@reclaimprotocol/agent 0.1.9 → 0.1.11

package/lib/old/tools/publish.js

@@ -4,53 +4,6 @@ import { INJECTION_GUIDE } from "../../provider/injection-doc.js";
 import { countsFor, matchRedactionWarnings, } from "../../provider/match-redaction-warning.js";
 import { bumpPatchString, extractVersions, injectedRequestDataFrom, providerToConfigBody, providerToRegisterBody, } from "../to-register.js";
 const DEFAULT_VERSION_INFO = 'Updated from MCP browser capture';
-/** Fields with no partial-patch equivalent on this backend: a version always
- *  replaces the WHOLE `providerConfig`, so omitting one of these on
- *  add-version must carry forward the current value rather than publish it
- *  blank. `allowedInjectedRequestData` is handled alongside these (further
- *  down, inline) since it needs translation when freshly authored, unlike
- *  these — which pass through unchanged either way. */
-const PRESERVABLE_KEYS = [
-    'customInjection',
-    'userAgent',
-    'pageTitle',
-    'stepsToFollow',
-    'useIncognitoWebview',
-    'extensionConfig',
-];
-/** Pull `providerConfig` out of a `get_provider_version_config` /
- *  `getProviderConfig` response, tolerant of a missing/malformed shape. */
-function extractProviderConfig(resp) {
-    if (resp && typeof resp === 'object') {
-        const cfg = resp.providerConfig;
-        if (cfg && typeof cfg === 'object') {
-            return cfg;
-        }
-    }
-    return undefined;
-}
-/** Prefer the caller's explicit value; otherwise fall back to `current`'s
- *  value (if any) and record `fieldName` as carried forward.
- *
- *  `current === null` is treated the SAME as `undefined` (nothing to carry),
- *  not as a real value to preserve. These are all optional fields with no
- *  Prisma default — a version where one was never set reads back as
- *  `null`, not a missing key, because Prisma normalizes an absent optional
- *  field to `null` on read. Carrying that `null` "forward" would falsely
- *  claim the field was preserved when really nothing was ever there — it
- *  most likely means an EARLIER version already lost it (e.g. published
- *  before this field had carry-forward support at all), not that this call
- *  is doing anything wrong. */
-function resolveField(explicit, current, fieldName, carried) {
-    if (explicit !== undefined) {
-        return explicit;
-    }
-    if (current !== undefined && current !== null) {
-        carried.push(fieldName);
-        return current;
-    }
-    return undefined;
-}
 /**
  * The old backend lets you add a version only to a provider YOU own. A
  * `providerId` for a public provider (or anyone else's) comes back as
@@ -111,23 +64,19 @@ export function createVersionFromCaptureTool(client) {
             'For data gated behind login/navigation, pass `customInjection` — a ' +
             'page-injection script (old-devtools\' name for the builder\'s ' +
             'jsUserScripts) that drives the page to where the request fires. \n\n' +
-            'This backend has NO partial-patch endpoint — adding a version ' +
-            'always replaces the WHOLE providerConfig. When `providerId` is ' +
-            'set, any of `customInjection`, `userAgent`, `pageTitle`, ' +
-            '`allowedInjectedRequestData`, `stepsToFollow`, ' +
-            '`useIncognitoWebview`, `extensionConfig` that you OMIT is carried ' +
-            'forward unchanged from the currently-published version (so ' +
-            're-publishing requestData never wipes a working login script or ' +
-            'other config someone set via the dashboard). This can only carry ' +
-            'forward what the CURRENT version actually has — if an earlier ' +
-            'version already lost a field (e.g. published before this tool ' +
-            'carried it forward at all), there is nothing left to preserve and ' +
-            'the result legitimately comes back empty/null for that field; ' +
-            'that is not this call failing to carry it forward. Pass an ' +
-            'explicit value (`""`, `[]`, `false`, ...) to intentionally clear ' +
-            'one of them instead, or call get_provider_version_config FIRST ' +
-            'to see exactly what is live today, rather than assuming this ' +
-            'call recovered something that may already be gone. ' +
+            'BY DESIGN, this backend only ever CREATES A NEW VERSION (POST) — ' +
+            'there is no partial-patch/edit endpoint, and this tool does NOT ' +
+            'read or carry anything forward from the previous version. Every ' +
+            'new version replaces the WHOLE providerConfig with exactly what ' +
+            'you pass in THIS call. Therefore any field you want present in the ' +
+            'new version MUST be supplied here — `customInjection`, `userAgent`, ' +
+            '`pageTitle`, `allowedInjectedRequestData`, `stepsToFollow`, ' +
+            '`useIncognitoWebview`, `extensionConfig`, and `requestData` (via ' +
+            '`provider`/`providers`). Anything you OMIT is published blank/' +
+            'default in the new version, NOT preserved. To change one field ' +
+            'while keeping the rest, first read the current version with ' +
+            'get_provider_info, then pass the full desired config (the existing ' +
+            'values plus your change) back into this call. ' +
