@reclaimprotocol/agent 0.1.0-dev.1

package/lib/old/identity.js

@@ -0,0 +1,47 @@
+import { deriveFromPrivateKey } from '@reclaimprotocol/client';
+import { ConfigStore } from "../config/store.js";
+/** Normalize an eth uid input to `eth:<lowercase-address>`. Accepts a bare
+ *  `0x…` address or an already-prefixed `eth:0x…`. */
+export function toEthUid(addressOrUid) {
+    const lower = addressOrUid.trim().toLowerCase();
+    const uid = lower.startsWith('eth:') ? lower : `eth:${lower}`;
+    return { kind: 'eth', uid };
+}
+/**
+ * Resolve a caller identity from the environment, in priority order:
+ *   1. `RECLAIM_OLD_API_TOKEN` — a dashboard Firebase bearer token.
+ *   2. `RECLAIM_OLD_ETH_UID`   — an `eth:<addr>` (or bare `0x…`) uid.
+ *   3. `RECLAIM_PRIVATE_KEY`   — derive the eth uid from the local app key.
+ * Returns undefined when none is set.
+ */
+export function resolveIdentityFromEnv() {
+    const token = process.env.RECLAIM_OLD_API_TOKEN?.trim();
+    if (token) {
+        return { kind: 'bearer', token };
+    }
+    const ethUid = process.env.RECLAIM_OLD_ETH_UID?.trim();
+    if (ethUid) {
+        return toEthUid(ethUid);
+    }
+    const privateKey = process.env.RECLAIM_PRIVATE_KEY?.trim();
+    if (privateKey) {
+        return toEthUid(deriveFromPrivateKey(privateKey).address);
+    }
+    return undefined;
+}
+/** Read the identity persisted by a prior `reclaim_authenticate` call. */
+export function loadPersistedIdentity() {
+    return new ConfigStore().read()?.old_devtools;
+}
+/** Persist the identity so it survives an MCP-server restart. */
+export function persistIdentity(identity) {
+    new ConfigStore().write({ old_devtools: identity });
+}
+/**
+ * The identity the client should start with: an explicit env var wins
+ * (useful for headless / CI), otherwise fall back to whatever the dev
+ * authenticated with last time.
+ */
+export function resolveInitialIdentity() {
+    return resolveIdentityFromEnv() ?? loadPersistedIdentity();
+}

package/lib/old/instructions.d.ts

@@ -0,0 +1,7 @@
+/**
+ * MCP server instructions shown to the LLM when running in OLD-devtools mode
+ * (`USE_OLD_DEVTOOLS` unset or not `false`). Describes the REDUCED tool
+ * surface — there are no org/credential-link/review flows and no generated
+ * API tools here. Must not mention disabled tools.
+ */
+export declare const OLD_MODE_INSTRUCTIONS: string;

package/lib/old/instructions.js

@@ -0,0 +1,29 @@
+/**
+ * MCP server instructions shown to the LLM when running in OLD-devtools mode
+ * (`USE_OLD_DEVTOOLS` unset or not `false`). Describes the REDUCED tool
+ * surface — there are no org/credential-link/review flows and no generated
+ * API tools here. Must not mention disabled tools.
+ */
+export const OLD_MODE_INSTRUCTIONS = 'This server is running against the LEGACY Reclaim devtools backend ' +
+    '(temporary, while the new builder backend is in development), so its ' +
+    'capabilities are intentionally limited.\n\n' +
+    'Provider-authoring flow:\n' +
+    '1. `reclaim_authenticate` — by default opens the dashboard in Chrome, ' +
+    'waits for you to sign in, captures the token automatically, and closes ' +
+    'the tab (or paste a `token` / pass an eth `ethAddress` to skip the ' +
+    'browser). Do this once before publishing or listing.\n' +
+    '2. `attach_chrome` → `start_capture` → drive the page (`navigate`, ' +
+    '`wait_for_page`) → inspect (`list_requests`, `get_request`, ' +
+    '`find_requests_containing`).\n' +
+    '3. `propose_provider` to draft a provider, `replay_request` to ' +
+    'pre-flight, `run_proof` to verify with the attestor. OPRF/`hash` ' +
+    'redactions are optional and supported.\n' +
+    '4. `create_provider_version_from_capture` to publish. With NO ' +
+    '`providerId` it REGISTERS A NEW provider (re-running creates a ' +
+    'duplicate); pass a ' +
+    '`providerId` from `get_me_providers` to add a new version to an existing ' +
+    'provider instead.\n' +
+    '5. `get_me_providers` lists the providers you own (the only ' +
+    'provider-listing tool available in this mode).\n\n' +
+    'Only GET/POST endpoints can be captured into providers here. There is no ' +
+    'organization, credential-linking, or public-review workflow in this mode.';

