@reclaimprotocol/agent 0.1.17 → 0.1.20

package/lib/mcp/credentials/import.js

@@ -1,52 +0,0 @@
-import { deriveFromPrivateKey } from '@reclaimprotocol/client';
-import { findProjectRoot } from "../../paths.js";
-import { defineTool } from "../server.js";
-import { persistCredentialLocally } from "./register.js";
-export function importTool() {
-    return defineTool({
-        name: 'import_credentials',
-        description: 'Import an existing Reclaim app credential the user ' +
-            'already holds elsewhere. Provide the private key ' +
-            '(0x-prefixed hex, 64 chars); we derive the address ' +
-            'locally and cache it. By default also writes ' +
-            'RECLAIM_PRIVATE_KEY to the project .env (0600) and appends ' +
-            '.env to .gitignore; pass `writeEnv: false` to keep it in ' +
-            'the local cache (memory) only and leave .env untouched. ' +
-            'ALWAYS ask the dev whether to save to .env before writing. ' +
-            'The credential stays local-only (SANDBOX); link it to an ' +
-            'org to use it in production.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                privateKey: {
-                    type: 'string',
-                    pattern: '^0x[0-9a-fA-F]{64}$',
-                    description: '0x-prefixed hex private key (64 hex chars / 32 bytes).',
-                },
-                label: {
-                    type: 'string',
-                    minLength: 1,
-                    maxLength: 100,
-                },
-                projectDir: {
-                    type: 'string',
-                    description: 'Project directory to write .env into. Defaults ' +
-                        'to the closest ancestor of cwd containing ' +
-                        '.git or package.json.',
-                },
-                writeEnv: {
-                    type: 'boolean',
-                    description: 'Write RECLAIM_PRIVATE_KEY to the project .env ' +
-                        '(default true). Set false to cache in memory only, ' +
-                        'without touching .env.',
-                },
-            },
-            required: ['privateKey'],
-        },
-    }, async (args) => {
-        const keypair = deriveFromPrivateKey(args.privateKey);
-        const projectDir = findProjectRoot(args.projectDir || process.cwd());
-        const persisted = persistCredentialLocally(keypair, args.label, projectDir, args.writeEnv ?? true);
-        return { ...persisted };
-    });
-}

package/lib/mcp/credentials/issue.d.ts

@@ -1,2 +0,0 @@
-import { type RegisteredTool } from '../server.ts';
-export declare function issueTool(): RegisteredTool;

