@reclaimprotocol/agent 0.1.2 → 0.1.4

package/README.md

@@ -111,13 +111,13 @@ Defaults target the production old-devtools backend, so **no env is needed for t
 
 See [Backends](#backends) for builder mode (`USE_OLD_DEVTOOLS=false`) and the full env-var list.
 
-### Companion skill (optional, recommended)
+### Provider-authoring guide
 
-The MCP server is all you need to start — but installing the companion skill makes the agent markedly better at the capture → prove → publish flow (login detection, choosing auth-bound endpoints, OPRF decisions, troubleshooting). See [Skill](#skill) for install steps.
+The MCP server is all you need — it ships a `how_it_works` tool that returns the full capture → prove → publish guide (login detection, choosing auth-bound endpoints, OPRF decisions, troubleshooting). Any MCP client can call it on demand; there's nothing extra to install.
 
 ## Using it from your agent
 
-Optional but recommended: install the [skill](#skill) so the agent follows the full authoring flow.
+Tip: have your agent call the `how_it_works` tool first so it follows the full authoring flow.
 
 Then just ask in plain language, e.g.:
 
@@ -138,28 +138,9 @@ The agent orchestrates the tools for you:
 
 Your only manual steps are signing in when the browser windows open and confirming the value you want to prove.
 
-## Skill
+## How it works (guide tool)
 
-Optional but recommended. The companion skill (`skill/SKILL.md`) is a Claude Code **Agent Skill** that teaches the agent the full mode-aware authoring flow — it ships inside the npm package and is also in this repo.
-
-```bash
-# macOS / Linux — from a global install of the package
-npm i -g @reclaimprotocol/agent
-mkdir -p ~/.claude/skills/reclaim-provider
-cp "$(npm root -g)/@reclaimprotocol/agent/skill/SKILL.md" ~/.claude/skills/reclaim-provider/SKILL.md
-
-# …or from a checkout of this repo
-cp packages/agent/skill/SKILL.md ~/.claude/skills/reclaim-provider/SKILL.md
-```
-
-```powershell
-# Windows (PowerShell) — from a global install
-npm i -g @reclaimprotocol/agent
-New-Item -ItemType Directory -Force $env:USERPROFILE\.claude\skills\reclaim-provider | Out-Null
-Copy-Item "$(npm root -g)\@reclaimprotocol\agent\skill\SKILL.md" $env:USERPROFILE\.claude\skills\reclaim-provider\SKILL.md
-```
-
-Claude Code auto-loads it once it's in `~/.claude/skills/`. **Other MCP clients** (Cursor, opencode, Antigravity, …) don't read `SKILL.md` automatically — the server's built-in instructions already cover the essentials, and you can paste or adapt the skill's content into that client's rules / system-prompt for the same depth.
+The full, mode-aware authoring guide (`skill/SKILL.md`) is served on demand by the **`how_it_works`** MCP tool — call it from any MCP client (Claude Code, Cursor, opencode, Antigravity, …) to get the deep capture → prove → publish workflow, decision frameworks, and troubleshooting. The server's always-on `instructions` cover the essentials; `how_it_works` is the in-depth version, with nothing to install.
 
 ## Provider-authoring tools
 
@@ -285,18 +266,6 @@ claude mcp add reclaim -- node "$(pwd)/packages/agent/lib/mcp-bin.js"
 
 To target a specific backend while developing, add an `env` block (Claude Code / `.mcp.json`) or `environment` (opencode) — e.g. `"USE_OLD_DEVTOOLS": "false"` for builder mode. See [Backends](#backends).
 
