@reclaimprotocol/client 0.1.43 → 0.1.44

package/src/types/openapi.gen.ts

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/openapi-typegen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:c3421d6bcf76).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:cbe3daf2a1f3).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -747,6 +747,66 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/orgs/{orgId}/ai-app-key": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an org's AI application key (admin-only)
+         * @description Admin only. Returns the metadata of the organization's active AI application key. Returns `404` if the organization has no key yet; Builder creates one when the organization starts its first AI session. The response never includes the secret.
+         */
+        get: operations["AdminGetOrgAiAppKey"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/orgs/{orgId}/ai-app-key/rotate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate an org's AI application key (admin-only)
+         * @description Admin only. Creates and registers a new AI application key and makes it the organization's active key. Builder disables the previous key in Builder only, so sessions that already started keep working until they expire. If the organization has no active key because staff disabled it, this issues a fresh key and so re-enables AI sessions for the organization. Returns `404` only if the organization doesn't exist. Returns the new key's metadata, never its secret.
+         */
+        post: operations["AdminRotateOrgAiAppKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/admin/orgs/{orgId}/ai-app-key/disable": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Disable an org's AI application key (admin-only)
+         * @description Admin only. Disables the organization's active AI application key at the AI SDK backend first, then in Builder. If the AI SDK backend call fails, the response is `503` and the key stays active, so you can retry. The disable persists: the organization's AI sessions fail with `403` until staff rotate the key with `POST /admin/orgs/{orgId}/ai-app-key/rotate`. Returns `404` if the organization has no active key. Returns the disabled key's metadata, never its secret.
+         */
+        post: operations["AdminDisableOrgAiAppKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/orgs/{orgId}/credits": {
         parameters: {
             query?: never;
@@ -2949,6 +3009,20 @@ export interface paths {
          *     the prompt states, such as the user's name, merged with the `context`
          *     you send. Your values take precedence.
          *
+         *     You can also send `dataPoints` (the values to verify, each with a
+         *     `name`, a `description`, and an optional `isOptional` flag) and
+         *     `loginUrls` (pages where the user signs in). Send a `prompt`, at least
+         *     one data point, or both. When you send `loginUrls`, Builder lists them
+         *     first as candidates and skips the web search. When you send
+         *     `dataPoints`, Builder keeps them and adds only optional ones. Every
+         *     required data point must appear in the verified proofs; optional ones
+         *     can be absent. Set
+         *     `isEmailVerificationAllowed` to `true` to let the user choose
+         *     email verification on the share page.
+         *
+         *     The first AI session of an organization creates and registers an
+         *     application key for the organization. You don't manage this key.
+         *
          *     On `201`, the session has no providers: the AI agent works out how to
          *     verify. The organization needs a callback subscription. The session
          *     uses one verification from the quota pool of the
@@ -2964,14 +3038,31 @@ export interface paths {
          *         curl -X POST $BASE/verifications/ai-sessions \
          *           -H "Authorization: Bearer $ORG_TOKEN" \
          *           -H 'Content-Type: application/json' \
-         *           -d '{"prompt":"verify I am a student at Manipal University"}'
+         *           -d '{
+         *             "prompt": "verify I am a student at Manipal University",
+         *             "dataPoints": [
+         *               {"name": "fullName", "description": "Name of the student"},
+         *               {"name": "studentId", "description": "Student ID", "isOptional": true}
+         *             ],
+         *             "loginUrls": ["https://learner.manipal.edu/login"],
+         *             "isEmailVerificationAllowed": false
+         *           }'
          *
          *     Errors:
          *
          *     - `400`: Builder rejects the prompt (for example, it targets an
-         *       internal host), `context` contains `attestationNonce` or
-         *       `attestationNonceData`, or `verificationClientUrl` isn't a
-         *       registered client.
+         *       internal host), the request has no `prompt` and no `dataPoints`,
+         *       `dataPoints` has duplicate names or no required item, a login URL
+         *       isn't a public `http` or `https` URL, the prompt and data points
+         *       together exceed 10,000 characters, `context` contains a reserved key
+         *       (`attestationNonce`, `attestationNonceData`, `reclaimSessionId`,
+         *       `extractedParameters`, or `builderSessionId`), or
+         *       `verificationClientUrl` isn't a registered client.