package/lib/mcp/credentials/issue.js

@@ -1,84 +0,0 @@
-import { generateKeypair } from '@reclaimprotocol/client';
-import { findProjectRoot } from "../../paths.js";
-import { defineTool } from "../server.js";
-import { findCached } from "./cache.js";
-import { persistCredentialLocally } from "./register.js";
-export function issueTool() {
-    return defineTool({
-        name: 'issue_credentials',
-        description: 'Mint a fresh anonymous Reclaim app key-pair (or reuse ' +
-            'a cached one via `reuseCachedAppPk`) and cache it locally. ' +
-            'By default also writes RECLAIM_PRIVATE_KEY to the project ' +
-            '.env (mode 0600) and appends .env to .gitignore; pass ' +
-            '`writeEnv: false` to keep it in the local cache (memory) ' +
-            'only and leave .env untouched. ALWAYS ask the dev whether ' +
-            'to save to .env before writing it. The key-pair is ' +
-            'generated locally and is NOT registered with the server — ' +
-            'anonymous credentials operate in SANDBOX mode entirely ' +
-            'client-side. PREFER REUSE over generating a new credential ' +
-            'unless the user explicitly asks for a new app identity. To ' +
-            'use a credential for verification in production, link it to ' +
-            'an organization (via link_credential) and add billing.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                reuseCachedAppPk: {
-                    type: 'string',
-                    pattern: '^0x[0-9a-fA-F]{40}$',
-                    description: 'Lowercase ETH address of a cached credential ' +
-                        'to reuse instead of minting a new one.',
-                },
-                label: {
-                    type: 'string',
-                    minLength: 1,
-                    maxLength: 100,
-                    description: 'Human label stored in the local cache.',
-                },
-                projectDir: {
-                    type: 'string',
-                    description: 'Project directory to write .env into. Defaults ' +
-                        'to the closest ancestor of cwd containing ' +
-                        '.git or package.json.',
-                },
-                writeEnv: {
-                    type: 'boolean',
-                    description: 'Write RECLAIM_PRIVATE_KEY to the project .env ' +
-                        '(default true). Set false to cache the credential ' +
-                        'in memory only, without touching .env.',
-                },
-            },
-        },
-    }, async (args) => {
-        const projectDir = findProjectRoot(args.projectDir || process.cwd());
-        let keypair;
-        let reused = false;
-        if (args.reuseCachedAppPk) {
-            const cached = findCached(args.reuseCachedAppPk);
-            if (!cached) {
-                throw new Error(`No cached credential for ${args.reuseCachedAppPk}. ` +
-                    'Call list_cached_credentials first.');
-            }
-            keypair = {
-                address: cached.address,
-                privateKey: cached.privateKey,
-            };
-            reused = true;
-        }
-        else {
-            keypair = generateKeypair();
-        }
-        const writeEnv = args.writeEnv ?? true;
-        const persisted = persistCredentialLocally(keypair, args.label, projectDir, writeEnv);
-        return {
-            reused,
-            ...persisted,
-            note: writeEnv
-                ? 'Private key written to .env (and the local cache); it is ' +
-                    'NOT in this response on purpose. The credential is ' +
-                    'local-only (SANDBOX); link it to an org for production.'
-                : 'Private key cached in memory only (.env untouched). Sign ' +
-                    'proofs with it by passing run_proof({ ownerAddress }). The ' +
-                    'credential is local-only (SANDBOX).',
-        };
-    });
-}

package/lib/mcp/credentials/keypair.d.ts

@@ -1,17 +0,0 @@
-export type EthKeypair = {
-    address: string;
-    publicKey: string;
-    privateKey: string;
-};
-/**
- * Generate a fresh secp256k1 key-pair and derive its lowercase
- * Ethereum address (keccak-256 of the uncompressed pubkey minus the
- * `0x04` prefix, last 20 bytes).
- */
-export declare function generateKeypair(): EthKeypair;
-/**
- * Recover the address + uncompressed public key from a hex-encoded
- * private key. Used by `importCredentials` to derive the public
- * surface the server needs from a key the user already holds.
- */
-export declare function deriveFromPrivateKey(privateKey: string): EthKeypair;

package/lib/mcp/credentials/keypair.js

@@ -1,48 +0,0 @@
-import { keccak_256 } from '@noble/hashes/sha3.js';
-import * as secp from '@noble/secp256k1';
-/**
- * Generate a fresh secp256k1 key-pair and derive its lowercase
- * Ethereum address (keccak-256 of the uncompressed pubkey minus the
- * `0x04` prefix, last 20 bytes).
- */
-export function generateKeypair() {
-    const priv = secp.utils.randomSecretKey();
-    const pub = secp.getPublicKey(priv, false);
-    return {
-        address: '0x' + bytesToHex(keccak_256(pub.slice(1))).slice(-40),
-        publicKey: '0x' + bytesToHex(pub),
-        privateKey: '0x' + bytesToHex(priv),
-    };
-}
-/**
- * Recover the address + uncompressed public key from a hex-encoded
- * private key. Used by `importCredentials` to derive the public
- * surface the server needs from a key the user already holds.
- */
-export function deriveFromPrivateKey(privateKey) {
-    const hex = privateKey.replace(/^0x/, '');
-    const priv = hexToBytes(hex);
-    const pub = secp.getPublicKey(priv, false);
-    return {
-        address: '0x' + bytesToHex(keccak_256(pub.slice(1))).slice(-40),
-        publicKey: '0x' + bytesToHex(pub),
-        privateKey: '0x' + hex,
-    };
-}
-function bytesToHex(bytes) {
-    let out = '';
-    for (const b of bytes) {
-        out += b.toString(16).padStart(2, '0');
-    }
-    return out;
-}
-function hexToBytes(hex) {
-    if (hex.length % 2 !== 0) {
-        throw new Error('private key hex must have even length');
-    }
-    const out = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < out.length; i++) {
-        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-    }
-    return out;
-}

