@reclaimprotocol/agent 0.1.18 → 0.1.20

package/lib/cli/args.d.ts

@@ -1,14 +0,0 @@
-export declare function parseCliArgs(argv: string[]): {
-    values: {
-        [longOption: string]: string | boolean | undefined;
-    } & {
-        'base-url'?: string | boolean | undefined;
-        token?: string | boolean | undefined;
-        param?: (string | boolean)[] | undefined;
-        query?: (string | boolean)[] | undefined;
-        body?: string | boolean | undefined;
-        help?: string | boolean | undefined;
-        version?: string | boolean | undefined;
-    };
-    positionals: string[];
-};

package/lib/cli/args.js

@@ -1,19 +0,0 @@
-import { parseArgs as nodeParseArgs } from 'node:util';
-// Placeholder. Final shape decided once the backend openapi stabilises and
-// the CLI surface is fleshed out (see AGENTS.md → "CLI").
-export function parseCliArgs(argv) {
-    return nodeParseArgs({
-        args: argv,
-        options: {
-            'base-url': { type: 'string' },
-            token: { type: 'string' },
-            param: { type: 'string', multiple: true },
-            query: { type: 'string', multiple: true },
-            body: { type: 'string' },
-            help: { type: 'boolean', short: 'h' },
-            version: { type: 'boolean', short: 'v' },
-        },
-        allowPositionals: true,
-        strict: false,
-    });
-}

package/lib/cli/commands.d.ts

@@ -1 +0,0 @@
-export declare function run(argv: string[]): Promise<void>;

package/lib/cli/commands.js

@@ -1,19 +0,0 @@
-import { notImplemented } from '@hapi/boom';
-import { DESCRIPTION, NAME, VERSION } from "../pkg.js";
-import { parseCliArgs } from "./args.js";
-// Entry point for the `reclaim` bin. Placeholder until backend openapi
-// finalises — `--version` and `--help` work; everything else throws.
-export async function run(argv) {
-    const parsed = parseCliArgs(argv);
-    if (parsed.values['version']) {
-        process.stdout.write(`${NAME} ${VERSION}\n`);
-        return;
-    }
-    if (parsed.values['help']) {
-        process.stdout.write(`${NAME} ${VERSION}\n${DESCRIPTION}\n\n` +
-            'Usage: reclaim call <OperationId> ' +
-            '[--param k=v] [--query k=v] [--body <json>]\n');
-        return;
-    }
-    throw notImplemented('reclaim CLI: pending @reclaimprotocol/app spec finalisation');
-}

package/lib/cli.d.ts

@@ -1 +0,0 @@
-export {};

package/lib/cli.js

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import { run } from "./cli/commands.js";
-import { LOGGER } from "./logger.js";
-run(process.argv.slice(2)).catch((err) => {
-    LOGGER.error({ err }, 'cli failed');
-    process.exitCode = 1;
-});

package/lib/mcp/credentials/authenticate.d.ts

@@ -1,3 +0,0 @@
-import type { ReclaimClient } from '@reclaimprotocol/client';
-import { type RegisteredTool } from '../server.ts';
-export declare function authenticateTool(client: ReclaimClient): RegisteredTool;

