@reclaimprotocol/client 0.1.32 → 0.1.33

package/lib/routes.gen.d.ts

@@ -127,10 +127,6 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/oauth/consent";
     };
-    readonly ConvertOrgToRegular: {
-        readonly method: "post";
-        readonly path: "/orgs/{orgId}/convert";
-    };
     readonly CreateAgentBrowserSession: {
         readonly method: "post";
         readonly path: "/orgs/{orgId}/agent-browser-sessions";
@@ -251,9 +247,9 @@ export declare const ROUTES: {
         readonly method: "delete";
         readonly path: "/orgs/{orgId}/themes/{themeId}";
     };
-    readonly DiscoverAgentWizard: {
-        readonly method: "post";
-        readonly path: "/discover/agent-wizard";
+    readonly Discover: {
+        readonly method: "get";
+        readonly path: "/discover";
     };
     readonly DiscoverDataPoints: {
         readonly method: "get";
@@ -263,10 +259,6 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/discover/resolve";
     };
-    readonly DiscoverTeachAgent: {
-        readonly method: "get";
-        readonly path: "/discover/teach";
-    };
     readonly DiscoverWebsites: {
         readonly method: "get";
         readonly path: "/discover/websites";
@@ -463,6 +455,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/openapi.yaml";
     };
+    readonly OpenIntegrate: {
+        readonly method: "get";
+        readonly path: "/integrate";
+    };
     readonly OrgInvitePage: {
         readonly method: "get";
         readonly path: "/orgs/{orgId}/invite";
@@ -583,10 +579,6 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/site/{domain}/alternative";
     };
-    readonly SiteBuildRepair: {
-        readonly method: "get";
-        readonly path: "/site/{domain}/repair";
-    };
     readonly SiteBuildTry: {
         readonly method: "post";
         readonly path: "/site/{domain}/try";

package/lib/routes.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:099a5bcf4fba).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:3e28ff308da3).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -36,7 +36,6 @@ export const ROUTES = {
     "CancelPublicListingRequest": { "method": "post", "path": "/providers/{providerId}/versions/{version}/cancel-review" },
     "ChangeOrgPlan": { "method": "post", "path": "/orgs/{orgId}/billing/change-plan" },
     "ConsentPage": { "method": "get", "path": "/oauth/consent" },
-    "ConvertOrgToRegular": { "method": "post", "path": "/orgs/{orgId}/convert" },
     "CreateAgentBrowserSession": { "method": "post", "path": "/orgs/{orgId}/agent-browser-sessions" },
     "CreateBillingCheckoutSession": { "method": "post", "path": "/orgs/{orgId}/billing/checkout" },
     "CreateBillingPortalSession": { "method": "post", "path": "/orgs/{orgId}/billing/portal" },
@@ -67,10 +66,9 @@ export const ROUTES = {
     "DeleteProvider": { "method": "delete", "path": "/providers/{providerId}" },
     "DeleteProviderVersion": { "method": "delete", "path": "/providers/{providerId}/versions/{version}" },
     "DeleteTheme": { "method": "delete", "path": "/orgs/{orgId}/themes/{themeId}" },
-    "DiscoverAgentWizard": { "method": "post", "path": "/discover/agent-wizard" },
+    "Discover": { "method": "get", "path": "/discover" },
     "DiscoverDataPoints": { "method": "get", "path": "/discover/data-points" },
     "DiscoverResolve": { "method": "get", "path": "/discover/resolve" },
-    "DiscoverTeachAgent": { "method": "get", "path": "/discover/teach" },
     "DiscoverWebsites": { "method": "get", "path": "/discover/websites" },
     "DisposeAgentBrowserSession": { "method": "delete", "path": "/orgs/{orgId}/agent-browser-sessions/{browserSessionId}" },
     "DisposeVerificationSession": { "method": "post", "path": "/v/{sessionId}/dispose" },
@@ -120,6 +118,7 @@ export const ROUTES = {
     "Logout": { "method": "post", "path": "/logout" },
     "MakePrivate": { "method": "post", "path": "/providers/{providerId}/make-private" },
     "OpenApiSpec": { "method": "get", "path": "/openapi.yaml" },
+    "OpenIntegrate": { "method": "get", "path": "/integrate" },
     "OrgInvitePage": { "method": "get", "path": "/orgs/{orgId}/invite" },
     "PatchVerificationClaimant": { "method": "patch", "path": "/verifications/sessions/{sessionId}/claimant" },
     "ProviderPreviewImage": { "method": "get", "path": "/providers/{providerId}/preview.png" },
@@ -150,7 +149,6 @@ export const ROUTES = {
     "SharePage": { "method": "get", "path": "/share/{client}" },
     "SiteBuild": { "method": "get", "path": "/site/{domain}/build" },
     "SiteBuildAlternative": { "method": "get", "path": "/site/{domain}/alternative" },
-    "SiteBuildRepair": { "method": "get", "path": "/site/{domain}/repair" },
     "SiteBuildTry": { "method": "post", "path": "/site/{domain}/try" },
     "Sitemap": { "method": "get", "path": "/sitemap.xml" },
     "SitePage": { "method": "get", "path": "/site/{domain}" },

package/lib/types/openapi.gen.d.ts

@@ -11,8 +11,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Discover home — search a website to verify
-         * @description Default home page. A website-first search: the visitor types a website and picks one to continue to `/site/{domain}`, where they choose what data to prove. Renders popular websites below the search, plus tag pills to narrow them.
+         * Home — sign-in or Discover
+         * @description Signed in, renders Discover (see `GET /discover`). Signed out, renders the sign-in page; a signed-out link carrying Discover's `q` / `tag` redirects to `/discover` with them.
          */
         get: operations["Index"];
         put?: never;
@@ -23,6 +23,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/discover": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Discover — search a website to verify
+         * @description The Catalog. A website-first search: the visitor types a website and picks one to continue to `/site/{domain}`, where they choose what data to prove. Renders popular websites below the search, plus tag pills to narrow them.
+         */
+        get: operations["Discover"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/providers": {
         parameters: {
             query?: never;
@@ -212,7 +232,7 @@ export interface paths {
         put?: never;
         /**
          * Mint a SANDBOX test verification session for the selection
-         * @description Creates a real SANDBOX verification session for the selected data points, so the signed-in member can test the flow on `/v/{sessionId}` without registering a callback subscription. Runs under an organization the member owns (`orgId` in the body; defaults to their personal organization). The provider set is recomputed server-side from the selection.
+         * @description Creates a real SANDBOX verification session for the selected data points, so the signed-in member can test the flow on `/v/{sessionId}` without registering a callback subscription. Runs under an organization the member owns (`orgId` in the body; defaults to their default organization). The provider set is recomputed server-side from the selection.
          */
         post: operations["SiteBuildTry"];
         delete?: never;
@@ -221,26 +241,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/site/{domain}/repair": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Failure-aware "Repair with an AI coding agent" wizard fragment
-         * @description Body of the build page's repair dialog, lazy-loaded after a sandbox Try fails so the agent prompt includes the REAL failure (which provider(s) failed + the error reason, read from the session's event log) and the resolved provider set. HTML / HTMX fragment.
