@reclaimprotocol/client 0.1.42 → 0.1.44

package/README.md

@@ -341,7 +341,8 @@ const verifierApp = await reclaim.sessions.create({
   verificationClientUrl: VerificationClient.verifierApp,
 })
 
-// 4. In-app SDK or add-to-app host.
+// 4. In-app SDK or add-to-app host. Required for these apps: pass
+//    inApp.verificationUrl to the app's startVerificationFromUrl.
 const inApp = await reclaim.sessions.create({
   providers: [{ providerId }],
   context,
@@ -372,6 +373,22 @@ const custom = await reclaim.sessions.create({
 })
 ```
 
+A session works only in the client it was created for. Builder fixes the
+session's client at creation, and every Verification Client request must carry
+that client's `x-reclaim-vc-id`, or it gets
+`403 x-reclaim-vc-id does not match this session`. Opening the link in another
+client first doesn't change this. So a mobile app using the in-app SDK or the
+add-to-app module needs sessions created with `VerificationClient.inAppSdk`
+(`https://build.reclaimprotocol.org/share/inapp-sdk`). A session created
+without `verificationClientUrl` is a Portal session, and those apps can't open
+it.
+
+Those apps start Builder mode from either value of the response:
+- `startVerificationFromUrl(inApp.verificationUrl)`;
+- `startVerificationFromJson({ api: '2', sessionId: inApp.id })`.
+  Add `diag: '1'` only when `verificationUrl` contains `diag=1`. Other keys
+  are ignored, and the Builder URL comes from the app's configuration.
+
 The Consumer supplies a URL, not `verificationClientId` or
 `x-reclaim-vc-id`. Builder resolves and stores the UUID. The selected
 Verification Client reads its own configured UUID and sends it only on its
@@ -565,6 +582,10 @@ curl -X POST "$BUILDER_URL/verifications/sessions" \
 # → 201 { "id": "…", "verificationUrl": "…&api=2", "status": "pending", "mode": "…", … }
 ```
 
+For the in-app SDK or add-to-app module, send
+`"verificationClientUrl": "https://build.reclaimprotocol.org/share/inapp-sdk"`.
+Those apps can't open a session created for another client.
+
 For a TEE-bound session, a raw HTTP client must derive the legacy hash nonce
 with its organization verification private key, sign the exact
 `RECLAIM_BUILDER_TEE_BINDING_V1:{organizationId}:{sessionId}:{applicationId}:{timestamp}:{attestationVersion}:{attestationNonce}`
@@ -668,7 +689,8 @@ reclaim.sessions.create({ providers, context, verificationClientUrl?, orgEthPriv
   // providers: { providerId, version? }[] — proved in order, one combined result; all required.
   // → VerificationSession (has `id`, `verificationUrl`, `status`, `mode`, …)
   // verificationClientUrl selects a registered Verification Client by URL;
-  // omitted, it defaults to the Portal.
+  // omitted, it defaults to the Portal. The session then only opens in that
+  // client: use VerificationClient.inAppSdk for in-app SDK / add-to-app hosts.
   // orgEthPrivateKey optionally creates the post-create TEE binding locally.
   // The returned verificationUrl contains sessionId and api=2.
 reclaim.sessions.bindTeeNonce(reclaimSessionId, { orgEthPrivateKey, timestamp? })

package/lib/result.js

@@ -386,6 +386,15 @@ export async function verifyResultFull(jws, opts = {}) {
         if (hasContentValidation(commonValidation)) {
             await verifyRequestProofGroup(proofGroups, commonValidation);
         }
+        else if (isProviderlessAiResult(payload, providerResults)) {
+            // AI sessions have no provider or recipe, so there is no content to
+            // match. Attestor trust, proof signatures, and session binding still
+            // apply through `commonValidation`.
+            await verifyRequestProofGroup(proofGroups, {
+                ...commonValidation,
+                dangerouslyDisableContentValidation: true,
+            });
+        }
         else {
             await verifyByResolvedRecipes(commonValidation, expectedSessionId);
         }
@@ -528,6 +537,23 @@ function hasContentValidation(config) {
         || config.providerId
         || config.dangerouslyDisableContentValidation);
 }
+/**
+ * Whether a result comes from an AI session: the session declares no
+ * providers, and no `results` entry names a provider or version. Any other
+ * shape, including a mix of both kinds of entries, takes the recipe path.
+ */
+function isProviderlessAiResult(payload, entries) {
+    const session = payload.verification_session;
+    if (!session || typeof session !== 'object' || Array.isArray(session)) {
+        return false;
+    }
+    const { providers } = session;
+    return Array.isArray(providers)
+        && providers.length === 0
+        && entries.length > 0
+        && entries.every((entry) => (entry.provider_id === undefined
+            && entry.resolved_version === undefined));
+}
 function proofGroupKey(group) {
     return `${group.providerId ?? ''}\u0000${group.providerVersion ?? ''}`;
 }