-### Skill
-
-Symlink the source `skill/` folder into `~/.claude/skills/` so edits to `SKILL.md` are picked up live (no re-copy):
-
-```bash
-# macOS / Linux — from the repo root
-ln -s "$(pwd)/packages/agent/skill" ~/.claude/skills/reclaim-provider
-```
-
-```powershell
-# Windows (PowerShell, Developer Mode or elevated) — from the repo root
-New-Item -ItemType SymbolicLink -Path $env:USERPROFILE\.claude\skills\reclaim-provider -Target (Resolve-Path packages\agent\skill)
-```
+### Authoring guide
 
-Claude Code auto-loads it once linked. opencode doesn't read `SKILL.md` automatically — paste or adapt its content into that client's rules / system-prompt for the same depth.
+`skill/SKILL.builder.md` and `skill/SKILL.old.md` are the sources the `how_it_works` tool serves — one per backend, so an agent is never shown tools its mode doesn't have. The server picks by `USE_OLD_DEVTOOLS`. Edit the relevant file and rebuild (`npm run build`) to update what the tool returns.

package/lib/cdp/capture-engine.d.ts

@@ -30,6 +30,13 @@ export interface ResponseReceivedLike {
  *  `:`. Stripping at capture time keeps every downstream consumer
  *  (`get_request`, draft, replay, proof) clean by construction. */
 export declare function stripPseudoHeaders(headers: Record<string, string>): Record<string, string>;
+/** True when the URL's path names a static asset (by file extension; query and
+ *  hash are ignored, so `chunk.js?v=1` still counts). The capture engine drops
+ *  these up front — they never carry JSON/HTML a recipe matches. */
+export declare function isStaticAsset(url: string): boolean;
+/** True when a response Content-Type is a static asset (scripts/styles/fonts/
+ *  images/media). Parameters (`; charset=…`) and case are ignored. */
+export declare function isStaticAssetMime(mimeType: string | undefined): boolean;
 export interface CaptureSession {
     captureId: string;
     requests: Map<string, CapturedRequest>;

package/lib/cdp/capture-engine.js

@@ -25,6 +25,64 @@ export function stripPseudoHeaders(headers) {
     }
     return out;
 }
+/** Extensions for static assets we never prove over — scripts, styles, fonts,
+ *  images, media, source maps. A real page pulls hundreds of these; tracking
+ *  them (and fetching their bodies) just bloats the request map and body store
+ *  with traffic no recipe ever matches. Note: `.json` is deliberately absent —
+ *  that's the API shape recipes care about. */
+const STATIC_ASSET_EXTENSIONS = new Set([
+    'js', 'mjs', 'cjs', 'css', 'map',
+    'png', 'jpg', 'jpeg', 'gif', 'svg', 'webp', 'avif', 'ico', 'bmp',
+    'woff', 'woff2', 'ttf', 'otf', 'eot',
+    'mp4', 'webm', 'mp3', 'ogg', 'wav',
+]);
+/** True when the URL's path names a static asset (by file extension; query and
+ *  hash are ignored, so `chunk.js?v=1` still counts). The capture engine drops
+ *  these up front — they never carry JSON/HTML a recipe matches. */
+export function isStaticAsset(url) {
+    let path;
+    try {
+        path = new URL(url).pathname;
+    }
+    catch {
+        path = url.split(/[?#]/)[0] ?? url;
+    }
+    // Extension of the last path segment only, so `/v1.2/data` isn't misread.