-         */
-        get: operations["SiteBuildRepair"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/site/{domain}/alternative": {
         parameters: {
             query?: never;
@@ -261,7 +261,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/discover/teach": {
+    "/integrate": {
         parameters: {
             query?: never;
             header?: never;
@@ -269,10 +269,10 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * “Teach our agent” instructions for a missing website / data point
-         * @description Returns the "Teach our agent" panel shown when a website or data point a user wants does not exist yet: steps to install the Reclaim MCP server plus a ready-to-copy prompt, templated with the requested `domain` and (optionally) `dataPoint`, that instructs an agent to author the missing provider. HTML / HTMX only (a dialog fragment).
+         * Go to the Integrate page
+         * @description Where the "Build it with an agent" links lead, from pages that don't know the viewer's organization. Signed in, redirects to the Integrate page of the console's selected organization (else the viewer's default organization), on its coding-agent track. Signed out, redirects to sign-in and back here.
          */
-        get: operations["DiscoverTeachAgent"];
+        get: operations["OpenIntegrate"];
         put?: never;
         post?: never;
         delete?: never;
@@ -281,26 +281,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/discover/agent-wizard": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Setup and prompt for the coding agent picked in the wizard
-         * @description Returns the last step of the "Build with an AI coding agent" wizard for the picked `agent`: how to attach the Reclaim MCP server, and the `basePrompt` with the optional `building` description appended. HTML / HTMX only (a fragment swapped into the open wizard).
-         */
-        post: operations["DiscoverAgentWizard"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/discover/resolve": {
         parameters: {
             query?: never;
@@ -1575,7 +1555,7 @@ export interface paths {
         put?: never;
         /**
          * Create an organization
-         * @description Creates a new `ORG`-kind organization with the caller as its first `OWNER`. The personal org is created automatically at user signup and is not created via this endpoint.
+         * @description Creates a new `ORG`-kind organization with the caller as its first `OWNER`. Every user gets a default organization at sign-up, and it counts toward their org-creation limit (1 active organization unless Reclaim support raises it). Past the limit this returns `409`; contact support@reclaimprotocol.org to raise the limit or archive an organization.
          */
         post: operations["CreateOrg"];
         delete?: never;
@@ -1636,8 +1616,8 @@ export interface paths {
         put?: never;
         post?: never;
         /**
-         * Delete a shared organization
-         * @description Owner only. `PERSONAL` organizations cannot be deleted independently of their owning user; deleting a personal org happens implicitly via `DELETE /me`.
+         * Archive an organization
+         * @description Reclaim staff only; owners ask support@reclaimprotocol.org to archive. Archives the organization, which frees a slot under its creator's org-creation limit. `403` for anyone else.
          */
         delete: operations["DeleteOrg"];
         options?: never;
@@ -1649,26 +1629,6 @@ export interface paths {
         patch: operations["UpdateOrg"];
         trace?: never;
     };
-    "/orgs/{orgId}/convert": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Convert a personal organization to a regular organization
-         * @description Owner only. One-way: flips a `PERSONAL` organization (auto-provisioned at sign-up, sandbox-only, single-member) to a regular `ORG`, unlocking billing, plan & usage, and member invites. All providers, sessions, credentials and themes carry over. `409` when the organization is not `PERSONAL`.
-         */
-        post: operations["ConvertOrgToRegular"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/orgs/{orgId}/members": {
         parameters: {
             query?: never;
@@ -1684,7 +1644,7 @@ export interface paths {
         put?: never;
         /**
          * Invite a member to an organization
-         * @description Owner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an invite email with an accept link is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` only when the invitee explicitly accepts via `POST /orgs/{orgId}/invite`. `PERSONAL` organizations reject this call (409).
+         * @description Owner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an invite email with an accept link is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` only when the invitee explicitly accepts via `POST /orgs/{orgId}/invite`.
          */
         post: operations["AddOrgMember"];
         delete?: never;
@@ -2742,16 +2702,32 @@ export interface paths {
         /**
          * Create a verification session
          * @description Creates a verification session for an end-user to complete.
+         *
+         *     **The response's `verificationUrl` is the one thing you need.** Send
+         *     your end user to it (redirect, link, or QR code): that is where they
+         *     verify. Everything else in the response is for tracking the session.
+         *
          *     Authenticated by the consumer's `OrgToken`; the session is scoped to
          *     the resolved organization. The request carries no callback URLs —
          *     results are delivered to the org's pre-registered callback
          *     subscriptions.
          *
+         *     `verificationClientUrl` picks where the user verifies. Omit it to use
+         *     the Reclaim Portal. The built-in clients are:
+         *
+         *     | Client | `verificationClientUrl` |
+         *     | --- | --- |
+         *     | Reclaim Portal (default) | `https://build.reclaimprotocol.org/share/portals` |
+         *     | Verifier app | `https://build.reclaimprotocol.org/share/verifier-app` |
+         *     | Browser extension | `https://build.reclaimprotocol.org/share/reclaim-browser-extension` |
+         *     | Builder browser | `https://build.reclaimprotocol.org/share/builder` |
+         *     | In-app SDK | `https://build.reclaimprotocol.org/share/inapp-sdk` |
+         *
          *         curl -X POST $BASE/verifications/sessions \
          *           -H "Authorization: Bearer $ORG_TOKEN" \
          *           -H 'Content-Type: application/json' \
          *           -d '{"providers":[{"providerId":"…","version":"^1.2.0"}],"context":{},
-         *                "verificationClientUrl":"https://verify.example.com/"}'
+         *                "verificationClientUrl":"https://build.reclaimprotocol.org/share/portals"}'
          *
          *     Fails with `409 Conflict` if the organization has no callback
          *     subscription (there would be nowhere to deliver the result).
@@ -3059,8 +3035,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get the stored encrypted result(s) for a session
-         * @description Returns the stored Builder-signed result payloads for this session — one item per callback subscription. Readable only by the consumer that created the session. The consumer's `OrgToken` must resolve to the session's organization. A pull-based companion to push delivery: when the organization enables encryption, Builder returns an ECIES ciphertext (base64url) that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted. Treat every returned payload as untrusted until `verifyResultFull` succeeds with the Builder issuer and JWKS URL.
+         * Get the stored result(s) for a session
+         * @description Returns the session's callback deliveries with their payloads — one item per callback subscription and event. Readable only by the consumer that created the session. The consumer's `OrgToken` must resolve to the session's organization. A recovery companion to push delivery, not a replacement for the callback: a signed result's `payload` (which can carry proofs) is kept only until its callback is delivered, or for 7 days while undelivered, then becomes `null`. When the organization enables encryption, a signed result is an ECIES ciphertext (base64url) that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted. Treat every returned payload as untrusted until `verifyResultFull` succeeds with the Builder issuer and JWKS URL.
          */
         get: operations["GetVerificationResult"];
         put?: never;
@@ -3082,7 +3058,7 @@ export interface paths {
         put?: never;
         /**
          * Re-enqueue callback delivery for a session
-         * @description Re-enqueues delivery of a session's stored result to its callback subscriptions. Use this after `list_verification_deliveries` shows a `failed` or dead-lettered delivery, once the consumer's callback endpoint is reachable again and answers 2xx — it re-attempts every not-yet-delivered callback for the session. Usable by the session creator (authenticated by the consumer's `OrgToken`) to recover from a transient consumer-side outage.
+         * @description Re-enqueues delivery of a session's stored result to its callback subscriptions. Use this after `list_verification_deliveries` shows a `failed` or dead-lettered delivery, once the consumer's callback endpoint is reachable again and answers 2xx — it re-attempts every not-yet-delivered callback for the session. Usable by the session creator (authenticated by the consumer's `OrgToken`) to recover from a transient consumer-side outage. A result left undelivered for 7 days is purged and can no longer be retried.
