInput"][];
-            /** @description Consumer context, shared by all providers. Validated against EACH resolved provider version's `requiredContext` JSON Schema (a 400 is returned on mismatch); extra fields are always allowed. Recipe requests reference these values as `{{context.<key>}}`. To support old DevTools recipes, Builder-mode Verification Clients also use a same-named scalar context value to seed a missing bare `{{key}}` when the recipe doesn't use `{{context.key}}`; an explicit parameter takes precedence. Echoed back (plus `reclaimSessionId`) in the result. Builder-owned `reclaimSessionId` and `attestationNonce` remain context-only. */
+            /** @description Consumer context, shared by all providers. Validated against EACH resolved provider version's `requiredContext` JSON Schema (a 400 is returned on mismatch); extra fields are always allowed. Recipe requests resolve scalar values as `{{context.key}}`, then `{{context_key}}`, then `{{key}}`. A lower-priority alias is used only when the recipe doesn't use a higher-priority spelling; an explicit parameter takes precedence. Echoed back (plus `reclaimSessionId`) in the result. Builder-owned `reclaimSessionId` and `attestationNonce` remain context-only. */
             context: {
                 [key: string]: unknown;
             };
-            /** @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`builder`) client. The Builder resolves and stores the registered client UUID, then returns the ready-to-share `verificationUrl` with the session id and `api=2`. A URL that is not a registered client's base is rejected with 400. Consumers append any client-owned redirect parameters after receiving the URL; Builder does not manage them. */
+            /** @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`portals`) client. The Builder resolves and stores the registered client UUID, then returns the ready-to-share `verificationUrl` with the session id and `api=2`. A URL that is not a registered client's base is rejected with 400. Consumers append any client-owned redirect parameters after receiving the URL; Builder does not manage them. */
             verificationClientUrl?: string;
             /** @description Optional active theme owned by the organization. When omitted, Builder snapshots the organization's most recently updated active theme. If the organization has no active theme, the Verification Client uses its default presentation. */
             themeId?: components["schemas"]["ThemeID"];
@@ -5189,6 +5849,37 @@ export interface components {
             preferredLocale?: string;
             /** @description Legacy-only preference. Builder mode runs the structured recipe and does not enable AI or manual verification. Omit this field for Builder-mode sessions; dual-mode clients may continue to interpret it only on their legacy path. */
             preferAiAgent?: boolean;
+            /** @description Optional; omit or send false for a normal session. Opts this session into diagnostic mode. A diagnostic session records more event detail, including personal data such as the claimant's IP addresses (see ClaimantDetails.network). Builder appends `diag=1` to the returned `verificationUrl` for a diagnostic session and strips any `diag` value the Consumer's own `verificationClientUrl` carries, so this field — not the URL — is the only way to turn diagnostics on. Treat a diagnostic verification URL as sensitive, and don't hand it to a claimant by default. */
+            diagnostics?: boolean;
+            /** @description Optional. Where a Verification Client sends the claimant's browser at the end of this session's flow — see VerificationLaunchOptions. Builder validates and stores this at creation (rejecting a non-`https:` URL with 400 here, rather than storing it and failing later); it never reads, redirects to, or executes it itself. A Verification Client reads it back off the session (verificationUrl.launchOptions, or BootstrapVerificationClient.session.launchOptions) and performs the redirect itself, exactly as `reclaim-js-sdk` and the portal already do for a query-string `redirectUrl` today — this is the same feature, sourced from the session instead of the URL. */
+            launchOptions?: components["schemas"]["VerificationLaunchOptions"];
+        };
+        /** @description Where a Verification Client sends the claimant's browser at the end of a flow. Builder stores these on the session and returns them unchanged (see VerificationSession.launchOptions / BootstrapVerificationClient) — it never reads them itself, never redirects a claimant to them, and never executes them; only the Verification Client that renders the flow does. Vocabulary matches `reclaim-js-sdk`'s `VerificationRequest` and `reclaim-portal`'s `parseVerificationLaunch`: `redirectUrl`/`redirectUrlOptions` on success, `cancelRedirectUrl`/`cancelRedirectUrlOptions` on cancellation. `https:` only — `javascript:`, `data:`, and any other scheme are rejected with 400 at session creation. */
+        VerificationLaunchOptions: {
+            /**
+             * Format: uri
+             * @description Where to send the claimant after a successful verification.
+             */
+            redirectUrl?: string;
+            /** @description How to perform `redirectUrl`'s redirect. */
+            redirectUrlOptions?: components["schemas"]["VerificationLaunchRedirectOptions"];
+            /**
+             * Format: uri
+             * @description Where to send the claimant after a cancelled verification.
+             */
+            cancelRedirectUrl?: string;
+            /** @description How to perform `cancelRedirectUrl`'s redirect. */
+            cancelRedirectUrlOptions?: components["schemas"]["VerificationLaunchRedirectOptions"];
+        };
+        /** @description How a Verification Client performs a launch-options redirect — a plain GET (default) or a form POST/GET carrying extra fields. Matches `reclaim-portal`'s `HttpRedirectionOptions`. */
+        VerificationLaunchRedirectOptions: {
+            /** @enum {string} */
+            method?: "GET" | "POST";
+            body?: components["schemas"]["VerificationLaunchRedirectFormEntry"][];
+        };
+        VerificationLaunchRedirectFormEntry: {
+            name: string;
+            value: string;
         };
         /** @description Exact legacy TEE nonce inputs. Builder stores this unchanged in the session context after it verifies the signed binding request. */
         AttestationNonceData: {
@@ -5211,8 +5902,8 @@ export interface components {
             /** @description EIP-191 65-byte secp256k1 signature, encoded as 0x-prefixed hex. */
             signature: string;
         };
-        /** @description Latest diagnostic claimant and device snapshot. Values are best-effort and never participate in proof verification. */
-        ClaimantDetails: {
+        /** @description Client-reported claimant and device snapshot. Values are best-effort and never participate in proof verification. Operating-system details are retained in normal mode; only the network object requires diagnostics. Server-observed values are added by Builder and cannot be supplied by the claimant. */
+        ClaimantDetailsRequest: {
             /**
              * Format: uuid
              * @description Verification Client installation identifier. The Builder also stores it in the session's dedicated claimantClientId field.