             '`allowedInjectedRequestData`/`useIncognitoWebview`/' +
             '`extensionConfig` only take effect on add-version — the register ' +
             'endpoint (no `providerId`) ignores them. \n\n' +
@@ -250,6 +199,26 @@ export function createVersionFromCaptureTool(client) {
                                 type: 'boolean',
                                 description: 'Fail validation if none match. Default true.',
                             },
+                            templateParams: {
+                                type: 'array',
+                                items: { type: 'string' },
+                                description: 'Names of `${var}` placeholders used in this ' +
+                                    'template\'s `responseMatches`/`responseRedactions` ' +
+                                    'that should be substituted at verify time from the ' +
+                                    'submitted proof\'s own witness params. Omit (or ' +
+                                    'leave empty) if the template has no such ' +
+                                    'placeholders.',
+                            },
+                            templateParamsMode: {
+                                type: 'string',
+                                enum: ['separate', 'merge'],
+                                description: 'How multiple values for `templateParams` expand ' +
+                                    'into request specs. `separate` (default): one ' +
+                                    'independent spec per value, each matching its own ' +
+                                    'proof. `merge`: fold all values into ONE spec with ' +
+                                    'one match/redaction entry per value, matching a ' +
+                                    'single proof that bundles them all into one claim.',
+                            },
                         },
                         required: ['url', 'method'],
                     },
@@ -281,22 +250,22 @@ export function createVersionFromCaptureTool(client) {
                 '(an array of 1+ drafts).', { statusCode: 400 });
         }
         const providers = hasMany ? args.providers : [args.provider];
-        const opts = { initialUrl: args.initialUrl };
-        if (args.description !== undefined) {
-            opts.description = args.description;
-        }
-        if (args.geoLocation !== undefined) {
-            opts.geoLocation = args.geoLocation;
-        }
-        if (args.useProxy !== undefined) {
-            opts.useProxy = args.useProxy;
-        }
-        if (args.providerType !== undefined) {
-            opts.providerType = args.providerType;
-        }
-        if (args.customInjection !== undefined) {
-            opts.customInjection = args.customInjection;
-        }
+        const opts = {
+            initialUrl: args.initialUrl,
+            description: args.description,
+            geoLocation: args.geoLocation,
+            useProxy: args.useProxy,
+            providerType: args.providerType,
+            customInjection: args.customInjection,
+            userAgent: args.userAgent,
+            pageTitle: args.pageTitle,
+            stepsToFollow: args.stepsToFollow,
+            useIncognitoWebview: args.useIncognitoWebview,
+            extensionConfig: args.extensionConfig,
+            allowedInjectedRequestData: args.allowedInjectedRequestData
+                ? injectedRequestDataFrom(args.allowedInjectedRequestData)
+                : undefined
+        };
         // Non-blocking advisory per request — never alters or blocks the
         // publish; the author keeps full control. Attaches under `_notes`.
         const notes = matchRedactionWarnings(providers.map((p, i) => countsFor(`Request ${i + 1}`, p)));
@@ -325,20 +294,13 @@ export function createVersionFromCaptureTool(client) {
             const ignoredOnRegister = REGISTER_IGNORED_KEYS
                 .filter((k) => args[k] !== undefined);
             if (ignoredOnRegister.length) {
-                notes.push(`${ignoredOnRegister.join(', ')} ${ignoredOnRegister.length > 1 ? 'are' : 'is'} ignored on register (no providerId) — the old backend only ` +
+                notes.push(`${ignoredOnRegister.join(', ')} ` +
+                    `${ignoredOnRegister.length > 1 ? 'are' : 'is'} ` +
+                    'ignored on register (no providerId) — the old backend only ' +
                     'reads them when adding a version. Publish once to create ' +
                     'the provider, then call this again WITH the returned ' +
                     'providerId to set them.');
             }
-            if (args.userAgent !== undefined) {
-                opts.userAgent = args.userAgent;
-            }
-            if (args.pageTitle !== undefined) {
-                opts.pageTitle = args.pageTitle;
-            }
-            if (args.stepsToFollow !== undefined) {
-                opts.stepsToFollow = args.stepsToFollow;
-            }
             const body = providerToRegisterBody(providers, opts);
             return withNotes(await client.registerProvider(body));
         }
@@ -348,42 +310,23 @@ export function createVersionFromCaptureTool(client) {
         // workaround instead of a bare permission error.
