@reclaimprotocol/agent 0.1.4 → 0.1.6

package/lib/old/sdk-client.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Default origin of the PUBLIC production read API that the Reclaim
+ * verification SDK/attestor itself calls at runtime to fetch a provider's
+ * recipe — a DIFFERENT service from the old-devtools dashboard backend
+ * (`ReclaimOldClient`, `devapi.reclaimprotocol.org`). Both endpoints below are
+ * unauthenticated reads (no `authenticateToken` middleware on this backend's
+ * routes), so this client needs no identity. Override with
+ * `RECLAIM_SDK_API_URL`.
+ */
+export declare const DEFAULT_SDK_API_URL = "https://api.reclaimprotocol.org";
+/**
+ * Minimal read-only client for the public provider-info endpoints on the SDK
+ * backend (`reclaim-sdk-backend`). Two distinct reads, on purpose:
+ *
+ *   - `getProvider` (`GET /providers/:id`) — the full provider row merged
+ *     with its version's WHOLE providerConfig, `customInjection` included.
+ *   - `getProviderConfigs` (`GET /providers/:id/configs`) — the trimmed
+ *     recipe the attestor actually consumes at verification time: a fixed
+ *     field projection that explicitly OMITS `customInjection` and adds a
+ *     computed `isScriptRequestingClaim` flag instead.
+ *
+ * Errors are thrown as `@hapi/boom` so `remapErrorAsResponse` renders them
+ * the same way as every other tool in this package.
+ */
+export declare class ReclaimSdkClient {
+    #private;
+    readonly baseUrl: string;
+    constructor(opts?: {
+        baseUrl?: string;
+        fetch?: typeof fetch;
+    });
+    /** Full provider + providerConfig (includes `customInjection`). Latest
+     *  version when `versionNumber` is omitted. */
+    getProvider(providerId: string, versionNumber?: string): Promise<unknown>;
+    /** Trimmed runtime recipe (no `customInjection`; adds
+     *  `isScriptRequestingClaim`). Latest version when `versionNumber` is
+     *  omitted. */
+    getProviderConfigs(providerId: string, versionNumber?: string): Promise<unknown>;
+}