@@ -5227,16 +5918,55 @@ export interface components {
                 [key: string]: unknown;
             };
             device?: {
+                /** @enum {string} */
+                category?: "desktop" | "mobile" | "tablet" | "unknown";
+            } & {
                 [key: string]: unknown;
             };
             operatingSystem?: {
                 [key: string]: unknown;
             };
-            browser?: {
+            browser?: components["schemas"]["ClaimantBrowser"];
+            viewport?: components["schemas"]["ClaimantDimensions"];
+            display?: components["schemas"]["ClaimantDimensions"];
+            /** @description The claimant's own IP address, self-reported. Builder stores it only when the session's `diagnostics` field is true; it drops this object otherwise, regardless of what a Verification Client sends. */
+            network?: {
+                reportedPublicIp?: string;
+            };
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Latest claimant and device snapshot populated by Builder. Values are best-effort and never participate in proof verification. Operating-system details are available in normal mode; network details require diagnostics. */
+        ClaimantDetails: {
+            /**
+             * Format: uuid
+             * @description Verification Client installation identifier. The Builder also stores it in the session's dedicated claimantClientId field.
+             */
+            claimantClientId: string;
+            claimantId?: string;
+            collectedAt?: components["schemas"]["Timestamp"];
+            apiClient?: string;
+            locale?: string;
+            httpUserAgent?: string;
+            /** @description Claimant country from Builder's trusted CDN country header, when available. */
+            countryCode?: string;
+            client?: {
+                [key: string]: unknown;
+            };
+            device?: {
+                /** @enum {string} */
+                category?: "desktop" | "mobile" | "tablet" | "unknown";
+            } & {
+                [key: string]: unknown;
+            };
+            operatingSystem?: {
                 [key: string]: unknown;
             };
+            browser?: components["schemas"]["ClaimantBrowser"];
             viewport?: components["schemas"]["ClaimantDimensions"];
             display?: components["schemas"]["ClaimantDimensions"];
+            /** @description The claimant's IP addresses: `reportedPublicIp` as the Verification Client observed it, `serverObservedIp` as Builder's own request peer address. Present only when the session's `diagnostics` field is true; a non-diagnostic session never carries this object, even if a Verification Client sent one. */
             network?: {
                 reportedPublicIp?: string;
                 serverObservedIp?: string;
@@ -5245,13 +5975,39 @@ export interface components {
                 [key: string]: unknown;
             };
         };
+        ClaimantBrowser: {
+            name?: string;
+            version?: string;
+            userAgent?: string;
+            userAgentData?: components["schemas"]["ClaimantUserAgentData"];
+        } & {
+            [key: string]: unknown;
+        };
+        /** @description Best-effort User-Agent Client Hints returned by the claimant browser. Browsers can omit or reduce any value for privacy or compatibility. */
+        ClaimantUserAgentData: {
+            architecture?: string;
+            bitness?: string;
+            brands?: components["schemas"]["UserAgentBrandVersion"][];
+            formFactors?: string[];
+            fullVersionList?: components["schemas"]["UserAgentBrandVersion"][];
+            mobile?: boolean;
+            model?: string;
+            platform?: string;
+            platformVersion?: string;
+            uaFullVersion?: string;
+            wow64?: boolean;
+        };
+        UserAgentBrandVersion: {
+            brand: string;
+            version: string;
+        };
         ClaimantDimensions: {
             width: number;
             height: number;
             /** @enum {string} */
             unit: "css-px" | "logical-px" | "physical-px";
         };
-        PatchVerificationClaimantRequest: components["schemas"]["ClaimantDetails"];
+        PatchVerificationClaimantRequest: components["schemas"]["ClaimantDetailsRequest"];
         /** @description Body for `POST /verifications/sessions/{sessionId}/events`. Status ping only — never carries the proof (use the result endpoint for that). */
         ReportEventRequest: {
             event: components["schemas"]["VerificationEvent"];
@@ -5282,7 +6038,7 @@ export interface components {
             receivedAt: components["schemas"]["Timestamp"];
             createdAt: components["schemas"]["Timestamp"];
         };
-        /** @description RFC 7515 JWS in General (or Flattened) JSON serialization. The signed verification result produced by the Verification Client — this is what the `data` field of a `VerificationResultDelivery` decrypts to. Signed ES256K (RFC 8812) over SHA-256 of `<protected>.<payload>`. Verify it with the Verification Client's registered issuer and JWKS URL; never derive a JWKS URL from JWS data. Its decoded payload is `VerificationResultPayload`. */
+        /** @description RFC 7515 JWS in General (or Flattened) JSON serialization. The signed verification result produced by Builder — this is what the `data` field of a `VerificationResultDelivery` decrypts to. Signed ES256K (RFC 8812) over SHA-256 of `<protected>.<payload>`. Verify it with Builder's issuer and JWKS URL; never derive a JWKS URL from JWS data. Its decoded payload is `VerificationResultPayload`. */
         Jws: {
             /** @description base64url-encoded JSON payload. */
             payload: string;
@@ -5306,8 +6062,30 @@ export interface components {
             /** @description Payload interpreted per `event`. Terminal result events: the signed result — an **ECIES ciphertext** (base64url, secp256k1 + AES-256-GCM) wrapping the signed JWS when the org's `canEncryptResult` is enabled (decrypt with the matching eth private key to recover the inner JWS), else the JWS directly; the inner JWS parses as the `Jws` schema with payload `VerificationResultPayload`. Non-terminal events: plaintext JSON `{ event, eventData }` (unsigned). */
             data: string;
         };
-        /** @description Exact `Proof` object emitted by a legacy Reclaim Verification Client. The Verification Client must preserve this object without renaming, wrapping, or dropping fields. Consumers pass it directly to `@reclaimprotocol/client` `verifyProof`, normally through `verifyResultFull`. Do not trust any proof field until verification succeeds. */
-        LegacyProof: {
+        /** @description A claimant-facing Verification Client's terminal result. Proofs retain the exact `Proof` shape; Builder signs only the outer result. */
+        SubmitVerificationClientResultRequest: {
+            /** @enum {string} */
+            status: "success" | "rejected" | "error" | "cancelled";
+            results: components["schemas"]["VerificationClientProviderResult"][];
+            problem?: components["schemas"]["Problem"] | null;
+        };
+        VerificationClientProviderResult: {
+            providerId: components["schemas"]["ProviderID"];
+            resolvedVersion: string;
+            requests: components["schemas"]["VerificationClientRequestResult"][];
+        };
+        VerificationClientRequestResult: {
+            requestId?: string;
+            url?: string;
+            /** @enum {string} */
+            method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+            proof: components["schemas"]["ReclaimRequestProof"];
+            extractedParameters?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Exact `Proof` object for one verified request within a provider, emitted by every Reclaim Verification Client — the in-app SDK, the browser extension, portals, and Builder's own client. The Verification Client must preserve this object without renaming, wrapping, or dropping fields. Consumers pass it directly to `@reclaimprotocol/client` `verifyRequestProof`, normally through `verifyResultFull`. Do not trust any proof field until verification succeeds. */
+        ReclaimRequestProof: {
             identifier: string;
             claimData: {
                 provider: string;
@@ -5321,30 +6099,36 @@ export interface components {
                 epoch: number;
             };
             signatures: string[];
-            witnesses: ({
+            witnesses: {
                 id: string;
                 url: string;
+                /** @description How this witness attested the claim. Every verification client emits the same envelope so consumers branch on `type` rather than on which client produced the proof. The attestor address and claim signature are always present and always checked; `type` selects what extra evidence, if any, comes with them. */
                 claimAttestation?: {
-                    [key: string]: unknown;
+                    /**
+                     * @description `embedded-attestor` — the in-app SDK and the browser extension, whose attestor signs the claim and may return its own `attestation_report`. `confidential-space` — portals, whose browser runtime signs inside a GCP Confidential Space and returns `tee_attestation`. Every client sets this explicitly.