          */
         post: operations["RetryVerificationCallback"];
         delete?: never;
@@ -3122,7 +3098,7 @@ export interface paths {
         put?: never;
         /**
          * Retry a dead-lettered callback (admin-only)
-         * @description Admin only. Re-enqueues a specific DLQ entry for delivery.
+         * @description Admin only. Re-enqueues a specific DLQ entry for delivery. 410 when the result was undelivered for 7 days and has been purged.
          */
         post: operations["RetryCallbackDlq"];
         delete?: never;
@@ -3391,11 +3367,9 @@ export interface components {
          */
         EntityStatus: "ACTIVE" | "ARCHIVED";
         /**
-         * @description - `PERSONAL`: Auto-provisioned at user signup. Exactly one
-         *       `OWNER`, no other members.
-         *
-         *     - `ORG`: Explicitly created via `POST /orgs`. Multiple
-         *       members, always ≥ 1 active `OWNER`.
+         * @description - `ORG`: A user's organization: the default one made at sign-up,
+         *       or one created via `POST /orgs`. Multiple members, always ≥ 1
+         *       active `OWNER`.
          *
          *     - `ANONYMOUS`: System-managed, member-less org auto-created to
          *       anchor an unaffiliated ETH credential's org-level settings
@@ -3404,7 +3378,7 @@ export interface components {
          *       created or named by clients; has no members.
          * @enum {string}
          */
-        OrganizationKind: "PERSONAL" | "ORG" | "ANONYMOUS";
+        OrganizationKind: "ORG" | "ANONYMOUS";
         /** @description A free-form label attached to an entity for grouping and filtering in listings. Must start and end with an alphanumeric character; only ASCII letters, digits, spaces, and hyphens are allowed between. */
         Tag: string;
         ActorMetadata: {
@@ -3413,7 +3387,7 @@ export interface components {
             /** @description Free-form notes from actor describing this change */
             notes?: string;
         };
-        /** @description A registered user of the platform. Every newly created user is automatically granted a personal organization (see `Organization.kind = PERSONAL`) whose id is exposed here as `personalOrgId`. */
+        /** @description A registered user of the platform. Every newly created user gets a default organization, whose id is exposed here as `defaultOrgId`. */
         User: {
             id: components["schemas"]["UserID"];
             /**
@@ -3435,13 +3409,13 @@ export interface components {
              * @enum {string}
              */
             role?: "user" | "admin";
-            /** @description ID of the user's auto-created personal organization. This organization is provisioned the moment the user is created and cannot be deleted independently of the user. */
-            personalOrgId: components["schemas"]["OrgID"];
+            /** @description ID of the organization created for the user at sign-up. It is a regular organization and counts toward the user's org-creation limit. */
+            defaultOrgId: components["schemas"]["OrgID"];
             createMetadata: components["schemas"]["ActorMetadata"];
             updateMetadata: components["schemas"]["ActorMetadata"];
         };
         /**
-         * @description Role a user holds in an organization. `OWNER` can invite, promote, demote, and remove members, and delete the org. `MEMBER` has read/write access to resources owned by the org but cannot manage membership. `PERSONAL` orgs have exactly one `OWNER` and reject all member-mutating operations.
+         * @description Role a user holds in an organization. `OWNER` can invite, promote, demote, and remove members, and delete the org. `MEMBER` has read/write access to resources owned by the org but cannot manage membership.
          * @enum {string}
          */
         OrganizationMemberRole: "OWNER" | "MEMBER";
@@ -3476,12 +3450,12 @@ export interface components {
             /** @description Timestamp the invite was accepted. Absent while `status` is `PENDING`. */
             joinedAt?: components["schemas"]["Timestamp"];
         };
-        /** @description A workspace that owns providers and other resources. Every user gets exactly one `PERSONAL` organization on signup; additional `ORG` organizations can be created and have multiple members. System-managed `ANONYMOUS` organizations have no members (see `OrganizationKind`). */
+        /** @description A workspace that owns providers and other resources. Every user gets a default `ORG` organization on signup; more can be created up to the user's org-creation limit, and any can have multiple members. System-managed `ANONYMOUS` organizations have no members (see `OrganizationKind`). */
         Organization: {
             id: components["schemas"]["OrgID"];
-            /** @description Display name of the organization. For `PERSONAL` orgs this defaults to the owner's name and may be edited by the owner. */
+            /** @description Display name of the organization. A user's default org starts with their name and may be renamed by an owner. */
             name: string;
-            /** @description Whether this is a user's personal org or a shared org. */
+            /** @description Whether this is a user's org or a system-managed anonymous one. */
             kind: components["schemas"]["OrganizationKind"];
             /**
              * Format: uri
@@ -3490,7 +3464,7 @@ export interface components {
             iconUrl?: string;
             /** @description Marker for system-managed singleton orgs. `'reclaim-staff'` identifies the auto-membership org that every `@reclaimprotocol.org` user is enrolled into on login (PRD-1 §3). Absent on normal user-created orgs. Names, status, and lifecycle of system-managed orgs are server-protected — clients cannot rename, archive, or delete them. */
             readonly systemId?: string;
-            /** @description All users with a role in this organization. `PERSONAL` and `ORG` orgs always contain at least one active `OWNER` (`PERSONAL` orgs contain exactly one member); `ANONYMOUS` orgs have no members, so this array is empty for them. */
+            /** @description All users with a role in this organization. `ORG` orgs always contain at least one active `OWNER`; `ANONYMOUS` orgs have no members, so this array is empty for them. */
             members: components["schemas"]["OrganizationMember"][];
             /** @description Providers owned by this organization. */
             providers?: components["schemas"]["ProviderListItem"][];
@@ -5229,7 +5203,7 @@ export interface components {
             webSettings: components["schemas"]["ProviderWebSettings"];
             requiredContext?: components["schemas"]["ProviderRequiredContext"];
         };
-        /** @description Body for `POST /orgs` — just a name. Every org is created keyless, like auto-provisioned personal orgs; its Ethereum (secp256k1) key pair is published separately via `PUT /orgs/{orgId}/keypair`, which is also where `canEncryptResult` is set. Creation deliberately collects nothing else so it never blocks on generating and safeguarding a private key. */
+        /** @description Body for `POST /orgs` — just a name. Every org is created keyless, like each user's default org; its Ethereum (secp256k1) key pair is published separately via `PUT /orgs/{orgId}/keypair`, which is also where `canEncryptResult` is set. Creation deliberately collects nothing else so it never blocks on generating and safeguarding a private key. */
         CreateOrgRequest: {
             name: string;
         };
@@ -5810,7 +5784,7 @@ export interface components {
              * @description Id of the registered verification client whose base URL was used (see `verification_clients`).
