@reclaimprotocol/agent 0.1.15 → 0.1.18

package/src/mcp/tools/mode/mode.ts

@@ -0,0 +1,82 @@
+import type { ConfigStore, DevtoolsMode } from '../../../config/store.ts'
+import { defaultConfigPath } from '../../../config/store.ts'
+import { oldModeSource } from '../../../consts.ts'
+import { defineTool, type RegisteredTool } from '../../server.ts'
+
+/**
+ * The `set_devtools_mode` / `get_devtools_mode` tools: persist which backend
+ * the MCP server targets (`old` devtools vs the `builder`), and
+ * report the mode currently in effect. The choice is written to
+ * `~/.reclaim/config.json` and applied the NEXT time the server starts —
+ * the registered tool set, server instructions, and backend client are all
+ * fixed at connect time, so the switch requires a restart/reconnect. Follows
+ * the `attach_chrome` persist-through-config pattern.
+ *
+ * Registered in BOTH modes (so the user can switch either direction) and
+ * outside `buildAgentTools` (so it survives `RECLAIM_AGENT_DISABLED=1`). An
+ * explicit `USE_OLD_DEVTOOLS` env var still overrides the persisted value —
+ * see `resolveOldMode` in consts.ts.
+ */
+export function buildModeTools(
+	config: ConfigStore,
+	currentOldMode: boolean,
+): RegisteredTool[] {
+	const current: DevtoolsMode = currentOldMode ? 'old' : 'builder'
+	return [
+		defineTool<{ mode: DevtoolsMode }>(
+			{
+				name: 'set_devtools_mode',
+				description:
+					'Choose which backend the MCP server targets: "old" (devtools) '
+					+ 'or "builder" (the builder backend). '
+					+ 'Persists the choice to ~/.reclaim/config.json; it takes effect '
+					+ 'the next time the MCP server starts, so restart/reconnect after '
+					+ 'switching. An explicit USE_OLD_DEVTOOLS env var overrides this.',
+				inputSchema: {
+					type: 'object',
+					properties: {
+						mode: { type: 'string', enum: ['old', 'builder'] },
+					},
+					required: ['mode'],
+				},
+			},
+			async(parsed) => {
+				config.write({ mode: parsed.mode })
+				const restartRequired = parsed.mode !== current
+				return {
+					saved: true,
+					mode: parsed.mode,
+					effectiveNow: current,
+					restartRequired,
+					configPath: defaultConfigPath(),
+					message: restartRequired
+						? 'Saved. Restart / reconnect the MCP server for '
+							+ `"${parsed.mode}" mode to take effect.`
+						: `Already running in "${parsed.mode}" mode; nothing to restart.`,
+				}
+			},
+		),
+		defineTool<Record<string, never>>(
+			{
+				name: 'get_devtools_mode',
+				description:
+					'Report which backend this MCP server is currently targeting: '
+					+ '"old" (devtools) or "builder" (the builder '
+					+ 'backend). Also reports WHY that mode is in effect (source: '
+					+ 'a USE_OLD_DEVTOOLS env override, the persisted config, or '
+					+ 'the default) and which mode is persisted for the next '
+					+ 'start. Use set_devtools_mode to change it.',
+				inputSchema: { type: 'object', properties: {} },
+			},
+			async() => {
+				const persisted = config.read()?.mode
+				return {
+					mode: current,
+					source: oldModeSource(persisted),
+					persistedMode: persisted ?? null,
+					configPath: defaultConfigPath(),
+				}
+			},
+		),
+	]
+}

package/src/old/to-register.ts

@@ -1,3 +1,4 @@
+import assert from 'node:assert'
 import type { ReclaimProvider } from '../provider/schema.ts'
 import type { AllowedJsRequest, DraftRequest } from '../provider/to-version.ts'
 import type {
@@ -6,7 +7,7 @@ import type {
 } from './client.ts'
 