+         *     - `403`: Reclaim staff disabled AI sessions for the organization.
+         *       Contact Reclaim support.
+         *     - `503`: Builder couldn't create or register the organization's
+         *       application key. Builder doesn't charge a verification. Retry the
+         *       request.
          *     - `409`: The organization has no callback subscription.
          *     - `429` or `402`: The quota or credits are spent. The body has
          *       `event: billing_required` and a terminal `sessionId`.
@@ -3001,10 +3092,13 @@ export interface paths {
          *     `error`. Poll every second or two while it's `resolving`.
          *
          *     `candidates` lists the pages to open, best first, each with a
-         *     `source` of `catalog` or `web`. It usually has one page. It has
-         *     several (up to 3) only when their `confidence` values are within 0.1
-         *     of the best page's value. In that case, the user picks one on the
-         *     session's `verificationUrl`.
+         *     `source` of `caller`, `catalog`, or `web`. URLs you sent in
+         *     `loginUrls` come first, up to 10 candidates in all. Without
+         *     `loginUrls`, it usually has one page, and several (up to 3) only when
+         *     their `confidence` values are within 0.1 of the best page's value. In
+         *     that case, the user picks one on the session's `verificationUrl`.
+         *     After the user picks a page, `status` is `started` and
+         *     `selectedLoginUrl` holds it.
          *
          *     The `OrgToken` must resolve to the session's organization. To track
          *     the session's status, call `GET /verifications/sessions/{sessionId}`.
@@ -3021,6 +3115,66 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/verifications/ai-sessions/{sessionId}/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start an AI verification session on a chosen page
+         * @description Starts the verification on one of the session's `candidates` and returns the URL of the remote browser where the user signs in. The share page calls this endpoint. The registered `x-reclaim-vc-id` must match the client selected when the session was created. `loginUrl` must be one of the session's candidates. The call is idempotent: after the session starts, it returns the same `verificationUrl` and ignores `loginUrl`. The call returns `409` while the lookup is `resolving` or after it `failed`, and when the session has finished.
+         */
+        post: operations["StartAiVerificationSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verifications/ai-sessions/{sessionId}/proofs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Receive the proofs of an AI verification session
+         * @description Callback that Reclaim Popcorn calls when the user finishes an AI verification. Consumers don't call this endpoint. The body is the array of proofs. Builder verifies them, checks that any values in the session's `context` match the extracted values (ignoring case and surrounding whitespace), and records the result. Every required data point must have a non-empty extracted value. If any is missing, the session ends as `rejected` with `reasonCode` `missing-data-points`, and the problem detail names the missing data points, never their values. It then delivers the result, with the proofs and extracted parameters, to your callback subscriptions. The `x-reclaim-session-id` header must equal the ID that Builder stored when it started the session; otherwise the endpoint returns `404`. The endpoint returns `400` for invalid proofs and doesn't change the session. If the session has already finished, the endpoint returns `200` and does nothing.
+         */
+        post: operations["ReceiveAiVerificationProofs"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verifications/ai-sessions/{sessionId}/cancel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Receive the cancellation of an AI verification session
+         * @description Callback that Reclaim Popcorn calls when an AI verification is cancelled or fails. Consumers don't call this endpoint. Builder ends the session with status `error`, using `message` from the body (a string of up to 500 characters) as the error message, and delivers the failure to your `verification_error` callbacks. The `x-reclaim-session-id` header must equal the ID that Builder stored when it started the session; otherwise the endpoint returns `404`. If the session has already finished, the endpoint returns `200` and does nothing.
+         */
+        post: operations["ReceiveAiVerificationCancel"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/verifications/sessions/{sessionId}": {
         parameters: {
             query?: never;
@@ -3414,13 +3568,19 @@ export interface paths {
          *     has exhausted its `ZKFETCH` pool is refused (`402`/`429`) and never
          *     receives a usable token.
          *
+         *     Attestor authentication is optional. If the deployment doesn't use
+         *     it (no `ATTESTOR_AUTH_PRIVATE_KEY`), the request is still
+         *     authenticated, counted against the `ZKFETCH` pool, and logged, but
+         *     the response is an empty object. In that case, connect to the
+         *     attestor without an auth request.