package/lib/old/sdk-client.js

@@ -0,0 +1,85 @@
+import { Boom } from '@hapi/boom';
+import { NAME, VERSION } from "../pkg.js";
+/**
+ * Default origin of the PUBLIC production read API that the Reclaim
+ * verification SDK/attestor itself calls at runtime to fetch a provider's
+ * recipe — a DIFFERENT service from the old-devtools dashboard backend
+ * (`ReclaimOldClient`, `devapi.reclaimprotocol.org`). Both endpoints below are
+ * unauthenticated reads (no `authenticateToken` middleware on this backend's
+ * routes), so this client needs no identity. Override with
+ * `RECLAIM_SDK_API_URL`.
+ */
+export const DEFAULT_SDK_API_URL = 'https://api.reclaimprotocol.org';
+/**
+ * Minimal read-only client for the public provider-info endpoints on the SDK
+ * backend (`reclaim-sdk-backend`). Two distinct reads, on purpose:
+ *
+ *   - `getProvider` (`GET /providers/:id`) — the full provider row merged
+ *     with its version's WHOLE providerConfig, `customInjection` included.
+ *   - `getProviderConfigs` (`GET /providers/:id/configs`) — the trimmed
+ *     recipe the attestor actually consumes at verification time: a fixed
+ *     field projection that explicitly OMITS `customInjection` and adds a
+ *     computed `isScriptRequestingClaim` flag instead.
+ *
+ * Errors are thrown as `@hapi/boom` so `remapErrorAsResponse` renders them
+ * the same way as every other tool in this package.
+ */
+export class ReclaimSdkClient {
+    baseUrl;
+    #fetch;
+    constructor(opts = {}) {
+        this.baseUrl = (opts.baseUrl || DEFAULT_SDK_API_URL).replace(/\/+$/, '');
+        this.#fetch = opts.fetch ?? fetch;
+    }
+    /** Full provider + providerConfig (includes `customInjection`). Latest
+     *  version when `versionNumber` is omitted. */
+    getProvider(providerId, versionNumber) {
+        return this.#get(`/providers/${encodeURIComponent(providerId)}`, versionNumber);
+    }
+    /** Trimmed runtime recipe (no `customInjection`; adds
+     *  `isScriptRequestingClaim`). Latest version when `versionNumber` is
+     *  omitted. */
+    getProviderConfigs(providerId, versionNumber) {
+        return this.#get(`/providers/${encodeURIComponent(providerId)}/configs`, versionNumber);
+    }
+    async #get(path, versionNumber) {
+        let url = `${this.baseUrl}/api${path}`;
+        if (versionNumber) {
+            url += `?versionNumber=${encodeURIComponent(versionNumber)}`;
+        }
+        const res = await this.#fetch(url, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json',
+                'User-Agent': `${NAME}/${VERSION}`,
+            },
+        });
+        let json;
+        try {
+            json = await res.json();
+        }
+        catch {
+            json = undefined;
+        }
+        const failed = !res.ok ||
+            (json !== undefined &&
+                typeof json === 'object' &&
+                json.isSuccess === false);
+        if (failed) {
+            const message = (json && typeof json === 'object' &&
+                typeof json.message === 'string'
+                ? json.message
+                : undefined) || res.statusText || 'SDK backend request failed';
+            throw new Boom(message, {
+                statusCode: res.ok ? 502 : res.status,
+                data: {
+                    status: res.status,
+                    title: message,
+                    detail: message,
+                    body: json,
+                },
+            });
+        }
+        return json;
+    }
+}

package/lib/old/to-register.d.ts

@@ -1,4 +1,5 @@
 import type { ReclaimProvider } from '../provider/schema.ts';
+import type { AllowedJsRequest } from '../provider/to-version.ts';
 import type { RegisterProviderBody, UpdateProviderConfigBody } from './client.ts';
 /**
  * Translate a drafted `ReclaimProvider` (from `propose_provider`) into the
@@ -22,7 +23,74 @@ export interface OldProviderOpts {
     /** Defaults to `true` when omitted. Register only (Provider-level flag). */
     useProxy?: boolean;
     providerType?: 'PRIVATE' | 'PUBLIC';
+    /** Page-injection script — old-devtools' name for the builder's
+     *  `webSettings.jsUserScripts`. Top-level on register, nested under
+     *  `providerConfig` on config (add-version). The backend rejects a few
+     *  deprecated injection APIs (e.g. `window.payloadData`) with a 400. */
+    customInjection?: string;
+    /** Accepted at register too (unlike the four fields below, which the
+     *  backend only accepts on config/add-version). */
+    userAgent?: {
+        ios?: string;
+        android?: string;
+    };
+    /** Accepted at register too. */
+    pageTitle?: string;
+    /** Config (add-version) ONLY — the register endpoint hardcodes this to
+     *  `[]` and ignores whatever is sent. Already old-backend-shaped: build
+     *  fresh entries with {@link injectedRequestDataFrom}; a carried-forward
+     *  value (read back from an existing version) passes through unchanged. */
+    allowedInjectedRequestData?: OldInjectedRequestData[];
+    /** Config (add-version) ONLY — the register endpoint never reads this
+     *  field from the request body. */
+    stepsToFollow?: string;
+    /** Config (add-version) ONLY — the register endpoint never reads this
+     *  field from the request body. */
+    useIncognitoWebview?: boolean;
+    /** Config (add-version) ONLY — the register endpoint never reads this
+     *  field from the request body. Free-form JSON. */
+    extensionConfig?: unknown;
 }
+interface OldResponseMatch {
+    value: string;
+    type: string;
+    isOptional: boolean;
+    order: number;
+}
+interface OldResponseRedaction {
+    xPath?: string;
+    jsonPath?: string;
+    regex?: string;
+    /** OPRF mode (`oprf` / `oprf-raw` / `oprf-mpc`) — the backend stores it as
+     *  a free-form string and the attestor interprets it at verification. */
+    hash?: string;
+    order: number;
+}
+interface OldRequestData {
+    url: string;
+    urlType: 'CONSTANT' | 'TEMPLATE';
+    method: 'GET' | 'POST';
+    responseMatches: OldResponseMatch[];
+    responseRedactions: OldResponseRedaction[];
+    credentials: 'include';
+    bodySniff?: {
+        enabled: boolean;
+        template: string;
+    };
+}
+/** One `allowedInjectedRequestData` entry — an `OldRequestData` plus the
+ *  pagination/optionality flags the old backend stores alongside it. */
+export interface OldInjectedRequestData extends OldRequestData {
+    required?: boolean;
+    multiple?: boolean;
+}
+/** Translate fresh `allowedInjectedRequestData` drafts (the author's input
+ *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
+ *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  carried-forward value read back from an existing version is ALREADY in
+ *  this shape and should be passed straight through instead — don't run it
+ *  through this a second time. */
+export declare function injectedRequestDataFrom(requests: AllowedJsRequest[]): OldInjectedRequestData[];
 /** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
  *  drafted request becomes a `requestData` entry; provider-level fields (name)
  *  come from the first draft. */
@@ -50,3 +118,4 @@ export declare function extractVersions(resp: unknown): SemverTriplet[];
  * rather than collide with the guaranteed 1.0.0).
  */
 export declare function bumpPatchString(versions: SemverTriplet[]): string;
+export {};