              */
             verificationClientId: string;
-            /** @description Ready-to-share URL: the registered base URL with the session id attached by the Builder — substituted into a `{sessionId}` placeholder, or appended as a `?sessionId=…` query parameter. It always includes `api=2`, which selects Builder mode in dual-mode Verification Clients. The Consumer may append its own redirect query fields before opening the URL for the claimant; the Builder does not store or execute those redirects. */
+            /** @description The URL to send your end user to: this is where they verify. Ready-to-share: the registered base URL with the session id attached by the Builder — substituted into a `{sessionId}` placeholder, or appended as a `?sessionId=…` query parameter. It always includes `api=2`, which selects Builder mode in dual-mode Verification Clients. The Consumer may append its own redirect query fields before opening the URL for the claimant; the Builder does not store or execute those redirects. */
             verificationUrl: string;
             createdAt: components["schemas"]["Timestamp"];
             /** @description When the session stops being completable. After this, a still- `pending` session becomes `expired` on the next sweep and the end-user can no longer finish it. */
@@ -5841,7 +5815,14 @@ export interface components {
             context: {
                 [key: string]: unknown;
             };
-            /** @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`portals`) client. The Builder resolves and stores the registered client UUID, then returns the ready-to-share `verificationUrl` with the session id and `api=2`. A URL that is not a registered client's base is rejected with 400. Consumers append any client-owned redirect parameters after receiving the URL; Builder does not manage them. */
+            /**
+             * @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`portals`) client. The Builder resolves and stores the registered client UUID, then returns the ready-to-share `verificationUrl` with the session id and `api=2`. A URL that is not a registered client's base is rejected with 400. Consumers append any client-owned redirect parameters after receiving the URL; Builder does not manage them. The built-in clients are `{origin}/share/{name}`, listed in the examples.
+             * @example https://build.reclaimprotocol.org/share/portals
+             * @example https://build.reclaimprotocol.org/share/verifier-app
+             * @example https://build.reclaimprotocol.org/share/reclaim-browser-extension
+             * @example https://build.reclaimprotocol.org/share/builder
+             * @example https://build.reclaimprotocol.org/share/inapp-sdk
+             */
             verificationClientUrl?: string;
             /** @description Optional active theme owned by the organization. When omitted, Builder snapshots the organization's most recently updated active theme. If the organization has no active theme, the Verification Client uses its default presentation. */
             themeId?: components["schemas"]["ThemeID"];
@@ -6321,6 +6302,24 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    Discover: {
+        parameters: {
+            query?: {
+                /** @description Free-text query matched against website domain, data points, brand title, and description. Restores the search box and results on a shared/bookmarked link. */
+                q?: string;
+                /** @description Narrow to websites with at least one visible provider carrying ANY of these tags. Repeat to pass several (OR-combined). */
+                tag?: string[];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     Providers: {
         parameters: {
             query?: {
@@ -6672,40 +6671,6 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SiteBuildRepair: {
-        parameters: {
-            query: {
-                /** @description The failing sandbox session whose analytics seed the prompt. */
-                sessionId: components["schemas"]["SessionID"];
-                dataPoints?: string[];
-                mode?: components["schemas"]["ResolveMode"];
-                provided?: string[];
-                /** @description Source pins: `pins[<dataPoint>]=<providerId>`. Pins the provider that must prove that data point; a pinned provider is taken first and is never pruned. Omit (or send empty) for Auto. A comma-separated list is also accepted — the first id that covers the point wins. */
-                pins?: {
-                    [key: string]: string;
-                };
-                exclude?: components["schemas"]["ProviderID"][];
-            };
-            header?: never;
-            path: {
-                domain: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description The repair wizard fragment. */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "text/html": components["schemas"]["HtmlContent"];
-                };
-            };
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
     SiteBuildAlternative: {
         parameters: {
             query: {
@@ -6747,49 +6712,22 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    DiscoverTeachAgent: {
+    OpenIntegrate: {
         parameters: {
-            query?: {
-                /** @description Website the user wanted to verify data from. */
-                domain?: string;
-                /** @description Specific data point the user could not find. */
-                dataPoint?: string;
-            };
+            query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            200: components["responses"]["HTMLResponse"];
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
-    DiscoverAgentWizard: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/x-www-form-urlencoded": {
-                    /** @description The wizard's ready-to-paste task prompt. */
-                    basePrompt: string;
-                    /** @description Prefix of the wizard's element ids, so copy targets stay unique. */
-                    idPrefix: string;
-                    /** @description Picked coding agent; unknown values fall back to the first. */
-                    agent?: string;
-                    /** @description What the user is building, appended to the prompt. */
-                    building?: string;
-                    /** @description Label for `building` in the prompt. Defaults to "What I'm building". */
-                    lead?: string;
+            /** @description Redirect to the Integrate page, or to sign-in. */
+            302: {
+                headers: {
+                    [name: string]: unknown;
                 };
+                content?: never;
             };
-        };
-        responses: {
-            200: components["responses"]["HTMLResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
@@ -7071,7 +7009,7 @@ export interface operations {
     AdminUsers: {
         parameters: {
             query?: {
-                /** @description Matches email, name, user id, or personal organization id (hyphens optional in ids). */
+                /** @description Matches email, name, user id, or default organization id (hyphens optional in ids). */
                 q?: string;
             };
             header?: never;
@@ -8748,9 +8686,9 @@ export interface operations {
                 /** @description Integrate tab only. Which integration path to show: a coding agent over MCP, the client package, or plain HTTP. */
                 track?: "agent" | "sdk" | "http";
                 /** @description Integrate tab, agent track only. Which coding agent's install command to show. */
-                agent?: "claude" | "cursor" | "opencode" | "codex" | "others";
-                /** @description Dashboard tab only. Scopes the report to sessions that ran this provider. Options come from `GET /orgs/{orgId}/providers/used`. */
-                providerId?: components["schemas"]["ProviderID"];
+                agent?: "claude" | "copilot" | "cursor" | "omp" | "opencode" | "codex" | "antigravity" | "others";
+                /** @description Integrate tab: the providers to show in the examples in place of placeholder ids, for example when arriving from a provider page or a build page. Repeat to pass several. Dashboard tab: scopes the report to sessions that ran this provider (the first one); options come from `GET /orgs/{orgId}/providers/used`. */
+                providerId?: components["schemas"]["ProviderID"][];
                 /** @description Integrate tab, HTTP track only. Which Verification Client the create-session example targets. `auto` (the default) leaves `verificationClientUrl` out. */
                 client?: "auto" | "portals" | "verifier-app" | "reclaim-browser-extension" | "builder" | "inapp-sdk";
                 /** @description Dashboard tab only. Start of the reporting period; defaults to 30 days before `to`. */
@@ -8840,31 +8778,6 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    ConvertOrgToRegular: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                orgId: components["schemas"]["OrgID"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Converted */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["Organization"];
-                };
-            };
-            403: components["responses"]["ForbiddenResponse"];