package/lib/mcp/credentials/link.d.ts

@@ -1,3 +0,0 @@
-import type { ReclaimClient } from '@reclaimprotocol/client';
-import { type RegisteredTool } from '../server.ts';
-export declare function linkTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/credentials/link.js

@@ -1,107 +0,0 @@
-import { defineTool } from "../server.js";
-import { patchCached } from "./cache.js";
-import { writeSession } from "./session-cache.js";
-export function linkTool(client) {
-    return defineTool({
-        name: 'link_credential_via_dashboard',
-        description: 'Pair a Reclaim app credential to an organization via the dashboard. '
-            + 'Two steps:\n\n'
-            + 'Step 1 — call with the credential `address`. Returns a `code` '
-            + 'and `attachUrl`. Tell the user to open the URL, sign in, pick '
-            + 'an organization, and click "Confirm link".\n\n'
-            + 'Step 2 — once the user has confirmed, call again with the same '
-            + '`code` from step 1 to check the result. Returns `LINKED` with '
-            + 'the linked `orgId` when done, `PENDING` if not yet.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                address: {
-                    type: 'string',
-                    pattern: '^0x[0-9a-fA-F]{40}$',
-                    description: 'Lowercase ETH address. Defaults to '
-                        + 'process.env.RECLAIM_APP_PK.',
-                },
-                code: {
-                    type: 'string',
-                    pattern: '^[A-HJ-NP-Z2-9]{5}$',
-                    description: '5-character code from a previous step-1 call. '
-                        + 'When provided, checks whether the user has '
-                        + 'confirmed that session.',
-                },
-            },
-        },
-    }, async (args) => {
-        // Step 2: check an existing session
-        if (args.code) {
-            const address = (args.address || process.env.RECLAIM_APP_PK || '').toLowerCase();
-            let session;
-            try {
-                session = await client.call('GetAttachSession', {
-                    params: { code: args.code },
-                    query: {}, body: {},
-                });
-            }
-            catch (err) {
-                const msg = err.message;
-                if (msg.includes('404') || msg.includes('Not Found')) {
-                    return {
-                        status: 'NOT_FOUND',
-                        hint: 'Session not found or expired. '
-                            + 'Call link_credential_via_dashboard with just the address to start over.',
-                    };
-                }
-                throw new Error(`Failed to check session: ${msg}`);
-            }
-            if (session.status === 'LINKED') {
-                if (session.linkedOrgId && address) {
-                    patchCached(address, { orgId: session.linkedOrgId });
-                }
-                const token = session.token?.trim();
-                if (token) {
-                    writeSession({
-                        token,
-                        expiresAt: new Date(Date.now() + 2 * 24 * 60 * 60 * 1000).toISOString(),
-                    });
-                    client.setToken(token);
-                }
-                return {
-                    status: 'LINKED',
-                    address,
-                    ...(session.linkedOrgId ? { orgId: session.linkedOrgId } : {}),
-                    ...(token ? { token } : {}),
-                };
-            }
-            if (session.status === 'EXPIRED') {
-                return {
-                    status: 'EXPIRED',
-                    hint: 'Session expired. Call link_credential_via_dashboard with the address to start over.',
-                };
-            }
-            // Still PENDING
-            return {
-                status: 'PENDING',
-                code: session.code,
-                attachUrl: session.attachUrl,
-                hint: `Still waiting. Open ${session.attachUrl}, sign in, pick an org, and confirm. `
-                    + `Then call link_credential_via_dashboard with code: "${session.code}" again.`,
-            };
-        }
-        // Step 1: open a new session
-        const address = (args.address || process.env.RECLAIM_APP_PK || '').toLowerCase();
-        if (!address) {
-            throw new Error('No address provided and RECLAIM_APP_PK is not set.');
-        }
-        const session = await client.call('CreateAttachSession', {
-            params: {}, query: {},
-            body: { address },
-        });
-        return {
-            status: 'PENDING',
-            code: session.code,
-            attachUrl: session.attachUrl,
-            expiresAt: session.expiresAt,
-            instructions: `Open ${session.attachUrl} in your browser, sign in, and pick an organization. `
-                + `Once done, call link_credential_via_dashboard again with code: "${session.code}" to confirm.`,
-        };
-    });
-}