package/lib/mcp/credentials/authenticate.js

@@ -1,108 +0,0 @@
-import { defineTool } from "../server.js";
-import { writeSession } from "./session-cache.js";
-export function authenticateTool(client) {
-    return defineTool({
-        name: 'reclaim_authenticate',
-        description: 'Authorize the CLI / MCP to make authenticated API calls by having ' +
-            'the user sign in on the dashboard. Two steps:\n\n' +
-            'Step 1 — call with no arguments. Returns a `code` and `attachUrl`. ' +
-            'Tell the user to open the URL, sign in, and authorize.\n\n' +
-            'Step 2 — once the user says they have authorized, call again ' +
-            'with the same `code` from step 1 to check if confirmed. ' +
-            'Returns `LINKED` with a 2-day bearer token when confirmed, ' +
-            '`PENDING` if not yet, or `EXPIRED` if too long has passed.\n\n' +
-            'The token is cached in ~/.reclaim/session.json automatically.\n\n' +
-            'To then link a credential to an org (needed only to use it ' +
-            'for verification in production), use the token with the ' +
-            'generated tools: `list_orgs` → `link_credential` with the ' +
-            "credential's `address` and the target `orgId`.",
-        inputSchema: {
-            type: 'object',
-            properties: {
-                code: {
-                    type: 'string',
-                    pattern: '^[A-HJ-NP-Z2-9]{5}$',
-                    description: '5-character code from a previous step-1 call. ' +
-                        'When provided, checks whether the user has ' +
-                        'confirmed that session instead of opening a new one.',
-                },
-            },
-        },
-    }, async (args) => {
-        // Step 2: check an existing session
-        if (args.code) {
-            return checkSession(client, args.code);
-        }
-        // Step 1: open a new auth-only session
-        const sessionResult = (await client.call('CreateAttachSession'));
-        const session = sessionResult.data;
-        return {
-            status: 'PENDING',
-            code: session.code,
-            attachUrl: session.attachUrl,
-            expiresAt: session.expiresAt,
-            instructions: `Open ${session.attachUrl} in your browser, sign in, and click ` +
-                '"Authorize this device". ' +
-                'Once done, call authenticate again with code: ' +
-                `"${session.code}" to confirm.`,
-        };
-    });
-}
-async function checkSession(client, code) {
-    let session;
-    try {
-        const sessionResult = (await client.call('GetAttachSession', {
-            params: { code }
-        }));
-        session = sessionResult.data;
-    }
-    catch (err) {
-        const status = err.status;
-        if (status === 404) {
-            return {
-                status: 'NOT_FOUND',
-                hint: 'Session not found — it may have expired (15-min window). ' +
-                    'Call authenticate without a code to start a new session.',
-            };
-        }
-        throw new Error(`Failed to check session: ${err.message}`);
-    }
-    if (session.status === 'LINKED') {
-        const token = session.token?.trim();
-        if (token) {
-            writeSession({
-                token,
-                expiresAt: new Date(Date.now() + 2 * 24 * 60 * 60 * 1000).toISOString(),
-            });
-            client.setToken(token);
-            return {
-                status: 'LINKED',
-                token,
-                note: 'Token cached in ~/.reclaim/session.json and active now.',
-            };
-        }
-        return {
-            status: 'LINKED_NO_TOKEN',
-            hint: 'Session confirmed but no token issued. ' +
-                'Restart the backend (npm run dev) and try again.',
-        };
-    }
-    if (session.status === 'EXPIRED') {
-        return {
-            status: 'EXPIRED',
-            hint: 'Session expired (15-min window passed). ' +
-                'Call authenticate without a code to start a new session.',
-        };
-    }
-    // Still PENDING
-    return {
-        status: 'PENDING',
-        code: session.code,
-        attachUrl: session.attachUrl,
-        hint: 'Session is still waiting. ' +
-            `Make sure you opened ${session.attachUrl}, ` +
-            'signed in, and clicked "Authorize this device". ' +
-            `Call authenticate again with code: "${session.code}"` +
-            ' once you have done so.',
-    };
-}

package/lib/mcp/credentials/build.d.ts

@@ -1,5 +0,0 @@
-import type { ReclaimClient } from '@reclaimprotocol/client';
-import type { RegisteredTool } from '../server.ts';
-/** Credential lifecycle tools — build the flat list of RegisteredTool
- *  entries. Mirrors buildAgentTools() in mcp/register.ts. */
-export declare function buildCredentialTools(client: ReclaimClient): RegisteredTool[];