+    const base = path.slice(path.lastIndexOf('/') + 1);
+    const dot = base.lastIndexOf('.');
+    if (dot <= 0) {
+        return false;
+    }
+    return STATIC_ASSET_EXTENSIONS.has(base.slice(dot + 1).toLowerCase());
+}
+/** Response Content-Types for static assets. The URL-extension filter misses
+ *  extension-less bundler/CDN URLs (e.g. `/assets/3b8f1c`), so we also drop by
+ *  MIME at response time. `text/html`, `application/json`, and `text/plain`
+ *  are NOT here — those are the document/API shapes recipes match. */
+const STATIC_ASSET_MIME_EXACT = new Set([
+    'text/css',
+    'application/javascript', 'text/javascript', 'application/x-javascript',
+    'application/ecmascript', 'text/ecmascript',
+    'application/wasm',
+    'application/font-woff', 'application/font-woff2',
+    'application/vnd.ms-fontobject', 'application/x-font-ttf',
+]);
+const STATIC_ASSET_MIME_PREFIXES = ['image/', 'font/', 'audio/', 'video/'];
+/** True when a response Content-Type is a static asset (scripts/styles/fonts/
+ *  images/media). Parameters (`; charset=…`) and case are ignored. */
+export function isStaticAssetMime(mimeType) {
+    if (!mimeType) {
+        return false;
+    }
+    const m = mimeType.toLowerCase().split(';')[0].trim();
+    if (!m) {
+        return false;
+    }
+    if (STATIC_ASSET_MIME_PREFIXES.some((p) => m.startsWith(p))) {
+        return true;
+    }
+    return STATIC_ASSET_MIME_EXACT.has(m);
+}
 export function createCaptureEngine(opts) {
     const captureId = randomUUID();
     const requests = new Map();
@@ -79,6 +137,13 @@ export function createCaptureEngine(opts) {
         pendingResponseExtra.set(requestId, { ...buffered, ...clean });
     }
     function onRequestWillBeSent(p) {
+        // Static assets never match a recipe — never track them (so we don't
+        // fetch their bodies or grow the store). Drop any extra-info that raced
+        // ahead of this event so it can't linger.
+        if (isStaticAsset(p.request.url)) {
+            pendingRequestExtra.delete(p.requestId);
+            return;
+        }
         const f = {
             requestId: p.requestId,
             method: p.request.method,
@@ -100,6 +165,19 @@ export function createCaptureEngine(opts) {
     function onResponseReceived(p) {
         const f = inFlight.get(p.requestId);
         if (!f) {
+            // No in-flight entry → the request was skipped (e.g. a static asset)
+            // or never seen. Discard any buffered response extra-info so a skipped
+            // asset can't leave a dangling entry.
+            pendingResponseExtra.delete(p.requestId);
+            return;
+        }
+        // Second-line asset filter by Content-Type: catches extension-less
+        // bundler/CDN URLs the request-time URL filter can't. Forget the
+        // in-flight entry so it never reaches `requests` and a later
+        // loadingFinished/extra-info for it becomes a no-op.
+        if (isStaticAssetMime(p.response.mimeType)) {
+            inFlight.delete(p.requestId);
+            pendingResponseExtra.delete(p.requestId);
             return;
         }
         const captured = {