package/lib/mcp/credentials/list-cached.d.ts

@@ -1,2 +0,0 @@
-import { type RegisteredTool } from '../server.ts';
-export declare function listCachedTool(): RegisteredTool;

package/lib/mcp/credentials/list-cached.js

@@ -1,55 +0,0 @@
-import { findProjectRoot } from "../../paths.js";
-import { defineTool } from "../server.js";
-import { readCache, suggestCredentialForDir } from "./cache.js";
-export function listCachedTool() {
-    return defineTool({
-        name: 'list_cached_credentials',
-        description: 'List Reclaim app credentials (ETH key-pairs) cached ' +
-            'locally in ~/.reclaim/credentials.json. Returns one ' +
-            'row per credential with address, optional label and ' +
-            'orgId, createdAt, createdIn (where it was first created), ' +
-            'and the project directories that have used it. Private keys ' +
-            'are stripped. The response also reports `currentDir` and ' +
-            'flags the best credential for it (`suggested`, plus ' +
-            '`suggestedAddress`/`suggestionReason`) — prefer reusing that ' +
-            'one over minting a new credential. When the cache is empty a ' +
-            '`suggestion` string explains how to create one.',
-        inputSchema: {
-            type: 'object',
-            properties: {},
-        },
-    }, async () => {
-        const doc = readCache();
-        const currentDir = findProjectRoot(process.cwd());
-        const suggestion = suggestCredentialForDir(currentDir, doc.credentials);
-        const suggestedAddress = suggestion?.credential.address;
-        const items = doc.credentials.map((c) => ({
-            address: c.address,
-            label: c.label,
-            orgId: c.orgId,
-            createdAt: c.createdAt,
-            createdIn: c.createdIn,
-            projectDirs: c.projectDirs,
-            matchesCurrentDir: c.createdIn === currentDir || c.projectDirs.includes(currentDir),
-            suggested: c.address === suggestedAddress,
-        }));
-        // Promote the single suggested row to the top; stable sort keeps
-        // the rest in insertion (newest-first) order.
-        items.sort((a, b) => Number(b.suggested) - Number(a.suggested));
-        if (items.length === 0) {
-            return {
-                items,
-                currentDir,
-                suggestion: 'No cached credentials. Call issue_credentials to mint a new ' +
-                    'app key-pair, or import_credentials if you already hold a ' +
-                    'private key. Do not invent credentials.',
-            };
-        }
-        return {
-            items,
-            currentDir,
-            suggestedAddress,
-            suggestionReason: suggestion?.reason,
-        };
-    });
-}

