@reclaimprotocol/agent 0.1.1-dev.1 → 0.1.2

package/lib/mcp/tools/replay.js

@@ -0,0 +1,46 @@
+import { replayProvider } from "../../proof/replay.js";
+import { defineTool } from "../server.js";
+export function replayTool(secrets) {
+    return defineTool({
+        name: 'replay_request',
+        description: 'Replay a drafted provider against the live endpoint ' +
+            'using Node fetch (no attestor). ' +
+            'Pre-flight gate before run_proof — ' +
+            'diagnoses CSRF / token-rotation / matcher-too-tight ' +
+            'issues with richer hints than the attestor would produce.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                // `type: 'object'` is required so MCP clients (the LLM)
+                // serialize the value as an object, not a JSON-stringified
+                // string. `properties: {}` is required so zod-from-json-schema
+                // compiles to a passthrough instead of strict-strip — leaving
+                // it off makes the server receive `{}`.
+                provider: { type: 'object', properties: {} },
+                secretParamsRef: { type: 'string' },
+            },
+            required: ['provider'],
+        },
+    }, async ({ provider, secretParamsRef }) => {
+        let resolved = {};
+        if (secretParamsRef !== undefined) {
+            const r = secrets.resolve(secretParamsRef);
+            if (!r) {
+                throw new Error(`unknown secretParamsRef "${secretParamsRef}" — ` +
+                    'the MCP server has restarted or reset_session was called. ' +
+                    'Re-run propose_provider to mint a fresh ref.');
+            }
+            resolved = r;
+        }
+        const result = await replayProvider(provider, resolved);
+        const out = {
+            status: result.status,
+            matchesOriginal: result.matchesOriginal,
+            bodySnippet: result.body.slice(0, 256),
+        };
+        if (result.hints !== undefined) {
+            out.hints = result.hints;
+        }
+        return out;
+    });
+}

package/lib/mcp/tools/session.d.ts

@@ -0,0 +1,10 @@
+import type { ConfigStore } from '../../config/store.ts';
+import { type RegisteredTool } from '../server.ts';
+import type { AttachState } from './attach.ts';
+import type { CaptureStore } from './capture.ts';
+export declare function sessionTools(attachRef: {
+    current?: AttachState;
+    config: ConfigStore;
+}, captures: CaptureStore, secrets: {
+    clear: () => void;
+}): RegisteredTool[];

package/lib/mcp/tools/session.js

@@ -0,0 +1,29 @@
+import { defineTool } from "../server.js";
+export function sessionTools(attachRef, captures, secrets) {
+    return [
+        defineTool({
+            name: 'get_session',
+            description: 'Return current attach state, active captures, and persisted config.',
+            inputSchema: { type: 'object', properties: {} },
+        }, async () => ({
+            config: attachRef.config.read(),
+            attached: Boolean(attachRef.current),
+            port: attachRef.current?.port,
+            captures: [...captures.sessions.keys()],
+            activeTab: captures.activeTab,
+        })),
+        defineTool({
+            name: 'reset_session',
+            description: 'Stop all captures, drop in-memory secrets, and clear capture state.',
+            inputSchema: { type: 'object', properties: {} },
+        }, async () => {
+            for (const s of captures.sessions.values()) {
+                await s.stop().catch(() => { });
+            }
+            captures.sessions.clear();
+            delete captures.activeTab;
+            secrets.clear();
+            return { reset: true };
+        }),
+    ];
+}

package/lib/mcp/tools/verification/build.d.ts

@@ -0,0 +1,12 @@
+import type { RegisteredTool } from '../../server.ts';
+/**
+ * Builder-mode verification tools: higher-level orchestrations over the
+ * generated API surface. `get_verification_result` authenticates with the org
+ * token, checks status, pulls the stored payload, and decrypts it locally with
+ * the optional eth key — a flow the generated raw-API tools can't express
+ * (the decryption key never leaves the consumer). Diagnosis is left to the
+ * agent over the generated tools (`get_verification_session`,
+ * `list_verification_events`, `list_verification_deliveries`), whose
+ * descriptions carry the lifecycle and delivery semantics.
+ */
+export declare function buildVerificationTools(): RegisteredTool[];

