@reclaimprotocol/agent 0.1.12 → 0.1.13

package/lib/mcp/tools/agent/shared.js

@@ -11,6 +11,33 @@ import { authoringTools, extendTool, } from "../../../authoring/index.js";
 import { runAttestorProof } from "../../../proof/attestor.js";
 import { replayProvider } from "../../../proof/replay.js";
 import { shapeRichProofResult } from "./proof.js";
+/**
+ * OPRF mode this LOCAL (non-TEE) attestor can actually run. Recipes carry
+ * `oprf-mpc` — the canonical/publish mode a TEE expects — but the local dev
+ * attestor can't do MPC. gnark `oprf` (Linux/Mac, needs ZK circuits) is the
+ * strongest it supports; Windows falls back to server-side `oprf-raw` (no
+ * circuits). Proving with the wrong mode fails, which is what pushed the agent
+ * to hand-craft a plaintext workaround.
+ */
+const LOCAL_OPRF_MODE = process.platform === 'win32' ? 'oprf-raw' : 'oprf';
+/**
+ * Clone `provider` with every `oprf-mpc` redaction remapped to the mode this
+ * local attestor can run, so the PROOF validates locally. The draft itself is
+ * untouched — it keeps `oprf-mpc`, so the PUBLISHED recipe is always the
+ * TEE-canonical mode regardless of where it was proved.
+ */
+function withLocalOprfMode(provider) {
+    const reds = provider.responseRedactions;
+    if (!reds?.some((r) => r.hash === 'oprf-mpc')) {
+        return provider;
+    }
+    return {
+        ...provider,
+        responseRedactions: reds.map((r) => {
+            return r.hash === 'oprf-mpc' ? { ...r, hash: LOCAL_OPRF_MODE } : r;
+        }),
+    };
+}
 /** The local backend for one capture: drive its tab over CDP, read its
  *  captured requests, prove via the in-process attestor, replay by re-fetch. */
 function localBackend(entry) {
@@ -50,7 +77,9 @@ function localBackend(entry) {
             };
         },
         prove: async (draft, opts) => {
-            const result = await runAttestorProof(draft.provider, draft.secrets, {
+            // Prove with the locally-runnable OPRF mode; the draft (→ published
+            // recipe) keeps oprf-mpc.
+            const result = await runAttestorProof(withLocalOprfMode(draft.provider), draft.secrets, {
                 ...(opts?.ownerAddress ? { ownerAddress: opts.ownerAddress } : {}),
                 ...(opts?.attestorUrl ? { attestorUrl: opts.attestorUrl } : {}),
             });

package/lib/mcp/tools/authenticate/decrypt-key.js

@@ -11,7 +11,7 @@
  * The hex is loaded via the client's `loadDecryptionKey` and passed straight
  * through as `ReclaimConfig.credential` / to `decryptCallback`.
  */
-import { loadDecryptionKey, } from '@reclaimprotocol/client';
+import { loadDecryptionKey } from '@reclaimprotocol/client';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { findProjectRoot } from "../../../paths.js";