package/lib/old/to-register.js

@@ -4,7 +4,10 @@
  *  is a Provider-level flag (register only). */
 const DEFAULT_GEO_LOCATION = '{{DYNAMIC_GEO}}';
 const DEFAULT_USE_PROXY = true;
-/** Build the single `requestData` entry shared by register + update. */
+/** Build the single `requestData` entry shared by register + update. Takes
+ *  the loose `DraftRequest` shape (not the full `ReclaimProvider`) so it can
+ *  build BOTH the top-level `requestData` and `allowedInjectedRequestData`
+ *  entries — a `ReclaimProvider` satisfies it structurally either way. */
 function requestDataFromProvider(provider) {
     const method = String(provider.method).toUpperCase();
     if (method !== 'GET' && method !== 'POST') {
@@ -22,7 +25,8 @@ function requestDataFromProvider(provider) {
             'consumer-supplied params to the {{context_<name>}} form ' +
             'for this backend.');
     }
-    const responseMatches = provider.responseMatches.map((m, i) => ({
+    const responseMatches = (provider.responseMatches ?? [])
+        .map((m, i) => ({
         value: m.value,
         type: m.type ?? 'contains',
         isOptional: false,
@@ -78,6 +82,19 @@ function requestDataFromProvider(provider) {
 function requestDataFrom(providers) {
     return providers.map(requestDataFromProvider);
 }
+/** Translate fresh `allowedInjectedRequestData` drafts (the author's input
+ *  shape, `AllowedJsRequest[]` — same shape the builder translator uses for
+ *  its own `allowedJsRequests`) into the old backend's shape. A
+ *  carried-forward value read back from an existing version is ALREADY in
+ *  this shape and should be passed straight through instead — don't run it
+ *  through this a second time. */
+export function injectedRequestDataFrom(requests) {
+    return requests.map((req) => ({
+        ...requestDataFromProvider(req),
+        required: req.required ?? true,
+        multiple: req.multiple ?? true,
+    }));
+}
 /** Body for `POST /api/providers/register` — new provider + v1.0.0. Every
  *  drafted request becomes a `requestData` entry; provider-level fields (name)
  *  come from the first draft. */
@@ -94,6 +111,18 @@ export function providerToRegisterBody(providers, opts) {
     if (opts.description !== undefined) {
         body.description = opts.description;
     }
+    if (opts.customInjection !== undefined) {
+        body.customInjection = opts.customInjection;
+    }
+    // Register also accepts these two (unlike allowedInjectedRequestData /
+    // stepsToFollow / useIncognitoWebview / extensionConfig, which the
+    // register controller never reads from the body at all).
+    if (opts.userAgent !== undefined) {
+        body.userAgent = opts.userAgent;
+    }
+    if (opts.pageTitle !== undefined) {
+        body.pageTitle = opts.pageTitle;
+    }
     return body;
 }
 /** Body for `POST /api/providers/:providerId/config` — adds a new version to
@@ -108,6 +137,27 @@ export function providerToConfigBody(providers, opts, version, versionInfo) {
         geoLocation: opts.geoLocation ?? DEFAULT_GEO_LOCATION,
         requestData: requestDataFrom(providers),
     };
+    if (opts.customInjection !== undefined) {
+        providerConfig.customInjection = opts.customInjection;
+    }
+    if (opts.userAgent !== undefined) {
+        providerConfig.userAgent = opts.userAgent;
+    }
+    if (opts.pageTitle !== undefined) {
+        providerConfig.pageTitle = opts.pageTitle;
+    }
+    if (opts.allowedInjectedRequestData !== undefined) {
+        providerConfig.allowedInjectedRequestData = opts.allowedInjectedRequestData;
+    }
+    if (opts.stepsToFollow !== undefined) {
+        providerConfig.stepsToFollow = opts.stepsToFollow;
+    }
+    if (opts.useIncognitoWebview !== undefined) {
+        providerConfig.useIncognitoWebview = opts.useIncognitoWebview;
+    }
+    if (opts.extensionConfig !== undefined) {
+        providerConfig.extensionConfig = opts.extensionConfig;
+    }
     return { providerConfig, version, versionInfo };
 }
 /**