package/lib/old/login-cdp.d.ts

@@ -0,0 +1,23 @@
+/** The devtools dashboard login page. Override per-call or via
+ *  `RECLAIM_OLD_LOGIN_URL`. */
+export declare const DEFAULT_LOGIN_URL = "https://dev.reclaimprotocol.org";
+export interface CdpLoginResult {
+    token: string;
+    /** True when we launched (and then closed) a dedicated Chrome just for
+     *  login; false when we attached to an already-running browser and only
+     *  closed the tab we opened. */
+    closedBrowser: boolean;
+}
+/**
+ * Open the dashboard login page in Chrome via CDP, wait for the developer to
+ * finish signing in, read the resulting Firebase ID token from page storage,
+ * then clean up. If we had to launch a dedicated Chrome for this, we close the
+ * whole browser afterwards; if we attached to a Chrome that was already up
+ * (e.g. the capture flow's), we only close the tab we opened so we don't
+ * disrupt it.
+ */
+export declare function captureFirebaseTokenViaCdp(opts: {
+    loginUrl?: string;
+    timeoutMs?: number;
+    pollMs?: number;
+}): Promise<CdpLoginResult>;

package/lib/old/login-cdp.js

@@ -0,0 +1,125 @@
+import { connectCdp } from "../cdp/client.js";
+import { defaultProfileDir, launchChrome, waitForCdpReady, } from "../cdp/launcher.js";
+import { ConfigStore } from "../config/store.js";
+/** The devtools dashboard login page. Override per-call or via
+ *  `RECLAIM_OLD_LOGIN_URL`. */
+export const DEFAULT_LOGIN_URL = 'https://dev.reclaimprotocol.org';
+/**
+ * Read the Firebase ID token the dashboard persisted after login.
+ *
+ * The frontend uses `browserLocalPersistence`, which the Firebase JS SDK
+ * implements on `localStorage` under a `firebase:authUser:<apiKey>:[DEFAULT]`
+ * key whose JSON value carries `stsTokenManager.accessToken`. We scan for any
+ * such key (so we never hard-code the project apiKey) and fall back to the
+ * IndexedDB persistence layout (`firebaseLocalStorageDb` /
+ * `firebaseLocalStorage`) in case a build switches persistence. Returns the
+ * token string, or null when the user has not finished logging in yet.
+ *
+ * Evaluated in-page with `awaitPromise` so the async IndexedDB branch resolves.
+ */
+const EXTRACT_TOKEN_JS = `(async () => {
+	try {
+		for (let i = 0; i < localStorage.length; i++) {
+			const k = localStorage.key(i)
+			if (k && k.indexOf('firebase:authUser:') === 0) {
+				const v = JSON.parse(localStorage.getItem(k) || 'null')
+				const t = v && v.stsTokenManager && v.stsTokenManager.accessToken
+				if (t) return t
+			}
+		}
+	} catch (e) {}
+	try {
+		return await new Promise((resolve) => {
+			const req = indexedDB.open('firebaseLocalStorageDb')
+			req.onerror = () => resolve(null)
+			req.onsuccess = () => {
+				try {
+					const db = req.result
+					if (!db.objectStoreNames.contains('firebaseLocalStorage')) {
+						resolve(null); return
+					}
+					const store = db
+						.transaction('firebaseLocalStorage', 'readonly')
+						.objectStore('firebaseLocalStorage')
+					const all = store.getAll()
+					all.onerror = () => resolve(null)
+					all.onsuccess = () => {
+						for (const row of (all.result || [])) {
+							const m = row && row.value && row.value.stsTokenManager
+							if (m && m.accessToken) { resolve(m.accessToken); return }
+						}
+						resolve(null)
+					}
+				} catch (e) { resolve(null) }
+			}
+		})
+	} catch (e) { return null }
+})()`;
+/**
+ * Open the dashboard login page in Chrome via CDP, wait for the developer to
+ * finish signing in, read the resulting Firebase ID token from page storage,
+ * then clean up. If we had to launch a dedicated Chrome for this, we close the
+ * whole browser afterwards; if we attached to a Chrome that was already up
+ * (e.g. the capture flow's), we only close the tab we opened so we don't
+ * disrupt it.
+ */
+export async function captureFirebaseTokenViaCdp(opts) {
+    const loginUrl = opts.loginUrl || process.env.RECLAIM_OLD_LOGIN_URL || DEFAULT_LOGIN_URL;
+    const timeoutMs = opts.timeoutMs ?? 180_000;
+    const pollMs = opts.pollMs ?? 1000;
+    const cfg = new ConfigStore().read()?.browser_agent;
+    const mode = cfg?.attachMode ?? 'dedicated';
+    const port = cfg?.port ?? 9222;
+    // Ensure something is answering CDP. In dedicated mode we may launch it.
+    let launchedByUs = false;
+    try {