         const providerId = args.providerId;
         try {
-            // This backend has no partial-patch endpoint — a version always
-            // replaces the WHOLE providerConfig. Anything the caller didn't
-            // pass at all is carried forward from the currently-published
-            // version instead of going out blank. Pass an explicit empty
-            // value ("", [], false) to intentionally clear one.
-            const needsCurrent = PRESERVABLE_KEYS.some((k) => args[k] === undefined)
-                || args.allowedInjectedRequestData === undefined;
-            const current = needsCurrent
-                ? extractProviderConfig(await client.getProviderConfig(providerId))
-                : undefined;
-            const carried = [];
-            for (const key of PRESERVABLE_KEYS) {
-                const resolved = resolveField(args[key], current?.[key], key, carried);
-                if (resolved !== undefined) {
-                    opts[key] = resolved;
-                }
-            }
-            const freshInjected = args.allowedInjectedRequestData !== undefined
-                ? injectedRequestDataFrom(args.allowedInjectedRequestData)
-                : undefined;
-            const resolvedInjected = resolveField(freshInjected, current?.allowedInjectedRequestData, 'allowedInjectedRequestData', carried);
-            if (resolvedInjected !== undefined) {
-                opts.allowedInjectedRequestData = resolvedInjected;
-            }
-            if (carried.length) {
-                notes.push('Not passed, carried forward unchanged from the current ' +
-                    `published version: ${carried.join(', ')}. Pass an explicit ` +
-                    'value ("", [], false, ...) to override any of them, or ' +
-                    'call get_provider_version_config first to see what is ' +
-                    'live today.');
-            }
+            // By design this always POSTs a brand-new version and publishes
+            // EXACTLY the config assembled above — nothing is read back or
+            // carried forward. Any field the caller omitted is already absent
+            // from `opts` and will be blank/default in the new version. To
+            // preserve existing fields, the caller must have read them via
+            // get_provider_info and passed them back in.
             if (args.customInjection !== undefined && opts.customInjection?.trim()) {
                 notes.push('customInjection will run in the verification client before ' +
                     'every page load (before navigating to initialUrl), matching ' +
                     'the builder\'s jsUserScripts.');
             }
+            notes.push('A NEW version was created with only the fields passed in this ' +
+                'call — nothing was carried forward from the previous version. ' +
+                'If you intended to keep other fields (customInjection, ' +
+                'userAgent, allowedInjectedRequestData, ...), read the prior ' +
+                'version with get_provider_info and re-publish with them ' +
+                'included.');
             const versionsResp = await client.listVersions(providerId);
             const version = bumpPatchString(extractVersions(versionsResp));
             const versionInfo = args.notes && args.notes.trim().length >= 10

package/lib/provider/dom-xpath.js

@@ -15,6 +15,76 @@ import "../proof/patch-domhandler.js";
 /** Identifying attributes stable enough to anchor an xPath on (value-bearing
  *  attrs like `content`/`href`/`value` are excluded). */
 const IDENT_ATTRS = ['name', 'property', 'itemprop', 'data-testid', 'rel', 'for'];
+/** Base weight by anchor kind: purpose-built test hooks and ids beat classes,
+ *  which beat a positional path. Modulated by {@link tokenQuality}. */
+const TYPE_WEIGHT = {
+    'ident-attr': 0.95,
+    id: 0.9,
+    class: 0.6,
+    positional: 0.3,
+};
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * How likely an identifier token is to survive a future render, by its SHAPE —
+ * framework-agnostic, so it catches generated ids/classes from any tool (this
+ * year's or next) without naming them. Returns `[0.02, 1]`.
+ *
+ * Volatile shapes (machine-generated): a `:` (React `useId` `:r1:`, Radix), a
+ * UUID, digit-heavy or trailing-digit tokens (`ember123`, `tab-2`), hex/hash
+ * runs (`css-1a2b3c`), or opaque wordless strings. Durable shapes (human
+ * authored): real word segments, kebab/snake of words (`settings-header`,
+ * `primary_email_select`).