package/lib/old/tools/build.d.ts

@@ -1,9 +1,14 @@
 import type { RegisteredTool } from '../../mcp/server.ts';
 import type { ReclaimOldClient } from '../client.ts';
+import type { ReclaimSdkClient } from '../sdk-client.ts';
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
  * list for `registerToolList`. These replace the builder credential + publish
  * tools and the (disabled) generated provider tools.
+ *
+ * `sdkClient` is a SEPARATE, unauthenticated client for the public
+ * production SDK backend (`api.reclaimprotocol.org`) — a different host from
+ * `client`'s old-devtools dashboard backend (`devapi.reclaimprotocol.org`).
  */
-export declare function buildOldBackendTools(client: ReclaimOldClient): RegisteredTool[];
+export declare function buildOldBackendTools(client: ReclaimOldClient, sdkClient: ReclaimSdkClient): RegisteredTool[];

package/lib/old/tools/build.js

@@ -1,18 +1,28 @@
 import { authenticateTool } from "./authenticate.js";
+import { getProviderInfoTool } from "./get-provider-info.js";
+import { getProviderVersionConfigTool } from "./get-version-config.js";
 import { getMeProvidersTool } from "./me-providers.js";
 import { createVersionFromCaptureTool } from "./publish.js";
 import { sessionAnalyticsLogsTool } from "./session-analytics-logs.js";
+import { updateProviderMetadataTool } from "./update-provider-metadata.js";
 /**
  * The backend-facing tools for OLD-devtools mode. Mirrors
  * `buildCredentialTools` / `buildAgentTools`: returns a flat `RegisteredTool`
  * list for `registerToolList`. These replace the builder credential + publish
  * tools and the (disabled) generated provider tools.
+ *
+ * `sdkClient` is a SEPARATE, unauthenticated client for the public
+ * production SDK backend (`api.reclaimprotocol.org`) — a different host from
+ * `client`'s old-devtools dashboard backend (`devapi.reclaimprotocol.org`).
  */
-export function buildOldBackendTools(client) {
+export function buildOldBackendTools(client, sdkClient) {
     return [
         authenticateTool(client),
         createVersionFromCaptureTool(client),
         getMeProvidersTool(client),
+        getProviderVersionConfigTool(client),
+        getProviderInfoTool(sdkClient),
+        updateProviderMetadataTool(client),
         sessionAnalyticsLogsTool(client),
     ];
 }