package/lib/mcp/credentials/owner-key.d.ts

@@ -1,23 +0,0 @@
-export type OwnerKey = {
-    privateKey: string;
-    address: string;
-    publicKey: string;
-    /** ISO timestamp when the key was generated. */
-    createdAt: string;
-};
-export declare function ownerKeyPath(): string;
-/** Read the saved owner key, or undefined if absent/unreadable. */
-export declare function readOwnerKey(): OwnerKey | undefined;
-/** Persist the owner key to ~/.reclaim/owner-key.json (0600). */
-export declare function writeOwnerKey(key: OwnerKey): void;
-/**
- * Resolve the owner private key for proof generation. Priority:
- * explicit `RECLAIM_AGENT_OWNER_PRIVATE_KEY` env var → saved
- * ~/.reclaim/owner-key.json → undefined. Mirrors the token-resolution
- * order used for the auth session.
- */
-export declare function resolveOwnerPrivateKey(): string | undefined;
-/** True when the env var is set and therefore shadows any saved file. */
-export declare function ownerKeyEnvOverrideActive(): boolean;
-/** Generate a fresh owner key, persist it, and return it. */
-export declare function generateOwnerKey(): OwnerKey;

package/lib/mcp/credentials/owner-key.js

@@ -1,58 +0,0 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
-import { join } from 'node:path';
-import { generateKeypair } from "./keypair.js";
-import { reclaimHome } from "./paths.js";
-const ENV_VAR = 'RECLAIM_AGENT_OWNER_PRIVATE_KEY';
-export function ownerKeyPath() {
-    return join(reclaimHome(), 'owner-key.json');
-}
-/** Read the saved owner key, or undefined if absent/unreadable. */
-export function readOwnerKey() {
-    const path = ownerKeyPath();
-    if (!existsSync(path)) {
-        return undefined;
-    }
-    try {
-        const k = JSON.parse(readFileSync(path, 'utf8'));
-        return k.privateKey ? k : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Persist the owner key to ~/.reclaim/owner-key.json (0600). */
-export function writeOwnerKey(key) {
-    const dir = reclaimHome();
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    chmodSync(dir, 0o700);
-    const path = ownerKeyPath();
-    writeFileSync(path, JSON.stringify(key, null, 2) + '\n', { mode: 0o600 });
-    chmodSync(path, 0o600);
-}
-/**
- * Resolve the owner private key for proof generation. Priority:
- * explicit `RECLAIM_AGENT_OWNER_PRIVATE_KEY` env var → saved
- * ~/.reclaim/owner-key.json → undefined. Mirrors the token-resolution
- * order used for the auth session.
- */
-export function resolveOwnerPrivateKey() {
-    return process.env[ENV_VAR] || readOwnerKey()?.privateKey;
-}
-/** True when the env var is set and therefore shadows any saved file. */
-export function ownerKeyEnvOverrideActive() {
-    return Boolean(process.env[ENV_VAR]);
-}
-/** Generate a fresh owner key, persist it, and return it. */
-export function generateOwnerKey() {
-    const kp = generateKeypair();
-    const key = {
-        privateKey: kp.privateKey,
-        address: kp.address,
-        publicKey: kp.publicKey,
-        createdAt: new Date().toISOString(),
-    };
-    writeOwnerKey(key);
-    return key;
-}

package/lib/mcp/credentials/paths.d.ts

@@ -1,12 +0,0 @@
-/**
- * Resolve the Reclaim cache directory (`~/.reclaim`). Honours the
- * `RECLAIM_HOME` env var as an override so tests can sandbox writes.
- */
-export declare function reclaimHome(): string;
-export declare function credentialsCachePath(): string;
-/**
- * Walk up from `start` until we find a directory containing one of
- * the project-root markers, then return that directory. Falls back
- * to `start` if no marker is found within 8 levels.
- */
-export declare function findProjectRoot(start?: string): string;

