@reclaimprotocol/agent 0.1.4 → 0.1.6

package/src/old/sdk-client.ts

@@ -0,0 +1,105 @@
+import { Boom } from '@hapi/boom'
+import { NAME, VERSION } from '../pkg.ts'
+
+/**
+ * Default origin of the PUBLIC production read API that the Reclaim
+ * verification SDK/attestor itself calls at runtime to fetch a provider's
+ * recipe — a DIFFERENT service from the old-devtools dashboard backend
+ * (`ReclaimOldClient`, `devapi.reclaimprotocol.org`). Both endpoints below are
+ * unauthenticated reads (no `authenticateToken` middleware on this backend's
+ * routes), so this client needs no identity. Override with
+ * `RECLAIM_SDK_API_URL`.
+ */
+export const DEFAULT_SDK_API_URL = 'https://api.reclaimprotocol.org'
+
+/**
+ * Minimal read-only client for the public provider-info endpoints on the SDK
+ * backend (`reclaim-sdk-backend`). Two distinct reads, on purpose:
+ *
+ *   - `getProvider` (`GET /providers/:id`) — the full provider row merged
+ *     with its version's WHOLE providerConfig, `customInjection` included.
+ *   - `getProviderConfigs` (`GET /providers/:id/configs`) — the trimmed
+ *     recipe the attestor actually consumes at verification time: a fixed
+ *     field projection that explicitly OMITS `customInjection` and adds a
+ *     computed `isScriptRequestingClaim` flag instead.
+ *
+ * Errors are thrown as `@hapi/boom` so `remapErrorAsResponse` renders them
+ * the same way as every other tool in this package.
+ */
+export class ReclaimSdkClient {
+	readonly baseUrl: string
+	#fetch: typeof fetch
+
+	constructor(opts: { baseUrl?: string, fetch?: typeof fetch } = {}) {
+		this.baseUrl = (opts.baseUrl || DEFAULT_SDK_API_URL).replace(/\/+$/, '')
+		this.#fetch = opts.fetch ?? fetch
+	}
+
+	/** Full provider + providerConfig (includes `customInjection`). Latest
+	 *  version when `versionNumber` is omitted. */
+	getProvider(providerId: string, versionNumber?: string): Promise<unknown> {
+		return this.#get(
+			`/providers/${encodeURIComponent(providerId)}`,
+			versionNumber,
+		)
+	}
+
+	/** Trimmed runtime recipe (no `customInjection`; adds
+	 *  `isScriptRequestingClaim`). Latest version when `versionNumber` is
+	 *  omitted. */
+	getProviderConfigs(
+		providerId: string,
+		versionNumber?: string,
+	): Promise<unknown> {
+		return this.#get(
+			`/providers/${encodeURIComponent(providerId)}/configs`,
+			versionNumber,
+		)
+	}
+
+	async #get(path: string, versionNumber?: string): Promise<unknown> {
+		let url = `${this.baseUrl}/api${path}`
+		if(versionNumber) {
+			url += `?versionNumber=${encodeURIComponent(versionNumber)}`
+		}
+
+		const res = await this.#fetch(url, {
+			method: 'GET',
+			headers: {
+				Accept: 'application/json',
+				'User-Agent': `${NAME}/${VERSION}`,
+			},
+		})
+
+		let json: unknown
+		try {
+			json = await res.json()
+		} catch{
+			json = undefined
+		}
+
+		const failed =
+			!res.ok ||
+			(json !== undefined &&
+				typeof json === 'object' &&
+				(json as { isSuccess?: unknown }).isSuccess === false)
+		if(failed) {
+			const message =
+				(json && typeof json === 'object' &&
+					typeof (json as { message?: unknown }).message === 'string'
+					? (json as { message: string }).message
+					: undefined) || res.statusText || 'SDK backend request failed'
+			throw new Boom(message, {
+				statusCode: res.ok ? 502 : res.status,
+				data: {
+					status: res.status,
+					title: message,
+					detail: message,
+					body: json,
+				},
+			})
+		}
+
+		return json
+	}
+}