package/lib/old/tools/js-sdk-integration-guide.js

@@ -1,130 +1,16 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
 import { defineTool } from "../../mcp/server.js";
 /**
  * Verified against `@reclaimprotocol/js-sdk` v5.8.1 source
  * (`reclaim-js-sdk/src/Reclaim.ts`) — NOT copied unchecked from the archived
  * `reclaim-mcp-server`'s guide, which predates several of these signatures.
- * Corrections that matter most, all called out inline below:
- *   - `getRequestUrl()` and `ReclaimProofRequest.fromJsonString()` are ASYNC.
- *   - `setContext` is current; `addContext` is deprecated (calls setContext).
- *   - `verifyProof`'s second arg (`{ providerId, providerVersion? }`) is
- *     REQUIRED, not optional.
- *   - The verified result's flag is `isVerified` (camelCase), not
- *     `is_verified`.
- *   - A raw webhook body is TEXT — it must be JSON-parsed (and URL-decoded if
- *     form-encoded) into a `Proof`/`Proof[]` before calling `verifyProof`.
+ * The prose lives in `skill/js-sdk-integration.md` so it can be edited as
+ * markdown without touching code — same pattern as `provider/injection-doc.ts`.
+ * The path resolves the same from `src/old/tools` (dev) and `lib/old/tools`
+ * (published): both are three levels below the package root.
  */
-const GUIDE = `# @reclaimprotocol/js-sdk — backend integration guide
-
-Keep \`appSecret\` on your BACKEND only. Everything below runs server-side;
-the browser only ever sees the \`requestUrl\`.
-
-## Testing locally, without deploying anything
-
-- **providerId \`"example"\`**: a canonical built-in smoke-test provider —
-  no need to author/publish your own provider just to confirm the SDK
-  plumbing works end-to-end. Swap in your real providerId once this passes.
-- **ngrok for the callback URL**: \`setAppCallbackUrl\` needs a URL Reclaim's
-  servers can reach over the public internet — \`localhost\` will never
-  receive the callback. Run \`ngrok http 3000\` (or your port) alongside your
-  local server and set \`PUBLIC_URL\` to the \`https://<id>.ngrok-free.app\`
-  URL it prints. Without this, only the frontend-side flow (opening
-  \`requestUrl\` and polling/reading the result client-side) will work — the
-  async webhook never lands.
-- \`scaffold_reclaim_demo_server\` defaults \`providerId\` to \`"example"\` and
-  its README calls out the ngrok step — use it to get a working local loop
-  before wiring in a real provider.
-
-## 1. Install
-
-\`\`\`bash
-npm install @reclaimprotocol/js-sdk
-\`\`\`
-
-## 2. Create a proof request (backend)
-
-\`\`\`js
-import { ReclaimProofRequest } from "@reclaimprotocol/js-sdk";
-
-const reclaimProofRequest = await ReclaimProofRequest.init(
-  process.env.RECLAIM_APP_ID,
-  process.env.RECLAIM_APP_SECRET,
-  providerId,
-  {
-    // acceptAiProviders: true,   // allow AI-verified providers
-    // useAppClip: true,          // mobile app-clip flow instead of a browser popup
-    // providerVersion: "1.0.0",  // pin a specific provider version
-  },
-);
-
-// Deliver the verified proof back to your server asynchronously instead of
-// (or in addition to) reading it from the frontend callback:
-reclaimProofRequest.setAppCallbackUrl(
-  \`\${process.env.PUBLIC_URL}/webhooks/reclaim\`,
-  true, // jsonProofResponse: send the callback body as JSON, not form-encoded
-);
-
-// Optional: attach your own correlation id / metadata, retrievable later.
-reclaimProofRequest.setContext(sessionId, JSON.stringify({ createdAt: Date.now() }));
-
-// IMPORTANT: getRequestUrl() is ASYNC — await it.
-const requestUrl = await reclaimProofRequest.getRequestUrl();
-
-// Hand the requestUrl to the frontend to open in a new tab/window/webview.
-// If you need to rehydrate this request object later (e.g. in the webhook
-// handler, in a different process), persist reclaimProofRequest.toJsonString()
-// (sync) and rehydrate with:
-//   const req = await ReclaimProofRequest.fromJsonString(json); // ASYNC
-\`\`\`
-
-## 3. Frontend: open the request URL
-
-Fetch \`requestUrl\` from your backend, then open it (popup/new tab/QR code) —
-never construct it in the browser, since that would require the appSecret
-client-side. Trigger the fetch+open from a real user click (not a page-load
-effect) or some browsers block the popup.
-
-## 4. Verify the callback (backend webhook)
-
-\`\`\`js
-import { verifyProof } from "@reclaimprotocol/js-sdk";
-
-app.post("/webhooks/reclaim", express.json(), async (req, res) => {
-  // req.body is already a parsed object here because jsonProofResponse was
-  // true above AND express.json() parsed it. If you did NOT set
-  // jsonProofResponse (or aren't using express.json()), the body arrives as
-  // form-encoded/raw text and must be JSON.parse()'d (and decodeURIComponent'd
-  // if form-encoded) into a Proof / Proof[] before calling verifyProof.
-  const proof = req.body;
-
-  // The second argument is REQUIRED — at minimum providerId.
-  const result = await verifyProof(proof, {
-    providerId,
-    // providerVersion,       // optional, pin if you pinned it in init()
-  });
-
-  if (!result.isVerified) {   // NOTE: isVerified, not is_verified
-    console.error("Proof verification failed:", result.error);
-    return res.status(400).json({ verified: false, error: result.error });
-  }
-
-  console.log("Verified data:", result.data, result.publicData);
-  res.status(200).json({ verified: true });
-});
-\`\`\`
-
-## Gotchas
-
-- \`getRequestUrl()\` and \`ReclaimProofRequest.fromJsonString()\` are async —
-  a missing \`await\` silently hands you a Promise instead of a string/instance.
-- \`verifyProof\`'s config arg is mandatory; omitting \`providerId\` throws.
-- Prefer \`setContext\` over the deprecated \`addContext\` (same signature).
-- \`ReclaimProofRequest.init\` needs network access to the Reclaim backend at
-  call time — don't call it at module load / cold-start if your platform pools
-  processes long-term; call it per-request instead.
-- Use \`check_app_status\` (this MCP server) to confirm your app is linked
-  and not still sandbox-limited before debugging "verification never lands"
-  issues.
-`;
+const GUIDE = readFileSync(fileURLToPath(new URL('../../../skill/js-sdk-integration.md', import.meta.url)), 'utf8').trim();
 export function getJsSdkIntegrationGuideTool() {
     return defineTool({
         name: 'get_js_sdk_integration_guide',