+                     * @enum {string}
+                     */
+                    type: "embedded-attestor" | "confidential-space";
+                    attestor_address: string;
+                    claim_signature: string;
+                    /** @description `embedded-attestor` only, and optional even then: the attestor's own Confidential Space attestation as an RS256 JWT. Attestors in production sign claims without returning one. */
+                    attestation_report?: string;
+                    /** @description `confidential-space` only: the runtime's TEE attestation, the same payload legacy proofs carry in the proof's top-level `teeAttestation`. Bound to the claim through `context.attestationNonce`. Preserve it exactly. */
+                    tee_attestation?: unknown;
                 };
-            } & {
-                [key: string]: unknown;
-            })[];
-            /** @description Extraction values carried by the proof. Consumers trust only the values returned by `verifyProof` after successful verification. */
+            }[];
+            /** @description Extraction values carried by the proof. Consumers trust only the values returned by `verifyRequestProof` after successful verification. */
             extractedParameterValues: unknown;
             /** @description Provider-supplied data. This field isn't verified. */
             publicData?: unknown;
             /** Format: int64 */
             taskId?: number;
-            teeAttestation?: {
-                [key: string]: unknown;
-            };
-        } & {
-            [key: string]: unknown;
+            /** @description Legacy TEE attestation payload. Clients preserve this value exactly; historical proofs may encode it as an object or a JSON string. */
+            teeAttestation?: unknown;
         };
-        /** @description The decoded payload of a signature-verified delivered result (the JWS itself is the `Jws` schema, signed ES256K by a key at the registered Verification Client JWKS URL). Consumers must compare `iss` with the registered issuer and use the separately registered JWKS URL; never derive a fetch URL from payload data. Consumers must also check `reclaimSessionId` against the session they created and `verification_session.status` for the outcome. `results` is present on success; `problem` (RFC 9457 shape) is set when the run failed. */
+        /** @description The decoded payload of a signature-verified delivered result (the JWS itself is the `Jws` schema, signed ES256K by Builder's key). Consumers must compare `iss` with their configured Builder origin and fetch the key from that origin's `/.well-known/jwks.json`; never derive a network destination from signed payload data. Consumers must also check `reclaimSessionId` against the session they created and `verification_session.status` for the outcome. `results` is present on success; `problem` (RFC 9457 shape) is set when the run failed. */
         VerificationResultPayload: {
-            /** @description Verification Client issuer URL. Compare this value with the registered issuer before fetching the separately registered JWKS. */
+            /** @description Builder issuer URL. Compare this with the configured Builder origin. */
             iss: string;
             /** @description The session id (same as `reclaimSessionId`). */
             sub: string;
@@ -5361,10 +6145,10 @@ export interface components {
             reclaimSessionId: components["schemas"]["SessionID"];
             verification_session: {
                 /** @enum {string} */
-                status: "success" | "rejected" | "error";
+                status: "success" | "rejected" | "error" | "cancelled";
                 /**
                  * Format: uuid
-                 * @description Registered Verification Client that signed this result. Use it to resolve the trusted issuer and JWKS configuration.
+                 * @description Registered claimant-facing Verification Client that produced the proofs. Builder signs the result.