-            409: components["responses"]["ProblemResponse"];
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
     SearchOrgMembers: {
         parameters: {
             query?: {
@@ -11269,8 +11182,8 @@ export interface operations {
                             /** Format: uuid */
                             subscriptionId: string;
                             event: components["schemas"]["VerificationEvent"];
-                            /** @description The result payload, as raw text: an ECIES ciphertext (base64url) wrapping the signed result JWS when the org's `canEncryptResult` is enabled, else the plaintext signed JWS JSON. */
-                            payload: string;
+                            /** @description The payload, as raw text. For a signed result: an ECIES ciphertext (base64url) wrapping the signed result JWS when the org's `canEncryptResult` is enabled, else the plaintext signed JWS JSON. For an event notification: `{event, eventData}` JSON. `null` once a signed result was delivered, or after 7 days undelivered. */
+                            payload: string | null;
                             deliveryStatus: components["schemas"]["CallbackDeliveryStatus"];
                             createdAt: components["schemas"]["Timestamp"];
                         }[];
@@ -11347,6 +11260,7 @@ export interface operations {
             };
             403: components["responses"]["ForbiddenResponse"];
             404: components["responses"]["ProblemResponse"];
+            410: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };

package/lib/types/openapi.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/openapi-typegen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:099a5bcf4fba).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:3e28ff308da3).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/client",
 	"title": "Reclaim Client",
-	"version": "0.1.32",
+	"version": "0.1.33",
 	"description": "Typed SDK/HTTP client SDK for the Reclaim Protocol — the programmatic way to use Reclaim Protocol to verify **data points** about your users (a follower count, an account balance, an order). Can be directly integrated by apps to request verification for their users using Reclaim Protocol and verify the results.",
 	"type": "module",
 	"sideEffects": false,

package/src/routes.gen.ts

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:099a5bcf4fba).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:3e28ff308da3).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -37,7 +37,6 @@ export const ROUTES = {
 	"CancelPublicListingRequest": {"method":"post","path":"/providers/{providerId}/versions/{version}/cancel-review"},
 	"ChangeOrgPlan": {"method":"post","path":"/orgs/{orgId}/billing/change-plan"},
 	"ConsentPage": {"method":"get","path":"/oauth/consent"},
-	"ConvertOrgToRegular": {"method":"post","path":"/orgs/{orgId}/convert"},
 	"CreateAgentBrowserSession": {"method":"post","path":"/orgs/{orgId}/agent-browser-sessions"},
 	"CreateBillingCheckoutSession": {"method":"post","path":"/orgs/{orgId}/billing/checkout"},
 	"CreateBillingPortalSession": {"method":"post","path":"/orgs/{orgId}/billing/portal"},
@@ -68,10 +67,9 @@ export const ROUTES = {
 	"DeleteProvider": {"method":"delete","path":"/providers/{providerId}"},
 	"DeleteProviderVersion": {"method":"delete","path":"/providers/{providerId}/versions/{version}"},
 	"DeleteTheme": {"method":"delete","path":"/orgs/{orgId}/themes/{themeId}"},
-	"DiscoverAgentWizard": {"method":"post","path":"/discover/agent-wizard"},
+	"Discover": {"method":"get","path":"/discover"},
 	"DiscoverDataPoints": {"method":"get","path":"/discover/data-points"},
 	"DiscoverResolve": {"method":"get","path":"/discover/resolve"},
-	"DiscoverTeachAgent": {"method":"get","path":"/discover/teach"},
 	"DiscoverWebsites": {"method":"get","path":"/discover/websites"},
 	"DisposeAgentBrowserSession": {"method":"delete","path":"/orgs/{orgId}/agent-browser-sessions/{browserSessionId}"},
 	"DisposeVerificationSession": {"method":"post","path":"/v/{sessionId}/dispose"},
@@ -121,6 +119,7 @@ export const ROUTES = {
 	"Logout": {"method":"post","path":"/logout"},
 	"MakePrivate": {"method":"post","path":"/providers/{providerId}/make-private"},
 	"OpenApiSpec": {"method":"get","path":"/openapi.yaml"},
+	"OpenIntegrate": {"method":"get","path":"/integrate"},
 	"OrgInvitePage": {"method":"get","path":"/orgs/{orgId}/invite"},
 	"PatchVerificationClaimant": {"method":"patch","path":"/verifications/sessions/{sessionId}/claimant"},
 	"ProviderPreviewImage": {"method":"get","path":"/providers/{providerId}/preview.png"},
@@ -151,7 +150,6 @@ export const ROUTES = {
 	"SharePage": {"method":"get","path":"/share/{client}"},
 	"SiteBuild": {"method":"get","path":"/site/{domain}/build"},
 	"SiteBuildAlternative": {"method":"get","path":"/site/{domain}/alternative"},
-	"SiteBuildRepair": {"method":"get","path":"/site/{domain}/repair"},
 	"SiteBuildTry": {"method":"post","path":"/site/{domain}/try"},
 	"Sitemap": {"method":"get","path":"/sitemap.xml"},
 	"SitePage": {"method":"get","path":"/site/{domain}"},

package/src/types/openapi.gen.ts

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/openapi-typegen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:099a5bcf4fba).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:3e28ff308da3).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -17,8 +17,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Discover home — search a website to verify
-         * @description Default home page. A website-first search: the visitor types a website and picks one to continue to `/site/{domain}`, where they choose what data to prove. Renders popular websites below the search, plus tag pills to narrow them.
+         * Home — sign-in or Discover
+         * @description Signed in, renders Discover (see `GET /discover`). Signed out, renders the sign-in page; a signed-out link carrying Discover's `q` / `tag` redirects to `/discover` with them.
          */
         get: operations["Index"];
         put?: never;
@@ -29,6 +29,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/discover": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Discover — search a website to verify
+         * @description The Catalog. A website-first search: the visitor types a website and picks one to continue to `/site/{domain}`, where they choose what data to prove. Renders popular websites below the search, plus tag pills to narrow them.
+         */
+        get: operations["Discover"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/providers": {
         parameters: {
             query?: never;
@@ -218,7 +238,7 @@ export interface paths {
         put?: never;
         /**
          * Mint a SANDBOX test verification session for the selection
-         * @description Creates a real SANDBOX verification session for the selected data points, so the signed-in member can test the flow on `/v/{sessionId}` without registering a callback subscription. Runs under an organization the member owns (`orgId` in the body; defaults to their personal organization). The provider set is recomputed server-side from the selection.
+         * @description Creates a real SANDBOX verification session for the selected data points, so the signed-in member can test the flow on `/v/{sessionId}` without registering a callback subscription. Runs under an organization the member owns (`orgId` in the body; defaults to their default organization). The provider set is recomputed server-side from the selection.
          */
         post: operations["SiteBuildTry"];
         delete?: never;
@@ -227,26 +247,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/site/{domain}/repair": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Failure-aware "Repair with an AI coding agent" wizard fragment
-         * @description Body of the build page's repair dialog, lazy-loaded after a sandbox Try fails so the agent prompt includes the REAL failure (which provider(s) failed + the error reason, read from the session's event log) and the resolved provider set. HTML / HTMX fragment.
-         */
-        get: operations["SiteBuildRepair"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/site/{domain}/alternative": {
         parameters: {
             query?: never;
@@ -267,7 +267,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/discover/teach": {
+    "/integrate": {
         parameters: {
             query?: never;
             header?: never;
@@ -275,10 +275,10 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * “Teach our agent” instructions for a missing website / data point
-         * @description Returns the "Teach our agent" panel shown when a website or data point a user wants does not exist yet: steps to install the Reclaim MCP server plus a ready-to-copy prompt, templated with the requested `domain` and (optionally) `dataPoint`, that instructs an agent to author the missing provider. HTML / HTMX only (a dialog fragment).
+         * Go to the Integrate page
+         * @description Where the "Build it with an agent" links lead, from pages that don't know the viewer's organization. Signed in, redirects to the Integrate page of the console's selected organization (else the viewer's default organization), on its coding-agent track. Signed out, redirects to sign-in and back here.