+         *
          *     `host` is recorded for observability only — the minted token is
          *     **not** restricted to it and today authorizes a proof against any
          *     host, exactly like every other Builder-issued attestor token. Host
          *     enforcement, if it ships, will be a server-side change rather than a
          *     breaking one.
          *
-         *     `expiresAt` is always about ten seconds after issuance. The attestor
+         *     When present, `expiresAt` is about ten seconds after issuance. The attestor
          *     checks expiry only once, at the auth handshake — never again for the
          *     life of the connection — so this window only has to cover Builder
          *     issuing the token and the caller opening its attestor connection; the
@@ -3520,11 +3680,24 @@ export interface components {
         ProviderID: string;
         /** Format: uuid */
         OrgID: string;
-        /** @description Body for `POST /verifications/ai-sessions`. */
+        /** @description Body for `POST /verifications/ai-sessions`. Send a `prompt`, at least one entry in `dataPoints`, or both. */
         CreateAiVerificationSessionRequest: {
-            /** @description What to verify, in plain language, such as "verify I'm a student at Manipal University". Builder rejects a prompt that contains credentials, card numbers, instructions for the AI, or a sensitive claim. */
-            prompt: string;
-            /** @description Values you already know, such as `{"fullName": "Asha Rao"}`. Builder merges them over the values the prompt states and returns the result in `context`. Must not contain `attestationNonce` or `attestationNonceData`; bind those after you create the session. Omit if you have none. */
+            /** @description What to verify, in plain language, such as "verify I'm a student at Manipal University". Required unless `dataPoints` has at least one item. Builder rejects a prompt that contains credentials, card numbers, instructions for the AI, or a sensitive claim. The prompt and the data point lines together can't exceed 10,000 characters. */
+            prompt?: string;
+            /** @description The values to verify. Required unless you send a `prompt`. Names must be unique, and at least one data point must be required (its `isOptional` is `false` or absent). When you send data points, Builder keeps them and adds only optional data points that the prompt implies. When you send none, Builder chooses the data points from the prompt. Every required data point must appear in the verified proofs. If one is missing, the session ends as `rejected` with `reasonCode` `missing-data-points`. */
+            dataPoints?: {
+                /** @description Name of the value, such as `username`. Starts with a letter or underscore, followed by up to 63 letters, digits, or underscores. */
+                name: string;
+                /** @description What the value is and why it proves the claim. */
+                description: string;
+                /** @description Defaults to `false`. If `true`, the claim can be proven without this value, and the proofs can omit it. If `false` or absent, the data point is required, and a session whose proofs omit it ends as `rejected` with `reasonCode` `missing-data-points`. */
+                isOptional?: boolean;
+            }[];
+            /** @description Pages where the user signs in, such as `https://portal.example.edu/login`. Builder shows them first as candidates with source `caller`, and skips the web search. Each URL must use `http` or `https`, can't contain credentials, and must resolve to a public host. */
+            loginUrls?: string[];
+            /** @description Defaults to `false`. If `true`, the share page offers the user a choice to verify using email instead of signing in. If you omit it, the page doesn't offer that choice. */
+            isEmailVerificationAllowed?: boolean;
+            /** @description Values you already know, such as `{"fullName": "Asha Rao"}`. Builder merges them over the values the prompt states and returns the result in `context`. Must not contain `attestationNonce` or `attestationNonceData`; bind those after you create the session. Also must not contain `reclaimSessionId`, `extractedParameters`, or `builderSessionId`. Omit if you have none. */
             context?: {
                 [key: string]: unknown;
             };
@@ -3533,6 +3706,45 @@ export interface components {
             /** @description ISO 3166-1 alpha-2 country code, such as `IN`. Builder searches the web from this country (Google's `gl` parameter), so portals for that country rank first. If you omit it, the search has no country preference. */
             geoLocation?: string;
         };
+        /** @description Body for `POST /verifications/ai-sessions/{sessionId}/start`. */
+        StartAiVerificationSessionRequest: {
+            /**
+             * Format: uri
+             * @description The page to open. Must be the `loginUrl` of one of the session's `candidates`.