package/lib/old/tools/link-app.js

@@ -1,4 +1,4 @@
-import { Wallet } from 'ethers';
+import { signEip191 } from '@reclaimprotocol/client';
 import { defineTool } from "../../mcp/server.js";
 /** Byte-for-byte the same format as the backend's `buildLinkMessage` in
  *  `application.controller.ts` — MUST stay in lockstep with it. */
@@ -11,7 +11,8 @@ function buildLinkMessage(appId, userId, nonce) {
 async function resolveUserId(client) {
     const identity = client.getIdentity();
     if (!identity) {
-        throw new Error('Not authenticated against old devtools. Call reclaim_authenticate first.');
+        throw new Error('Not authenticated against old devtools. Call reclaim_authenticate ' +
+            'first.');
     }
     if (identity.kind === 'eth') {
         return identity.uid;
@@ -61,7 +62,7 @@ export function linkAppTool(client) {
         const userId = await resolveUserId(client);
         const { nonce } = await client.getLinkNonce();
         const message = buildLinkMessage(appId, userId, nonce);
-        const signature = await new Wallet(appSecret).signMessage(message);
+        const signature = signEip191(message, appSecret);
         await client.linkAppToAccount(appId, signature, nonce);
         return {
             linked: true,

package/lib/old/tools/publish.js

@@ -104,10 +104,10 @@ export function createVersionFromCaptureTool(client) {
                     type: 'array',
                     description: 'Multiple proven drafts → one multi-request version (each ' +
                         'becomes a parallel `requestData` entry, all verified ' +
-                        'together). Each item has the same shape as `provider`. Pass ' +
-                        'this OR `provider`, not both. May be omitted (or empty) ' +
-                        'together with `provider` ONLY when adding a version to an ' +
-                        'EXISTING provider (`providerId` set) — this publishes with ' +
+                        'together). Each item has the same shape as `provider` (if ' +
+                        'both are passed, they are combined). May be omitted (or ' +
+                        'empty) together with `provider` ONLY when adding a version ' +
+                        'to an EXISTING provider (`providerId` set) — publishes with ' +
                         'zero `requestData` entries, for a pure customInjection/' +
                         'HAWKEYE provider that relies entirely on ' +
                         '`allowedInjectedRequestData` for validation instead of a ' +
@@ -248,28 +248,23 @@ export function createVersionFromCaptureTool(client) {
             required: ['initialUrl'],
         },
     }, async (args) => {
-        // Exactly one of `provider` / `providers` — normalize to an array so a
-        // multi-request capture publishes every request, not just the first.
-        // Omitting both is allowed too, but ONLY when adding a version to an
-        // EXISTING provider (`providerId` set): that publishes with zero
-        // `requestData` entries, which only makes sense for a pure
-        // customInjection/HAWKEYE provider whose claims are validated entirely
-        // via `allowedInjectedRequestData` instead of a static requestData stub.
-        // Registering a brand-new provider (no `providerId`) still needs at
-        // least one draft — its name comes from the first one.
-        const hasMany = Array.isArray(args.providers) && args.providers.length > 0;
-        const hasOne = !!args.provider;
-        if (hasMany && hasOne) {
-            throw new Boom('Pass at most one of `provider` (a single draft) or `providers` ' +
-                '(an array of 1+ drafts) — not both.', { statusCode: 400 });
-        }
-        if (!hasMany && !hasOne && !args.providerId) {
+        // `provider` / `providers` are just two spellings of the same input —
+        // fold them into one array. Zero drafts is allowed ONLY when adding a
+        // version to an EXISTING provider (`providerId` set): that publishes
+        // with zero `requestData` entries, for a pure customInjection/HAWKEYE
+        // provider whose claims are validated entirely via
+        // `allowedInjectedRequestData`. Registering a brand-new provider still
+        // needs at least one draft — its name comes from the first one.
+        const providers = [
+            ...(args.provider ? [args.provider] : []),
+            ...(args.providers ?? []),
+        ];
+        if (!providers.length && !args.providerId) {
             throw new Boom('Pass at least one of `provider`/`providers` when registering a ' +
                 'new provider (its name comes from the first draft). Omitting ' +
                 'both is only allowed when adding a version to an EXISTING ' +
                 'provider via `providerId`.', { statusCode: 400 });
         }
-        const providers = hasMany ? args.providers : (hasOne ? [args.provider] : []);
         const opts = {
             initialUrl: args.initialUrl,
             description: args.description,