                  */
                 verification_client_id: string;
                 /** @description The providers verified in this session, in run order. */
@@ -5391,7 +6175,7 @@ export interface components {
                     request_id?: string;
                     url?: string;
                     method?: string;
-                    /** @description Signed-envelope diagnostic copy. Don't trust this copy; use the data returned by `verifyProof`. */
+                    /** @description Signed-envelope diagnostic copy. Don't trust this copy; use the data returned by `verifyRequestProof`. */
                     extracted_parameters?: {
                         [key: string]: unknown;
                     };
@@ -5399,7 +6183,7 @@ export interface components {
                     content_hash?: string;
                     identifier?: string;
                     owner?: string;
-                    proof: components["schemas"]["LegacyProof"];
+                    proof: components["schemas"]["ReclaimRequestProof"];
                 } & {
                     [key: string]: unknown;
                 })[];
@@ -5413,24 +6197,6 @@ export interface components {
         } & {
             [key: string]: unknown;
         };
-        /** @description A callback subscription's delivery key, returned to the Verification Client. When `publicKeyJwk` is present the VC ECIES-encrypts the result for that org (its `canEncryptResult` is enabled); when absent the VC submits the plaintext signed JWS. */
-        CallbackKey: {
-            /** Format: uuid */
-            subscriptionId: string;
-            /** @description The org's secp256k1 (eth) public JWK to ECIES-encrypt the result to. Absent ⇒ deliver plaintext. */
-            publicKeyJwk?: components["schemas"]["JwkSecp256k1Public"];
-        };
-        /** @description One result payload for one callback subscription. The Verification Client signs the JWS and, when the org's `canEncryptResult` is enabled, ECIES-encrypts it to the org's eth public key; otherwise it submits the plaintext JWS. Either way the payload is carried in `payload` and the Builder stores + delivers it as a blind relay. */
-        CallbackDelivery: {
-            /** Format: uuid */
-            subscriptionId: string;
-            /** @description The signed result payload, as raw text — an ECIES ciphertext (base64url) when the org's `canEncryptResult` is enabled, otherwise the plaintext JWS JSON. Same raw form the callback envelope's `data` carries. */
-            payload: string;
-        };
-        /** @description Body for `POST /verifications/sessions/{sessionId}/result`. The Verification Client signs the JWS, encrypts it per callback subscription (keys fetched from the callback-keys endpoint), and submits one ciphertext per subscription. The Builder stores + delivers them; it never sees the plaintext result. */
-        SubmitVerificationResultRequest: {
-            deliveries: components["schemas"]["CallbackDelivery"][];
-        };
         /** @description Diagnostic state of one callback delivery (one per subscription × terminal event). Never carries the payload — use `GetVerificationResult` to pull the stored ciphertext. */
         VerificationDelivery: {
             subscriptionId: components["schemas"]["SubscriptionID"];
@@ -5511,6 +6277,8 @@ export interface components {
         };
     };
     parameters: {
+        /** @description Stable feature flag key. */
+        FeatureFlagKey: string;
         /** @description Exact canonical provider version, for example `1.4.2` or `1.4.3-fixed.1`. A prerelease build never falls back to another row. */
         ProviderVersionPath: string;
         /**
@@ -5809,14 +6577,8 @@ export interface operations {
     SiteBuild: {
         parameters: {
             query?: {
-                /** @description Selected data-point names. Repeat to pass several. Optional only so the "Build it with AI" entry can open the build page with just a missing `dataPoint`; the normal flow always passes ≥1. */
+                /** @description Selected data-point names. Repeat to pass several. Without any, the page redirects back to the site page to pick some. */
                 dataPoints?: string[];
-                /** @description When set, auto-opens the "Try with AI" dialog on load (the "Build it with AI" entry from the explore page). */
-                ai?: string;
-                /** @description Provider id that an AI authoring run just built and proved. Renders the build page in its "already built and verified" state — the provider and its data points instead of another Try. Ignored unless it names a provider the viewer can see on this domain with a live trunk version. */
-                aiBuilt?: components["schemas"]["ProviderID"];
-                /** @description A specific missing data point to seed the AI prompt with. */
-                dataPoint?: string;
                 mode?: components["schemas"]["ResolveMode"];
                 /** @description Source pins: `pins[<dataPoint>]=<providerId>`. Pins the provider that must prove that data point; a pinned provider is taken first and is never pruned. Omit (or send empty) for Auto. A comma-separated list is also accepted — the first id that covers the point wins. */
                 pins?: {
@@ -5985,106 +6747,47 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SiteAiProvider: {
+    DiscoverTeachAgent: {
         parameters: {
             query?: {
-                /** @description A specific missing data point to name in the prompt. */
+                /** @description Website the user wanted to verify data from. */
+                domain?: string;
+                /** @description Specific data point the user could not find. */
                 dataPoint?: string;
-                /** @description A failed sandbox session whose error seeds the prompt. */
-                sessionId?: components["schemas"]["SessionID"];
-                /** @description A provider to version (when owned + editable) instead of creating one. */
-                fromProviderId?: components["schemas"]["ProviderID"];
-                dataPoints?: string[];
-                mode?: components["schemas"]["ResolveMode"];
-                provided?: string[];
-                /** @description Source pins: `pins[<dataPoint>]=<providerId>`. Pins the provider that must prove that data point; a pinned provider is taken first and is never pruned. Omit (or send empty) for Auto. A comma-separated list is also accepted — the first id that covers the point wins. */
-                pins?: {
-                    [key: string]: string;
-                };
-                exclude?: components["schemas"]["ProviderID"][];
             };
             header?: never;
-            path: {
-                domain: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        /** @description Optional: which owned organization to author the provider under. */
-        requestBody?: {
-            content: {
-                "application/x-www-form-urlencoded": components["schemas"]["SiteAiProviderBody"];
-                "application/json": components["schemas"]["SiteAiProviderBody"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description The AI dialog body (editable prompt + Try with AI). */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "text/html": components["schemas"]["HtmlContent"];
-                };
-            };
+            200: components["responses"]["HTMLResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SiteTryAi: {
+    DiscoverAgentWizard: {
         parameters: {
-            query: {
-                /** @description The AI provider to try. */
-                providerId: components["schemas"]["ProviderID"];
-                /** @description Which owned organization the sandbox session runs under (defaults to the member's personal organization, or their first owned org). Must own the provider. */
-                orgId?: components["schemas"]["OrgID"];
-            };
+            query?: never;
             header?: never;
-            path: {
-                domain: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        /** @description An optional edited extraction prompt to save before trying. */
-        requestBody?: {
+        requestBody: {
             content: {
-                "application/x-www-form-urlencoded": components["schemas"]["SiteTryAiBody"];
-                "application/json": components["schemas"]["SiteTryAiBody"];
-            };
-        };
-        responses: {
-            /** @description Session created. */
-            201: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["VerificationSession"];
-                };
-            };
-            /** @description Sandbox verification quota exceeded. */
-            429: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/problem+json": components["schemas"]["Problem"];
+                "application/x-www-form-urlencoded": {
+                    /** @description The wizard's ready-to-paste task prompt. */
+                    basePrompt: string;
+                    /** @description Prefix of the wizard's element ids, so copy targets stay unique. */
+                    idPrefix: string;
+                    /** @description Picked coding agent; unknown values fall back to the first. */
+                    agent?: string;