+             */
+            loginUrl: string;
+        };
+        StartAiVerificationSessionResponse: {
+            /**
+             * Format: uri
+             * @description URL of the remote browser where the user signs in.
+             */
+            verificationUrl: string;
+        };
+        AiVerificationCallbackAck: {
+            /** @description Always `true`. */
+            ok: boolean;
+        };
+        /** @description Metadata of an organization's AI application key. The response never includes the key's secret. */
+        AdminOrgAiAppKey: {
+            /** @description Public identifier (an Ethereum address) of the key. */
+            appId: string;
+            /**
+             * Format: date-time
+             * @description When Builder created the key.
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description When Builder registered the key with the AI SDK backend, or `null` if registration hasn't completed.
+             */
+            registeredAt: string | null;
+            /**
+             * Format: date-time
+             * @description When the key was disabled, or `null` if it's active.
+             */
+            disabledAt: string | null;
+        };
         /** @description The lookup `POST /verifications/ai-sessions` started for a session: its status, and once `ready`, the pages to open and the data points to verify there. */
         AiVerificationSession: {
             /**
@@ -3541,27 +3753,34 @@ export interface components {
              */
             sessionId: string;
             /**
-             * @description `resolving` while Builder looks up the pages and data points. `ready` when `candidates` and `dataPoints` are set. `failed` when the lookup failed: `error` says why, the session ended with status `error`, and its verification was refunded.
+             * @description `resolving` while Builder looks up the pages and data points. `ready` when `candidates` and `dataPoints` are set. `started` when the user has picked a page and the verification is running; the session's own status stays `pending` until it finishes. `failed` when the lookup failed: `error` says why, the session ended with status `error`, and its verification was refunded.
              * @enum {string}
              */
-            status: "resolving" | "ready" | "failed";
+            status: "resolving" | "ready" | "started" | "failed";
             /** @description Why the lookup failed. Only when `status` is `failed`. Its `status` is 422 when the prompt isn't a request to verify something about the user, 404 when no login page was found, and 503 when the AI model or web search stayed unavailable. */
             error?: components["schemas"]["Problem"];
-            /** @description Only when `status` is `ready`. The fewest data points that prove the prompt's claim, required data points first. A data point for a value the prompt states is always required. */
+            /** @description Only when `status` is `ready` or `started`. The data points to verify, required data points first. They combine the data points you sent with any optional ones Builder added. If you sent none, Builder chooses the fewest that prove the prompt's claim. A data point for a value the prompt or `context` states is always required. */
             dataPoints?: {
-                /** @description Short camelCase name, such as `username`. */
+                /** @description Name of the value, such as `username`. */
                 name: string;
                 /** @description What the value is and why it proves the claim. */
                 description: string;
-                /** @description If `true`, the claim can be proven without this value, as with `isOptional` on a provider's `ResponseMatch`. If absent, the data point is required. */
-                isOptional?: boolean;
+                /** @description If `true`, the claim can be proven without this value, as with `isOptional` on a provider's `ResponseMatch`. If `false`, the data point is required. */
+                isOptional: boolean;
             }[];
             /** @description Values the signed-in account must show, such as `{"fullName": "Asha Rao"}`. Each key is the `dataPoints` name that the value pins. It combines the values the prompt states with the request's `context`. It's empty if neither has any. It's the session's `context`. If the prompt names a specific page, such as a post, `pageUrl` holds it: the page to open after the user logs in on the candidate's site. */
             context: {
                 [key: string]: unknown;
             };
-            /** @description Only when `status` is `ready`. Pages to open, best first. Each is the page that shows the data after the user signs in (it sends the user to sign in first), or else the sign-in page. Usually one page. Several pages appear only when the choice is ambiguous, such as a college with two or three student portals whose `confidence` values are within 0.1 of the best. In that case, the user picks one on the session's `verificationUrl`. At most one page per host. */
+            /** @description Only when `status` is `ready` or `started`. Pages to open, best first. Each is the page that shows the data after the user signs in (it sends the user to sign in first), or else the sign-in page. URLs you sent in `loginUrls` come first (source `caller`, confidence 1), up to 10 candidates in all. Otherwise it's usually one page, and several pages appear only when the choice is ambiguous, such as a college with two or three student portals whose `confidence` values are within 0.1 of the best. In that case, the user picks one on the session's `verificationUrl`. At most one page per host. */
             candidates?: components["schemas"]["ResolvedLoginPage"][];
+            /** @description Whether the share page offers the user a choice to verify using email. Matches the value you sent when you created the session. */
+            isEmailVerificationAllowed: boolean;
+            /**
+             * Format: uri
+             * @description The page the user picked. Only when `status` is `started`.