+        await waitForCdpReady(port, 500);
+    }
+    catch {
+        if (mode !== 'dedicated') {
+            throw new Error(`attach mode: nothing answering CDP on port ${port}. Launch Chrome ` +
+                `with --remote-debugging-port=${port} AND a non-default ` +
+                '--user-data-dir, or switch to dedicated mode (attach_chrome).');
+        }
+        launchChrome({ port, profileDir: defaultProfileDir() });
+        await waitForCdpReady(port, 10_000);
+        launchedByUs = true;
+    }
+    const handles = await connectCdp(port);
+    const { Target } = handles.browser;
+    const { targetId } = await Target.createTarget({ url: loginUrl });
+    try {
+        const session = await handles.attachToTab(targetId);
+        const { Runtime } = session;
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            const r = await Runtime.evaluate({
+                expression: EXTRACT_TOKEN_JS,
+                awaitPromise: true,
+                returnByValue: true,
+            });
+            const value = r.result?.value;
+            if (typeof value === 'string' && value.length > 0) {
+                return { token: value, closedBrowser: launchedByUs };
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollMs));
+        }
+        throw new Error('Timed out waiting for login. Finish signing in at the opened ' +
+            'page, or re-run reclaim_authenticate with a longer timeoutMs.');
+    }
+    finally {
+        // Best-effort cleanup — never mask the real result/error.
+        try {
+            if (launchedByUs) {
+                await handles.browser.Browser.close();
+            }
+            else {
+                await handles.browser.Target.closeTarget({ targetId });
+            }
+        }
+        catch {
+            // ignore
+        }
+        await handles.close().catch(() => { });
+    }
+}

package/lib/old/to-register.d.ts

@@ -0,0 +1,47 @@
+import type { ReclaimProvider } from '../provider/schema.ts';
+import type { RegisterProviderBody, UpdateProviderConfigBody } from './client.ts';
+/**
+ * Translate a drafted `ReclaimProvider` (from `propose_provider`) into the
+ * OLD devtools backend shapes. Deliberately a SEPARATE module from
+ * `provider/to-version.ts` (the builder translator) — the two backends have
+ * structurally different bodies:
+ *
+ *   - builder NESTS each redaction into its match's `extract`;
+ *   - old devtools keeps `responseMatches` and `responseRedactions` as
+ *     PARALLEL arrays on each `requestData` entry.
+ *
+ * Old-devtools limit we enforce here (a clear error beats a confusing
+ * server-side 400): only `GET` / `POST` methods. OPRF redactions are passed
+ * through unchanged — the backend's `hash` field accepts them.
+ */
+export interface OldProviderOpts {
+    initialUrl: string;
+    description?: string;
+    geoLocation?: string;
+    providerType?: 'PRIVATE' | 'PUBLIC';
+}
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
+export declare function providerToRegisterBody(provider: ReclaimProvider, opts: OldProviderOpts): RegisterProviderBody;
+/** Body for `POST /api/providers/:providerId/config` — adds a new version to
+ *  an EXISTING provider. `version` must not already exist; `versionInfo` is
+ *  required and must be ≥10 chars (enforced by the backend). */
+export declare function providerToConfigBody(provider: ReclaimProvider, opts: OldProviderOpts, version: string, versionInfo: string): UpdateProviderConfigBody;
+/** Minimal version triplet as the old backend stores it. */
+export interface SemverTriplet {
+    major: number;
+    minor: number;
+    patch: number;
+}
+/**
+ * Pull `{major,minor,patch}` triplets out of a `/versions` response, tolerant
+ * of the exact envelope (array, `{ providerVersions: [...] }`, `{ items }`,
+ * etc.). Each entry's `version` is the triplet.
+ */
+export declare function extractVersions(resp: unknown): SemverTriplet[];
+/**
+ * Next version string for an update: the highest existing triplet with its
+ * patch bumped, as `"major.minor.patch"`. Falls back to `"1.0.1"` when no
+ * versions are found (a provider being updated always has ≥1, but stay safe
+ * rather than collide with the guaranteed 1.0.0).
+ */
+export declare function bumpPatchString(versions: SemverTriplet[]): string;