package/lib/cdp/capture.d.ts

@@ -6,6 +6,6 @@
  */
 import type CDP from 'chrome-remote-interface';
 import { type CaptureSession, type StartCaptureOptions } from './capture-engine.ts';
-export { stripPseudoHeaders } from './capture-engine.ts';
+export { isStaticAsset, isStaticAssetMime, stripPseudoHeaders, } from './capture-engine.ts';
 export type { CaptureSession, StartCaptureOptions } from './capture-engine.ts';
 export declare function startCapture(tab: CDP.Client, opts?: StartCaptureOptions): Promise<CaptureSession>;

package/lib/cdp/capture.js

@@ -1,5 +1,5 @@
 import { createCaptureEngine, } from "./capture-engine.js";
-export { stripPseudoHeaders } from "./capture-engine.js";
+export { isStaticAsset, isStaticAssetMime, stripPseudoHeaders, } from "./capture-engine.js";
 export async function startCapture(tab, opts = {}) {
     const engine = createCaptureEngine({
         ...(opts.maxBodyBytes !== undefined && { maxBodyBytes: opts.maxBodyBytes }),

package/lib/consts.d.ts

@@ -16,12 +16,12 @@
  * Each var's default/fallback literal is co-located with its getter.
  */
 import { DEFAULT_BASE_URL } from '@reclaimprotocol/client';
-import { DEFAULT_OLD_API_URL } from './old/client.ts';
+import { DEFAULT_OLD_API_URL, DEFAULT_OLD_LOGS_URL } from './old/client.ts';
 /** Public attestor websocket URL — fallback for `RECLAIM_ATTESTOR_URL`. */
 export declare const FALLBACK_ATTESTOR_URL = "wss://attestor.reclaimprotocol.org:444/ws";
 /** The devtools dashboard login page — fallback for `RECLAIM_OLD_LOGIN_URL`. */
 export declare const DEFAULT_LOGIN_URL = "https://dev.reclaimprotocol.org";
-export { DEFAULT_BASE_URL, DEFAULT_OLD_API_URL };
+export { DEFAULT_BASE_URL, DEFAULT_OLD_API_URL, DEFAULT_OLD_LOGS_URL };
 /** Pino log level. Read once at logger construction, so an eager const is
  *  safe (no test mutates LOG_LEVEL at runtime). */
 export declare const LOG_LEVEL: string;
@@ -45,6 +45,8 @@ export declare function chromePath(): string | undefined;
 export declare function agentDisabled(): boolean;
 /** Old-devtools backend base URL. */
 export declare function oldApiUrl(): string;
+/** Old-devtools analytics-logs service base URL (separate host). */
+export declare function oldLogsUrl(): string;
 /** Builder backend base URL. Shared by mcp/start and the verification tool. */
 export declare function apiUrl(): string;
 /** Explicit builder API token (overrides the cached session token). */

package/lib/consts.js

@@ -18,7 +18,7 @@
 import { DEFAULT_BASE_URL } from '@reclaimprotocol/client';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { DEFAULT_OLD_API_URL } from "./old/client.js";
+import { DEFAULT_OLD_API_URL, DEFAULT_OLD_LOGS_URL } from "./old/client.js";
 // ---------------------------------------------------------------------------
 // Default / fallback literals (used only as env fallbacks).
 // ---------------------------------------------------------------------------
@@ -28,7 +28,7 @@ export const FALLBACK_ATTESTOR_URL = 'wss://attestor.reclaimprotocol.org:444/ws'
 export const DEFAULT_LOGIN_URL = 'https://dev.reclaimprotocol.org';
 // Re-export the two non-env-fallback defaults so callers can keep importing
 // their URL defaults from a single place if they wish.
-export { DEFAULT_BASE_URL, DEFAULT_OLD_API_URL };
+export { DEFAULT_BASE_URL, DEFAULT_OLD_API_URL, DEFAULT_OLD_LOGS_URL };
 // ---------------------------------------------------------------------------
 // Logging.
 // ---------------------------------------------------------------------------
@@ -79,6 +79,10 @@ export function agentDisabled() {
 export function oldApiUrl() {
     return process.env.RECLAIM_OLD_API_URL || DEFAULT_OLD_API_URL;
 }
+/** Old-devtools analytics-logs service base URL (separate host). */
+export function oldLogsUrl() {
+    return process.env.RECLAIM_OLD_LOGS_URL || DEFAULT_OLD_LOGS_URL;
+}
 /** Builder backend base URL. Shared by mcp/start and the verification tool. */
 export function apiUrl() {
     return process.env.RECLAIM_API_URL || DEFAULT_BASE_URL;

package/lib/mcp/api/operations.gen.d.ts

@@ -75,6 +75,14 @@ export declare const MCP_TOOLS: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
     };
+    DiscoverDataPoints: {
+        description: string;
+        inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
+    };
+    DiscoverResolve: {
+        description: string;
+        inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
+    };
     GetAttachSession: {
         description: string;
         inputSchema: import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;