package/lib/routes.gen.d.ts

@@ -35,10 +35,18 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/admin/callback-dlq";
     };
+    readonly AdminDisableOrgAiAppKey: {
+        readonly method: "post";
+        readonly path: "/admin/orgs/{orgId}/ai-app-key/disable";
+    };
     readonly AdminFeatureFlags: {
         readonly method: "get";
         readonly path: "/admin/feature-flags";
     };
+    readonly AdminGetOrgAiAppKey: {
+        readonly method: "get";
+        readonly path: "/admin/orgs/{orgId}/ai-app-key";
+    };
     readonly AdminGrantOrgCredit: {
         readonly method: "post";
         readonly path: "/admin/orgs/{orgId}/credits";
@@ -59,6 +67,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/admin/reviews";
     };
+    readonly AdminRotateOrgAiAppKey: {
+        readonly method: "post";
+        readonly path: "/admin/orgs/{orgId}/ai-app-key/rotate";
+    };
     readonly AdminSessions: {
         readonly method: "get";
         readonly path: "/admin/sessions";
@@ -503,6 +515,14 @@ export declare const ROUTES: {
         readonly method: "post";
         readonly path: "/providers/{providerId}/versions/{version}/publish";
     };
+    readonly ReceiveAiVerificationCancel: {
+        readonly method: "post";
+        readonly path: "/verifications/ai-sessions/{sessionId}/cancel";
+    };
+    readonly ReceiveAiVerificationProofs: {
+        readonly method: "post";
+        readonly path: "/verifications/ai-sessions/{sessionId}/proofs";
+    };
     readonly RefreshBillingPlans: {
         readonly method: "post";
         readonly path: "/admin/billing/plans/refresh";
@@ -623,6 +643,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/site/{domain}/panel";
     };
+    readonly StartAiVerificationSession: {
+        readonly method: "post";
+        readonly path: "/verifications/ai-sessions/{sessionId}/start";
+    };
     readonly StartSocialLogin: {
         readonly method: "get";
         readonly path: "/login/social/{provider}";

package/lib/routes.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:c3421d6bcf76).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:cbe3daf2a1f3).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -13,12 +13,15 @@ export const ROUTES = {
     "AdminBillingPlans": { "method": "get", "path": "/admin/billing/plans" },
     "AdminBillingTransactions": { "method": "get", "path": "/admin/billing/transactions" },
     "AdminCallbackDlq": { "method": "get", "path": "/admin/callback-dlq" },
+    "AdminDisableOrgAiAppKey": { "method": "post", "path": "/admin/orgs/{orgId}/ai-app-key/disable" },
     "AdminFeatureFlags": { "method": "get", "path": "/admin/feature-flags" },
+    "AdminGetOrgAiAppKey": { "method": "get", "path": "/admin/orgs/{orgId}/ai-app-key" },
     "AdminGrantOrgCredit": { "method": "post", "path": "/admin/orgs/{orgId}/credits" },
     "AdminHome": { "method": "get", "path": "/admin" },
     "AdminOrgs": { "method": "get", "path": "/admin/orgs" },
     "AdminProviders": { "method": "get", "path": "/admin/providers" },
     "AdminReviews": { "method": "get", "path": "/admin/reviews" },
+    "AdminRotateOrgAiAppKey": { "method": "post", "path": "/admin/orgs/{orgId}/ai-app-key/rotate" },
     "AdminSessions": { "method": "get", "path": "/admin/sessions" },
     "AdminSetProviderFixWithAi": { "method": "put", "path": "/admin/providers/{providerId}/fix-with-ai" },
     "AdminSetUserOrgLimit": { "method": "put", "path": "/users/{userId}/org-limit" },
@@ -130,6 +133,8 @@ export const ROUTES = {
     "ProviderPreviewImage": { "method": "get", "path": "/providers/{providerId}/preview.png" },
     "Providers": { "method": "get", "path": "/providers" },
     "PublishProviderVersion": { "method": "post", "path": "/providers/{providerId}/versions/{version}/publish" },
+    "ReceiveAiVerificationCancel": { "method": "post", "path": "/verifications/ai-sessions/{sessionId}/cancel" },
+    "ReceiveAiVerificationProofs": { "method": "post", "path": "/verifications/ai-sessions/{sessionId}/proofs" },
     "RefreshBillingPlans": { "method": "post", "path": "/admin/billing/plans/refresh" },
     "RefundTransaction": { "method": "post", "path": "/admin/billing/transactions/{txId}/refund" },
     "ReleaseCallbackListener": { "method": "post", "path": "/verifications/callback-listener/release" },
@@ -160,6 +165,7 @@ export const ROUTES = {
     "Sitemap": { "method": "get", "path": "/sitemap.xml" },
     "SitePage": { "method": "get", "path": "/site/{domain}" },
     "SitePanel": { "method": "get", "path": "/site/{domain}/panel" },
+    "StartAiVerificationSession": { "method": "post", "path": "/verifications/ai-sessions/{sessionId}/start" },
     "StartSocialLogin": { "method": "get", "path": "/login/social/{provider}" },
     "StripeWebhook": { "method": "post", "path": "/billing/stripe/webhook" },
     "SubmitConsent": { "method": "post", "path": "/oauth/consent" },