package/lib/old/tools/scaffold-demo-server.js

@@ -1,182 +1,31 @@
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { defineTool } from "../../mcp/server.js";
 import { findProjectRoot } from "../../paths.js";
-/** Corrected against `@reclaimprotocol/js-sdk` v5.8.1 (`Reclaim.ts`): awaits
- *  `getRequestUrl()`, uses `setContext` (not deprecated `addContext`), JSON-
- *  parses the raw webhook body before `verifyProof`, passes the required
- *  `{ providerId, providerVersion }` config, and reads `result.isVerified`
- *  (not `is_verified`). `providerVersion` is left unpinned (`undefined`) by
- *  default — the built-in "example" providerId isn't versioned, so pinning
+/** The demo's source files live in `samples/demo-server/` so they can be
+ *  edited (and even run) as plain files without touching code — same pattern
+ *  as `skill/*.md`. The path resolves the same from `src/old/tools` (dev) and
+ *  `lib/old/tools` (published): both are three levels below the package root.
+ *
+ *  `server.js` there is corrected against `@reclaimprotocol/js-sdk` v5.8.1
+ *  (`Reclaim.ts`): awaits `getRequestUrl()`, uses `setContext` (not deprecated
+ *  `addContext`), JSON-parses the raw webhook body before `verifyProof`,
+ *  passes the required `{ providerId, providerVersion }` config, and reads
+ *  `result.isVerified` (not `is_verified`). `providerVersion` is left unpinned
+ *  by default — the built-in "example" providerId isn't versioned, so pinning
  *  one is only meaningful once you swap in your own provider. */
+const SAMPLE_DIR = fileURLToPath(new URL('../../../samples/demo-server', import.meta.url));
+function readSample(name) {
+    return readFileSync(join(SAMPLE_DIR, name), 'utf8');
+}
+/** `server.js` with its `__PROVIDER_ID__` / `__PROVIDER_VERSION__` tokens
+ *  substituted with JS literals. */
 function serverJs(providerId, providerVersion) {
-    return `import express from "express";
-import "dotenv/config";
-import { ReclaimProofRequest, verifyProof } from "@reclaimprotocol/js-sdk";
-import { randomUUID } from "node:crypto";
-
-const app = express();
-const port = process.env.PORT || 3000;
-const providerId = ${JSON.stringify(providerId)};
-// Left unpinned by default — set this if you need to pin a specific version.
-const providerVersion = ${providerVersion ? JSON.stringify(providerVersion) : 'undefined'};
-
-app.set("trust proxy", true);
-app.use(express.json({ limit: "2mb" }));
-
-app.get("/health", (_req, res) => {
-  res.json({ ok: true });
-});
-
-app.get("/verify", (_req, res) => {
-  res.type("html").send(\`<!doctype html>
-    <html lang="en">
-      <head>
-        <meta charset="utf-8" />
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <title>Reclaim demo verification</title>
-        <style>
-          body { font-family: system-ui, sans-serif; max-width: 680px; margin: 64px auto; padding: 0 20px; line-height: 1.5; }
-          code { background: #f3f4f6; padding: 2px 6px; border-radius: 4px; }
-          button { background: #111827; border: 0; border-radius: 8px; color: white; cursor: pointer; font: inherit; padding: 12px 18px; }
-          button:disabled { cursor: wait; opacity: 0.7; }
-          pre { background: #f3f4f6; border-radius: 8px; overflow: auto; padding: 12px; }
-        </style>
-      </head>
-      <body>
-        <h1>Reclaim demo verification</h1>
-        <p>Uses provider <code>\${providerId}</code>.</p>
-        <button id="start">Start verification</button>
-        <pre id="status">Ready.</pre>
-        <p>Webhook endpoint: <code>/webhooks/reclaim</code></p>
-        <script>
-          const button = document.getElementById("start");