package/src/old/to-register.ts

@@ -1,4 +1,5 @@
 import type { ReclaimProvider } from '../provider/schema.ts'
+import type { AllowedJsRequest, DraftRequest } from '../provider/to-version.ts'
 import type {
 	RegisterProviderBody,
 	UpdateProviderConfigBody,
@@ -34,6 +35,30 @@ export interface OldProviderOpts {
 	/** Defaults to `true` when omitted. Register only (Provider-level flag). */
 	useProxy?: boolean
 	providerType?: 'PRIVATE' | 'PUBLIC'
+	/** Page-injection script — old-devtools' name for the builder's
+	 *  `webSettings.jsUserScripts`. Top-level on register, nested under
+	 *  `providerConfig` on config (add-version). The backend rejects a few
+	 *  deprecated injection APIs (e.g. `window.payloadData`) with a 400. */
+	customInjection?: string
+	/** Accepted at register too (unlike the four fields below, which the
+	 *  backend only accepts on config/add-version). */
+	userAgent?: { ios?: string, android?: string }
+	/** Accepted at register too. */
+	pageTitle?: string
+	/** Config (add-version) ONLY — the register endpoint hardcodes this to
+	 *  `[]` and ignores whatever is sent. Already old-backend-shaped: build
+	 *  fresh entries with {@link injectedRequestDataFrom}; a carried-forward
+	 *  value (read back from an existing version) passes through unchanged. */
+	allowedInjectedRequestData?: OldInjectedRequestData[]
+	/** Config (add-version) ONLY — the register endpoint never reads this
+	 *  field from the request body. */
+	stepsToFollow?: string
+	/** Config (add-version) ONLY — the register endpoint never reads this
+	 *  field from the request body. */
+	useIncognitoWebview?: boolean
+	/** Config (add-version) ONLY — the register endpoint never reads this
+	 *  field from the request body. Free-form JSON. */
+	extensionConfig?: unknown
 }
 
 interface OldResponseMatch {
@@ -63,8 +88,18 @@ interface OldRequestData {
 	bodySniff?: { enabled: boolean, template: string }
 }
 
-/** Build the single `requestData` entry shared by register + update. */
-function requestDataFromProvider(provider: ReclaimProvider): OldRequestData {
+/** One `allowedInjectedRequestData` entry — an `OldRequestData` plus the
+ *  pagination/optionality flags the old backend stores alongside it. */
+export interface OldInjectedRequestData extends OldRequestData {
+	required?: boolean
+	multiple?: boolean
+}
+
+/** Build the single `requestData` entry shared by register + update. Takes
+ *  the loose `DraftRequest` shape (not the full `ReclaimProvider`) so it can
+ *  build BOTH the top-level `requestData` and `allowedInjectedRequestData`
+ *  entries — a `ReclaimProvider` satisfies it structurally either way. */
+function requestDataFromProvider(provider: DraftRequest): OldRequestData {
 	const method = String(provider.method).toUpperCase()
 	if(method !== 'GET' && method !== 'POST') {
 		throw new Error(
@@ -87,14 +122,13 @@ function requestDataFromProvider(provider: ReclaimProvider): OldRequestData {
 		)
 	}
 
-	const responseMatches: OldResponseMatch[] = provider.responseMatches.map(
-		(m, i) => ({
+	const responseMatches: OldResponseMatch[] = (provider.responseMatches ?? [])
+		.map((m, i) => ({
 			value: m.value,
 			type: m.type ?? 'contains',
 			isOptional: false,
 			order: i,
-		}),
-	)
+		}))
 
 	// Old devtools wants `responseMatches` and `responseRedactions` as PARALLEL
 	// arrays — same shape the builder uses, so pass them through directly. We do
@@ -157,6 +191,22 @@ function requestDataFrom(providers: ReclaimProvider[]): OldRequestData[] {
 	return providers.map(requestDataFromProvider)
 }
 
+/** Translate fresh `allowedInjectedRequestData` drafts (the author's input
+ *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
+ *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  carried-forward value read back from an existing version is ALREADY in
+ *  this shape and should be passed straight through instead — don't run it
+ *  through this a second time. */
+export function injectedRequestDataFrom(
+	requests: AllowedJsRequest[],
+): OldInjectedRequestData[] {
+	return requests.map((req) => ({
+		...requestDataFromProvider(req),
+		required: req.required ?? true,
+		multiple: req.multiple ?? true,
+	}))
+}
+
 /** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
  *  drafted request becomes a `requestData` entry; provider-level fields (name)
  *  come from the first draft. */
@@ -177,6 +227,21 @@ export function providerToRegisterBody(
 		body.description = opts.description
 	}
 