+ */
+function tokenQuality(token) {
+    const t = token.trim();
+    if (!t) {
+        return 0.3;
+    }
+    // Kill signals — these tokens are (almost) always per-render generated.
+    if (t.includes(':') || UUID_RE.test(t)) {
+        return 0.05;
+    }
+    let q = 1;
+    const len = t.length;
+    const digits = (t.match(/\d/g) ?? []).length;
+    const digitRatio = digits / len;
+    // A trailing digit run after letters is the classic generated-id tail.
+    if (/[A-Za-z][-_]?\d+$/.test(t)) {
+        q *= 0.3;
+    }
+    if (digitRatio > 0.3) {
+        q *= 0.4;
+    }
+    else if (digitRatio > 0.15) {
+        q *= 0.7;
+    }
+    // A pure hex/short-hash run (`1a2b3c`, `deadbeef`) — no semantic content.
+    if (/^[0-9a-f]{6,}$/i.test(t)) {
+        q *= 0.15;
+    }
+    // A real word — an alpha run ≥3 that ITSELF contains a vowel — is the
+    // strongest durability signal; its absence means the token is opaque /
+    // hash-like (`css-1a2b3c`, `sc-bdfBwQ`). Checking per-segment matters: a
+    // stray vowel elsewhere in a hash must not count as "has a word".
+    const hasWord = (t.match(/[A-Za-z]+/g) ?? [])
+        .some((run) => run.length >= 3 && /[aeiou]/i.test(run));
+    if (!hasWord) {
+        q *= 0.3;
+    }
+    if (len > 40) {
+        q *= 0.6;
+    }
+    return Math.max(0.02, Math.min(1, q));
+}
+/** Stability score for a candidate: base weight for its kind × the shape
+ *  quality of its identifier, minus a small depth nudge so a nearer/shorter
+ *  anchor wins an otherwise-tie. Positional paths score on kind alone. */
+function anchorStability(c) {
+    const base = TYPE_WEIGHT[c.kind];
+    const quality = c.kind === 'positional' ? 1 : tokenQuality(c.token ?? '');
+    const depthNudge = 1 - Math.min(c.depth, 8) * 0.01;
+    return base * quality * depthNudge;
+}
 /**
  * A verified xPath to the tightest element containing one of `targets`, or
  * undefined if the value isn't present in the parsed tree. Prefers a short
@@ -45,14 +115,24 @@ export function elementAnchor(html, targets) {
     if (startIndex === null || endIndex === null) {
         return undefined;
     }
-    for (const candidate of candidateXPaths(el)) {
-        if (matchesUniquely(doc, candidate, el)) {
-            // `[startIndex, endIndex)` is exactly the slice the attestor reveals for
-            // this xPath (its getNodeRange uses these same parse5 source locations).
-            return { xPath: candidate, start: startIndex, end: endIndex };
-        }
+    // Score EVERY candidate that provably resolves (first-match, uniquely) to the
+    // target, and take the most durable — not merely the first that resolves.
+    // Because each survivor already matches uniquely NOW, the choice only trades
+    // on FUTURE stability; it can never pick a wrong/non-resolving node.
+    const verified = [...candidateXPaths(el)]
+        .map((c, i) => ({ c, i }))
+        .filter(({ c }) => matchesUniquely(doc, c.xPath, el));
+    if (!verified.length) {
+        return undefined;
     }
-    return undefined;
+    verified.sort((a, b) => {
+        return anchorStability(b.c) - anchorStability(a.c) ||
+            a.c.depth - b.c.depth ||
+            a.i - b.i;
+    });
+    // `[startIndex, endIndex)` is exactly the slice the attestor reveals for this
+    // xPath (its getNodeRange uses these same parse5 source locations).