package/lib/mcp/credentials/build.js

@@ -1,18 +0,0 @@
-import { authenticateTool } from "./authenticate.js";
-import { importTool } from "./import.js";
-import { issueTool } from "./issue.js";
-import { listCachedTool } from "./list-cached.js";
-import { resolveOwnerKeyTool } from "./resolve-owner-key.js";
-import { statusTool } from "./status.js";
-/** Credential lifecycle tools — build the flat list of RegisteredTool
- *  entries. Mirrors buildAgentTools() in mcp/register.ts. */
-export function buildCredentialTools(client) {
-    return [
-        authenticateTool(client),
-        listCachedTool(),
-        resolveOwnerKeyTool(),
-        issueTool(),
-        importTool(),
-        statusTool(client),
-    ];
-}

package/lib/mcp/credentials/cache.d.ts

@@ -1,70 +0,0 @@
-export type CachedCredential = {
-    address: string;
-    privateKey: string;
-    label?: string;
-    orgId?: string;
-    createdAt: string;
-    /** Project dir where this credential was first created. */
-    createdIn: string;
-    /** All project dirs this credential has been used in ("used by"). */
-    projectDirs: string[];
-};
-type CacheFile = {
-    version: 1;
-    credentials: CachedCredential[];
-};
-/**
- * Read the cache file. Returns an empty doc if missing. Surface-level
- * shape errors fall back to empty — we'd rather lose the cache than
- * crash the CLI on a corrupted file the user can re-create.
- */
-export declare function readCache(): CacheFile;
-/**
- * Write the cache file with strict permissions. The directory gets
- * `0700` and the file `0600` — same posture as `~/.ssh`. We rewrite
- * the whole doc each save; the file is tiny and the alternative
- * (append-only) loses our ability to deduplicate `projectDirs`.
- */
-export declare function writeCache(doc: CacheFile): void;
-/**
- * Upsert a credential entry. If a row already exists for `address`,
- * we merge the new `projectDirs` into the existing list, refresh
- * mutable fields, and keep the original `createdAt` / `createdIn`
- * (backfilling `createdIn` from the new entry when an old row lacks it).
- */
-export declare function upsertCredential(entry: CachedCredential): CachedCredential;
-/** Look up a cached credential by address. Case-insensitive. */
-export declare function findCached(address: string): CachedCredential | undefined;
-export type SuggestionReason = 'createdIn' | 'usedIn' | 'newest';
-export type CredentialSuggestion = {
-    credential: CachedCredential;
-    reason: SuggestionReason;
-};
-/**
- * Pick the best cached credential for `dir`. Ranking tiers:
- *   1. created in `dir`           (reason: 'createdIn')
- *   2. previously used in `dir`   (reason: 'usedIn')
- *   3. most recently created      (reason: 'newest')
- * Within every tier, newest `createdAt` wins; address ascending is the
- * final deterministic tie-break. Returns undefined only on an empty cache.
- *
- * Pass a pre-read `creds` array to avoid a redundant `readCache()` (and to
- * rank against the same snapshot the caller already holds).
- */
-export declare function suggestCredentialForDir(dir: string, creds?: CachedCredential[]): CredentialSuggestion | undefined;
-/**
- * Resolve the private key to sign attestor proofs with (the claim
- * "owner"). Reuses the app credential rather than a dedicated key — for
- * build-time test proofs the developer is both the app and the proof
- * owner, and the owner identity is immaterial to whether the provider's
- * matching works.
- *
- * The owner is chosen up front (see the `resolve_owner_key` tool) and
- * passed by `address`; this just fetches the matching private key:
- *   - the `RECLAIM_PRIVATE_KEY` env / project `.env` key, if it derives
- *     to `address` (the dev pinned it), else
- *   - the cached credential with that address.
- * Returns undefined when no key for `address` is known.
- */
-export declare function resolveOwnerPrivateKey(address: string): string | undefined;
-export {};