 /** Default web settings, mirroring the builder openapi defaults
- *  (`ProviderWebSettings.geoLocation`, `PortalClientOptions.useProxy`). The old
+ *  (`ProviderWebSettings.geoLocation`, `PortalClientOptions.useProxy`). The
  *  backend accepts both: `geoLocation` lives on the providerConfig, `useProxy`
  *  is a Provider-level flag (register only). */
 const DEFAULT_GEO_LOCATION = '{{DYNAMIC_GEO}}'
@@ -14,15 +15,15 @@ const DEFAULT_USE_PROXY = true
 
 /**
  * Translate a drafted `ReclaimProvider` (from `propose_provider`) into the
- * OLD devtools backend shapes. Deliberately a SEPARATE module from
+ * devtools backend shapes. Deliberately a SEPARATE module from
  * `provider/to-version.ts` (the builder translator) — the two backends have
  * structurally different bodies:
  *
  *   - builder NESTS each redaction into its match's `extract`;
- *   - old devtools keeps `responseMatches` and `responseRedactions` as
+ *   - devtools keeps `responseMatches` and `responseRedactions` as
  *     PARALLEL arrays on each `requestData` entry.
  *
- * Old-devtools limit we enforce here (a clear error beats a confusing
+ * Devtools limit we enforce here (a clear error beats a confusing
  * server-side 400): only `GET` / `POST` methods. OPRF redactions are passed
  * through unchanged — the backend's `hash` field accepts them.
  */
@@ -35,7 +36,7 @@ export interface OldProviderOpts {
 	/** Defaults to `true` when omitted. Register only (Provider-level flag). */
 	useProxy?: boolean
 	providerType?: 'PRIVATE' | 'PUBLIC'
-	/** Page-injection script — old-devtools' name for the builder's
+	/** Page-injection script — the devtools name for the builder's
 	 *  `webSettings.jsUserScripts`. Top-level on register, nested under
 	 *  `providerConfig` on config (add-version). The backend rejects a few
 	 *  deprecated injection APIs (e.g. `window.payloadData`) with a 400. */
@@ -59,6 +60,14 @@ export interface OldProviderOpts {
 	/** Config (add-version) ONLY — the register endpoint never reads this
 	 *  field from the request body. Free-form JSON. */
 	extensionConfig?: unknown
+	/** Provider-level `disableRequestReplay` (HAWKEYE document replay skip).
+	 *  Config (add-version) ONLY: the register endpoint hardcodes it to false
+	 *  — the publish tool follows a register up with an add-version call to
+	 *  apply it for new providers (see `old/tools/publish.ts`). NOTE the
+	 *  builder backend has NO equivalent; its inverse is
+	 *  `webSettings.clientOptions.inapp.interceptorOptions
+	 *  .isDocumentRequestReplayEnabled`. */
+	disableRequestReplay?: boolean
 }
 
 interface OldResponseMatch {
@@ -80,11 +89,11 @@ interface OldResponseRedaction {
 
 interface OldRequestData {
 	url: string
-	urlType: 'CONSTANT' | 'TEMPLATE'
+	urlType: 'REGEX' | 'CONSTANT' | 'TEMPLATE'
 	method: 'GET' | 'POST'
 	responseMatches: OldResponseMatch[]
 	responseRedactions: OldResponseRedaction[]
-	credentials: 'include'
+	credentials: 'omit' | 'same-origin' | 'include'
 	bodySniff?: { enabled: boolean, template: string }
 }
 
@@ -103,36 +112,42 @@ export interface OldInjectedRequestData extends OldRequestData {
  *  entries — a `ReclaimProvider` satisfies it structurally either way. */
 function requestDataFromProvider(provider: DraftRequest): OldRequestData {
 	const method = String(provider.method).toUpperCase()
-	if(method !== 'GET' && method !== 'POST') {
-		throw new Error(
-			'Old devtools supports only GET/POST requests; got ' +
+	assert(
+		method === 'GET' || method === 'POST',
+		new Error(
+			'Devtools supports only GET/POST requests; got ' +
 			`"${provider.method}". Re-capture against a GET/POST endpoint.`,
 		)
-	}
+	)
 