package/lib/mcp/tools/verification/build.js

@@ -0,0 +1,14 @@
+import { verificationResultTool } from "./result.js";
+/**
+ * Builder-mode verification tools: higher-level orchestrations over the
+ * generated API surface. `get_verification_result` authenticates with the org
+ * token, checks status, pulls the stored payload, and decrypts it locally with
+ * the optional eth key — a flow the generated raw-API tools can't express
+ * (the decryption key never leaves the consumer). Diagnosis is left to the
+ * agent over the generated tools (`get_verification_session`,
+ * `list_verification_events`, `list_verification_deliveries`), whose
+ * descriptions carry the lifecycle and delivery semantics.
+ */
+export function buildVerificationTools() {
+    return [verificationResultTool()];
+}

package/lib/mcp/tools/verification/diagnose.d.ts

@@ -0,0 +1,11 @@
+import { type ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../../server.ts';
+/**
+ * `diagnose_verification_session` — one call that answers "what's wrong
+ * with this session?". Pulls the session, its full event log, and its
+ * callback-delivery diagnostics, then derives findings (where the flow
+ * stalled or failed) and concrete suggestions (what to check or do next).
+ * Read-only; authenticates with the active eth credential like
+ * `get_verification_result`.
+ */
+export declare function verificationDiagnoseTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/tools/verification/diagnose.js

@@ -0,0 +1,132 @@
+import { buildAuthHeaders } from '@reclaimprotocol/client';
+import { defineTool } from "../../server.js";
+import { resolveActivePrivateKey } from "./result.js";
+const TERMINAL = new Set(['success', 'rejected', 'error']);
+/**
+ * `diagnose_verification_session` — one call that answers "what's wrong
+ * with this session?". Pulls the session, its full event log, and its
+ * callback-delivery diagnostics, then derives findings (where the flow
+ * stalled or failed) and concrete suggestions (what to check or do next).
+ * Read-only; authenticates with the active eth credential like
+ * `get_verification_result`.
+ */
+export function verificationDiagnoseTool(client) {
+    return defineTool({
+        name: 'diagnose_verification_session',
+        description: 'Diagnose a verification session: fetches its status, event ' +
+            'timeline, and callback-delivery state, then reports findings ' +
+            '(where the flow stalled or failed — link never opened, proof ' +
+            'failed, callback endpoint erroring, dead-lettered delivery, ' +
+            'expiry) and suggested next steps. Read-only. Use ' +
+            'get_verification_result to fetch and decrypt the actual result.',
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId'],
+            properties: {
+                sessionId: {
+                    type: 'string',
+                    description: 'The verification session id to diagnose.',
+                },
+            },
+        },
+    }, async (args) => {
+        const privateKey = resolveActivePrivateKey();
+        const auth = () => buildAuthHeaders(privateKey, 'VerificationAuth');
+        const params = { sessionId: args.sessionId };
+        const [session, events, deliveries] = await Promise.all([
+            client.call('GetVerificationSession', { params, headers: auth() })
+                .then((r) => r.data),
+            client.call('ListVerificationEvents', { params, headers: auth() })
+                .then((r) => r.data.items),
+            client.call('ListVerificationDeliveries', { params, headers: auth() })
+                .then((r) => r.data.items),
+        ]);
+        const seen = new Set(events.map((e) => e.event));
+        const last = events[events.length - 1];
+        const findings = [];
+        const suggestions = [];
+        // Where did the flow get to?
+        if (session.status === 'pending') {
+            if (new Date(session.expiresAt).getTime() < Date.now()) {