-          const status = document.getElementById("status");
-          button.addEventListener("click", async () => {
-            button.disabled = true;
-            status.textContent = "Creating verification request...";
-            try {
-              const response = await fetch("/api/reclaim/request", { method: "POST" });
-              if (!response.ok) throw new Error(await response.text());
-              const { requestUrl } = await response.json();
-              status.textContent = "Opening Reclaim verification...";
-              window.open(requestUrl, "_blank", "noopener,noreferrer");
-              status.textContent = "Verification opened. Complete it in the Reclaim window.";
-            } catch (error) {
-              status.textContent = error instanceof Error ? error.message : String(error);
-              button.disabled = false;
-            }
-          });
-        </script>
-      </body>
-    </html>\`);
-});
-
-app.post("/api/reclaim/request", async (req, res, next) => {
-  try {
-    const appId = process.env.RECLAIM_APP_ID;
-    const appSecret = process.env.RECLAIM_APP_SECRET;
-    if (!appId || !appSecret) {
-      return res.status(500).json({ error: "Missing RECLAIM_APP_ID or RECLAIM_APP_SECRET" });
-    }
-
-    const origin = process.env.PUBLIC_URL || \`\${req.protocol}://\${req.get("host")}\`;
-    const reclaimProofRequest = await ReclaimProofRequest.init(appId, appSecret, providerId, {
-      providerVersion,
-    });
-    reclaimProofRequest.setAppCallbackUrl(\`\${origin}/webhooks/reclaim\`, true);
-    reclaimProofRequest.setContext(
-      randomUUID(),
-      JSON.stringify({ createdAt: new Date().toISOString() }),
-    );
-
-    // getRequestUrl() is ASYNC in the current SDK — must be awaited.
-    const requestUrl = await reclaimProofRequest.getRequestUrl();
-
-    res.json({
-      request: reclaimProofRequest.toJsonString(),
-      requestUrl,
-    });
-  } catch (error) {
-    next(error);
-  }
-});
-
-app.post("/webhooks/reclaim", async (req, res, next) => {
-  try {
-    // With jsonProofResponse: true + express.json() above, req.body is
-    // already a parsed Proof/Proof[]. Without either of those, the raw body
-    // is text and must be JSON.parse()'d (and URL-decoded if form-encoded)
-    // before calling verifyProof.
-    const proof = req.body;
-
-    // The second argument is REQUIRED — must include providerId.
-    const result = await verifyProof(proof, { providerId, providerVersion });
-
-    console.log("Received Reclaim verification:");
-    console.log(JSON.stringify({ isVerified: result.isVerified, data: result.data, error: result.error }, null, 2));
-
-    res.status(200).json({ received: true, verified: result.isVerified });
-  } catch (error) {
-    next(error);
-  }
-});
-
-app.use((err, _req, res, _next) => {
-  console.error(err);
-  res.status(500).json({ error: err instanceof Error ? err.message : "Internal server error" });
-});
-
-app.listen(port, () => {
-  console.log(\`Reclaim demo server listening on http://localhost:\${port}\`);
-  console.log(\`Verify page:      http://localhost:\${port}/verify\`);
-  console.log(\`Webhook endpoint: http://localhost:\${port}/webhooks/reclaim\`);
-  if (!process.env.PUBLIC_URL) {
-    console.log("Set PUBLIC_URL (e.g. an ngrok URL) so the webhook is reachable from Reclaim's servers.");
-  }
-});
-`;
+    return readSample('server.js')
+        .replace('__PROVIDER_ID__', JSON.stringify(providerId))
+        .replace('__PROVIDER_VERSION__', providerVersion ? JSON.stringify(providerVersion) : 'undefined');
 }
-const PACKAGE_JSON = (name) => JSON.stringify({