-	// The old backend has no dotted interpolation: consumer-supplied params
+	// The devtools backend has no dotted interpolation: consumer-supplied params
 	// must use the `{{context_<name>}}` form here, not the builder's
 	// `{{context.<name>}}`. Catch the mix-up at publish with a clear error
 	// instead of a template that silently never resolves.
 	const dotted = `${provider.url}\n${provider.body ?? ''}`
 		.match(/\{\{context\.[A-Za-z_][A-Za-z0-9_]*\}\}/)
-	if(dotted) {
-		throw new Error(
-			`Old devtools does not support ${dotted[0]} — rename ` +
+	assert(
+		!dotted,
+		new Error(
+			`Devtools does not support ${dotted?.[0]} — rename ` +
 			'consumer-supplied params to the {{context_<name>}} form ' +
 			'for this backend.',
 		)
-	}
+	)
 
 	const responseMatches: OldResponseMatch[] = (provider.responseMatches ?? [])
 		.map((m, i) => ({
 			value: m.value,
 			type: m.type ?? 'contains',
-			isOptional: false,
+			// The backend honors isOptional on BOTH register and add-version
+			// (responseMatches pass through verbatim) — forward the author's
+			// flag, default false. (`invert` has no old-backend equivalent and
+			// stays dropped.)
+			isOptional: m.isOptional ?? false,
 			order: i,
 		}))
 
-	// Old devtools wants `responseMatches` and `responseRedactions` as PARALLEL
+	// Devtools wants `responseMatches` and `responseRedactions` as PARALLEL
 	// arrays — same shape the builder uses, so pass them through directly. We do
 	// NOT enforce any match/redaction count relationship here (and never pad —
 	// empty placeholder matches break proof generation): the author keeps full
@@ -166,36 +181,38 @@ function requestDataFromProvider(provider: DraftRequest): OldRequestData {
 
 	const requestData: OldRequestData = {
 		url: provider.url,
-		// `{{param}}` placeholders → TEMPLATE so the backend templates them;
-		// otherwise a fixed CONSTANT url. (REGEX is never drafted.)
-		urlType: provider.url.includes('{{') ? 'TEMPLATE' : 'CONSTANT',
+		// Explicit override wins; otherwise `{{param}}` placeholders → TEMPLATE
+		// so the backend templates them, else a fixed CONSTANT url.
+		urlType: provider.urlType
+			?? (provider.url.includes('{{') ? 'TEMPLATE' : 'CONSTANT'),
 		method: method,
 		responseMatches,
 		responseRedactions,
 		// The verification client re-supplies cookies/auth at runtime; secrets
 		// are never persisted (propose_provider already stripped them).
-		credentials: 'include',
+		credentials: provider.credentials ?? 'include',
 	}
 	if(provider.body !== undefined) {
 		requestData.bodySniff = { enabled: true, template: provider.body }
 	}
 
-	// NOTE: `responseVariables` is intentionally omitted — the old backend
+	// NOTE: `responseVariables` is intentionally omitted — the devtools backend
 	// auto-extracts it from `{{var}}` placeholders in responseMatches. Sending
 	// it ourselves would risk drifting from the server's own extraction.
 	return requestData
 }
 
 /** One `requestData` entry per drafted provider. A multi-request provider
- *  becomes parallel entries that the old backend runs together at verification
- *  (the same way the builder version carries multiple `requests`). */
+ *  becomes parallel entries that the devtools backend runs together at
+ *  verification (the same way the builder version carries multiple
+ *  `requests`). */
 function requestDataFrom(providers: ReclaimProvider[]): OldRequestData[] {
 	return providers.map(requestDataFromProvider)
 }
 