+             */
+            selectedLoginUrl?: string;
         };
         /** @description A page for the user to open and sign in to. */
         ResolvedLoginPage: {
@@ -3573,10 +3792,10 @@ export interface components {
             /** @description Estimated likelihood, from 0 to 1, that signing in here shows the claim. Candidates below 0.5 are never returned. */
             confidence: number;
             /**
-             * @description Where the page came from. `catalog` is the page of a provider in the catalog (public, or your organization's own). `web` is a page that a web search found; it has no provider yet.
+             * @description Where the page came from. `caller` is a URL you sent in `loginUrls`. `catalog` is the page of a provider in the catalog (public, or your organization's own). `web` is a page that a web search found; it has no provider yet.
              * @enum {string}
              */
-            source: "catalog" | "web";
+            source: "caller" | "catalog" | "web";
         };
         /** @description A verification client id used as a filter. Hyphens are ignored. */
         VerificationClientIDFilter: string;
@@ -3623,14 +3842,14 @@ export interface components {
              */
             host: string;
         };
-        /** @description A short-lived attestor authorization for one zkFetch call. */
+        /** @description A short-lived attestor authorization for one zkFetch call. Both `token` and `expiresAt` are absent when the deployment doesn't use attestor authentication. The caller then connects to the attestor without an auth request. */
         FetchAuthorization: {
             /**
              * Format: byte
              * @description Base64-encoded legacy attestor authorization — the same form `POST /verifications/sessions/{sessionId}/attestor-auth` returns. Decode it back into the native `AuthenticationRequest` to open the attestor connection.
              */
-            token: string;
-            expiresAt: components["schemas"]["Timestamp"];
+            token?: string;
+            expiresAt?: components["schemas"]["Timestamp"];
         };
         /**
          * Format: uuid
@@ -4514,6 +4733,29 @@ export interface components {
                 orgId: components["schemas"]["OrgID"];
                 orgName: string;
             }[];
+            /** @description Prompts callers sent to `POST /verifications/ai-sessions` in the window, most recent first, with how each resolved and ended. Never holds proofs, extracted values or the verification URL. */
+            aiSessionPrompts: {
+                /** Format: uuid */
+                sessionId: string;
+                /** Format: date-time */
+                createdAt: string;
+                orgId: components["schemas"]["OrgID"];
+                orgName: string;
+                prompt: string;
+                geoLocation?: string;
+                requiredDataPoints: string[];
+                optionalDataPoints: string[];
+                /** @enum {string} */
+                taskStatus: "resolving" | "ready" | "started" | "failed";
+                /** @description Login pages found, by host only. */
+                candidates: {
+                    host: string;
+                    source: string;
+                }[];
+                errorTitle?: string;
+                sessionStatus: string;
+                outcomeReasonCode?: string;
+            }[];
             /** @description Coding-agent activity reported by the Reclaim MCP server in the window. `toolCalls` and `clients` come from a daily rollup that refreshes every 15 minutes. The `orgId` filter doesn't apply here. */
             agents: {
                 /**
@@ -6288,7 +6530,7 @@ export interface components {
              * @description UUID v7 session id (also echoed in context as `reclaimSessionId`).