package/lib/old/to-register.js

@@ -0,0 +1,133 @@
+/** Build the single `requestData` entry shared by register + update. */
+function requestDataFromProvider(provider) {
+    const method = String(provider.method).toUpperCase();
+    if (method !== 'GET' && method !== 'POST') {
+        throw new Error('Old devtools supports only GET/POST requests; got ' +
+            `"${provider.method}". Re-capture against a GET/POST endpoint.`);
+    }
+    const responseMatches = provider.responseMatches.map((m, i) => ({
+        value: m.value,
+        type: m.type ?? 'contains',
+        isOptional: false,
+        order: i,
+    }));
+    const responseRedactions = (provider.responseRedactions ?? []).map((r, i) => {
+        const out = { order: i };
+        if (r.xPath !== undefined) {
+            out.xPath = r.xPath;
+        }
+        if (r.jsonPath !== undefined) {
+            out.jsonPath = r.jsonPath;
+        }
+        if (r.regex !== undefined) {
+            out.regex = r.regex;
+        }
+        // OPRF redactions are supported — pass the mode through unchanged.
+        if (r.hash !== undefined) {
+            out.hash = r.hash;
+        }
+        return out;
+    });
+    const requestData = {
+        url: provider.url,
+        // `{{param}}` placeholders → TEMPLATE so the backend templates them;
+        // otherwise a fixed CONSTANT url. (REGEX is never drafted.)
+        urlType: provider.url.includes('{{') ? 'TEMPLATE' : 'CONSTANT',
+        method: method,
+        responseMatches,
+        responseRedactions,
+        // The verification client re-supplies cookies/auth at runtime; secrets
+        // are never persisted (propose_provider already stripped them).
+        credentials: 'include',
+    };
+    if (provider.body !== undefined) {
+        requestData.bodySniff = { enabled: true, template: provider.body };
+    }
+    // NOTE: `responseVariables` is intentionally omitted — the old backend
+    // auto-extracts it from `{{var}}` placeholders in responseMatches. Sending
+    // it ourselves would risk drifting from the server's own extraction.
+    return requestData;
+}
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
+export function providerToRegisterBody(provider, opts) {
+    const body = {
+        name: provider.name,
+        loginUrl: opts.initialUrl,
+        providerType: opts.providerType ?? 'PRIVATE',
+        requestData: [requestDataFromProvider(provider)],
+    };
+    if (opts.description !== undefined) {
+        body.description = opts.description;
+    }
+    if (opts.geoLocation !== undefined) {
+        body.geoLocation = opts.geoLocation;
+    }
+    return body;
+}
+/** Body for `POST /api/providers/:providerId/config` — adds a new version to
+ *  an EXISTING provider. `version` must not already exist; `versionInfo` is
+ *  required and must be ≥10 chars (enforced by the backend). */
+export function providerToConfigBody(provider, opts, version, versionInfo) {
+    const providerConfig = {
+        loginUrl: opts.initialUrl,
+        requestData: [requestDataFromProvider(provider)],
+    };
+    if (opts.geoLocation !== undefined) {
+        providerConfig.geoLocation = opts.geoLocation;
+    }
+    return { providerConfig, version, versionInfo };
+}
+/**
+ * Pull `{major,minor,patch}` triplets out of a `/versions` response, tolerant
+ * of the exact envelope (array, `{ providerVersions: [...] }`, `{ items }`,
+ * etc.). Each entry's `version` is the triplet.
+ */
+export function extractVersions(resp) {
+    const list = pickArray(resp);
+    const out = [];
+    for (const item of list) {
+        const v = item.version ?? item;
+        if (v && typeof v === 'object' &&
+            typeof v.major === 'number' &&
+            typeof v.minor === 'number' &&
+            typeof v.patch === 'number') {
+            const t = v;
+            out.push({ major: t.major, minor: t.minor, patch: t.patch });
+        }
+    }
+    return out;
+}
+/**
+ * Next version string for an update: the highest existing triplet with its
+ * patch bumped, as `"major.minor.patch"`. Falls back to `"1.0.1"` when no
+ * versions are found (a provider being updated always has ≥1, but stay safe
+ * rather than collide with the guaranteed 1.0.0).
+ */
+export function bumpPatchString(versions) {
+    if (versions.length === 0) {
+        return '1.0.1';
+    }
+    let hi = versions[0];
+    for (const v of versions) {
+        if (v.major > hi.major ||
+            (v.major === hi.major && v.minor > hi.minor) ||
+            (v.major === hi.major && v.minor === hi.minor && v.patch > hi.patch)) {
+            hi = v;
+        }
+    }
+    return `${hi.major}.${hi.minor}.${hi.patch + 1}`;
+}
+function pickArray(resp) {
+    if (Array.isArray(resp)) {
+        return resp;
+    }
+    if (resp && typeof resp === 'object') {
+        const obj = resp;
+        for (const key of ['providerVersions', 'versions', 'items', 'data']) {
+            if (Array.isArray(obj[key])) {
+                return obj[key];
+            }
+        }
+    }
+    return [];
+}