          */
-        get: operations["DiscoverTeachAgent"];
+        get: operations["OpenIntegrate"];
         put?: never;
         post?: never;
         delete?: never;
@@ -287,26 +287,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/discover/agent-wizard": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Setup and prompt for the coding agent picked in the wizard
-         * @description Returns the last step of the "Build with an AI coding agent" wizard for the picked `agent`: how to attach the Reclaim MCP server, and the `basePrompt` with the optional `building` description appended. HTML / HTMX only (a fragment swapped into the open wizard).
-         */
-        post: operations["DiscoverAgentWizard"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/discover/resolve": {
         parameters: {
             query?: never;
@@ -1581,7 +1561,7 @@ export interface paths {
         put?: never;
         /**
          * Create an organization
-         * @description Creates a new `ORG`-kind organization with the caller as its first `OWNER`. The personal org is created automatically at user signup and is not created via this endpoint.
+         * @description Creates a new `ORG`-kind organization with the caller as its first `OWNER`. Every user gets a default organization at sign-up, and it counts toward their org-creation limit (1 active organization unless Reclaim support raises it). Past the limit this returns `409`; contact support@reclaimprotocol.org to raise the limit or archive an organization.
          */
         post: operations["CreateOrg"];
         delete?: never;
@@ -1642,8 +1622,8 @@ export interface paths {
         put?: never;
         post?: never;
         /**
-         * Delete a shared organization
-         * @description Owner only. `PERSONAL` organizations cannot be deleted independently of their owning user; deleting a personal org happens implicitly via `DELETE /me`.
+         * Archive an organization
+         * @description Reclaim staff only; owners ask support@reclaimprotocol.org to archive. Archives the organization, which frees a slot under its creator's org-creation limit. `403` for anyone else.
          */
         delete: operations["DeleteOrg"];
         options?: never;
@@ -1655,26 +1635,6 @@ export interface paths {
         patch: operations["UpdateOrg"];
         trace?: never;
     };
-    "/orgs/{orgId}/convert": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Convert a personal organization to a regular organization
-         * @description Owner only. One-way: flips a `PERSONAL` organization (auto-provisioned at sign-up, sandbox-only, single-member) to a regular `ORG`, unlocking billing, plan & usage, and member invites. All providers, sessions, credentials and themes carry over. `409` when the organization is not `PERSONAL`.
-         */
-        post: operations["ConvertOrgToRegular"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/orgs/{orgId}/members": {
         parameters: {
             query?: never;
@@ -1690,7 +1650,7 @@ export interface paths {
         put?: never;
         /**
          * Invite a member to an organization
-         * @description Owner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an invite email with an accept link is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` only when the invitee explicitly accepts via `POST /orgs/{orgId}/invite`. `PERSONAL` organizations reject this call (409).
+         * @description Owner only. Invites a user to the organization by email. The invitee does **not** need to be a registered user — an invite is created in either case, and an invite email with an accept link is dispatched. The new row is returned with `status: PENDING`; it flips to `ACTIVE` only when the invitee explicitly accepts via `POST /orgs/{orgId}/invite`.
          */
         post: operations["AddOrgMember"];
         delete?: never;
@@ -2748,16 +2708,32 @@ export interface paths {
         /**
          * Create a verification session
          * @description Creates a verification session for an end-user to complete.
+         *
+         *     **The response's `verificationUrl` is the one thing you need.** Send
+         *     your end user to it (redirect, link, or QR code): that is where they
+         *     verify. Everything else in the response is for tracking the session.
+         *
          *     Authenticated by the consumer's `OrgToken`; the session is scoped to
          *     the resolved organization. The request carries no callback URLs —
          *     results are delivered to the org's pre-registered callback
          *     subscriptions.
          *
+         *     `verificationClientUrl` picks where the user verifies. Omit it to use
+         *     the Reclaim Portal. The built-in clients are:
+         *
+         *     | Client | `verificationClientUrl` |
+         *     | --- | --- |
+         *     | Reclaim Portal (default) | `https://build.reclaimprotocol.org/share/portals` |
+         *     | Verifier app | `https://build.reclaimprotocol.org/share/verifier-app` |
+         *     | Browser extension | `https://build.reclaimprotocol.org/share/reclaim-browser-extension` |
+         *     | Builder browser | `https://build.reclaimprotocol.org/share/builder` |
+         *     | In-app SDK | `https://build.reclaimprotocol.org/share/inapp-sdk` |
+         *
          *         curl -X POST $BASE/verifications/sessions \
          *           -H "Authorization: Bearer $ORG_TOKEN" \
          *           -H 'Content-Type: application/json' \
          *           -d '{"providers":[{"providerId":"…","version":"^1.2.0"}],"context":{},
-         *                "verificationClientUrl":"https://verify.example.com/"}'
+         *                "verificationClientUrl":"https://build.reclaimprotocol.org/share/portals"}'
          *
          *     Fails with `409 Conflict` if the organization has no callback
          *     subscription (there would be nowhere to deliver the result).
@@ -3065,8 +3041,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get the stored encrypted result(s) for a session
-         * @description Returns the stored Builder-signed result payloads for this session — one item per callback subscription. Readable only by the consumer that created the session. The consumer's `OrgToken` must resolve to the session's organization. A pull-based companion to push delivery: when the organization enables encryption, Builder returns an ECIES ciphertext (base64url) that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted. Treat every returned payload as untrusted until `verifyResultFull` succeeds with the Builder issuer and JWKS URL.
+         * Get the stored result(s) for a session
+         * @description Returns the session's callback deliveries with their payloads — one item per callback subscription and event. Readable only by the consumer that created the session. The consumer's `OrgToken` must resolve to the session's organization. A recovery companion to push delivery, not a replacement for the callback: a signed result's `payload` (which can carry proofs) is kept only until its callback is delivered, or for 7 days while undelivered, then becomes `null`. When the organization enables encryption, a signed result is an ECIES ciphertext (base64url) that the holder of the matching private key decrypts client-side, else plaintext. Empty `items` until the session reaches a terminal state and a result has been submitted. Treat every returned payload as untrusted until `verifyResultFull` succeeds with the Builder issuer and JWKS URL.
          */
         get: operations["GetVerificationResult"];
         put?: never;
@@ -3088,7 +3064,7 @@ export interface paths {
         put?: never;
         /**
          * Re-enqueue callback delivery for a session
-         * @description Re-enqueues delivery of a session's stored result to its callback subscriptions. Use this after `list_verification_deliveries` shows a `failed` or dead-lettered delivery, once the consumer's callback endpoint is reachable again and answers 2xx — it re-attempts every not-yet-delivered callback for the session. Usable by the session creator (authenticated by the consumer's `OrgToken`) to recover from a transient consumer-side outage.
+         * @description Re-enqueues delivery of a session's stored result to its callback subscriptions. Use this after `list_verification_deliveries` shows a `failed` or dead-lettered delivery, once the consumer's callback endpoint is reachable again and answers 2xx — it re-attempts every not-yet-delivered callback for the session. Usable by the session creator (authenticated by the consumer's `OrgToken`) to recover from a transient consumer-side outage. A result left undelivered for 7 days is purged and can no longer be retried.
          */
         post: operations["RetryVerificationCallback"];
         delete?: never;
@@ -3128,7 +3104,7 @@ export interface paths {
         put?: never;
         /**
          * Retry a dead-lettered callback (admin-only)
-         * @description Admin only. Re-enqueues a specific DLQ entry for delivery.
+         * @description Admin only. Re-enqueues a specific DLQ entry for delivery. 410 when the result was undelivered for 7 days and has been purged.