-    name,
-    private: true,
-    type: 'module',
-    scripts: { start: 'node server.js' },
-    dependencies: {
-        '@reclaimprotocol/js-sdk': '^5.8.1',
-        dotenv: '^16.4.5',
-        express: '^4.21.2',
-    },
-}, null, 2) + '\n';
-const ENV_EXAMPLE = `RECLAIM_APP_ID=
-RECLAIM_APP_SECRET=
-PORT=3000
-# REQUIRED for the webhook callback to land — Reclaim's servers can't reach
-# localhost. Run: ngrok http 3000 (in a separate terminal) and paste the
-# https://<id>.ngrok-free.app URL it prints here. Without this, only the
-# frontend-side flow works (opening requestUrl) — the webhook never fires.
-PUBLIC_URL=
-`;
-const README = `# Reclaim demo server
-
-1. \`npm install\`
-2. Fill in \`.env\` (copy from \`.env.example\`) — get \`RECLAIM_APP_ID\`/
-   \`RECLAIM_APP_SECRET\` from the \`issue_app_credentials\` MCP tool, or your
-   existing app.
-3. In a separate terminal, run \`ngrok http 3000\` (install from
-   https://ngrok.com if needed) and copy the \`https://<id>.ngrok-free.app\`
-   URL it prints into \`PUBLIC_URL\` in \`.env\`. This is REQUIRED — Reclaim's
-   servers must reach your webhook over the public internet, and
-   \`localhost\` is not reachable from there.
-4. \`npm start\`, then open http://localhost:3000/verify and click "Start
-   verification".
-5. Watch the server logs for the \`/webhooks/reclaim\` payload once you
-   complete verification.
-
-This demo defaults to providerId \`"example"\` — a built-in smoke-test
-provider, so you can confirm the whole loop (request → open → callback)
-works before wiring in a real provider.
-`;
 /**
  * Scaffold a small, runnable Express demo that exercises the full
  * @reclaimprotocol/js-sdk flow end-to-end: request a proof (backend), open it
@@ -193,9 +42,12 @@ export function scaffoldDemoServerTool() {
             'verifies the async webhook callback, using the CURRENT ' +
             '@reclaimprotocol/js-sdk API. Defaults `providerId` to the built-in ' +
             '"example" smoke-test provider so you can confirm the whole loop ' +
-            'without authoring one first, and requires ngrok (or similar) to ' +
-            'expose the local server so the webhook callback can reach it — ' +
-            'the generated README walks through that step. Use ' +
+            'without authoring one first. The webhook callback needs a URL ' +
+            'Reclaim\'s servers can reach — localhost never works — via EITHER ' +
+            'a tunnel (ngrok or similar) OR quickly deploying this demo to a ' +
+            'dev/staging server the user already has; ASK THE USER which they\'d ' +
+            'rather use before assuming ngrok, since either sets `PUBLIC_URL` in ' +
+            '.env (the generated README covers both). Use ' +
             'get_js_sdk_integration_guide for the annotated write-up of the ' +
             'same flow.',
         inputSchema: {
@@ -228,9 +80,9 @@ export function scaffoldDemoServerTool() {
         mkdirSync(dir, { recursive: true });
         const id = providerId ?? DEFAULT_PROVIDER_ID;
         writeFileSync(join(dir, 'server.js'), serverJs(id, providerVersion));
-        writeFileSync(join(dir, 'package.json'), PACKAGE_JSON('reclaim-demo-server'));
-        writeFileSync(join(dir, '.env.example'), ENV_EXAMPLE);
-        writeFileSync(join(dir, 'README.md'), README);
+        writeFileSync(join(dir, 'package.json'), readSample('package.json'));
+        writeFileSync(join(dir, '.env.example'), readSample('.env.example'));
+        writeFileSync(join(dir, 'README.md'), readSample('README.md'));
         return {
             dir,
             providerId: id,