+                findings.push('Session is past expiresAt — it will flip to expired on the ' +
+                    'next sweep; the end-user can no longer complete it.');
+                suggestions.push('Create a new session and share a fresh link.');
+            }
+            else if (!seen.has('verification_client_opened')) {
+                findings.push('The end-user has not opened the verification link yet.');
+                suggestions.push(`Re-share the link (${session.verificationUrl}) before ` +
+                    `it expires at ${session.expiresAt}.`);
+            }
+            else if (!seen.has('request_matched')) {
+                findings.push('The page was opened but the target request was never ' +
+                    'captured — the end-user likely has not completed the ' +
+                    'login/journey on the provider site.');
+            }
+            else {
+                findings.push('Proof flow is in progress — the target request was ' +
+                    'captured and the run has not reached a terminal event.');
+            }
+        }
+        if (session.status === 'expired') {
+            findings.push(seen.has('verification_client_opened')
+                ? 'Session expired mid-flow — the end-user started but did ' +
+                    'not finish before expiresAt.'
+                : 'Session expired without the link ever being opened.');
+            suggestions.push('Create a new session and share a fresh link.');
+        }
+        // Surface failure detail from the event log.
+        for (const e of events) {
+            if (e.event === 'request_claim_failed' ||
+                e.event === 'request_claim_rejected' ||
+                e.event === 'verification_error' ||
+                e.event === 'verification_rejected') {
+                findings.push(`${e.event} at ${e.createdAt}` +
+                    (e.eventData ? `: ${JSON.stringify(e.eventData)}` : ''));
+            }
+        }
+        // Callback delivery health (only meaningful after a terminal event).
+        for (const d of deliveries) {
+            if (d.deliveryStatus === 'delivered') {
+                continue;
+            }
+            findings.push(`Callback to ${d.callbackUrl} is ${d.deliveryStatus} after ` +
+                `${d.attempts} attempt(s)` +
+                (d.lastError ? ` — last error: ${d.lastError}` : '') +
+                (d.deadLettered ? ' (dead-lettered; retries exhausted)' : ''));
+            suggestions.push(`Check that ${d.callbackUrl} is reachable and answers 2xx.`);
+            if (d.deadLettered) {
+                suggestions.push('Once the endpoint is fixed, re-deliver via ' +
+                    'POST /verifications/sessions/{sessionId}/retry-callback ' +
+                    '(or ask an admin to retry it from the Callback DLQ).');
+            }
+        }
+        if (TERMINAL.has(session.status) &&
+            deliveries.every((d) => d.deliveryStatus === 'delivered')) {
+            suggestions.push('Result delivered. Use get_verification_result to fetch and ' +
+                'decrypt it locally.');
+        }
+        if (!findings.length) {
+            findings.push('No problems detected.');
+        }
+        return {
+            sessionId: session.id,
+            status: session.status,
+            callbackDeliveryStatus: session.callbackDeliveryStatus,
+            mode: session.mode,
+            createdAt: session.createdAt,
+            expiresAt: session.expiresAt,
+            completedAt: session.completedAt,
+            lastEvent: last
+                ? { event: last.event, at: last.createdAt }
+                : undefined,
+            events: events.map((e) => ({
+                event: e.event,
+                at: e.createdAt,
+                ...(e.eventData ? { data: e.eventData } : {}),
+            })),
+            deliveries,
+            findings,
+            suggestions,
+        };
+    });
+}