package/lib/old/tools/get-provider-info.d.ts

@@ -0,0 +1,16 @@
+import { type RegisteredTool } from '../../mcp/server.ts';
+import type { ReclaimSdkClient } from '../sdk-client.ts';
+/**
+ * Read provider info from the PUBLIC production SDK backend
+ * (`api.reclaimprotocol.org`) — the service the verification SDK/attestor
+ * itself calls at runtime, NOT the old-devtools dashboard backend
+ * (`get_provider_version_config`, `devapi.reclaimprotocol.org`, requires
+ * auth). Both underlying reads are unauthenticated.
+ *
+ * Fetches BOTH shapes in one call, since they're complementary:
+ *   - `provider`: full provider + providerConfig, `customInjection` included.
+ *   - `configs`: the trimmed runtime recipe the attestor actually consumes —
+ *     `customInjection` deliberately omitted, `isScriptRequestingClaim`
+ *     computed instead.
+ */
+export declare function getProviderInfoTool(client: ReclaimSdkClient): RegisteredTool;

package/lib/old/tools/get-provider-info.js

@@ -0,0 +1,73 @@
+import { isBoom } from '@hapi/boom';
+import { defineTool } from "../../mcp/server.js";
+/** Best-effort call: resolve to the response, or to an error string instead
+ *  of throwing — one endpoint 404ing (e.g. a bad `versionNumber`) shouldn't
+ *  hide a result the other endpoint DID have. */
+async function attempt(label, call) {
+    try {
+        return { ok: true, value: await call() };
+    }
+    catch (err) {
+        const message = isBoom(err) ? err.message : String(err);
+        return { ok: false, error: `${label}: ${message}` };
+    }
+}
+/**
+ * Read provider info from the PUBLIC production SDK backend
+ * (`api.reclaimprotocol.org`) — the service the verification SDK/attestor
+ * itself calls at runtime, NOT the old-devtools dashboard backend
+ * (`get_provider_version_config`, `devapi.reclaimprotocol.org`, requires
+ * auth). Both underlying reads are unauthenticated.
+ *
+ * Fetches BOTH shapes in one call, since they're complementary:
+ *   - `provider`: full provider + providerConfig, `customInjection` included.
+ *   - `configs`: the trimmed runtime recipe the attestor actually consumes —
+ *     `customInjection` deliberately omitted, `isScriptRequestingClaim`
+ *     computed instead.
+ */
+export function getProviderInfoTool(client) {
+    return defineTool({
+        name: 'get_provider_info',
+        description: 'Read a PUBLISHED provider from the public production SDK backend ' +
+            '(api.reclaimprotocol.org — what the verification SDK/attestor ' +
+            'itself fetches at runtime), for ANY provider, no auth required. ' +
+            'Different from get_provider_version_config, which reads the old ' +
+            'devtools DASHBOARD backend and requires auth. \n\n' +
+            'Returns two complementary reads for the given version (latest ' +
+            'when `versionNumber` is omitted): `provider` (the full provider ' +
+            '+ providerConfig, including `customInjection`) and `configs` (the ' +
+            'trimmed recipe the attestor actually consumes — `customInjection` ' +
+            'is deliberately OMITTED there, replaced by a computed ' +
+            '`isScriptRequestingClaim` flag). One endpoint failing (e.g. an ' +
+            'invalid `versionNumber`) is reported under `errors` without ' +
+            'hiding a result the other endpoint did return.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                providerId: {
+                    type: 'string',
+                    description: 'UUID of the provider.',
+                },
+                versionNumber: {
+                    type: 'string',
+                    description: 'Specific version, e.g. "1.0.2". Omit for the ' +
+                        "provider's current latest version.",
+                },
+            },
+            required: ['providerId'],
+        },
+    }, async ({ providerId, versionNumber }) => {
+        const [provider, configs] = await Promise.all([
+            attempt('provider', () => client.getProvider(providerId, versionNumber)),
+            attempt('configs', () => client.getProviderConfigs(providerId, versionNumber)),
+        ]);
+        const errors = [provider, configs]
+            .filter((r) => !r.ok)
+            .map((r) => r.error);
+        return {
+            ...(provider.ok ? { provider: provider.value } : {}),
+            ...(configs.ok ? { configs: configs.value } : {}),
+            ...(errors.length ? { errors } : {}),
+        };
+    });
+}