package/lib/mcp/api/operations.gen.js

@@ -1421,6 +1421,98 @@ export const MCP_TOOLS = {
             "additionalProperties": false
         }),
     },
+    "DiscoverDataPoints": {
+        description: "List the verifiable data points on a website\n\nThe data points existing providers can prove on a website — the menu to pick from before `GET /discover/resolve`. Optionally filter by `q`.",
+        inputSchema: toZod({
+            "type": "object",
+            "properties": {
+                "params": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "query": {
+                    "type": "object",
+                    "properties": {
+                        "domain": {
+                            "type": "string",
+                            "format": "hostname",
+                            "minLength": 1,
+                            "maxLength": 200
+                        },
+                        "q": {
+                            "type": "string",
+                            "maxLength": 200
+                        }
+                    },
+                    "required": [
+                        "domain"
+                    ],
+                    "additionalProperties": false
+                },
+                "body": {
+                    "type": "object"
+                }
+            },
+            "required": [
+                "params",
+                "query"
+            ],
+            "additionalProperties": false
+        }),
+    },
+    "DiscoverResolve": {
+        description: "Resolve a website + data points to verification providers\n\nProvider resolution: given a website and the data points the user wants their users to prove, return the smallest set of existing providers whose data points COVER the selection (greedy combine), the `requiredContext` inputs the consumer must supply, and any `uncovered` points no provider exposes yet (`needsCreation` is true then — author a provider with the agent tools). When the chosen providers can be fused into one (same start page, no clashing page scripts) `merge.mergeable` is true.\n\nAgent flow: pick a website (`GET /discover/data-points` lists what's verifiable there), confirm the data points with the user, call this to get the `providers` + `requiredContext`, collect those context values from the user, then `POST /verifications/sessions` with `providers` (pass every id) and `context` to mint a verification.",
+        inputSchema: toZod({
+            "type": "object",
+            "properties": {
+                "params": {
+                    "type": "object",
+                    "properties": {}
+                },
+                "query": {
+                    "type": "object",
+                    "properties": {
+                        "domain": {
+                            "type": "string",
+                            "format": "hostname",
+                            "minLength": 1,
+                            "maxLength": 200
+                        },
+                        "dataPoints": {
+                            "type": "array",
+                            "minItems": 1,
+                            "maxItems": 200,
+                            "items": {
+                                "type": "string",
+                                "minLength": 1,
+                                "maxLength": 200
+                            }
+                        },
+                        "mode": {
+                            "type": "string",
+                            "enum": [
+                                "combine",
+                                "ai"
+                            ]
+                        }
+                    },
+                    "required": [
+                        "domain",
+                        "dataPoints"
+                    ],
+                    "additionalProperties": false
+                },
+                "body": {
+                    "type": "object"
+                }
+            },
+            "required": [
+                "params",
+                "query"
+            ],
+            "additionalProperties": false
+        }),
+    },
     "GetAttachSession": {
         description: "Poll a pairing session\n\nAnonymous poll endpoint used by the CLI / MCP while it waits for the human to complete the dashboard step. Once `status` is `LINKED`, the response includes a `token` (2-day bearer token) the CLI / MCP can use for authenticated API calls. Expired or unknown codes return `404`.",
         inputSchema: toZod({

package/lib/mcp/instructions.d.ts

@@ -1 +1,3 @@
 export declare const BUILDER_MODE_INSTRUCTIONS: string;
+export declare const PROVIDER_GUIDE_BUILDER: string;
+export declare const PROVIDER_GUIDE_OLD: string;

package/lib/mcp/instructions.js

@@ -9,3 +9,19 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 export const BUILDER_MODE_INSTRUCTIONS = readFileSync(fileURLToPath(new URL('../../skill/builder-mode.md', import.meta.url)), 'utf8').trim();
+/**
+ * The full provider-authoring guide — the deep capture→prove→publish workflow,
+ * decision frameworks, and troubleshooting. Served on demand by the
+ * `how_it_works` MCP tool so every client (not just Claude Code, which
+ * auto-loads skills) can pull it. There's a guide PER MODE so an agent is never
+ * shown auth/publish tools that don't exist in its backend: the server picks
+ * one by `oldMode` (see `mcp/start.ts`). Same `../../skill/` path resolution as
+ * the instructions above; any leading frontmatter is stripped defensively.
+ */
+function readGuide(file) {
+    return readFileSync(fileURLToPath(new URL(file, import.meta.url)), 'utf8')
+        .replace(/^---\n[\s\S]*?\n---\n/, '')
+        .trim();
+}
+export const PROVIDER_GUIDE_BUILDER = readGuide('../../skill/SKILL.builder.md');
+export const PROVIDER_GUIDE_OLD = readGuide('../../skill/SKILL.old.md');