package/lib/mcp/tools/verification/index.d.ts

@@ -0,0 +1 @@
+export { buildVerificationTools } from './build.ts';

package/lib/mcp/tools/verification/index.js

@@ -0,0 +1,2 @@
+// Barrel for the verification tool group (result retrieval + decryption).
+export { buildVerificationTools } from "./build.js";

package/lib/mcp/tools/verification/result.d.ts

@@ -0,0 +1,11 @@
+import { type RegisteredTool } from '../../server.ts';
+/**
+ * `get_verification_result` — check a session's status and, once a result has
+ * been submitted, pull the stored payload(s) and verify locally. Auth is the
+ * org token; delivery is org-scoped. Each stored payload is either the
+ * plaintext signed JWS (when the org's encryption is off) or an ECIES
+ * ciphertext that we decrypt here with the optional eth key
+ * (`RECLAIM_DECRYPT_KEY` or the `reclaim-decrypt.key` hex file). The Builder
+ * only ever relays the payload — decryption, when needed, happens here.
+ */
+export declare function verificationResultTool(): RegisteredTool;

package/lib/mcp/tools/verification/result.js

@@ -0,0 +1,126 @@
+import { createReclaim, decryptCallback, verifyResultFull, } from '@reclaimprotocol/client';
+import assert from 'node:assert';
+import { apiUrl, orgSecret } from "../../../consts.js";
+import { defineTool } from "../../server.js";
+import { resolveDecryptionKey } from "../authenticate/decrypt-key.js";
+/** Statuses that can carry a submitted (terminal) result. `expired`/`pending`
+ *  never have one. */
+const TERMINAL = new Set(['success', 'rejected', 'error']);
+/**
+ * Resolve the org secret used to authenticate verification reads. Auth is a
+ * single per-org bearer secret (`rorg_…`), not an eth signature — read it from
+ * `RECLAIM_ORG_SECRET`.
+ */
+function resolveOrgSecret() {
+    const secret = orgSecret()?.trim();
+    assert(secret, new Error('RECLAIM_ORG_SECRET is not set. Verification reads authenticate with ' +
+        'the org secret (rorg_…) — issue one from the dashboard ' +
+        '(POST /orgs/{orgId}/token) and export it as RECLAIM_ORG_SECRET.'));
+    return secret;
+}
+/**
+ * `get_verification_result` — check a session's status and, once a result has
+ * been submitted, pull the stored payload(s) and verify locally. Auth is the
+ * org token; delivery is org-scoped. Each stored payload is either the
+ * plaintext signed JWS (when the org's encryption is off) or an ECIES
+ * ciphertext that we decrypt here with the optional eth key
+ * (`RECLAIM_DECRYPT_KEY` or the `reclaim-decrypt.key` hex file). The Builder
+ * only ever relays the payload — decryption, when needed, happens here.
+ */
+export function verificationResultTool() {
+    return defineTool({
+        name: 'get_verification_result',
+        description: 'Check a verification session and return its result when ready. ' +
+            'Authenticates with the org secret (RECLAIM_ORG_SECRET). Fetches the ' +
+            'session status; if it is terminal and a result has been submitted, ' +
+            'pulls the stored result(s) and verifies them locally. Encrypted ' +
+            'deliveries (ECIES over secp256k1) are decrypted with your optional ' +
+            'eth key (RECLAIM_DECRYPT_KEY or reclaim-decrypt.key); plaintext ' +
+            'deliveries are read directly. Returns ' +
+            '`ready: false` while the session is still pending or no result has ' +
+            'been delivered yet. Use list_verification_events for the full ' +
+            'lifecycle log.',
+        inputSchema: {
+            type: 'object',
+            required: ['sessionId'],
+            properties: {
+                sessionId: {
+                    type: 'string',
+                    description: 'The verification session id from create_verification_session.',
+                },
+            },
+        },
+    }, async (args) => {
+        const secret = resolveOrgSecret();
+        // Optional eth decryption key — absent ⇒ plaintext-only.
+        const decryptionKey = await resolveDecryptionKey();
+        const reclaim = createReclaim({
+            baseUrl: apiUrl(),
+            orgSecret: secret,
+        });
+        const sessionRes = await reclaim.api('GetVerificationSession', {
+            params: { sessionId: args.sessionId },
+        });
+        const status = sessionRes.data.status;
+        if (!TERMINAL.has(status)) {
+            return { sessionId: args.sessionId, status, ready: false };
+        }
+        const resultRes = await reclaim.api('GetVerificationResult', {
+            params: { sessionId: args.sessionId },
+        });
+        const { items } = resultRes.data;
+        if (!items.length) {
+            return {
+                sessionId: args.sessionId,
+                status,
+                ready: false,
+                note: 'Session is terminal but no result has been submitted yet.',
+            };
+        }
+        // Each item's `payload` is a compact JWE (encrypted to the org's
+        // credential) or the plaintext signed JWS, as raw text. `decryptCallback`
+        // branches on the body shape; an encrypted delivery with no key throws
+        // a clear error, which we surface per-subscription rather than skip.
+        const results = [];
+        const undecryptable = [];
+        for (const item of items) {
+            let jws;
+            try {
+                jws = await decryptCallback(decryptionKey, item.payload);
+            }
+            catch (err) {
+                undecryptable.push(item.subscriptionId);
+                void err;
+                continue;
+            }
+            const outcome = await verifyResultFull(jws, {
+                expectedReclaimSessionId: args.sessionId,
+            });
+            results.push({
+                subscriptionId: item.subscriptionId,
+                valid: outcome.valid,
+                reason: outcome.reason,
+                payload: outcome.payload,
+                proofs: outcome.proofs,
+            });
+        }
+        if (!results.length) {
+            return {
+                sessionId: args.sessionId,
+                status,
+                ready: false,
+                note: 'A result was stored, but no payload could be read — it is ' +
+                    'corrupt, or encrypted (ECIES) to a key this consumer does not ' +
+                    'hold. Set RECLAIM_DECRYPT_KEY (or reclaim-decrypt.key) to the ' +
+                    'eth private key matching the org keypair.',
+            };
+        }
+        return {
+            sessionId: args.sessionId,
+            status,
+            ready: true,
+            results,
+            ...(undecryptable.length ? { undecryptable } : {}),
+        };
+    });
+}