package/lib/old/tools/authenticate.d.ts

@@ -0,0 +1,18 @@
+import { type RegisteredTool } from '../../mcp/server.ts';
+import type { ReclaimOldClient } from '../client.ts';
+/**
+ * OLD-devtools authenticate. The default, zero-arg flow drives Chrome via CDP:
+ * it opens the devtools dashboard, waits for the developer to sign in, reads
+ * the Firebase ID token straight from page storage, then closes the tab (or
+ * the browser, if it launched one just for this). Two manual overrides remain:
+ *
+ *   - `token`: paste a Firebase ID token yourself (skips the browser).
+ *   - `ethAddress`: an `eth:<addr>`/`0x…` uid for an already-provisioned eth
+ *     user (header carries no signature, so the uid must already exist).
+ *
+ * The chosen identity is attached to the shared client and persisted to
+ * `~/.reclaim/config.json` so later calls and future restarts reuse it. A
+ * zero-arg call reuses a still-valid stored identity before falling back to
+ * the browser flow.
+ */
+export declare function authenticateTool(client: ReclaimOldClient): RegisteredTool;

package/lib/old/tools/authenticate.js

@@ -0,0 +1,127 @@
+import { defineTool } from "../../mcp/server.js";
+import { persistIdentity, toEthUid } from "../identity.js";
+import { captureFirebaseTokenViaCdp } from "../login-cdp.js";
+/**
+ * OLD-devtools authenticate. The default, zero-arg flow drives Chrome via CDP:
+ * it opens the devtools dashboard, waits for the developer to sign in, reads
+ * the Firebase ID token straight from page storage, then closes the tab (or
+ * the browser, if it launched one just for this). Two manual overrides remain:
+ *
+ *   - `token`: paste a Firebase ID token yourself (skips the browser).
+ *   - `ethAddress`: an `eth:<addr>`/`0x…` uid for an already-provisioned eth
+ *     user (header carries no signature, so the uid must already exist).
+ *
+ * The chosen identity is attached to the shared client and persisted to
+ * `~/.reclaim/config.json` so later calls and future restarts reuse it. A
+ * zero-arg call reuses a still-valid stored identity before falling back to
+ * the browser flow.
+ */
+export function authenticateTool(client) {
+    /** Validate an identity against the backend (throws on failure). */
+    const validate = async (identity) => {
+        client.setIdentity(identity);
+        if (identity.kind === 'bearer') {
+            await client.loginWithToken();
+        }
+        else {
+            await client.getMyProviders({ pageSize: 1 });
+        }
+    };
+    return defineTool({
+        name: 'reclaim_authenticate',
+        description: 'Authenticate against the OLD Reclaim devtools backend. \n\n' +
+            'Default (no args): opens the devtools dashboard in Chrome via CDP, ' +
+            'waits for you to sign in, grabs the Firebase token automatically, ' +
+            'and closes the tab. A previously stored identity that is still ' +
+            'valid is reused first (pass `useBrowser: true` to force a fresh ' +
+            'login). \n\n' +
+            'Manual overrides:\n' +
+            '- `token`: paste a Firebase ID token (skips the browser).\n' +
+            '- `ethAddress`: an `eth:0x…` / `0x…` uid for an already-provisioned ' +
+            'eth user (returns 401 "ETH user not found" if unknown).\n\n' +
+            'The identity is cached locally for subsequent publish / ' +
+            'get_me_providers calls. Firebase tokens are short-lived (~1h) — ' +