+    return { xPath: verified[0].c.xPath, start: startIndex, end: endIndex };
 }
 /** The tightest element that DIRECTLY holds a target. Prefers a COMPLETE-value
  *  occurrence — an attribute whose value IS the target, or a text child that IS
@@ -97,46 +177,119 @@ function smallestElement(els) {
         .sort((a, b) => elementSpan(a) - elementSpan(b))
         .at(0);
 }
-/** Candidate xPaths for `el`, best (most stable / shortest) first. */
+/** Every candidate xPath for `el`, each tagged with what it anchors on. The
+ *  caller verifies + scores them ({@link anchorStability}) rather than trusting
+ *  emission order, so the DURABILITY winner is chosen, not the first that
+ *  resolves. Order here is only the final tie-break. */
 function* candidateXPaths(el) {
     const tag = el.name;
     const a = el.attribs ?? {};
     if (a.id) {
-        yield `//${tag}[@id=${xpathLiteral(a.id)}]`;
+        yield { xPath: `//${tag}[@id=${xpathLiteral(a.id)}]`, kind: 'id',
+            token: a.id, depth: 0 };
     }
     for (const name of IDENT_ATTRS) {
         if (a[name]) {
-            yield `//${tag}[@${name}=${xpathLiteral(a[name])}]`;
-        }
-    }
-    if (a.class) {
-        const distinctive = a.class
-            .split(/\s+/)
-            .filter(Boolean)
-            .sort((x, y) => y.length - x.length)[0];
-        if (distinctive) {
-            yield `//${tag}[contains(@class, ${xpathLiteral(distinctive)})]`;
+            yield { xPath: `//${tag}[@${name}=${xpathLiteral(a[name])}]`,
+                kind: 'ident-attr', token: a[name], depth: 0 };
         }
     }
     // A uniquely-identified DIRECT child pins the parent without a positional
-    // path (`//span[span[@id="labels"]]`). Self-verification (firstSelected)
-    // discards it when the child id/attr isn't unique — e.g. GitHub reuses
-    // `id="labels"` per email row — so it never silently matches the wrong node.
+    // path (`//span[span[@id="labels"]]`). Self-verification discards it when the
+    // child id/attr isn't unique — e.g. GitHub reuses `id="labels"` per email row
+    // — so it never silently matches the wrong node.
     for (const child of el.children) {
         if (!isTag(child)) {
             continue;
         }
         const ca = child.attribs ?? {};
         if (ca.id) {
-            yield `//${tag}[${child.name}[@id=${xpathLiteral(ca.id)}]]`;
+            yield { xPath: `//${tag}[${child.name}[@id=${xpathLiteral(ca.id)}]]`,
+                kind: 'id', token: ca.id, depth: 0 };
         }
         for (const name of IDENT_ATTRS) {
             if (ca[name]) {
-                yield `//${tag}[${child.name}[@${name}=${xpathLiteral(ca[name])}]]`;
+                yield {
+                    xPath: `//${tag}[${child.name}[@${name}=${xpathLiteral(ca[name])}]]`,
+                    kind: 'ident-attr', token: ca[name], depth: 0,
+                };
             }
         }
     }
-    yield absolutePath(el);
+    // The value element's own distinctive class.
+    const distinctive = distinctiveClass(a.class);
+    if (distinctive) {
+        yield { xPath: `//${tag}[contains(@class, ${xpathLiteral(distinctive)})]`,
+            kind: 'class', token: distinctive, depth: 0 };
+    }
+    // Ancestor-anchored (id/attr, then class), descending positionally to `el`.
+    yield* ancestorAnchoredCandidates(el);
+    yield { xPath: absolutePath(el), kind: 'positional', depth: 99 };
+}
+/** The longest whitespace-delimited token of a class attribute (the most
+ *  distinctive one), or undefined when there's no class. */
+function distinctiveClass(cls) {
+    return (cls ?? '')
+        .split(/\s+/)
+        .filter(Boolean)
+        .sort((x, y) => y.length - x.length)[0];
+}
+/** Positional path from `anc` (exclusive) down to `el` (inclusive), e.g.