package/lib/mcp/credentials/cache.js

@@ -1,131 +0,0 @@
-import { deriveFromPrivateKey } from '@reclaimprotocol/client';
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
-import { credentialsCachePath, findProjectRoot, reclaimHomeDirPath } from "../../paths.js";
-import { readPrivateKeyFromEnvFile } from "./env-file.js";
-const EMPTY = { version: 1, credentials: [] };
-/**
- * Read the cache file. Returns an empty doc if missing. Surface-level
- * shape errors fall back to empty — we'd rather lose the cache than
- * crash the CLI on a corrupted file the user can re-create.
- */
-export function readCache() {
-    const path = credentialsCachePath();
-    if (!existsSync(path)) {
-        return { ...EMPTY };
-    }
-    try {
-        const raw = readFileSync(path, 'utf8');
-        const parsed = JSON.parse(raw);
-        if (parsed.version !== 1 || !Array.isArray(parsed.credentials)) {
-            return { ...EMPTY };
-        }
-        return parsed;
-    }
-    catch {
-        return { ...EMPTY };
-    }
-}
-/**
- * Write the cache file with strict permissions. The directory gets
- * `0700` and the file `0600` — same posture as `~/.ssh`. We rewrite
- * the whole doc each save; the file is tiny and the alternative
- * (append-only) loses our ability to deduplicate `projectDirs`.
- */
-export function writeCache(doc) {
-    const dir = reclaimHomeDirPath();
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    chmodSync(dir, 0o700);
-    const path = credentialsCachePath();
-    writeFileSync(path, JSON.stringify(doc, null, 2) + '\n', { mode: 0o600 });
-    chmodSync(path, 0o600);
-}
-/**
- * Upsert a credential entry. If a row already exists for `address`,
- * we merge the new `projectDirs` into the existing list, refresh
- * mutable fields, and keep the original `createdAt` / `createdIn`
- * (backfilling `createdIn` from the new entry when an old row lacks it).
- */
-export function upsertCredential(entry) {
-    const doc = readCache();
-    const idx = doc.credentials.findIndex((c) => c.address === entry.address.toLowerCase());
-    const merged = {
-        ...entry,
-        address: entry.address.toLowerCase(),
-        projectDirs: Array.from(new Set([
-            ...(doc.credentials[idx]?.projectDirs ?? []),
-            ...entry.projectDirs,
-        ])),
-        createdAt: doc.credentials[idx]?.createdAt ?? entry.createdAt,
-        createdIn: doc.credentials[idx]?.createdIn ?? entry.createdIn,
-    };
-    if (idx >= 0) {
-        doc.credentials[idx] = merged;
-    }
-    else {
-        doc.credentials.unshift(merged);
-    }
-    writeCache(doc);
-    return merged;
-}
-/** Look up a cached credential by address. Case-insensitive. */
-export function findCached(address) {
-    const doc = readCache();
-    const lc = address.toLowerCase();
-    return doc.credentials.find((c) => c.address === lc);
-}
-/**
- * Pick the best cached credential for `dir`. Ranking tiers:
- *   1. created in `dir`           (reason: 'createdIn')
- *   2. previously used in `dir`   (reason: 'usedIn')
- *   3. most recently created      (reason: 'newest')
- * Within every tier, newest `createdAt` wins; address ascending is the
- * final deterministic tie-break. Returns undefined only on an empty cache.
- *
- * Pass a pre-read `creds` array to avoid a redundant `readCache()` (and to
- * rank against the same snapshot the caller already holds).
- */
-export function suggestCredentialForDir(dir, creds = readCache().credentials) {
-    if (creds.length === 0) {
-        return undefined;
-    }
-    const byNewest = (a, b) => {
-        return (b.createdAt ?? '').localeCompare(a.createdAt ?? '') ||
-            a.address.localeCompare(b.address);
-    };
-    const createdHere = creds.filter((c) => c.createdIn === dir).sort(byNewest);
-    if (createdHere[0]) {
-        return { credential: createdHere[0], reason: 'createdIn' };
-    }
-    const usedHere = creds
-        .filter((c) => c.projectDirs.includes(dir))
-        .sort(byNewest);
-    if (usedHere[0]) {
-        return { credential: usedHere[0], reason: 'usedIn' };
-    }
-    return { credential: [...creds].sort(byNewest)[0], reason: 'newest' };
-}
-/**
- * Resolve the private key to sign attestor proofs with (the claim
- * "owner"). Reuses the app credential rather than a dedicated key — for
- * build-time test proofs the developer is both the app and the proof
- * owner, and the owner identity is immaterial to whether the provider's
- * matching works.
- *
- * The owner is chosen up front (see the `resolve_owner_key` tool) and
- * passed by `address`; this just fetches the matching private key:
- *   - the `RECLAIM_PRIVATE_KEY` env / project `.env` key, if it derives
- *     to `address` (the dev pinned it), else
- *   - the cached credential with that address.
- * Returns undefined when no key for `address` is known.
- */
-export function resolveOwnerPrivateKey(address) {
-    const target = address.toLowerCase();
-    const envKey = process.env.RECLAIM_PRIVATE_KEY ??
-        readPrivateKeyFromEnvFile(findProjectRoot(process.cwd()));
-    if (envKey && deriveFromPrivateKey(envKey).address === target) {
-        return envKey;
-    }
-    return findCached(target)?.privateKey;
-}