package/lib/old/tools/get-version-config.d.ts

@@ -0,0 +1,17 @@
+import { type RegisteredTool } from '../../mcp/server.ts';
+import type { ReclaimOldClient } from '../client.ts';
+/**
+ * Read the full `providerConfig` (loginUrl, customInjection, requestData,
+ * geoLocation, ...) of one provider version on the old devtools backend —
+ * the latest version when `version` is omitted.
+ *
+ * Exists so a dev/agent can see what's CURRENTLY published before adding a
+ * new version with `create_provider_version_from_capture`. That tool always
+ * takes a FULL replacement `providerConfig` (no partial-patch endpoint on
+ * this backend), so a version added without knowing the current
+ * `customInjection` would silently publish it blank — wiping a working
+ * login script instead of preserving it. Read it here first, then pass it
+ * straight through (or omit `customInjection` on publish to have it carried
+ * forward automatically).
+ */
+export declare function getProviderVersionConfigTool(client: ReclaimOldClient): RegisteredTool;

package/lib/old/tools/get-version-config.js

@@ -0,0 +1,47 @@
+import { defineTool } from "../../mcp/server.js";
+/**
+ * Read the full `providerConfig` (loginUrl, customInjection, requestData,
+ * geoLocation, ...) of one provider version on the old devtools backend —
+ * the latest version when `version` is omitted.
+ *
+ * Exists so a dev/agent can see what's CURRENTLY published before adding a
+ * new version with `create_provider_version_from_capture`. That tool always
+ * takes a FULL replacement `providerConfig` (no partial-patch endpoint on
+ * this backend), so a version added without knowing the current
+ * `customInjection` would silently publish it blank — wiping a working
+ * login script instead of preserving it. Read it here first, then pass it
+ * straight through (or omit `customInjection` on publish to have it carried
+ * forward automatically).
+ */
+export function getProviderVersionConfigTool(client) {
+    return defineTool({
+        name: 'get_provider_version_config',
+        description: 'Fetch the full providerConfig (loginUrl, customInjection, ' +
+            'requestData, geoLocation, ...) of one version on the old devtools ' +
+            'backend — the latest version when `version` is omitted. Readable ' +
+            'for any non-archived provider, not just ones you own. Use this ' +
+            'BEFORE calling create_provider_version_from_capture with a ' +
+            '`providerId` to see the currently-published customInjection/' +
+            'requestData so you know what you would be changing — that tool ' +
+            'replaces the whole providerConfig, so a field you never see and ' +
+            "never pass comes out blank in the new version, even if it's set " +
+            'today.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                providerId: {
+                    type: 'string',
+                    description: 'UUID of the provider (from get_me_providers).',
+                },
+                version: {
+                    type: 'string',
+                    description: 'Specific version to fetch, e.g. "1.0.2". Omit for the ' +
+                        "provider's current latest version.",
+                },
+            },
+            required: ['providerId'],
+        },
+    }, async ({ providerId, version }) => {
+        return client.getProviderConfig(providerId, version);
+    });
+}