package/lib/mcp/start.js

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ReclaimClient } from '@reclaimprotocol/client';
-import { agentDisabled, apiToken, apiUrl, oldApiUrl, useOldDevtools, } from "../consts.js";
+import { agentDisabled, apiToken, apiUrl, oldApiUrl, oldLogsUrl, useOldDevtools, } from "../consts.js";
 import { ReclaimOldClient } from "../old/client.js";
 import { resolveInitialIdentity } from "../old/identity.js";
 import { OLD_MODE_INSTRUCTIONS } from "../old/instructions.js";
@@ -30,6 +30,7 @@ export async function startMcpServer() {
         // get_me_providers instead.
         const oldClient = new ReclaimOldClient({
             baseUrl: oldApiUrl(),
+            logsBaseUrl: oldLogsUrl(),
             identity: resolveInitialIdentity(),
         });
         registerToolList(server, buildLocalCredentialTools());

package/lib/mcp/tools/agent/build.js

@@ -14,6 +14,7 @@ import { attachTool } from "./attach.js";
 import { captureTools } from "./capture.js";
 import { browserTools } from "./eval.js";
 import { findTool } from "./find.js";
+import { howItWorksTool } from "./how-it-works.js";
 import { proofTool } from "./proof.js";
 import { makeSecretStore, proposeTool, } from "./propose.js";
 import { createVersionFromCaptureTool } from "./publish.js";
@@ -35,6 +36,9 @@ export function buildAgentTools(client) {
     const state = buildAgentState();
     ensureAttestorCrypto();
     const tools = [];
+    // Stateless docs tool — serve the mode-specific authoring guide to any
+    // client. No `client` ⇒ old-devtools mode (see `mcp/start.ts`).
+    tools.push(howItWorksTool(!client));
     tools.push(attachTool(state.attach));
     for (const t of captureTools(state.attach, state.captures)) {
         tools.push(t);

package/lib/mcp/tools/agent/how-it-works.d.ts

@@ -0,0 +1,11 @@
+import { type RegisteredTool } from '../../server.ts';
+/**
+ * Serves the full provider-authoring guide on demand. The MCP server's
+ * always-on `instructions` are a terse tool-flow reference; this tool returns
+ * the deep version (workflow, decision frameworks, gotchas, "never do" rules)
+ * so any MCP client — not just Claude Code, which alone auto-loads skills — can
+ * pull it. `oldMode` selects the backend-specific guide so the agent is never
+ * told to call auth/publish tools that aren't registered in its mode.
+ * Stateless: callable before `attach_chrome`.
+ */
+export declare function howItWorksTool(oldMode: boolean): RegisteredTool;

package/lib/mcp/tools/agent/how-it-works.js

@@ -0,0 +1,24 @@
+import { PROVIDER_GUIDE_BUILDER, PROVIDER_GUIDE_OLD, } from "../../instructions.js";
+import { defineTool } from "../../server.js";
+/**
+ * Serves the full provider-authoring guide on demand. The MCP server's
+ * always-on `instructions` are a terse tool-flow reference; this tool returns
+ * the deep version (workflow, decision frameworks, gotchas, "never do" rules)
+ * so any MCP client — not just Claude Code, which alone auto-loads skills — can
+ * pull it. `oldMode` selects the backend-specific guide so the agent is never
+ * told to call auth/publish tools that aren't registered in its mode.
+ * Stateless: callable before `attach_chrome`.
+ */
+export function howItWorksTool(oldMode) {
+    const guide = oldMode ? PROVIDER_GUIDE_OLD : PROVIDER_GUIDE_BUILDER;
+    return defineTool({
+        name: 'how_it_works',
+        description: 'Return the full Reclaim provider-authoring guide for THIS server: '
+            + 'the capture → draft → replay → prove → publish workflow, decision '
+            + 'frameworks (login detection, OPRF privacy, context vs bare params), '
+            + 'multi-request handling, troubleshooting, and what never to do. '
+            + 'Call this BEFORE building a provider unless you are already '
+            + 'fluent in the flow.',
+        inputSchema: { type: 'object', properties: {} },
+    }, async () => ({ guide }));
+}