package/lib/mcp/credentials/env-file.d.ts

@@ -1,25 +0,0 @@
-export type EnvWriteResult = {
-    envPath: string;
-    gitignorePath: string;
-    gitignoreAppended: boolean;
-};
-/**
- * Idempotently set `RECLAIM_PRIVATE_KEY` in the project's `.env`, then
- * `chmod 0600` it. The private key is the only secret we write — the
- * ETH address (and public key) are derived from it on demand, so there
- * is no separate address variable to keep in sync. Existing variables
- * are replaced in place; other lines are preserved verbatim so we
- * don't trample on unrelated config the user wrote by hand.
- *
- * Also appends `.env` to the project's `.gitignore` if it isn't
- * already listed.
- */
-export declare function writeAppCredentialsToEnv(projectDir: string, privateKey: string): EnvWriteResult;
-/**
- * Read `RECLAIM_PRIVATE_KEY` back out of the project's `.env`, if set.
- * Read live (not from `process.env`) so a credential written by
- * `issue_credentials` / `import_credentials` is picked up immediately,
- * without a Claude Code restart. Returns undefined when the file or the
- * variable is absent.
- */
-export declare function readPrivateKeyFromEnvFile(projectDir: string): string | undefined;

package/lib/mcp/credentials/env-file.js

@@ -1,71 +0,0 @@
-import { appendFileSync, chmodSync, existsSync, readFileSync, writeFileSync, } from 'node:fs';
-import { join } from 'node:path';
-const PRIVATE_KEY = 'RECLAIM_PRIVATE_KEY';
-const GITIGNORE_LINE = '.env';
-/**
- * Idempotently set `RECLAIM_PRIVATE_KEY` in the project's `.env`, then
- * `chmod 0600` it. The private key is the only secret we write — the
- * ETH address (and public key) are derived from it on demand, so there
- * is no separate address variable to keep in sync. Existing variables
- * are replaced in place; other lines are preserved verbatim so we
- * don't trample on unrelated config the user wrote by hand.
- *
- * Also appends `.env` to the project's `.gitignore` if it isn't
- * already listed.
- */
-export function writeAppCredentialsToEnv(projectDir, privateKey) {
-    const envPath = join(projectDir, '.env');
-    const lines = existsSync(envPath)
-        ? readFileSync(envPath, 'utf8').split('\n')
-        : [];
-    setOrInsert(lines, PRIVATE_KEY, privateKey);
-    const body = lines.join('\n').replace(/\n+$/, '') + '\n';
-    writeFileSync(envPath, body, { mode: 0o600 });
-    chmodSync(envPath, 0o600);
-    const gitignorePath = join(projectDir, '.gitignore');
-    const gitignoreAppended = ensureLine(gitignorePath, GITIGNORE_LINE);
-    return { envPath, gitignorePath, gitignoreAppended };
-}
-/**
- * Read `RECLAIM_PRIVATE_KEY` back out of the project's `.env`, if set.
- * Read live (not from `process.env`) so a credential written by
- * `issue_credentials` / `import_credentials` is picked up immediately,
- * without a Claude Code restart. Returns undefined when the file or the
- * variable is absent.
- */
-export function readPrivateKeyFromEnvFile(projectDir) {
-    const envPath = join(projectDir, '.env');
-    if (!existsSync(envPath)) {
-        return undefined;
-    }
-    const prefix = `${PRIVATE_KEY}=`;
-    const line = readFileSync(envPath, 'utf8')
-        .split('\n')
-        .find((l) => l.startsWith(prefix));
-    const value = line?.slice(prefix.length).trim();
-    return value || undefined;
-}