 /** Translate fresh `allowedInjectedRequestData` drafts (the author's input
  *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
- *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  its own `allowedJsRequests`) into the devtools backend's shape. A
  *  carried-forward value read back from an existing version is ALREADY in
  *  this shape and should be passed straight through instead — don't run it
  *  through this a second time. */
@@ -300,10 +317,16 @@ export function providerToConfigBody(
 		providerConfig.extensionConfig = opts.extensionConfig
 	}
 
+	// The config (add-version) controller persists providerConfig verbatim,
+	// so this lands as-is; the register controller ignores it entirely.
+	if(opts.disableRequestReplay !== undefined) {
+		providerConfig.disableRequestReplay = opts.disableRequestReplay
+	}
+
 	return { providerConfig, version, versionInfo }
 }
 
-/** Minimal version triplet as the old backend stores it. */
+/** Minimal version triplet as the devtools backend stores it. */
 export interface SemverTriplet {
 	major: number
 	minor: number

package/src/old/tools/publish.ts

@@ -19,6 +19,16 @@ import {
 
 const DEFAULT_VERSION_INFO = 'Updated from MCP browser capture'
 
+/** Pull the new provider's id out of a register response, tolerant of the
+ *  envelope (`{providerId}`, `{provider:{providerId}}`, `{id}`). */
+function extractProviderId(resp: unknown): string | undefined {
+	const obj = resp as
+		{ providerId?: string, provider?: { providerId?: string }, id?: string }
+		| null
+		| undefined
+	return obj?.providerId ?? obj?.provider?.providerId ?? obj?.id
+}
+
 /**
  * The old backend lets you add a version only to a provider YOU own. A
  * `providerId` for a public provider (or anyone else's) comes back as
@@ -81,11 +91,12 @@ export function createVersionFromCaptureTool(
 		stepsToFollow?: string
 		useIncognitoWebview?: boolean
 		extensionConfig?: unknown
+		disableRequestReplay?: boolean
 	}>(
 		{
 			name: 'create_provider_version_from_capture',
 			description:
-				'Publish drafted ReclaimProvider(s) to the OLD devtools backend. ' +
+				'Publish drafted ReclaimProvider(s) to the devtools backend. ' +
 				'Pass the `provider` object from propose_provider VERBATIM and the ' +
 				'`initialUrl` the user landed on (the login/landing page, NOT the ' +
 				'API url). \n\n' +
@@ -103,7 +114,7 @@ export function createVersionFromCaptureTool(
 				"PUBLIC provider you don't own, omit `providerId` to register your " +
 				'own copy (you cannot edit someone else\'s provider here). \n\n' +
 				'For data gated behind login/navigation, pass `customInjection` — a ' +
-				'page-injection script (old-devtools\' name for the builder\'s ' +
+				'page-injection script (the devtools name for the builder\'s ' +
 				'jsUserScripts) that drives the page to where the request fires. \n\n' +
 				'BY DESIGN, this backend only ever CREATES A NEW VERSION (POST) — ' +
 				'there is no partial-patch/edit endpoint, and this tool does NOT ' +
@@ -120,7 +131,14 @@ export function createVersionFromCaptureTool(
 				'values plus your change) back into this call. ' +
 				'`allowedInjectedRequestData`/`useIncognitoWebview`/' +
 				'`extensionConfig` only take effect on add-version — the register ' +
-				'endpoint (no `providerId`) ignores them. \n\n' +
+				'endpoint (no `providerId`) ignores them. `disableRequestReplay` ' +
+				'is also add-version-only, but when it is true the tool follows ' +