package/lib/old/tools/verify-sdk-setup.js

@@ -100,8 +100,10 @@ export function verifySdkSetupTool(client) {
                     'base for setAppCallbackUrl.'
                 : 'PUBLIC_URL not set — fine if you only read the proof from the ' +
                     'frontend flow, but the async webhook callback needs a ' +
-                    'publicly-reachable URL (e.g. from `ngrok http <port>`) or it ' +
-                    'will never fire.',
+                    'publicly-reachable URL or it will never fire. Get one via a ' +
+                    'tunnel (e.g. `ngrok http <port>`) or by deploying to a ' +
+                    'dev/staging server you already have — ask the user which they ' +
+                    'prefer.',
         });
         if (appId) {
             try {
@@ -112,7 +114,9 @@ export function verifySdkSetupTool(client) {
                     ok: status?.available !== false,
                     detail: `isLinked=${linked}, sandboxMode=${status?.sandboxMode}, ` +
                         `available=${status?.available}` +
-                        (linked ? '' : ' — run link_app_to_account to lift the sandbox limit.'),
+                        (linked
+                            ? ''
+                            : ' — run link_app_to_account to lift the sandbox limit.'),
                 });
             }
             catch (err) {

package/lib/proof/attestor.js

@@ -6,7 +6,7 @@
 // revealed slice; jsonPath/xPath live on responseRedactions (what the prover
 // reveals), never on responseMatches.
 import { bytesToHex } from '@noble/hashes/utils.js';
-import { createClaimOnAttestor, } from '@reclaimprotocol/attestor-core';
+import { createClaimOnAttestor } from '@reclaimprotocol/attestor-core';
 // Side-effect: make external domhandler nodes DOM-like so attestor-core's
 // bundled `xpath` accepts them (see patch-domhandler.ts). Must load before any
 // proof runs its response-redaction extraction.
@@ -14,7 +14,7 @@ import "./patch-domhandler.js";
 import { agentTraceEnabled } from "../consts.js";
 import { resolveEthKey } from "../mcp/tools/authenticate/eth-key.js";
 import { installResponseDump } from "./debug-response-dump.js";
-import { buildHttpParams, ensureAttestorCrypto, parseClaim, resolveAttestorUrl, } from "./proof-core.js";
+import { buildHttpParams, ensureAttestorCrypto, parseClaim, resolveAttestorUrl } from "./proof-core.js";
 import { ensureZkFiles } from "./zk-files.js";
 /** Trim a captured log stream to the last N entries — for shrinking the
  *  LLM-visible response while the full stream stays in the on-disk dump. */