package/lib/mcp/credentials/paths.js

@@ -1,35 +0,0 @@
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-/**
- * Resolve the Reclaim cache directory (`~/.reclaim`). Honours the
- * `RECLAIM_HOME` env var as an override so tests can sandbox writes.
- */
-export function reclaimHome() {
-    return process.env.RECLAIM_HOME || join(homedir(), '.reclaim');
-}
-export function credentialsCachePath() {
-    return join(reclaimHome(), 'credentials.json');
-}
-/**
- * Walk up from `start` until we find a directory containing one of
- * the project-root markers, then return that directory. Falls back
- * to `start` if no marker is found within 8 levels.
- */
-export function findProjectRoot(start = process.cwd()) {
-    const markers = ['.git', 'package.json', 'pyproject.toml', 'Cargo.toml'];
-    let dir = resolve(start);
-    for (let i = 0; i < 8; i++) {
-        for (const m of markers) {
-            if (existsSync(join(dir, m))) {
-                return dir;
-            }
-        }
-        const parent = dirname(dir);
-        if (parent === dir) {
-            break;
-        }
-        dir = parent;
-    }
-    return start;
-}

package/lib/mcp/credentials/poll.d.ts

@@ -1,27 +0,0 @@
-import type { ReclaimClient } from '@reclaimprotocol/client';
-import type { components } from '../../types/openapi.gen.ts';
-type Session = components['schemas']['CredentialAttachSession'];
-type PollResult = {
-    outcome: 'linked';
-    token?: string;
-    orgId?: string;
-} | {
-    outcome: 'expired';
-} | {
-    outcome: 'timeout';
-    elapsed: number;
-    attachUrl: string;
-} | {
-    outcome: 'error';
-    message: string;
-};
-/**
- * Poll GET /credentials/attach/sessions/{code} until the session is
- * LINKED or we give up, whichever comes first.
- *
- * Errors inside the loop are surfaced immediately after MAX_CONSECUTIVE_ERRORS
- * rather than being silently swallowed — this is what tells the agent that
- * e.g. the confirmation POST failed or the server restarted.
- */
-export declare function pollUntilLinked(client: ReclaimClient, session: Pick<Session, 'code' | 'attachUrl' | 'expiresAt'>, onToken?: (token: string) => void): Promise<PollResult>;
-export {};

package/lib/mcp/credentials/poll.js

@@ -1,61 +0,0 @@
-// How long to poll before giving up and telling the user what to do.
-// Shorter than the 15-min server TTL on purpose — agents can't block long.
-const POLL_TIMEOUT_MS = 3 * 60_000; // 3 minutes
-const POLL_INTERVAL_MS = 5_000; // 5 seconds
-const MAX_CONSECUTIVE_ERRORS = 5;
-/**
- * Poll GET /credentials/attach/sessions/{code} until the session is
- * LINKED or we give up, whichever comes first.
- *
- * Errors inside the loop are surfaced immediately after MAX_CONSECUTIVE_ERRORS
- * rather than being silently swallowed — this is what tells the agent that
- * e.g. the confirmation POST failed or the server restarted.
- */
-export async function pollUntilLinked(client, session, onToken) {
-    const sessionExpiry = new Date(session.expiresAt).getTime();
-    const deadline = Math.min(sessionExpiry, Date.now() + POLL_TIMEOUT_MS);
-    const startedAt = Date.now();
-    let consecutiveErrors = 0;
-    while (Date.now() < deadline) {
-        await new Promise(r => setTimeout(r, POLL_INTERVAL_MS));
-        let polled;
-        try {
-            polled = await client.call('GetAttachSession', {
-                params: { code: session.code },
-                query: {}, body: {},
-            });
-            consecutiveErrors = 0;
-        }
-        catch (err) {
-            consecutiveErrors++;
-            if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
-                return {
-                    outcome: 'error',
-                    message: `Polling failed ${consecutiveErrors} times in a row: `
-                        + err.message
-                        + '. The session confirmation may have failed — try opening '
-                        + session.attachUrl
-                        + ' again and confirming, then retry.',
-                };
-            }
-            continue; // transient error, retry
-        }
-        if (polled.status === 'LINKED') {
-            const token = polled.token?.trim();
-            if (token) {
-                onToken?.(token);
-            }
-            return {
-                outcome: 'linked',
-                token,
-                orgId: polled.linkedOrgId,
-            };
-        }
-        if (polled.status === 'EXPIRED') {
-            return { outcome: 'expired' };
-        }
-        // status === 'PENDING' → keep polling
-    }
-    const elapsed = Math.round((Date.now() - startedAt) / 60_000);
-    return { outcome: 'timeout', elapsed, attachUrl: session.attachUrl };
-}