+				'a register up with an add-version call automatically so it takes ' +
+				'effect on new providers too. Per-request fields you may set on ' +
+				'`provider`/`providers`: `credentials` (omit/same-origin/include, ' +
+				'default include), `urlType` (REGEX/CONSTANT/TEMPLATE, default ' +
+				'derived from {{placeholders}}), and `isOptional` on each ' +
+				'responseMatch (default false). \n\n' +
 				'Captured requests must be GET/POST. OPRF redactions are supported.',
 			inputSchema: {
 				type: 'object',
@@ -136,6 +154,21 @@ export function createVersionFromCaptureTool(
 							method: { type: 'string' },
 							headers: { type: 'object' },
 							body: { type: 'string' },
+							credentials: {
+								type: 'string',
+								enum: ['omit', 'same-origin', 'include'],
+								description:
+									'How the verification client supplies cookies/auth ' +
+									'when replaying this request. Default `include`.',
+							},
+							urlType: {
+								type: 'string',
+								enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+								description:
+									'How the backend treats the URL. Default derived: ' +
+									'TEMPLATE when the URL has {{placeholders}}, else ' +
+									'CONSTANT.',
+							},
 							responseMatches: { type: 'array' },
 							responseRedactions: { type: 'array' },
 							paramValues: { type: 'object' },
@@ -165,6 +198,14 @@ export function createVersionFromCaptureTool(
 								method: { type: 'string' },
 								headers: { type: 'object' },
 								body: { type: 'string' },
+								credentials: {
+									type: 'string',
+									enum: ['omit', 'same-origin', 'include'],
+								},
+								urlType: {
+									type: 'string',
+									enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+								},
 								responseMatches: { type: 'array' },
 								responseRedactions: { type: 'array' },
 								paramValues: { type: 'object' },
@@ -253,6 +294,14 @@ export function createVersionFromCaptureTool(
 							properties: {
 								url: { type: 'string' },
 								method: { type: 'string' },
+								urlType: {
+									type: 'string',
+									enum: ['REGEX', 'CONSTANT', 'TEMPLATE'],
+									description:
+										'How the backend treats this URL. Default derived ' +
+										'from {{placeholders}} (TEMPLATE) like a normal ' +
+										'request entry.',
+								},
 								body: {
 									type: 'string',
 									description:
@@ -375,6 +424,15 @@ export function createVersionFromCaptureTool(
 							'Free-form JSON passed through to the client. Add-version ' +
 							'ONLY.',
 					},
+					disableRequestReplay: {
+						type: 'boolean',
+						description:
+							'Skip replaying the main document request (HAWKEYE ' +
+							'provider-level flag). Honored on add-version; for a ' +
+							'provider (no `providerId`) the register endpoint ignores ' +
+							'it, so when true the tool automatically follows the ' +
+							'register up with an add-version call that applies it.',
+					},
 				},
 				required: ['initialUrl'],
 			},
@@ -413,6 +471,7 @@ export function createVersionFromCaptureTool(
 				stepsToFollow: args.stepsToFollow,
 				useIncognitoWebview: args.useIncognitoWebview,
 				extensionConfig: args.extensionConfig,
+				disableRequestReplay: args.disableRequestReplay,
 				allowedInjectedRequestData: args.allowedInjectedRequestData
 					? injectedRequestDataFrom(
 						args.allowedInjectedRequestData,
@@ -448,6 +507,12 @@ export function createVersionFromCaptureTool(
 					)
 				}
 