-function setOrInsert(lines, key, value) {
-    const prefix = `${key}=`;
-    const idx = lines.findIndex((l) => l.startsWith(prefix));
-    const next = `${key}=${value}`;
-    if (idx >= 0) {
-        lines[idx] = next;
-        return;
-    }
-    lines.push(next);
-}
-function ensureLine(path, line) {
-    if (!existsSync(path)) {
-        writeFileSync(path, line + '\n', { mode: 0o644 });
-        return true;
-    }
-    const body = readFileSync(path, 'utf8');
-    const present = body.split('\n').some((l) => l.trim() === line);
-    if (present) {
-        return false;
-    }
-    const suffix = body.endsWith('\n') ? '' : '\n';
-    appendFileSync(path, suffix + line + '\n');
-    return true;
-}

package/lib/mcp/credentials/import.d.ts

@@ -1,2 +0,0 @@
-import { type RegisteredTool } from '../server.ts';
-export declare function importTool(): RegisteredTool;

package/lib/mcp/credentials/import.js

@@ -1,52 +0,0 @@
-import { deriveFromPrivateKey } from '@reclaimprotocol/client';
-import { findProjectRoot } from "../../paths.js";
-import { defineTool } from "../server.js";
-import { persistCredentialLocally } from "./register.js";
-export function importTool() {
-    return defineTool({
-        name: 'import_credentials',
-        description: 'Import an existing Reclaim app credential the user ' +
-            'already holds elsewhere. Provide the private key ' +
-            '(0x-prefixed hex, 64 chars); we derive the address ' +
-            'locally and cache it. By default also writes ' +
-            'RECLAIM_PRIVATE_KEY to the project .env (0600) and appends ' +
-            '.env to .gitignore; pass `writeEnv: false` to keep it in ' +
-            'the local cache (memory) only and leave .env untouched. ' +
-            'ALWAYS ask the dev whether to save to .env before writing. ' +
-            'The credential stays local-only (SANDBOX); link it to an ' +
-            'org to use it in production.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                privateKey: {
-                    type: 'string',
-                    pattern: '^0x[0-9a-fA-F]{64}$',
-                    description: '0x-prefixed hex private key (64 hex chars / 32 bytes).',
-                },
-                label: {
-                    type: 'string',
-                    minLength: 1,
-                    maxLength: 100,
-                },
-                projectDir: {
-                    type: 'string',
-                    description: 'Project directory to write .env into. Defaults ' +
-                        'to the closest ancestor of cwd containing ' +
-                        '.git or package.json.',
-                },
-                writeEnv: {
-                    type: 'boolean',
-                    description: 'Write RECLAIM_PRIVATE_KEY to the project .env ' +
-                        '(default true). Set false to cache in memory only, ' +
-                        'without touching .env.',
-                },
-            },
-            required: ['privateKey'],
-        },
-    }, async (args) => {
-        const keypair = deriveFromPrivateKey(args.privateKey);
-        const projectDir = findProjectRoot(args.projectDir || process.cwd());
-        const persisted = persistCredentialLocally(keypair, args.label, projectDir, args.writeEnv ?? true);
-        return { ...persisted };
-    });
-}