+	if(opts.customInjection !== undefined) {
+		body.customInjection = opts.customInjection
+	}
+
+	// Register also accepts these two (unlike allowedInjectedRequestData /
+	// stepsToFollow / useIncognitoWebview / extensionConfig, which the
+	// register controller never reads from the body at all).
+	if(opts.userAgent !== undefined) {
+		body.userAgent = opts.userAgent
+	}
+
+	if(opts.pageTitle !== undefined) {
+		body.pageTitle = opts.pageTitle
+	}
+
 	return body
 }
 
@@ -197,6 +262,33 @@ export function providerToConfigBody(
 		geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
 		requestData: requestDataFrom(providers),
 	}
+	if(opts.customInjection !== undefined) {
+		providerConfig.customInjection = opts.customInjection
+	}
+
+	if(opts.userAgent !== undefined) {
+		providerConfig.userAgent = opts.userAgent
+	}
+
+	if(opts.pageTitle !== undefined) {
+		providerConfig.pageTitle = opts.pageTitle
+	}
+
+	if(opts.allowedInjectedRequestData !== undefined) {
+		providerConfig.allowedInjectedRequestData = opts.allowedInjectedRequestData
+	}
+
+	if(opts.stepsToFollow !== undefined) {
+		providerConfig.stepsToFollow = opts.stepsToFollow
+	}
+
+	if(opts.useIncognitoWebview !== undefined) {
+		providerConfig.useIncognitoWebview = opts.useIncognitoWebview
+	}
+
+	if(opts.extensionConfig !== undefined) {
+		providerConfig.extensionConfig = opts.extensionConfig
+	}
 
 	return { providerConfig, version, versionInfo }
 }

package/src/old/tools/build.ts

@@ -1,23 +1,35 @@
 import type { RegisteredTool } from '../../mcp/server.ts'
 import type { ReclaimOldClient } from '../client.ts'
+import type { ReclaimSdkClient } from '../sdk-client.ts'
 import { authenticateTool } from './authenticate.ts'
+import { getProviderInfoTool } from './get-provider-info.ts'
+import { getProviderVersionConfigTool } from './get-version-config.ts'
 import { getMeProvidersTool } from './me-providers.ts'
 import { createVersionFromCaptureTool } from './publish.ts'
 import { sessionAnalyticsLogsTool } from './session-analytics-logs.ts'
+import { updateProviderMetadataTool } from './update-provider-metadata.ts'
 
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
  * list for `registerToolList`. These replace the builder credential + publish
  * tools and the (disabled) generated provider tools.
+ *
+ * `sdkClient` is a SEPARATE, unauthenticated client for the public
+ * production SDK backend (`api.reclaimprotocol.org`) — a different host from
+ * `client`'s old-devtools dashboard backend (`devapi.reclaimprotocol.org`).
  */
 export function buildOldBackendTools(
 	client: ReclaimOldClient,
+	sdkClient: ReclaimSdkClient,
 ): RegisteredTool[] {
 	return [
 		authenticateTool(client),
 		createVersionFromCaptureTool(client),
 		getMeProvidersTool(client),
+		getProviderVersionConfigTool(client),
+		getProviderInfoTool(sdkClient),
+		updateProviderMetadataTool(client),
 		sessionAnalyticsLogsTool(client),
 	]
 }