package/lib/old/client.d.ts

@@ -2,6 +2,9 @@
  *  `/api` route prefix itself, so this is the bare origin. Override with
  *  `RECLAIM_OLD_API_URL`. */
 export declare const DEFAULT_OLD_API_URL = "https://devapi.reclaimprotocol.org";
+/** Default origin of the OLD-devtools analytics-logs service — a SEPARATE host
+ *  from the devtools API. Override with `RECLAIM_OLD_LOGS_URL`. */
+export declare const DEFAULT_OLD_LOGS_URL = "https://logs.reclaimprotocol.org";
 /**
  * Externally-supplied caller identity. We do NOT mint these — the dev
  * provides one:
@@ -53,8 +56,10 @@ export interface MyProvidersQuery {
 export declare class ReclaimOldClient {
     #private;
     readonly baseUrl: string;
+    readonly logsBaseUrl: string;
     constructor(opts?: {
         baseUrl?: string;
+        logsBaseUrl?: string;
         identity?: OldIdentity;
         fetch?: typeof fetch;
     });
@@ -66,5 +71,10 @@ export declare class ReclaimOldClient {
     registerProvider(body: RegisterProviderBody): Promise<unknown>;
     updateProviderConfig(providerId: string, body: UpdateProviderConfigBody): Promise<unknown>;
     listVersions(providerId: string): Promise<unknown>;
+    /** Analytics logs for a verification session, from the logs service (a
+     *  DIFFERENT host than the devtools API — hence its own fetch, not
+     *  `#request`). Attaches the caller identity when one is set; queried
+     *  anonymously otherwise. */
+    getSessionAnalyticsLogs(sessionId: string): Promise<unknown>;
     getMyProviders(query?: MyProvidersQuery): Promise<unknown>;
 }

package/lib/old/client.js

@@ -4,6 +4,9 @@ import { NAME, VERSION } from "../pkg.js";
  *  `/api` route prefix itself, so this is the bare origin. Override with
  *  `RECLAIM_OLD_API_URL`. */
 export const DEFAULT_OLD_API_URL = 'https://devapi.reclaimprotocol.org';
+/** Default origin of the OLD-devtools analytics-logs service — a SEPARATE host
+ *  from the devtools API. Override with `RECLAIM_OLD_LOGS_URL`. */
+export const DEFAULT_OLD_LOGS_URL = 'https://logs.reclaimprotocol.org';
 /**
  * Minimal REST client for the OLD devtools Express backend (base `/api`).
  * Deliberately NOT a clone of `@reclaimprotocol/client`'s operationId
@@ -16,10 +19,13 @@ export const DEFAULT_OLD_API_URL = 'https://devapi.reclaimprotocol.org';
  */
 export class ReclaimOldClient {
     baseUrl;
+    logsBaseUrl;
     #identity;
     #fetch;
     constructor(opts = {}) {
         this.baseUrl = (opts.baseUrl || DEFAULT_OLD_API_URL).replace(/\/+$/, '');
+        this.logsBaseUrl = (opts.logsBaseUrl || DEFAULT_OLD_LOGS_URL)
+            .replace(/\/+$/, '');
         this.#identity = opts.identity;
         this.#fetch = opts.fetch ?? fetch;
     }
@@ -43,6 +49,27 @@ export class ReclaimOldClient {
     listVersions(providerId) {
         return this.#request('GET', `/providers/${encodeURIComponent(providerId)}/versions`, { auth: true });
     }
+    /** Analytics logs for a verification session, from the logs service (a
+     *  DIFFERENT host than the devtools API — hence its own fetch, not
+     *  `#request`). Attaches the caller identity when one is set; queried
+     *  anonymously otherwise. */
+    async getSessionAnalyticsLogs(sessionId) {
+        const url = `${this.logsBaseUrl}/api/analytics-logs/session/`
+            + encodeURIComponent(sessionId);
+        const headers = {
+            Accept: 'application/json',
+            'User-Agent': `${NAME}/${VERSION}`,
+        };
+        if (this.#identity) {
+            headers[this.#authHeaderName()] = this.#authHeaderValue();
+        }
+        const res = await this.#fetch(url, { method: 'GET', headers });
+        const json = await this.#parseBody(res);
+        if (!res.ok) {
+            throw this.#asBoom(res, json);
+        }
+        return json;
+    }
     getMyProviders(query = {}) {
         // Every one of these query params is REQUIRED by the backend
         // validator (missing/invalid → 400), so default them all here.