+				// disableRequestReplay is honored ONLY on add-version, so a
+				// register can't set it — when true we immediately follow the
+				// register with an add-version call (which also lands any other
+				// register-ignored fields).
+				const followUp = args.disableRequestReplay === true
+
 				const REGISTER_IGNORED_KEYS = [
 					'allowedInjectedRequestData',
 					'useIncognitoWebview',
@@ -459,15 +524,50 @@ export function createVersionFromCaptureTool(
 					notes.push(
 						`${ignoredOnRegister.join(', ')} ` +
 						`${ignoredOnRegister.length > 1 ? 'are' : 'is'} ` +
-						'ignored on register (no providerId) — the old backend only ' +
-						'reads them when adding a version. Publish once to create ' +
-						'the provider, then call this again WITH the returned ' +
-						'providerId to set them.',
+						'ignored on register (no providerId) — the devtools backend only ' +
+						'reads them when adding a version. ' +
+						(followUp
+							? 'They were applied by the follow-up version the tool ' +
+								'created to set disableRequestReplay.'
+							: 'Publish once to create the provider, then call this ' +
+								'again WITH the returned providerId to set them.'),
 					)
 				}
 
 				const body = providerToRegisterBody(providers, opts)
-				return withNotes(await client.registerProvider(body))
+				const registered = await client.registerProvider(body)
+
+				if(followUp) {
+					const newProviderId = extractProviderId(registered)
+					if(newProviderId) {
+						const versionsResp = await client.listVersions(newProviderId)
+						const followVersion = bumpPatchString(
+							extractVersions(versionsResp),
+						)
+						const configBody = providerToConfigBody(
+							providers,
+							{ ...opts, disableRequestReplay: true },
+							followVersion,
+							DEFAULT_VERSION_INFO,
+						)
+						await client.updateProviderConfig(newProviderId, configBody)
+						notes.push(
+							'disableRequestReplay is ignored by the register endpoint — ' +
+							`applied it via a follow-up version (${followVersion}) on ` +
+							'the new provider, which also lands any register-ignored ' +
+							'fields you passed.',
+						)
+					} else {
+						notes.push(
+							'Could not apply disableRequestReplay: the register ' +
+							'response did not include the new providerId. Call this ' +
+							'tool again WITH `providerId` and `disableRequestReplay: ' +
+							'true` to set it.',
+						)
+					}
+				}
+
+				return withNotes(registered)
 			}
 
 			// New version of an existing provider — pick the next patch above

package/src/proof/debug-response-dump.ts

@@ -26,7 +26,7 @@ let installed = false
 /** Wrap attestor-core's http `getResponseRedactions` to dump the response it
  *  runs against. Idempotent; no-op unless RECLAIM_AGENT_DUMP_RESPONSE is
  *  set. */
-export function installResponseDump(): void {
+export function installResponseDump() {
 	if(installed || !process.env['RECLAIM_AGENT_DUMP_RESPONSE']) {
 		return
 	}

package/src/proof/proof-core.ts

@@ -20,7 +20,7 @@ let cryptoInitialized = false
  *  caller; without this the first proof dies inside the TLS client with
  *  `crypto.randomBytes is not a function`. Shared by every attestor caller —
  *  the agent MCP `run_proof` tool and the app's verification runner. */
-export function ensureAttestorCrypto(): void {
+export function ensureAttestorCrypto() {
 	if(cryptoInitialized) {
 		return
 	}

package/src/proof/zk-files.ts

@@ -27,7 +27,7 @@ let inFlight: Promise<void> | undefined
  * All output goes to stderr (fd 2): the MCP server speaks JSON-RPC over stdout,
  * so a stray write to fd 1 mid-session would corrupt the protocol.
  */
-export function ensureZkFiles(): Promise<void> {
+export function ensureZkFiles() {
 	inFlight ??= download().catch((err) => {
 		inFlight = undefined
 		throw err
@@ -35,7 +35,7 @@ export function ensureZkFiles(): Promise<void> {
 	return inFlight
 }
 
-async function download(): Promise<void> {
+async function download() {
 	let mainPath: string
 	try {
 		mainPath = require.resolve('@reclaimprotocol/zk-symmetric-crypto')

package/src/provider/dom-xpath.ts

@@ -190,7 +190,7 @@ function findElement(root: Node, targets: string[]): Element | undefined {
 	const complete: Element[] = []
 	const embedded: Element[] = []
 
-	const walk = (node: Node): void => {
+	const walk = (node: Node) => {
 		if(isTag(node)) {
 			const el = node
 			const texts = el.children.filter(isText).map((c) => c.data)