+                    /** @description What the user is building, appended to the prompt. */
+                    building?: string;
+                    /** @description Label for `building` in the prompt. Defaults to "What I'm building". */
+                    lead?: string;
                 };
             };
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
-    DiscoverTeachAgent: {
-        parameters: {
-            query?: {
-                /** @description Website the user wanted to verify data from. */
-                domain?: string;
-                /** @description Specific data point the user could not find. */
-                dataPoint?: string;
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
         };
-        requestBody?: never;
         responses: {
             200: components["responses"]["HTMLResponse"];
             default: components["responses"]["ProblemResponse"];
@@ -6097,6 +6800,7 @@ export interface operations {
                 domain: string;
                 /** @description Selected data-point names. Repeat to pass several. */
                 dataPoints: string[];
+                /** @description Provider-selection strategy. See `ResolveMode`. */
                 mode?: components["schemas"]["ResolveMode"];
             };
             header?: never;
@@ -6249,7 +6953,7 @@ export interface operations {
     AdminProviders: {
         parameters: {
             query?: {
-                /** @description Free-text search on title, domain, or slug. */
+                /** @description Free-text search on title, domain, slug, or provider id (hyphens optional). */
                 q?: string;
                 visibility?: components["schemas"]["EntityVisibility"];
                 status?: components["schemas"]["EntityStatus"];
@@ -6324,8 +7028,10 @@ export interface operations {
     AdminOrgs: {
         parameters: {
             query?: {
-                /** @description Matches workspace name or any member's email. */
+                /** @description Matches workspace name, organization id (hyphens optional), or any member's email. */
                 q?: string;
+                /** @description Opaque cursor returned as `nextPageCursor` on a prior response. Pass it back as-is to fetch the next page; omit on the first request. Clients must not parse, modify, or fabricate cursors — the server reserves the encoding. */
+                cursor?: string;
             };
             header?: never;
             path?: never;
@@ -6355,6 +7061,7 @@ export interface operations {
                             /** Format: date-time */
                             updatedAt?: string;
                         }[];
+                        nextPageCursor?: string;
                     };
                 };
             };
@@ -6364,6 +7071,7 @@ export interface operations {
     AdminUsers: {
         parameters: {
             query?: {
+                /** @description Matches email, name, user id, or personal organization id (hyphens optional in ids). */
                 q?: string;
             };
             header?: never;
@@ -6421,19 +7129,25 @@ export interface operations {
     AdminSessions: {
         parameters: {
             query?: {
-                /** @description Only return sessions whose id starts with this value (matched at least 5 characters). */
+                /** @description Only return sessions whose id starts with this value, ignoring hyphens and case. Ignored under 5 characters. A full id matches exactly. */
                 sessionId?: string;
-                /** @description Only return sessions for this exact provider id. */
+                /** @description Only return sessions for this exact provider id (hyphens optional) or slug. */
                 providerId?: string;
-                /** @description Only return the session matching this claimant client id. */
+                /** @description Only return sessions created through this verification client. Hyphens are optional; an id that matches no client returns nothing. */
+                verificationClientId?: components["schemas"]["VerificationClientIDFilter"];
+                /** @description Only return sessions that ran a provider whose name, domain, slug, or id contains this text (an id matches with or without hyphens). Matches at most 50 providers. */
+                providerSearch?: string;
+                /** @description Only return the session matching this claimant client id (hyphens optional). */
                 claimantClientId?: string;
-                /** @description Only return sessions belonging to this exact organization id. */
+                /** @description Only return sessions belonging to this exact organization id (hyphens optional). */
                 orgId?: string;
                 status?: components["schemas"]["VerificationStatus"];
                 /** @description Only return sessions created at or after this time (inclusive). */
                 createdAfter?: string;
                 /** @description Only return sessions created at or before this time (inclusive). */
                 createdBefore?: string;
+                /** @description Opaque cursor returned as `nextPageCursor` on a prior response. Pass it back as-is to fetch the next page; omit on the first request. */
+                cursor?: string;
             };
             header?: never;
             path?: never;
@@ -6450,6 +7164,7 @@ export interface operations {
                     "text/html": components["schemas"]["HtmlContent"];
                     "application/json": {
                         items: components["schemas"]["VerificationSession"][];
+                        nextPageCursor?: string;
                     };
                 };
             };
@@ -6457,6 +7172,45 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    AdminAnalytics: {
+        parameters: {
+            query?: {
+                /** @description Restrict every section to this organization. */
+                orgId?: components["schemas"]["OrgIDFilter"];
+                /** @description Only count sessions that ran a provider whose name, domain, slug, or id contains this text (an id matches with or without hyphens). Matches at most 50 providers. Applies to the session and verification sections, not revenue or usage. */
+                providerSearch?: string;
+                /** @description Only count sessions created through this verification client. Applies to the session and verification sections, not revenue or usage. The zkFetch section is left out unless this is the zkfetch client. Hyphens are optional; an id that matches no client returns nothing. */
+                verificationClientId?: components["schemas"]["VerificationClientIDFilter"];
+                /** @description Window start, inclusive. Defaults to 30 days before `to`. */
+                from?: components["schemas"]["DateWindowBound"];
+                /** @description Window end, exclusive. Defaults to now. */
+                to?: components["schemas"]["DateWindowBound"];
+                /** @description Set to `csv` to download one section as a spreadsheet instead of rendering the page. Pair it with `section`. A CSV export returns up to 1000 rows, where the page shows only the leading rows of each ranked section. */
+                format?: "csv";
+                /** @description Which section `format=csv` exports. Each section has its own columns, so one download holds one section. Defaults to `providers`. */
+                section?: "providers" | "revenue" | "usage";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                    "application/json": components["schemas"]["AdminAnalytics"];
+                    "text/csv": string;
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     AdminCallbackDlq: {
         parameters: {
             query?: never;
@@ -6485,6 +7239,7 @@ export interface operations {
     AdminThemes: {
         parameters: {
             query?: {
+                /** @description Matches theme label, organization name, theme id, or organization id (hyphens optional in ids). */
                 q?: string;
             };
             header?: never;
@@ -6638,9 +7393,9 @@ export interface operations {
     AdminBillingTransactions: {
         parameters: {
             query?: {
-                orgId?: components["schemas"]["OrgID"];
-                from?: string;
-                to?: string;
+                orgId?: components["schemas"]["OrgIDFilter"];
+                from?: components["schemas"]["DateWindowBound"];
+                to?: components["schemas"]["DateWindowBound"];
                 limit?: number;
                 offset?: number;
             };
@@ -6967,7 +7722,7 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    AdminVerificationClients: {
+    AdminFeatureFlags: {
         parameters: {
             query?: never;
             header?: never;
@@ -6976,7 +7731,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Ok */
+            /** @description Current feature flags */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -6984,7 +7739,7 @@ export interface operations {
                 content: {
                     "text/html": string;
                     "application/json": {
-                        items: components["schemas"]["VerificationClient"][];