package/lib/old/to-register.d.ts

@@ -23,12 +23,14 @@ export interface OldProviderOpts {
     useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
 }
-/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
-export declare function providerToRegisterBody(provider: ReclaimProvider, opts: OldProviderOpts): RegisterProviderBody;
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
+ *  drafted request becomes a `requestData` entry; provider-level fields (name)
+ *  come from the first draft. */
+export declare function providerToRegisterBody(providers: ReclaimProvider[], opts: OldProviderOpts): RegisterProviderBody;
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
-export declare function providerToConfigBody(provider: ReclaimProvider, opts: OldProviderOpts, version: string, versionInfo: string): UpdateProviderConfigBody;
+export declare function providerToConfigBody(providers: ReclaimProvider[], opts: OldProviderOpts, version: string, versionInfo: string): UpdateProviderConfigBody;
 /** Minimal version triplet as the old backend stores it. */
 export interface SemverTriplet {
     major: number;

package/lib/old/to-register.js

@@ -72,16 +72,24 @@ function requestDataFromProvider(provider) {
     // it ourselves would risk drifting from the server's own extraction.
     return requestData;
 }
-/** Body for `POST /api/providers/register` — new provider + v1.0.0. */
-export function providerToRegisterBody(provider, opts) {
+/** One `requestData` entry per drafted provider. A multi-request provider
+ *  becomes parallel entries that the old backend runs together at verification
+ *  (the same way the builder version carries multiple `requests`). */
+function requestDataFrom(providers) {
+    return providers.map(requestDataFromProvider);
+}
+/** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
+ *  drafted request becomes a `requestData` entry; provider-level fields (name)
+ *  come from the first draft. */
+export function providerToRegisterBody(providers, opts) {
     const body = {
-        name: provider.name,
+        name: providers[0].name,
         loginUrl: opts.initialUrl,
         providerType: opts.providerType ?? 'PRIVATE',
         // Web-settings defaults mirror the builder openapi defaults.
         geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
         useProxy: opts.useProxy ?? DEFAULT_USE_PROXY,
-        requestData: [requestDataFromProvider(provider)],
+        requestData: requestDataFrom(providers),
     };
     if (opts.description !== undefined) {
         body.description = opts.description;
@@ -91,14 +99,14 @@ export function providerToRegisterBody(provider, opts) {
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to
  *  an EXISTING provider. `version` must not already exist; `versionInfo` is
  *  required and must be ≥10 chars (enforced by the backend). */
-export function providerToConfigBody(provider, opts, version, versionInfo) {
+export function providerToConfigBody(providers, opts, version, versionInfo) {
     // `useProxy` is a Provider-level flag on the old backend, not part of a
     // version's providerConfig — so the config (new-version) path only carries
     // `geoLocation`. It defaults the same way as register.
     const providerConfig = {
         loginUrl: opts.initialUrl,
         geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
-        requestData: [requestDataFromProvider(provider)],
+        requestData: requestDataFrom(providers),
     };
     return { providerConfig, version, versionInfo };
 }

package/lib/old/tools/build.d.ts

@@ -3,7 +3,7 @@ import type { ReclaimOldClient } from '../client.ts';
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
- * list for `registerToolList`. These three replace the builder credential +
- * publish tools and the (disabled) generated provider tools.
+ * list for `registerToolList`. These replace the builder credential + publish
+ * tools and the (disabled) generated provider tools.
  */
 export declare function buildOldBackendTools(client: ReclaimOldClient): RegisteredTool[];