package/src/provider/draft.ts

@@ -160,7 +160,7 @@ export function assertPortableMatches(
 	matches: ResponseMatch[],
 	redactions: ResponseRedaction[],
 	targets: DraftTarget[],
-): void {
+) {
 	// A baked email LOCAL-PART ("jane.doe@…") pins the provider to one user
 	// even when only the domain is captured as a param — the classic result of
 	// proving an email's domain substring. Reject it regardless of the declared
@@ -172,7 +172,7 @@ export function assertPortableMatches(
 		.replace(/\{\{[^}]*\}\}/g, '')
 		.replace(/\(\?<[^>]*>[^)]*\)/g, '')
 		.replace(/\\(.)/g, '$1')
-	const scanEmail = (text: string, where: string): void => {
+	const scanEmail = (text: string, where: string) => {
 		if(EMAIL_LOCAL_BAKED.test(deregex(text))) {
 			throw new Error(
 				`drafted ${where} bakes a per-user email local-part as a literal — `
@@ -203,7 +203,7 @@ export function assertPortableMatches(
 	}
 
 	const stripParams = (s: string): string => s.replace(/\{\{[^}]*\}\}/g, '')
-	const scan = (text: string, where: string, own: string | null): void => {
+	const scan = (text: string, where: string, own: string | null) => {
 		const bare = stripParams(text)
 		for(const v of guarded) {
 			if(bare.includes(v)) {

package/src/provider/injection-doc.ts

@@ -14,9 +14,10 @@
  * It also covers the HAWKEYE-style live-interception path (`injectionType` /
  * `interceptorType`, `disableRequestReplay` / `isDocumentRequestReplayEnabled`)
  * and `bodySniff`, reverse-engineered from the old-devtools Prisma schema,
- * controller code, and dashboard field hints — neither publish tool exposes
- * these as inputs (both only build the standard replay flow), so this is
- * read-the-field-and-recognize-it documentation, not authoring guidance.
+ * controller code, and dashboard field hints. The replay flag IS settable via
+ * the publish tools (`disableRequestReplay` on old-devtools — add-version or
+ * the register follow-up; `interceptorOptions` on the builder), so this is
+ * recognition + authoring guidance for the remaining internals.
  */
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'

package/src/provider/schema.ts

@@ -15,6 +15,25 @@ export type HttpMethod = HttpParams['method']
  */
 export type ResponseMatch = HttpParams['responseMatches'][number]
 
+/**
+ * A response match as drafted for PUBLISH: the attestor's match plus
+ * `isOptional` — a backend-side matcher flag (both the old devtools backend
+ * and the builder store it; the attestor's own params have no such field, so
+ * `propose_provider` drafts never set it — only an explicit publish input
+ * does). Default false on both backends.
+ */
+export type DraftResponseMatch = ResponseMatch & { isOptional?: boolean }
+
+/** How the verification client supplies cookies/auth when replaying a
+ *  request. Both backends accept the same enum (old devtools on
+ *  `requestData`, builder on `RequestSelection`); default `include`. */
+export type WebCredentials = 'omit' | 'same-origin' | 'include'
+
+/** Old-devtools `urlType` for a requestData entry. The builder backend has
+ *  no such field (templating is implicit in the URL's `{{param}}`
+ *  placeholders), so the builder translator ignores it. */
+export type OldUrlType = 'REGEX' | 'CONSTANT' | 'TEMPLATE'
+
 /**
  * Selector telling the prover which portion of the response to reveal:
  * `xPath`/`jsonPath` narrows the slice, `regex` (with named groups) matches
@@ -67,8 +86,15 @@ export interface ReclaimProvider {
 	method: HttpMethod
 	headers?: Record<string, string>
 	body?: string
-	responseMatches: ResponseMatch[]
+	responseMatches: DraftResponseMatch[]
 	responseRedactions?: ResponseRedaction[]
+	/** How the verification client supplies cookies/auth on replay. Both
+	 *  backends default to `include` when unset. */
+	credentials?: WebCredentials
+	/** Old-devtools-only url type override (`REGEX`/`CONSTANT`/`TEMPLATE`).
+	 *  Auto-derived from `{{param}}` placeholders when unset; ignored by the
+	 *  builder backend. */
+	urlType?: OldUrlType
 	/** Public param refs (templated into URL/body), populated by draft layer. */
 	paramValues?: Record<string, string>
 	/** Redaction mode for the transcript (attestor default: 'key-update'). */