package/lib/mcp/verifications/build.d.ts

@@ -0,0 +1,5 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import type { RegisteredTool } from '../server.ts';
+/** Verification CRUD tools — build the flat list of RegisteredTool
+ *  entries. Mirrors buildAgentTools() in mcp/register.ts. */
+export declare function buildVerificationTools(client: ReclaimClient): RegisteredTool[];

package/lib/mcp/verifications/build.js

@@ -0,0 +1,14 @@
+import { createTool } from "./create.js";
+import { findTool } from "./find.js";
+import { getTool } from "./get.js";
+import { updateTool } from "./update.js";
+/** Verification CRUD tools — build the flat list of RegisteredTool
+ *  entries. Mirrors buildAgentTools() in mcp/register.ts. */
+export function buildVerificationTools(client) {
+    return [
+        findTool(client),
+        getTool(client),
+        createTool(client),
+        updateTool(client),
+    ];
+}

package/lib/mcp/verifications/create.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function createTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/create.js

@@ -0,0 +1,57 @@
+import { defineTool } from "../server.js";
+export function createTool(client) {
+    return defineTool({
+        name: 'create_verification',
+        description: 'Create a new Reclaim verification. Use this only ' +
+            'after `find_verification` returned nothing useful ' +
+            'for the domain. The caller must be an active ' +
+            'member of the target organization.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                orgId: {
+                    type: 'string',
+                    description: 'uuid identifier of the organization ' +
+                        'that will own the verification.'
+                },
+                domain: {
+                    type: 'string',
+                    minLength: 1,
+                    maxLength: 200,
+                    description: 'Canonical root domain (e.g. `github.com`). ' +
+                        'No scheme, no port, no path.',
+                },
+                slug: {
+                    type: 'string',
+                    pattern: '^[a-z0-9]+(?:-[a-z0-9]+)*$',
+                    minLength: 1,
+                    maxLength: 100,
+                    description: 'URL-safe identifier. Globally unique — pick ' +
+                        'something domain-specific like `github-followers`.',
+                },
+                title: {
+                    type: 'string',
+                    minLength: 1,
+                    maxLength: 100,
+                    description: 'Short headline shown to end-users. Defaults ' +
+                        'to a domain-derived brand name.',
+                },
+                description: { type: 'string', minLength: 1, maxLength: 2000 },
+                iconUrl: { type: 'string', description: 'uri of the icon' },
+                tags: { type: 'array', items: { type: 'string' }, maxItems: 50 },
+            },
+            required: ['orgId', 'domain', 'slug'],
+        },
+    }, async (args) => client.call('CreateProvider', {
+        body: {
+            orgId: args.orgId,
+            domain: args.domain,
+            slug: args.slug,
+            title: args.title,
+            description: args.description,
+            iconUrl: args.iconUrl,
+            tags: args.tags ?? [],
+            visibility: 'PRIVATE'
+        },
+    }));
+}

package/lib/mcp/verifications/find.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function findTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/find.js

@@ -0,0 +1,37 @@
+import { defineTool } from "../server.js";
+export function findTool(client) {
+    return defineTool({
+        name: 'find_verification',
+        description: 'Search published Reclaim verifications by domain or ' +
+            'data point. A verification is the recipe an end-user ' +
+            'follows to prove something about themselves (e.g. ' +
+            '"I have N followers on Twitter"). Returns a list of ' +
+            'matches. Call this BEFORE `create_verification` — ' +
+            'most popular domains already have a public ' +
+            'verification you can reuse.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                query: {
+                    type: 'string',
+                    minLength: 1,
+                    maxLength: 200,
+                    description: 'Free-text query. Matches domain (e.g. ' +
+                        '"github.com"), title, description, and the ' +
+                        'data points a verification can prove.',
+                },
+                tags: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Restrict to verifications carrying every tag.',
+                },
+                limit: { type: 'number', minimum: 1, maximum: 100 },
+            },
+        },
+    }, async (args) => client.call('Providers', {
+        query: {
+            q: args.query,
+            tag: args.tags ?? [],
+        },
+    }));
+}

package/lib/mcp/verifications/get.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function getTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/get.js