              */
             id: string;
-            /** @description The providers this session verifies, in run order. The Verification Client runs each (sequentially, in one browser session) and submits one combined result; all are required. */
+            /** @description The providers this session verifies, in run order. The Verification Client runs each (sequentially, in one browser session) and submits one combined result; all are required. AI sessions have no providers, so the array is empty. */
             providers: components["schemas"]["SessionProvider"][];
             /** @description The organization that owns this session. */
             orgId: components["schemas"]["OrgID"];
@@ -6709,10 +6951,12 @@ export interface components {
             } & {
                 [key: string]: unknown;
             };
-            /** @description One entry per verified provider (success only), in run order. Each carries that provider's proven requests. */
+            /** @description One entry per verified provider (success only), in run order. Each carries that provider's proven requests. AI sessions have no provider, so they carry a single entry without `provider_id` and `resolved_version`. */
             results?: ({
-                provider_id: components["schemas"]["ProviderID"];
-                resolved_version: string;
+                /** @description Absent for AI sessions. */
+                provider_id?: components["schemas"]["ProviderID"];
+                /** @description Absent for AI sessions. */
+                resolved_version?: string;
                 /** @description One entry per proven request for this provider. */
                 requests: ({
                     request_id?: string;
@@ -7698,7 +7942,7 @@ export interface operations {
                 /** @description Set to `csv` to download one section as a spreadsheet instead of rendering the page. Pair it with `section`. A CSV export returns up to 1000 rows, where the page shows only the leading rows of each ranked section. */
                 format?: "csv";
                 /** @description Which section `format=csv` exports. Each section has its own columns, so one download holds one section. Defaults to `providers`. */
-                section?: "providers" | "revenue" | "usage" | "goals" | "tools" | "agents" | "funnel";
+                section?: "providers" | "revenue" | "usage" | "goals" | "ai-session-prompts" | "tools" | "agents" | "funnel";
             };
             header?: never;
             path?: never;
@@ -8060,6 +8304,81 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    AdminGetOrgAiAppKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The key's metadata. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminOrgAiAppKey"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminRotateOrgAiAppKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The key's metadata. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminOrgAiAppKey"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AdminDisableOrgAiAppKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgId: components["schemas"]["OrgID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The key's metadata. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminOrgAiAppKey"];
+                };
+            };
+            403: components["responses"]["ForbiddenResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     AdminGrantOrgCredit: {
         parameters: {
             query?: never;
@@ -11682,6 +12001,15 @@ export interface operations {
                     "application/problem+json": components["schemas"]["Problem"];
                 };
             };
+            /** @description Reclaim staff disabled AI sessions for the organization. Contact Reclaim support. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
             /** @description The organization has no callback subscription. */
             409: {
                 headers: {
@@ -11700,6 +12028,15 @@ export interface operations {
                     "application/problem+json": components["schemas"]["Problem"];
                 };
             };
+            /** @description Builder couldn't create or register the organization's AI application key. Nothing is charged. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
             default: components["responses"]["ProblemResponse"];
         };
     };
@@ -11735,6 +12072,110 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    StartAiVerificationSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StartAiVerificationSessionRequest"];
+            };
+        };
+        responses: {
+            /** @description The session started. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["StartAiVerificationSessionResponse"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            /** @description The lookup is still `resolving`, it `failed`, or the session has finished. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ReceiveAiVerificationProofs: {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description ID of the AI SDK session that Popcorn is reporting. */
+                "x-reclaim-session-id": string;
+            };
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    [key: string]: unknown;
+                }[];
+            };
+        };
+        responses: {
+            /** @description Builder accepted the proofs. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AiVerificationCallbackAck"];
+                };
+            };
+            400: components["responses"]["ProblemResponse"];
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ReceiveAiVerificationCancel: {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description ID of the AI SDK session that Popcorn is reporting. */
+                "x-reclaim-session-id": string;
+            };
+            path: {
+                sessionId: components["schemas"]["SessionID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    [key: string]: unknown;
+                };
+            };
+        };
+        responses: {
+            /** @description Builder recorded the cancellation. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AiVerificationCallbackAck"];
+                };
+            };
+            404: components["responses"]["ProblemResponse"];
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     GetVerificationSession: {
         parameters: {
             query?: never;
@@ -12184,7 +12625,7 @@ export interface operations {
             };
         };
         responses: {
-            /** @description Attestor authorization minted. */
+            /** @description Attestor authorization minted, or an empty object if the deployment doesn't use attestor authentication. */
             200: {
                 headers: {
                     [name: string]: unknown;