package/src/old/tools/get-provider-info.ts

@@ -0,0 +1,91 @@
+import { isBoom } from '@hapi/boom'
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimSdkClient } from '../sdk-client.ts'
+
+/** Best-effort call: resolve to the response, or to an error string instead
+ *  of throwing — one endpoint 404ing (e.g. a bad `versionNumber`) shouldn't
+ *  hide a result the other endpoint DID have. */
+async function attempt(
+	label: string,
+	call: () => Promise<unknown>,
+): Promise<{ ok: true, value: unknown } | { ok: false, error: string }> {
+	try {
+		return { ok: true, value: await call() }
+	} catch(err) {
+		const message = isBoom(err) ? err.message : String(err)
+		return { ok: false, error: `${label}: ${message}` }
+	}
+}
+
+/**
+ * Read provider info from the PUBLIC production SDK backend
+ * (`api.reclaimprotocol.org`) — the service the verification SDK/attestor
+ * itself calls at runtime, NOT the old-devtools dashboard backend
+ * (`get_provider_version_config`, `devapi.reclaimprotocol.org`, requires
+ * auth). Both underlying reads are unauthenticated.
+ *
+ * Fetches BOTH shapes in one call, since they're complementary:
+ *   - `provider`: full provider + providerConfig, `customInjection` included.
+ *   - `configs`: the trimmed runtime recipe the attestor actually consumes —
+ *     `customInjection` deliberately omitted, `isScriptRequestingClaim`
+ *     computed instead.
+ */
+export function getProviderInfoTool(client: ReclaimSdkClient): RegisteredTool {
+	return defineTool<{ providerId: string, versionNumber?: string }>(
+		{
+			name: 'get_provider_info',
+			description:
+				'Read a PUBLISHED provider from the public production SDK backend ' +
+				'(api.reclaimprotocol.org — what the verification SDK/attestor ' +
+				'itself fetches at runtime), for ANY provider, no auth required. ' +
+				'Different from get_provider_version_config, which reads the old ' +
+				'devtools DASHBOARD backend and requires auth. \n\n' +
+				'Returns two complementary reads for the given version (latest ' +
+				'when `versionNumber` is omitted): `provider` (the full provider ' +
+				'+ providerConfig, including `customInjection`) and `configs` (the ' +
+				'trimmed recipe the attestor actually consumes — `customInjection` ' +
+				'is deliberately OMITTED there, replaced by a computed ' +
+				'`isScriptRequestingClaim` flag). One endpoint failing (e.g. an ' +
+				'invalid `versionNumber`) is reported under `errors` without ' +
+				'hiding a result the other endpoint did return.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					providerId: {
+						type: 'string',
+						description: 'UUID of the provider.',
+					},
+					versionNumber: {
+						type: 'string',
+						description:
+							'Specific version, e.g. "1.0.2". Omit for the ' +
+							"provider's current latest version.",
+					},
+				},
+				required: ['providerId'],
+			},
+		},
+		async({ providerId, versionNumber }) => {
+			const [provider, configs] = await Promise.all([
+				attempt(
+					'provider',
+					() => client.getProvider(providerId, versionNumber),
+				),
+				attempt(
+					'configs',
+					() => client.getProviderConfigs(providerId, versionNumber),
+				),
+			])
+
+			const errors = [provider, configs]
+				.filter((r) => !r.ok)
+				.map((r) => (r as { error: string }).error)
+
+			return {
+				...(provider.ok ? { provider: provider.value } : {}),
+				...(configs.ok ? { configs: configs.value } : {}),
+				...(errors.length ? { errors } : {}),
+			}
+		},
+	)
+}

package/src/old/tools/get-version-config.ts

@@ -0,0 +1,56 @@
+import { defineTool, type RegisteredTool } from '../../mcp/server.ts'
+import type { ReclaimOldClient } from '../client.ts'
+
+/**
+ * Read the full `providerConfig` (loginUrl, customInjection, requestData,
+ * geoLocation, ...) of one provider version on the old devtools backend —
+ * the latest version when `version` is omitted.
+ *
+ * Exists so a dev/agent can see what's CURRENTLY published before adding a
+ * new version with `create_provider_version_from_capture`. That tool always
+ * takes a FULL replacement `providerConfig` (no partial-patch endpoint on
+ * this backend), so a version added without knowing the current
+ * `customInjection` would silently publish it blank — wiping a working
+ * login script instead of preserving it. Read it here first, then pass it
+ * straight through (or omit `customInjection` on publish to have it carried
+ * forward automatically).
+ */
+export function getProviderVersionConfigTool(
+	client: ReclaimOldClient,
+): RegisteredTool {
+	return defineTool<{ providerId: string, version?: string }>(
+		{
+			name: 'get_provider_version_config',
+			description:
+				'Fetch the full providerConfig (loginUrl, customInjection, ' +
+				'requestData, geoLocation, ...) of one version on the old devtools ' +
+				'backend — the latest version when `version` is omitted. Readable ' +
+				'for any non-archived provider, not just ones you own. Use this ' +
+				'BEFORE calling create_provider_version_from_capture with a ' +
+				'`providerId` to see the currently-published customInjection/' +
+				'requestData so you know what you would be changing — that tool ' +
+				'replaces the whole providerConfig, so a field you never see and ' +
+				"never pass comes out blank in the new version, even if it's set " +
+				'today.',
+			inputSchema: {
+				type: 'object',
+				properties: {
+					providerId: {
+						type: 'string',
+						description: 'UUID of the provider (from get_me_providers).',
+					},
+					version: {
+						type: 'string',
+						description:
+							'Specific version to fetch, e.g. "1.0.2". Omit for the ' +
+							"provider's current latest version.",
+					},
+				},
+				required: ['providerId'],
+			},
+		},
+		async({ providerId, version }) => {
+			return client.getProviderConfig(providerId, version)
+		},
+	)
+}