@@ -0,0 +1,26 @@
+import { defineTool } from "../server.js";
+export function getTool(client) {
+    return defineTool({
+        name: 'get_verification',
+        description: 'Fetch a single Reclaim verification by id. Returns ' +
+            'every field needed to integrate it into a flow: ' +
+            'domain, the live version (initialUrl + requests), ' +
+            'and the data points it can prove. Use ' +
+            '`find_verification` first if you only have a query ' +
+            'string.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                providerId: {
+                    type: 'string',
+                    description: 'UUID of the verification. (Internally stored ' +
+                        'as `providerId` — the field name reflects ' +
+                        'the openapi schema.)',
+                },
+            },
+            required: ['providerId'],
+        },
+    }, async (args) => client.call('GetProvider', {
+        params: { providerId: args.providerId },
+    }));
+}

package/lib/mcp/verifications/update.d.ts

@@ -0,0 +1,3 @@
+import type { ReclaimClient } from '@reclaimprotocol/client';
+import { type RegisteredTool } from '../server.ts';
+export declare function updateTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/verifications/update.js

@@ -0,0 +1,78 @@
+import { defineTool } from "../server.js";
+export function updateTool(client) {
+    return defineTool({
+        name: 'update_verification',
+        description: "Update a Reclaim verification's metadata. Partial " +
+            'PATCH — pass only fields you want to change. The ' +
+            'caller must be an active member of the owning ' +
+            "organization. To change the verification's " +
+            'recipe (initialUrl, requests, …) cut a new ' +
+            'version via the dashboard. Use `seo` to control how ' +
+            'the verification appears in search results and social ' +
+            'shares; omit a subfield to keep the server default.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                providerId: {
+                    type: 'string',
+                    description: 'UUID of the verification. (Internally stored ' +
+                        'as `providerId` — the field name reflects ' +
+                        'the openapi schema.)',
+                },
+                title: { type: 'string', minLength: 1, maxLength: 100 },
+                description: { type: 'string', minLength: 1, maxLength: 2000 },
+                iconUrl: { type: 'string', description: 'uri of icon' },
+                clearIcon: {
+                    type: 'boolean',
+                    description: 'Set true to wipe the icon explicitly.',
+                },
+                visibility: { type: 'string', enum: ['PRIVATE', 'PUBLIC'] },
+                status: { type: 'string', enum: ['ACTIVE', 'ARCHIVED'] },
+                tags: { type: 'array', items: { type: 'string' }, maxItems: 50 },
+                seo: {
+                    type: 'object',
+                    additionalProperties: false,
+                    description: 'Author SEO overrides. Each field falls back to a ' +
+                        'server-derived suggestion when unset.',
+                    properties: {
+                        brandUrl: {
+                            type: 'string',
+                            maxLength: 2000,
+                            description: 'Canonical homepage url of the brand.',
+                        },
+                        primaryDataPoint: {
+                            type: 'string',
+                            maxLength: 200,
+                            description: 'Headline data point (e.g. "subscriber ' +
+                                'count"); used in the SEO title.',
+                        },
+                        dataPoints: {
+                            type: 'array',
+                            items: { type: 'string', maxLength: 200 },
+                            maxItems: 50,
+                            description: 'Full list of verifiable data points.',
+                        },
+                        titleOverride: {
+                            type: 'string',
+                            maxLength: 200,
+                            description: 'Replaces the composed page title.',
+                        },
+                        descriptionOverride: {
+                            type: 'string',
+                            maxLength: 320,
+                            description: 'Replaces the composed meta description.',
+                        },
+                    },
+                },
+            },
+            required: ['providerId'],
+        },
+    }, async (args) => {
+        const { providerId, ...rest } = args;
+        return client.call('UpdateProvider', {
+            params: { providerId },
+            headers: {},
+            body: rest,
+        });
+    });
+}