+            're-run this when calls start returning 401.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                token: {
+                    type: 'string',
+                    description: 'Firebase ID token (skips the browser flow).',
+                },
+                ethAddress: {
+                    type: 'string',
+                    description: 'eth uid (`eth:0x…`) or bare `0x…` address.',
+                },
+                loginUrl: {
+                    type: 'string',
+                    description: 'Dashboard URL to open for the browser flow ' +
+                        '(default https://dev.reclaimprotocol.org).',
+                },
+                timeoutMs: {
+                    type: 'number',
+                    description: 'How long to wait for sign-in, in ms (default 180000).',
+                },
+                useBrowser: {
+                    type: 'boolean',
+                    description: 'Force the browser login even if a stored identity exists.',
+                },
+            },
+        },
+    }, async ({ token, ethAddress, loginUrl, timeoutMs, useBrowser }) => {
+        if (token && ethAddress) {
+            throw new Error('Provide only ONE of `token` or `ethAddress`, not both.');
+        }
+        // Explicit credential paths skip the browser entirely.
+        if (token || ethAddress) {
+            const identity = token
+                ? { kind: 'bearer', token: token.trim() }
+                : toEthUid(ethAddress);
+            await validate(identity);
+            persistIdentity(identity);
+            return {
+                authenticated: true,
+                method: identity.kind === 'bearer' ? 'token' : 'eth',
+                identity: identity.kind === 'bearer'
+                    ? { kind: 'bearer' }
+                    : { kind: 'eth', uid: identity.uid },
+            };
+        }
+        // Reuse a still-valid stored/env identity before opening a browser.
+        if (!useBrowser) {
+            const existing = client.getIdentity();
+            if (existing) {
+                try {
+                    await validate(existing);
+                    persistIdentity(existing);
+                    return {
+                        authenticated: true,
+                        method: 'reused',
+                        identity: existing.kind === 'bearer'
+                            ? { kind: 'bearer' }
+                            : { kind: 'eth', uid: existing.uid },
+                    };
+                }
+                catch {
+                    // Stale/expired — fall through to the browser flow.
+                }
+            }
+        }
+        // CDP browser login (the default headline flow).
+        if (process.env.RECLAIM_AGENT_DISABLED === '1') {
+            throw new Error('Browser login is unavailable (RECLAIM_AGENT_DISABLED=1). Pass a ' +
+                '`token` (Firebase ID token) or `ethAddress` instead.');
+        }
+        const result = await captureFirebaseTokenViaCdp({ loginUrl, timeoutMs });
+        const identity = { kind: 'bearer', token: result.token };
+        await validate(identity);
+        persistIdentity(identity);
+        return {
+            authenticated: true,
+            method: 'browser',
+            closedBrowser: result.closedBrowser,
+            note: 'Signed in via the dashboard; Firebase token captured and cached. ' +
+                'Tokens expire (~1h) — re-run reclaim_authenticate on 401.',
+        };
+    });
+}