+                        items: components["schemas"]["VerificationFeatureFlag"][];
                     };
                 };
             };
@@ -6992,7 +7747,7 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    CreateVerificationClient: {
+    CreateFeatureFlag: {
         parameters: {
             query?: never;
             header?: never;
@@ -7001,97 +7756,125 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateVerificationClientRequest"];
-                "application/x-www-form-urlencoded": components["schemas"]["CreateVerificationClientRequest"];
+                "application/json": components["schemas"]["CreateVerificationFeatureFlagRequest"];
             };
         };
         responses: {
-            /** @description Registered */
+            /** @description Feature flag created */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["VerificationClientWithToken"];
+                    "application/json": components["schemas"]["VerificationFeatureFlag"];
                 };
             };
+            400: components["responses"]["ProblemResponse"];
             403: components["responses"]["ForbiddenResponse"];
             409: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
-    IssueVerificationClientToken: {
+    UpdateFeatureFlag: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                clientId: string;
+                /** @description Stable feature flag key. */
+                flagKey: components["parameters"]["FeatureFlagKey"];
             };
             cookie?: never;
         };
-        requestBody?: {
+        requestBody: {
             content: {
-                "application/json": components["schemas"]["IssueVerificationClientTokenRequest"];
-                "application/x-www-form-urlencoded": components["schemas"]["IssueVerificationClientTokenRequest"];
+                "application/json": components["schemas"]["UpdateVerificationFeatureFlagRequest"];
             };
         };
         responses: {
-            /** @description Issued */
-            201: {
+            /** @description New feature flag revision */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["VerificationClientWithToken"];
+                    "application/json": components["schemas"]["VerificationFeatureFlag"];
                 };
             };
+            400: components["responses"]["ProblemResponse"];
             403: components["responses"]["ForbiddenResponse"];
             404: components["responses"]["ProblemResponse"];
+            409: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
-    RevokeVerificationClientToken: {
+    ListFeatureFlagRevisions: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                clientId: string;
-                tokenId: string;
+                /** @description Stable feature flag key. */
+                flagKey: components["parameters"]["FeatureFlagKey"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Revoked */
-            204: {
+            /** @description Revision history */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["VerificationFeatureFlagRevision"][];
+                    };
+                };
             };
             403: components["responses"]["ForbiddenResponse"];
-            404: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
-    UpdateVerificationClient: {
+    AdminVerificationClients: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                clientId: string;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                    "application/json": {
+                        items: components["schemas"]["VerificationClient"][];
+                    };
+                };
             };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateVerificationClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["UpdateVerificationClientRequest"];
-                "application/x-www-form-urlencoded": components["schemas"]["UpdateVerificationClientRequest"];
+                "application/json": components["schemas"]["CreateVerificationClientRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["CreateVerificationClientRequest"];
             };
         };
         responses: {
-            /** @description Updated */
-            200: {
+            /** @description Registered */
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -7100,11 +7883,11 @@ export interface operations {
                 };
             };
             403: components["responses"]["ForbiddenResponse"];
-            404: components["responses"]["ProblemResponse"];
+            409: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
-    AddVerificationClientKey: {
+    UpdateVerificationClient: {
         parameters: {
             query?: never;
             header?: never;
@@ -7115,13 +7898,13 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["AddVerificationClientKeyRequest"];
-                "application/x-www-form-urlencoded": components["schemas"]["AddVerificationClientKeyRequest"];
+                "application/json": components["schemas"]["UpdateVerificationClientRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["UpdateVerificationClientRequest"];
             };
         };
         responses: {
-            /** @description Registered */
-            201: {
+            /** @description Updated */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -7131,39 +7914,85 @@ export interface operations {
             };
             403: components["responses"]["ForbiddenResponse"];
             404: components["responses"]["ProblemResponse"];
-            /** @description This key (ETH address) is already registered. */
-            409: {
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminSiteBanners: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Current banner content, as raw admin-authored HTML */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/problem+json": components["schemas"]["Problem"];
+                    "text/html": string;
+                    "application/json": components["schemas"]["SiteBanners"];
                 };
             };
+            403: components["responses"]["ForbiddenResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
-    RevokeVerificationClientKey: {
+    UpdateAnnouncementBar: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                clientId: string;
-                keyId: string;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AnnouncementBar"];
+                "application/x-www-form-urlencoded": components["schemas"]["AnnouncementBar"];
+            };
+        };
+        responses: {
+            /** @description Saved announcement bar, as raw admin-authored HTML */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AnnouncementBar"];
+                };
             };
+            400: components["responses"]["ProblemResponse"];
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    UpdateScrollingBanner: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ScrollingBanner"];
+                "application/x-www-form-urlencoded": components["schemas"]["ScrollingBannerForm"];
+            };
+        };
         responses: {
-            /** @description Revoked */
-            204: {
+            /** @description Saved scrolling ticker, as raw admin-authored HTML */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ScrollingBanner"];
+                };
             };
+            400: components["responses"]["ProblemResponse"];
             403: components["responses"]["ForbiddenResponse"];
-            404: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
@@ -7237,27 +8066,58 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    VerificationPage: {
+    SharePage: {
         parameters: {
             query?: {
-                /** @description Exact `1` enables diagnostic mode for this launch. */
+                /** @description Required for `builder`, `portals`, `verifier-app`, and `reclaim-browser-extension` (400 without it — each needs it to build a destination or a handoff payload). Optional and ignored for `inapp-sdk`/`zkfetch`'s static pages, which render even without one. */
+                sessionId?: components["schemas"]["SessionID"];
+                /** @description Verification URL contract version, always `2` on a link Builder generates. Accepted so the query string matches what every other Verification Client parses; only the `builder` redirect forwards it onward. */
+                api?: "2";
+                /** @description Backend-derived echo of the session's `diagnostics` field, carried through to the launched destination unchanged. See the same parameter on `VerificationPage`. */
                 diag?: "1";
-                /** @description Internal marker added after the claimant accepts organization consent. */
-                consent?: "1";
             };
             header?: never;
             path: {
-                sessionId: components["schemas"]["SessionID"];
+                client: "builder" | "portals" | "verifier-app" | "inapp-sdk" | "reclaim-browser-extension" | "zkfetch";
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
             200: components["responses"]["HTMLResponse"];
+            /** @description Redirect (`builder` to `/v/{sessionId}`, `portals` to the portal). */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             default: components["responses"]["ProblemResponse"];
         };
     };