package/lib/mcp/credentials/issue.d.ts

@@ -1,2 +0,0 @@
-import { type RegisteredTool } from '../server.ts';
-export declare function issueTool(): RegisteredTool;

package/lib/mcp/credentials/issue.js

@@ -1,84 +0,0 @@
-import { generateKeypair } from '@reclaimprotocol/client';
-import { findProjectRoot } from "../../paths.js";
-import { defineTool } from "../server.js";
-import { findCached } from "./cache.js";
-import { persistCredentialLocally } from "./register.js";
-export function issueTool() {
-    return defineTool({
-        name: 'issue_credentials',
-        description: 'Mint a fresh anonymous Reclaim app key-pair (or reuse ' +
-            'a cached one via `reuseCachedAppPk`) and cache it locally. ' +
-            'By default also writes RECLAIM_PRIVATE_KEY to the project ' +
-            '.env (mode 0600) and appends .env to .gitignore; pass ' +
-            '`writeEnv: false` to keep it in the local cache (memory) ' +
-            'only and leave .env untouched. ALWAYS ask the dev whether ' +
-            'to save to .env before writing it. The key-pair is ' +
-            'generated locally and is NOT registered with the server — ' +
-            'anonymous credentials operate in SANDBOX mode entirely ' +
-            'client-side. PREFER REUSE over generating a new credential ' +
-            'unless the user explicitly asks for a new app identity. To ' +
-            'use a credential for verification in production, link it to ' +
-            'an organization (via link_credential) and add billing.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                reuseCachedAppPk: {
-                    type: 'string',
-                    pattern: '^0x[0-9a-fA-F]{40}$',
-                    description: 'Lowercase ETH address of a cached credential ' +
-                        'to reuse instead of minting a new one.',
-                },
-                label: {
-                    type: 'string',
-                    minLength: 1,
-                    maxLength: 100,
-                    description: 'Human label stored in the local cache.',
-                },
-                projectDir: {
-                    type: 'string',
-                    description: 'Project directory to write .env into. Defaults ' +
-                        'to the closest ancestor of cwd containing ' +
-                        '.git or package.json.',
-                },
-                writeEnv: {
-                    type: 'boolean',
-                    description: 'Write RECLAIM_PRIVATE_KEY to the project .env ' +
-                        '(default true). Set false to cache the credential ' +
-                        'in memory only, without touching .env.',
-                },
-            },
-        },
-    }, async (args) => {
-        const projectDir = findProjectRoot(args.projectDir || process.cwd());
-        let keypair;
-        let reused = false;
-        if (args.reuseCachedAppPk) {
-            const cached = findCached(args.reuseCachedAppPk);
-            if (!cached) {
-                throw new Error(`No cached credential for ${args.reuseCachedAppPk}. ` +
-                    'Call list_cached_credentials first.');
-            }
-            keypair = {
-                address: cached.address,
-                privateKey: cached.privateKey,
-            };
-            reused = true;
-        }
-        else {
-            keypair = generateKeypair();
-        }
-        const writeEnv = args.writeEnv ?? true;
-        const persisted = persistCredentialLocally(keypair, args.label, projectDir, writeEnv);
-        return {
-            reused,
-            ...persisted,
-            note: writeEnv
-                ? 'Private key written to .env (and the local cache); it is ' +
-                    'NOT in this response on purpose. The credential is ' +
-                    'local-only (SANDBOX); link it to an org for production.'
-                : 'Private key cached in memory only (.env untouched). Sign ' +
-                    'proofs with it by passing run_proof({ ownerAddress }). The ' +
-                    'credential is local-only (SANDBOX).',
-        };
-    });
-}