package/lib/provider/draft.js

@@ -56,19 +56,43 @@ const STRIP_REQUEST_HEADERS = new Set([
     'host',
     'content-length',
     'transfer-encoding',
+    // Per-session anti-CSRF tokens. Not caught by splitSecrets (no `-token`
+    // suffix), so without this they baked in as PUBLIC headers and went stale at
+    // verify time — the attestor replayed one user's captured CSRF for everyone,
+    // which the origin rejects. A CSRF token is never portable; drop it.
+    'csrf',
+    'x-csrf',
+    'xsrf',
+    'x-xsrf',
+    'x-csrf-token',
+    'xsrf-token',
 ]);
 /** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
  *  `:scheme`) — never a valid request header the attestor can replay. */
 function isPseudoHeader(name) {
     return name.startsWith(':');
 }
+/** A header VALUE that is a per-session/request token — a UUID or a long opaque
+ *  hex/base64 blob. Such a value is captured-user-specific: baked into the
+ *  provider it goes stale and the origin rejects the replay for everyone else.
+ *  Stable identifiers (a tenant/space id like `1237`, a timezone, client hints)
+ *  are short/structured and don't match, so they survive. */
+function isVolatileHeaderValue(value) {
+    const v = value.trim();
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+        .test(v)
+        || /^[0-9a-f]{16,}$/i.test(v)
+        || /^[A-Za-z0-9_-]{32,}$/.test(v);
+}
 /** Drop the headers the attestor manages or that would 304 at proof time
  *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
  *  attestor's replay looks like the browser's request. */
 function sanitizeRequestHeaders(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers)) {
-        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase()) || isPseudoHeader(k)) {
+        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase())
+            || isPseudoHeader(k)
+            || isVolatileHeaderValue(v)) {
             continue;
         }
         out[k] = v;
@@ -86,6 +110,32 @@ function sanitizeRequestHeaders(headers) {
  *  `{{param}}`. Throwing discards the draft so the agent re-captures or
  *  re-proposes rather than shipping a provider pinned to this one user. */
 export function assertPortableMatches(matches, redactions, targets) {
+    // A baked email LOCAL-PART ("jane.doe@…") pins the provider to one user
+    // even when only the domain is captured as a param — the classic result of
+    // proving an email's domain substring. Reject it regardless of the declared
+    // targets (the local part is usually not itself a target, so the value scan
+    // below wouldn't catch it). Strip params + named groups + regex escapes
+    // first, then look for `localpart@` as a surviving literal.
+    const EMAIL_LOCAL_BAKED = /[A-Za-z0-9._%+-]{3,}@/;
+    const deregex = (s) => s
+        .replace(/\{\{[^}]*\}\}/g, '')
+        .replace(/\(\?<[^>]*>[^)]*\)/g, '')
+        .replace(/\\(.)/g, '$1');
+    const scanEmail = (text, where) => {
+        if (EMAIL_LOCAL_BAKED.test(deregex(text))) {
+            throw new Error(`drafted ${where} bakes a per-user email local-part as a literal — `
+                + 'the provider would be pinned to this user. Capture the WHOLE email '
+                + 'as a {{param}} (optionally OPRF-hashed), not just its domain.');
+        }
+    };
+    for (const [i, m] of matches.entries()) {
+        scanEmail(m.value, `responseMatch for "${targets[i]?.name ?? '?'}"`);
+    }
+    for (const r of redactions) {
+        if (r.regex) {
+            scanEmail(r.regex, 'responseRedaction regex');
+        }
+    }
     // Guard only values long enough to be plausibly user-specific; shorter runs
     // (single digits, 2-3 char tokens) collide with ordinary structural bytes.
     const MIN_ALNUM = 4;