-    ReportClaimant: {
+    VerificationPage: {
+        parameters: {
+            query?: {
+                /** @description Verification URL contract version, always `2` on a link Builder generates. `/share/builder` forwards it here; the page itself ignores it. */
+                api?: "2";
+                /** @description Backend-derived echo of the session's `diagnostics` field (see CreateVerificationSessionRequest.diagnostics), present on `verificationUrl` for a diagnostic session. Builder reads `diagnostics` from the session, not this parameter, so setting it by hand on the address bar has no effect. */
+                diag?: "1";
+                /** @description Internal marker added after the claimant accepts organization consent. */
+                consent?: "1";
+            };
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ReportClaimant: {
         parameters: {
             query?: never;
             header?: never;
@@ -7328,10 +8188,7 @@ export interface operations {
     };
     VerificationStatus: {
         parameters: {
-            query?: {
-                /** @description When set, the fragment is mirrored inside a dialog on the build page rather than being the end-user's own verification page — so the terminal message points at the dialog, not the window. */
-                embedded?: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 sessionId: components["schemas"]["SessionID"];
@@ -7438,13 +8295,79 @@ export interface operations {
                             [key: string]: unknown;
                         }[];
                         /** @description Trusted EIP-191 proof signer addresses. Consumers compare locally recovered proof signers with this registry. */
-                        "x-reclaim-attestors"?: string[];
+                        "x-reclaim-attestors": string[];
+                        /** @description Trusted sha256 image digests for attestor containers. Server-side proof verification pins each attestor TEE attestation to this allowlist. */
+                        "x-reclaim-attestor-image-digests": string[];
                     };
                 };
             };
             default: components["responses"]["ProblemResponse"];
         };
     };
+    AppleAppSiteAssociation: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        applinks: {
+                            details: {
+                                appIDs: string[];
+                                components: {
+                                    "/"?: string;
+                                    "?"?: {
+                                        [key: string]: string;
+                                    };
+                                }[];
+                            }[];
+                        };
+                        appclips?: {
+                            apps?: string[];
+                        };
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AssetLinksJson: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        relation: string[];
+                        target: {
+                            namespace: string;
+                            package_name: string;
+                            sha256_cert_fingerprints: string[];
+                        };
+                    }[];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     OpenApiSpec: {
         parameters: {
             query?: never;
@@ -7707,8 +8630,12 @@ export interface operations {
     ListOrgs: {
         parameters: {
             query?: {
+                /** @description Keeps organizations whose name or id (hyphens optional) contains this text. */
+                q?: string;
                 /** @description Opaque cursor returned as `nextPageCursor` on a prior response. Pass it back as-is to fetch the next page; omit on the first request. Clients must not parse, modify, or fabricate cursors — the server reserves the encoding. */
                 cursor?: string;
+                /** @description HTML only. Renders the New organization dialog already open, so a link from another page can land on it. */
+                newOrg?: boolean;
             };
             header?: never;
             path?: never;
@@ -7817,7 +8744,27 @@ export interface operations {
         parameters: {
             query?: {
                 /** @description Which section to show (server-rendered tab); unknown values fall back to the first. */
-                tab?: "connect" | "providers" | "members" | "themes" | "sessions" | "billing";
+                tab?: "overview" | "connect" | "integrate" | "providers" | "members" | "themes" | "settings" | "sessions" | "billing";
+                /** @description Integrate tab only. Which integration path to show: a coding agent over MCP, the client package, or plain HTTP. */
+                track?: "agent" | "sdk" | "http";
+                /** @description Integrate tab, agent track only. Which coding agent's install command to show. */
+                agent?: "claude" | "cursor" | "opencode" | "codex" | "others";
+                /** @description Dashboard tab only. Scopes the report to sessions that ran this provider. Options come from `GET /orgs/{orgId}/providers/used`. */
+                providerId?: components["schemas"]["ProviderID"];
+                /** @description Integrate tab, HTTP track only. Which Verification Client the create-session example targets. `auto` (the default) leaves `verificationClientUrl` out. */
+                client?: "auto" | "portals" | "verifier-app" | "reclaim-browser-extension" | "builder" | "inapp-sdk";
+                /** @description Dashboard tab only. Start of the reporting period; defaults to 30 days before `to`. */
+                from?: components["schemas"]["DateWindowBound"];
+                /** @description Dashboard tab only. End of the reporting period; defaults to now. */
+                to?: components["schemas"]["DateWindowBound"];
+                /** @description Dashboard tab only. Scopes the report to sessions created through this verification client. Hyphens are optional; an id that matches no client returns nothing. */
+                verificationClientId?: components["schemas"]["VerificationClientIDFilter"];
+                /** @description Providers tab only. Keeps providers whose title, domain, or id (hyphens optional) contains this text. */
+                q?: string;
+                /** @description Providers tab only. Keeps providers with this visibility. */
+                visibility?: "PUBLIC" | "PRIVATE";
+                /** @description Providers tab only. Renders the New provider dialog already open, so a link from another page can land on it. */
+                newProvider?: boolean;
                 /** @description Post-checkout status signal set by Stripe redirect (`success_url` / `cancel_url`), the card-save flow, and the credit top-up. Drives a one-shot notice and deep-links to the Billing tab; nothing else about the page depends on it. */
                 billing?: "success" | "cancelled" | "changed" | "credits";
             };
@@ -8929,6 +9876,7 @@ export interface operations {
                 };
             };
             403: components["responses"]["ForbiddenResponse"];
+            409: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
@@ -9724,18 +10672,55 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    ListOrgUsedProviders: {
+        parameters: {
+            query?: {
+                /** @description Keeps providers whose name, domain, or id (hyphens optional) contains this text. */
+                q?: string;
+                /** @description Opaque cursor returned as `nextPageCursor` on a prior response. Pass it back as-is to fetch the next page; omit on the first request. Clients must not parse, modify, or fabricate cursors — the server reserves the encoding. */
+                cursor?: string;
+                /** @description Page size. Defaults to 50. */
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["OrgUsedProvider"][];
+                        nextPageCursor?: string;
+                    };
+                    "text/html": components["schemas"]["HtmlContent"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     ListOrgVerificationSessions: {
         parameters: {
             query?: {
-                /** @description Only return sessions whose id starts with this value (matched at least 5 characters). */
+                /** @description Only return sessions whose id starts with this value, ignoring hyphens and case. Ignored under 5 characters. A full id matches exactly. */
                 sessionId?: string;
-                /** @description Only return sessions for this exact provider id. */
+                /** @description Only return sessions for this exact provider id (hyphens optional) or slug. */
                 providerId?: string;
+                /** @description Only return sessions created through this verification client. Hyphens are optional; an id that matches no client returns nothing. */
+                verificationClientId?: components["schemas"]["VerificationClientIDFilter"];
                 /** @description Only return sessions in this status. */
                 status?: components["schemas"]["VerificationStatus"];
                 /** @description Only return sessions resolved to this exact provider version. */