package/lib/old/tools/build.d.ts

@@ -0,0 +1,9 @@
+import type { RegisteredTool } from '../../mcp/server.ts';
+import type { ReclaimOldClient } from '../client.ts';
+/**
+ * The backend-facing tools for OLD-devtools mode. Mirrors
+ * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
+ * list for `registerToolList`. These three replace the builder credential +
+ * publish tools and the (disabled) generated provider tools.
+ */
+export declare function buildOldBackendTools(client: ReclaimOldClient): RegisteredTool[];

package/lib/old/tools/build.js

@@ -0,0 +1,16 @@
+import { authenticateTool } from "./authenticate.js";
+import { getMeProvidersTool } from "./me-providers.js";
+import { createVersionFromCaptureTool } from "./publish.js";
+/**
+ * The backend-facing tools for OLD-devtools mode. Mirrors
+ * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
+ * list for `registerToolList`. These three replace the builder credential +
+ * publish tools and the (disabled) generated provider tools.
+ */
+export function buildOldBackendTools(client) {
+    return [
+        authenticateTool(client),
+        createVersionFromCaptureTool(client),
+        getMeProvidersTool(client),
+    ];
+}

package/lib/old/tools/me-providers.d.ts

@@ -0,0 +1,10 @@
+import { type RegisteredTool } from '../../mcp/server.ts';
+import type { ReclaimOldClient } from '../client.ts';
+/**
+ * List the authenticated user's OWN providers on the old devtools backend
+ * (`GET /api/providers/user/paginated`, filtered server-side to the caller's
+ * uid). This exists ONLY in old mode: the generated provider-listing tools
+ * are disabled there, so this is the way to discover a `providerId` to pass
+ * back into `create_provider_version_from_capture` for a version update.
+ */
+export declare function getMeProvidersTool(client: ReclaimOldClient): RegisteredTool;

package/lib/old/tools/me-providers.js

@@ -0,0 +1,32 @@
+import { defineTool } from "../../mcp/server.js";
+/**
+ * List the authenticated user's OWN providers on the old devtools backend
+ * (`GET /api/providers/user/paginated`, filtered server-side to the caller's
+ * uid). This exists ONLY in old mode: the generated provider-listing tools
+ * are disabled there, so this is the way to discover a `providerId` to pass
+ * back into `create_provider_version_from_capture` for a version update.
+ */
+export function getMeProvidersTool(client) {
+    return defineTool({
+        name: 'get_me_providers',
+        description: 'List the providers YOU own on the old devtools backend (newest ' +
+            'first). Returns provider metadata including each `providerId` — ' +
+            'pass one back to create_provider_version_from_capture to publish a ' +
+            'new version of that provider instead of creating a duplicate. ' +
+            'Requires reclaim_authenticate first.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                pageKey: { type: 'number', description: 'Page index (default 0).' },
+                pageSize: {
+                    type: 'number',
+                    description: 'Page size (default 20).',
+                },
+                searchQuery: {
+                    type: 'string',
+                    description: 'Filter by name or providerId.',
+                },
+            },
+        },
+    }, async (args) => client.getMyProviders(args));
+}

package/lib/old/tools/publish.d.ts

@@ -0,0 +1,16 @@
+import { type RegisteredTool } from '../../mcp/server.ts';
+import type { ReclaimOldClient } from '../client.ts';
+/**
+ * Publish a drafted provider to the OLD devtools backend. Keeps the builder
+ * tool NAME (`create_provider_version_from_capture`) so the skill flow is
+ * unchanged, but the behaviour differs:
+ *
+ *   - WITHOUT `providerId` → `POST /api/providers/register`: creates a
+ *     brand-new provider + version 1.0.0. Re-running creates a DUPLICATE.
+ *   - WITH `providerId` → `POST /api/providers/:providerId/config`: adds a
+ *     new version to an existing provider (auto-bumps the patch above the
+ *     highest existing version).
+ *
+ * Get a `providerId` from `get_me_providers`.
+ */
+export declare function createVersionFromCaptureTool(client: ReclaimOldClient): RegisteredTool;