package/lib/mcp/credentials/register.d.ts

@@ -1,18 +0,0 @@
-import type { EthKeypair } from '@reclaimprotocol/client';
-import { type CachedCredential } from './cache.ts';
-import { type EnvWriteResult } from './env-file.ts';
-/** Shape returned by `persistCredentialLocally` — the fields both
- *  `issue_credentials` and `import_credentials` expose in their MCP
- *  responses. The env-file fields are present only when the credential
- *  was persisted to `.env` (`writeEnv: true`); a memory-only credential
- *  lives in the cache and omits them. */
-export type PersistedCredential = Pick<CachedCredential, 'address' | 'label'> & Partial<EnvWriteResult> & {
-    wroteEnv: boolean;
-};
-/** Local persistence step shared by `issue_credentials` and
- *  `import_credentials`. Always upserts the credentials cache; when
- *  `writeEnv` is true (default) it also writes `RECLAIM_PRIVATE_KEY` to
- *  the project `.env` (0600) and appends `.env` to `.gitignore`. Pass
- *  `writeEnv: false` to keep the credential in the cache (memory) only,
- *  without touching the project's `.env`. */
-export declare function persistCredentialLocally(keypair: EthKeypair, label: string | undefined, projectDir: string, writeEnv?: boolean): PersistedCredential;

package/lib/mcp/credentials/register.js

@@ -1,30 +0,0 @@
-import { upsertCredential } from "./cache.js";
-import { writeAppCredentialsToEnv } from "./env-file.js";
-/** Local persistence step shared by `issue_credentials` and
- *  `import_credentials`. Always upserts the credentials cache; when
- *  `writeEnv` is true (default) it also writes `RECLAIM_PRIVATE_KEY` to
- *  the project `.env` (0600) and appends `.env` to `.gitignore`. Pass
- *  `writeEnv: false` to keep the credential in the cache (memory) only,
- *  without touching the project's `.env`. */
-export function persistCredentialLocally(keypair, label, projectDir, writeEnv = true) {
-    const cached = upsertCredential({
-        address: keypair.address,
-        privateKey: keypair.privateKey,
-        label,
-        createdAt: new Date().toISOString(),
-        createdIn: projectDir,
-        projectDirs: [projectDir],
-    });
-    if (!writeEnv) {
-        return { address: cached.address, label: cached.label, wroteEnv: false };
-    }
-    const env = writeAppCredentialsToEnv(projectDir, keypair.privateKey);
-    return {
-        address: cached.address,
-        label: cached.label,
-        wroteEnv: true,
-        envPath: env.envPath,
-        gitignorePath: env.gitignorePath,
-        gitignoreAppended: env.gitignoreAppended,
-    };
-}

package/lib/mcp/credentials/resolve-owner-key.d.ts

@@ -1,12 +0,0 @@
-import { type RegisteredTool } from '../server.ts';
-/**
- * Decide which app credential `run_proof` should sign with, BEFORE
- * calling it. `run_proof` requires an `ownerAddress` and does no
- * resolution of its own — this is the single place that "checks memory,
- * env, etc and offers options".
- *
- * Checks, in order: `RECLAIM_PRIVATE_KEY` in the MCP env → the project
- * `.env` → the best cached credential for this directory. Never returns
- * the private key — only the address to pass through as `ownerAddress`.
- */
-export declare function resolveOwnerKeyTool(): RegisteredTool;