          */
         post: operations["RetryCallbackDlq"];
         delete?: never;
@@ -3397,11 +3373,9 @@ export interface components {
          */
         EntityStatus: "ACTIVE" | "ARCHIVED";
         /**
-         * @description - `PERSONAL`: Auto-provisioned at user signup. Exactly one
-         *       `OWNER`, no other members.
-         *
-         *     - `ORG`: Explicitly created via `POST /orgs`. Multiple
-         *       members, always ≥ 1 active `OWNER`.
+         * @description - `ORG`: A user's organization: the default one made at sign-up,
+         *       or one created via `POST /orgs`. Multiple members, always ≥ 1
+         *       active `OWNER`.
          *
          *     - `ANONYMOUS`: System-managed, member-less org auto-created to
          *       anchor an unaffiliated ETH credential's org-level settings
@@ -3410,7 +3384,7 @@ export interface components {
          *       created or named by clients; has no members.
          * @enum {string}
          */
-        OrganizationKind: "PERSONAL" | "ORG" | "ANONYMOUS";
+        OrganizationKind: "ORG" | "ANONYMOUS";
         /** @description A free-form label attached to an entity for grouping and filtering in listings. Must start and end with an alphanumeric character; only ASCII letters, digits, spaces, and hyphens are allowed between. */
         Tag: string;
         ActorMetadata: {
@@ -3419,7 +3393,7 @@ export interface components {
             /** @description Free-form notes from actor describing this change */
             notes?: string;
         };
-        /** @description A registered user of the platform. Every newly created user is automatically granted a personal organization (see `Organization.kind = PERSONAL`) whose id is exposed here as `personalOrgId`. */
+        /** @description A registered user of the platform. Every newly created user gets a default organization, whose id is exposed here as `defaultOrgId`. */
         User: {
             id: components["schemas"]["UserID"];
             /**
@@ -3441,13 +3415,13 @@ export interface components {
              * @enum {string}
              */
             role?: "user" | "admin";
-            /** @description ID of the user's auto-created personal organization. This organization is provisioned the moment the user is created and cannot be deleted independently of the user. */
-            personalOrgId: components["schemas"]["OrgID"];
+            /** @description ID of the organization created for the user at sign-up. It is a regular organization and counts toward the user's org-creation limit. */
+            defaultOrgId: components["schemas"]["OrgID"];
             createMetadata: components["schemas"]["ActorMetadata"];
             updateMetadata: components["schemas"]["ActorMetadata"];
         };
         /**
-         * @description Role a user holds in an organization. `OWNER` can invite, promote, demote, and remove members, and delete the org. `MEMBER` has read/write access to resources owned by the org but cannot manage membership. `PERSONAL` orgs have exactly one `OWNER` and reject all member-mutating operations.
+         * @description Role a user holds in an organization. `OWNER` can invite, promote, demote, and remove members, and delete the org. `MEMBER` has read/write access to resources owned by the org but cannot manage membership.
          * @enum {string}
          */
         OrganizationMemberRole: "OWNER" | "MEMBER";
@@ -3482,12 +3456,12 @@ export interface components {
             /** @description Timestamp the invite was accepted. Absent while `status` is `PENDING`. */
             joinedAt?: components["schemas"]["Timestamp"];
         };
-        /** @description A workspace that owns providers and other resources. Every user gets exactly one `PERSONAL` organization on signup; additional `ORG` organizations can be created and have multiple members. System-managed `ANONYMOUS` organizations have no members (see `OrganizationKind`). */
+        /** @description A workspace that owns providers and other resources. Every user gets a default `ORG` organization on signup; more can be created up to the user's org-creation limit, and any can have multiple members. System-managed `ANONYMOUS` organizations have no members (see `OrganizationKind`). */
         Organization: {
             id: components["schemas"]["OrgID"];
-            /** @description Display name of the organization. For `PERSONAL` orgs this defaults to the owner's name and may be edited by the owner. */
+            /** @description Display name of the organization. A user's default org starts with their name and may be renamed by an owner. */
             name: string;
-            /** @description Whether this is a user's personal org or a shared org. */
+            /** @description Whether this is a user's org or a system-managed anonymous one. */
             kind: components["schemas"]["OrganizationKind"];
             /**
              * Format: uri
@@ -3496,7 +3470,7 @@ export interface components {
             iconUrl?: string;
             /** @description Marker for system-managed singleton orgs. `'reclaim-staff'` identifies the auto-membership org that every `@reclaimprotocol.org` user is enrolled into on login (PRD-1 §3). Absent on normal user-created orgs. Names, status, and lifecycle of system-managed orgs are server-protected — clients cannot rename, archive, or delete them. */
             readonly systemId?: string;
-            /** @description All users with a role in this organization. `PERSONAL` and `ORG` orgs always contain at least one active `OWNER` (`PERSONAL` orgs contain exactly one member); `ANONYMOUS` orgs have no members, so this array is empty for them. */
+            /** @description All users with a role in this organization. `ORG` orgs always contain at least one active `OWNER`; `ANONYMOUS` orgs have no members, so this array is empty for them. */
             members: components["schemas"]["OrganizationMember"][];
             /** @description Providers owned by this organization. */
             providers?: components["schemas"]["ProviderListItem"][];
@@ -5235,7 +5209,7 @@ export interface components {
             webSettings: components["schemas"]["ProviderWebSettings"];
             requiredContext?: components["schemas"]["ProviderRequiredContext"];
         };
-        /** @description Body for `POST /orgs` — just a name. Every org is created keyless, like auto-provisioned personal orgs; its Ethereum (secp256k1) key pair is published separately via `PUT /orgs/{orgId}/keypair`, which is also where `canEncryptResult` is set. Creation deliberately collects nothing else so it never blocks on generating and safeguarding a private key. */
+        /** @description Body for `POST /orgs` — just a name. Every org is created keyless, like each user's default org; its Ethereum (secp256k1) key pair is published separately via `PUT /orgs/{orgId}/keypair`, which is also where `canEncryptResult` is set. Creation deliberately collects nothing else so it never blocks on generating and safeguarding a private key. */
         CreateOrgRequest: {
             name: string;
         };
@@ -5816,7 +5790,7 @@ export interface components {
              * @description Id of the registered verification client whose base URL was used (see `verification_clients`).
              */
             verificationClientId: string;
-            /** @description Ready-to-share URL: the registered base URL with the session id attached by the Builder — substituted into a `{sessionId}` placeholder, or appended as a `?sessionId=…` query parameter. It always includes `api=2`, which selects Builder mode in dual-mode Verification Clients. The Consumer may append its own redirect query fields before opening the URL for the claimant; the Builder does not store or execute those redirects. */
+            /** @description The URL to send your end user to: this is where they verify. Ready-to-share: the registered base URL with the session id attached by the Builder — substituted into a `{sessionId}` placeholder, or appended as a `?sessionId=…` query parameter. It always includes `api=2`, which selects Builder mode in dual-mode Verification Clients. The Consumer may append its own redirect query fields before opening the URL for the claimant; the Builder does not store or execute those redirects. */
             verificationUrl: string;
             createdAt: components["schemas"]["Timestamp"];
             /** @description When the session stops being completable. After this, a still- `pending` session becomes `expired` on the next sweep and the end-user can no longer finish it. */
@@ -5847,7 +5821,14 @@ export interface components {
             context: {
                 [key: string]: unknown;
             };
-            /** @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`portals`) client. The Builder resolves and stores the registered client UUID, then returns the ready-to-share `verificationUrl` with the session id and `api=2`. A URL that is not a registered client's base is rejected with 400. Consumers append any client-owned redirect parameters after receiving the URL; Builder does not manage them. */
+            /**
+             * @description Optional. Must exactly equal the base URL of a registered verification client (see the `verification_clients` registry / `/admin/verification-clients`). Omit to use the default (`portals`) client. The Builder resolves and stores the registered client UUID, then returns the ready-to-share `verificationUrl` with the session id and `api=2`. A URL that is not a registered client's base is rejected with 400. Consumers append any client-owned redirect parameters after receiving the URL; Builder does not manage them. The built-in clients are `{origin}/share/{name}`, listed in the examples.