                 resolvedVersion?: string;
-                /** @description Only return the session matching this claimant client id. */
+                /** @description Only return the session matching this claimant client id (hyphens optional). */
                 claimantClientId?: string;
                 /** @description Only return sessions created at or after this time (inclusive). */
                 createdAfter?: string;
@@ -9771,7 +10756,10 @@ export interface operations {
     };
     GetOrgSession: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Only list events from this stage of the run. */
+                phase?: "session" | "client" | "auth" | "provider" | "claim" | "result";
+            };
             header?: never;
             path: {
                 orgId: components["schemas"]["OrgID"];
@@ -9787,6 +10775,30 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    RetryOrgSessionCallback: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deliveries re-enqueued; returns to the session page. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     GetVerificationFunnel: {
         parameters: {
             query: {
@@ -9819,6 +10831,38 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    GetOrgVerificationAnalytics: {
+        parameters: {
+            query?: {
+                from?: components["schemas"]["DateWindowBound"];
+                to?: components["schemas"]["DateWindowBound"];
+                /** @description Only count sessions that ran this provider. */
+                providerId?: components["schemas"]["ProviderID"];
+                /** @description Only count sessions created through this verification client. The zkFetch section is left out unless this is the zkfetch client. Hyphens are optional; an id that matches no client returns nothing. */
+                verificationClientId?: components["schemas"]["VerificationClientIDFilter"];
+            };
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Verification analytics */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": components["schemas"]["HtmlContent"];
+                    "application/json": components["schemas"]["VerificationAnalytics"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     CreateVerificationSession: {
         parameters: {
             query?: never;
@@ -9917,34 +10961,126 @@ export interface operations {
         responses: {
             /** @description Ok */
             200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationRecipeList"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    BootstrapVerificationClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Session and resolved recipes */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationClientBootstrap"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ResolveVerificationRuntimeConfig: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ResolveVerificationRuntimeConfigRequest"];
+            };
+        };
+        responses: {
+            /** @description The session's feature configuration */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VerificationRuntimeConfig"];
+                };
+            };
+            403: components["responses"]["ProblemResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    CreateVerificationAttestorAuth: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": Record<string, never>;
+            };
+        };
+        responses: {
+            /** @description Base64-encoded legacy attestor authorization, or empty */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/plain": string;
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    SubmitVerificationClientResult: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SubmitVerificationClientResultRequest"];
+            };
+        };
+        responses: {
+            /** @description Result stored and callback deliveries enqueued */
+            202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description One recipe per session provider, in run order. */
-                        recipes: {
-                            providerId: components["schemas"]["ProviderID"];
-                            /** @description Display-only provider branding. Verification Clients can use it in claimant-facing UI; it does not affect recipe execution or proof verification. */
-                            provider: components["schemas"]["VerificationBrand"];
-                            resolvedVersion: string;
-                            initialUrl: string;
-                            /** @description Legacy-only preference. Builder-mode sessions run the structured recipe and do not enable AI or manual verification. Dual-mode clients may use this value only on their legacy path. */
-                            preferAiAgent: boolean;
-                            /** @description The version's webSettings geoLocation template (`{{DYNAMIC_GEO}}` / `{{DYNAMIC_GEO_SECRET}}` / '' / ISO code), applied to this provider's requests. */
-                            geoLocation?: string;
-                            /** @description The version's webSettings.jsUserScripts — page JavaScript the Verification Client installs to run before every page load (before navigating to initialUrl), to drive login/navigation so the target requests fire. */
-                            jsUserScripts?: string;
-                            /** @description Browser client options from the resolved provider version. Verification Clients apply these options before opening the provider. */
-                            clientOptions?: components["schemas"]["ClientOptions"];
-                            requests: components["schemas"]["RequestSelection"][];
-                            /** @description The version's allowedJsRequests — request-selection templates (with optional templateParams expansion) for requests fired by injected JS, which the Verification Client may additionally prove. */
-                            allowedJsRequests?: components["schemas"]["RequestSelectionTemplate"][];
-                        }[];
+                        deliveries: number;
                     };
                 };
             };
-            404: components["responses"]["ProblemResponse"];
+            400: components["responses"]["ProblemResponse"];
+            409: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
@@ -10111,41 +11247,6 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    ListSessionCallbackKeys: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                sessionId: components["schemas"]["SessionID"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Ok */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        items: components["schemas"]["CallbackKey"][];
-                    };
-                };
-            };
-            404: components["responses"]["ProblemResponse"];
-            /** @description No subscription on the session's organization matches the terminal event — the result would be encrypted for zero keys and therefore undeliverable (for example, the org deleted its last matching subscription mid-verification). Re-register a subscription and retry. */
-            409: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/problem+json": components["schemas"]["Problem"];
-                };
-            };
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
     GetVerificationResult: {
         parameters: {
             query?: never;
@@ -10180,37 +11281,6 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SubmitVerificationResult: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                sessionId: components["schemas"]["SessionID"];
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["SubmitVerificationResultRequest"];
-            };
-        };
-        responses: {
-            /** @description Result stored and deliveries enqueued. */
-            202: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        /** @description Number of deliveries stored and enqueued. Submitted targets whose subscription no longer matches the session's org + terminal event are skipped, so this may be less than the number of items submitted. */
-                        deliveries: number;
-                    };
-                };
-            };
-            404: components["responses"]["ProblemResponse"];
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
     RetryVerificationCallback: {
         parameters: {
             query?: never;
@@ -10280,4 +11350,47 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    CreateFetchAuthorization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["FetchAuthorizationRequest"];
+            };
+        };
+        responses: {
+            /** @description Attestor authorization minted. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["FetchAuthorization"];
+                };
+            };
+            /** @description Overage paused — the organization is past its plan's `ZKFETCH` allowance, its prepaid credit balance is exhausted, and its per-pool credit-exhaustion allowance is depleted. Requests within the plan allowance still succeed; add credits to resume overage. */
+            402: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            /** @description ZKFETCH quota exceeded for the current billing period. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
 }