+             * @example https://build.reclaimprotocol.org/share/portals
+             * @example https://build.reclaimprotocol.org/share/verifier-app
+             * @example https://build.reclaimprotocol.org/share/reclaim-browser-extension
+             * @example https://build.reclaimprotocol.org/share/builder
+             * @example https://build.reclaimprotocol.org/share/inapp-sdk
+             */
             verificationClientUrl?: string;
             /** @description Optional active theme owned by the organization. When omitted, Builder snapshots the organization's most recently updated active theme. If the organization has no active theme, the Verification Client uses its default presentation. */
             themeId?: components["schemas"]["ThemeID"];
@@ -6327,6 +6308,24 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    Discover: {
+        parameters: {
+            query?: {
+                /** @description Free-text query matched against website domain, data points, brand title, and description. Restores the search box and results on a shared/bookmarked link. */
+                q?: string;
+                /** @description Narrow to websites with at least one visible provider carrying ANY of these tags. Repeat to pass several (OR-combined). */
+                tag?: string[];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["HTMLResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     Providers: {
         parameters: {
             query?: {
@@ -6678,40 +6677,6 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    SiteBuildRepair: {
-        parameters: {
-            query: {
-                /** @description The failing sandbox session whose analytics seed the prompt. */
-                sessionId: components["schemas"]["SessionID"];
-                dataPoints?: string[];
-                mode?: components["schemas"]["ResolveMode"];
-                provided?: string[];
-                /** @description Source pins: `pins[<dataPoint>]=<providerId>`. Pins the provider that must prove that data point; a pinned provider is taken first and is never pruned. Omit (or send empty) for Auto. A comma-separated list is also accepted — the first id that covers the point wins. */
-                pins?: {
-                    [key: string]: string;
-                };
-                exclude?: components["schemas"]["ProviderID"][];
-            };
-            header?: never;
-            path: {
-                domain: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description The repair wizard fragment. */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "text/html": components["schemas"]["HtmlContent"];
-                };
-            };
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
     SiteBuildAlternative: {
         parameters: {
             query: {
@@ -6753,49 +6718,22 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    DiscoverTeachAgent: {
+    OpenIntegrate: {
         parameters: {
-            query?: {
-                /** @description Website the user wanted to verify data from. */
-                domain?: string;
-                /** @description Specific data point the user could not find. */
-                dataPoint?: string;
-            };
+            query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            200: components["responses"]["HTMLResponse"];
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
-    DiscoverAgentWizard: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/x-www-form-urlencoded": {
-                    /** @description The wizard's ready-to-paste task prompt. */
-                    basePrompt: string;
-                    /** @description Prefix of the wizard's element ids, so copy targets stay unique. */
-                    idPrefix: string;
-                    /** @description Picked coding agent; unknown values fall back to the first. */
-                    agent?: string;
-                    /** @description What the user is building, appended to the prompt. */
-                    building?: string;
-                    /** @description Label for `building` in the prompt. Defaults to "What I'm building". */
-                    lead?: string;
+            /** @description Redirect to the Integrate page, or to sign-in. */
+            302: {
+                headers: {
+                    [name: string]: unknown;
                 };
+                content?: never;
             };
-        };
-        responses: {
-            200: components["responses"]["HTMLResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };
@@ -7077,7 +7015,7 @@ export interface operations {
     AdminUsers: {
         parameters: {
             query?: {
-                /** @description Matches email, name, user id, or personal organization id (hyphens optional in ids). */
+                /** @description Matches email, name, user id, or default organization id (hyphens optional in ids). */
                 q?: string;
             };
             header?: never;
@@ -8754,9 +8692,9 @@ export interface operations {
                 /** @description Integrate tab only. Which integration path to show: a coding agent over MCP, the client package, or plain HTTP. */
                 track?: "agent" | "sdk" | "http";
                 /** @description Integrate tab, agent track only. Which coding agent's install command to show. */
-                agent?: "claude" | "cursor" | "opencode" | "codex" | "others";
-                /** @description Dashboard tab only. Scopes the report to sessions that ran this provider. Options come from `GET /orgs/{orgId}/providers/used`. */
-                providerId?: components["schemas"]["ProviderID"];
+                agent?: "claude" | "copilot" | "cursor" | "omp" | "opencode" | "codex" | "antigravity" | "others";
+                /** @description Integrate tab: the providers to show in the examples in place of placeholder ids, for example when arriving from a provider page or a build page. Repeat to pass several. Dashboard tab: scopes the report to sessions that ran this provider (the first one); options come from `GET /orgs/{orgId}/providers/used`. */
+                providerId?: components["schemas"]["ProviderID"][];
                 /** @description Integrate tab, HTTP track only. Which Verification Client the create-session example targets. `auto` (the default) leaves `verificationClientUrl` out. */
                 client?: "auto" | "portals" | "verifier-app" | "reclaim-browser-extension" | "builder" | "inapp-sdk";
                 /** @description Dashboard tab only. Start of the reporting period; defaults to 30 days before `to`. */
@@ -8846,31 +8784,6 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
-    ConvertOrgToRegular: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                orgId: components["schemas"]["OrgID"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Converted */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["Organization"];
-                };
-            };
-            403: components["responses"]["ForbiddenResponse"];
-            409: components["responses"]["ProblemResponse"];
-            default: components["responses"]["ProblemResponse"];
-        };
-    };
     SearchOrgMembers: {
         parameters: {
             query?: {
@@ -11275,8 +11188,8 @@ export interface operations {
                             /** Format: uuid */
                             subscriptionId: string;
                             event: components["schemas"]["VerificationEvent"];
-                            /** @description The result payload, as raw text: an ECIES ciphertext (base64url) wrapping the signed result JWS when the org's `canEncryptResult` is enabled, else the plaintext signed JWS JSON. */
-                            payload: string;
+                            /** @description The payload, as raw text. For a signed result: an ECIES ciphertext (base64url) wrapping the signed result JWS when the org's `canEncryptResult` is enabled, else the plaintext signed JWS JSON. For an event notification: `{event, eventData}` JSON. `null` once a signed result was delivered, or after 7 days undelivered. */
+                            payload: string | null;
                             deliveryStatus: components["schemas"]["CallbackDeliveryStatus"];
                             createdAt: components["schemas"]["Timestamp"];
                         }[];
@@ -11353,6 +11266,7 @@ export interface operations {
             };
             403: components["responses"]["ForbiddenResponse"];
             404: components["responses"]["ProblemResponse"];
+            410: components["responses"]["ProblemResponse"];
             default: components["responses"]["ProblemResponse"];
         };
     };