+ *  `/ul[1]/li[3]/a[1]`; empty string when `anc` is not an ancestor of `el`. */
+function relativeSteps(anc, el) {
+    const parts = [];
+    let node = el;
+    while (node && isTag(node) && node !== anc) {
+        const tag = node.name;
+        let index = 1;
+        for (let sib = node.prev; sib; sib = sib.prev) {
+            if (isTag(sib) && sib.name === tag) {
+                index++;
+            }
+        }
+        parts.unshift(`/${tag}[${index}]`);
+        node = node.parent;
+    }
+    return node === anc ? parts.join('') : '';
+}
+/** Ancestors of `el` (nearest first) with their depth, skipping
+ *  `html`/`body`/`head` (≈ the absolute path) and non-ancestors. Capped depth
+ *  keeps paths short. */
+function* anchorAncestors(el) {
+    let depth = 1;
+    for (let anc = el.parent; anc && isTag(anc) && depth <= 10; anc = anc.parent, depth++) {
+        const tag = anc.name;
+        if (tag === 'html' || tag === 'body' || tag === 'head') {
+            continue;
+        }
+        const rel = relativeSteps(anc, el);
+        if (rel) {
+            yield { tag, attribs: anc.attribs ?? {}, rel, depth };
+        }
+    }
+}
+/** Ancestor-anchored candidates, descending positionally to `el`
+ *  (`//div[@id="nav"]/ul[1]/li[1]/a[1]`): an id / identifying-attr or a
+ *  distinctive-class anchor per ancestor, tagged with its kind + depth so the
+ *  scorer weighs a stable ancestor id above the value's own utility class. */
+function* ancestorAnchoredCandidates(el) {
+    for (const { tag, attribs, rel, depth } of anchorAncestors(el)) {
+        if (attribs.id) {
+            yield { xPath: `//${tag}[@id=${xpathLiteral(attribs.id)}]${rel}`,
+                kind: 'id', token: attribs.id, depth };
+        }
+        for (const name of IDENT_ATTRS) {
+            if (attribs[name]) {
+                const xp = `//${tag}[@${name}=${xpathLiteral(attribs[name])}]${rel}`;
+                yield { xPath: xp, kind: 'ident-attr', token: attribs[name], depth };
+            }
+        }
+        const dc = distinctiveClass(attribs.class);
+        if (dc) {
+            yield { xPath: `//${tag}[contains(@class, ${xpathLiteral(dc)})]${rel}`,
+                kind: 'class', token: dc, depth };
+        }
+    }
 }
 /** Chrome "full XPath"-style absolute path: `/html[1]/body[1]/…/tag[n]`, where
  *  n is the element's 1-based position among same-tag siblings. */

package/lib/provider/draft.d.ts

@@ -1,4 +1,10 @@
 import type { CapturedRequest, OprfMode, ReclaimProvider, ResponseMatch, ResponseRedaction, SecretParamRef } from './schema.ts';
+/** OPRF mode to apply when the caller passed none: the anti-leak floor —
+ *  force-hash a value whose SHAPE is unambiguous PII, but ONLY when it's
+ *  OPRF-hashable AND within the 62-byte MPC-circuit cap (UTF-8). Undefined =
+ *  leave plaintext (a longer value can't be OPRF'd; contextual PII + the proven
+ *  identity are the model's/plaintext call). */
+export declare function defaultSensitiveHash(value: string): OprfMode | undefined;
 /** One value to extract from the request: the captured `value`, a `name` (its
  *  param / capture-group), and an optional per-target OPRF `hash`. */
 export interface DraftTarget {

package/lib/provider/draft.js

@@ -1,6 +1,35 @@
-import { synthesizeMatcher } from "./matcher.js";
+import { isOprfHashable, OPRF_MAX_BYTES, synthesizeMatcher } from "./matcher.js";
 import { splitSecrets } from "./secrets.js";
-/** Request headers that must NOT survive into the provider params. Two kinds:
+/** OPRF mode for the auto-hash floor — TEE-native (attestor rejects oprf-raw,
+ *  isn't set up for gnark oprf). */
+const DEFAULT_SENSITIVE_HASH = 'oprf-mpc';
+// The deterministic ANTI-LEAK FLOOR: values whose SHAPE is unambiguously
+// sensitive PII, force-hashed no matter the field name or the model's judgment.
+// Deliberately only FIXED-FORMAT identifiers — OPRF is byte-exact, so a
+// self-mutable value (a display name re-cased) would be grindable and pointless
+// to hash; and a bare number is ambiguous (a private account id vs a PUBLIC
+// user id / follower count that's meant to be proven in the clear). Those
+// contextual calls are the model's, via an explicit per-target `hash`. This
+// floor is universal (not domain-specific) and high-precision.
+const EMAIL_VALUE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/;
+const SSN_VALUE = /^\d{3}-\d{2}-\d{4}$/;
+const IBAN_VALUE = /^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/;
+function isCanonicalPii(value) {
+    return EMAIL_VALUE.test(value)
+        || SSN_VALUE.test(value) || IBAN_VALUE.test(value);
+}
+/** OPRF mode to apply when the caller passed none: the anti-leak floor —
+ *  force-hash a value whose SHAPE is unambiguous PII, but ONLY when it's
+ *  OPRF-hashable AND within the 62-byte MPC-circuit cap (UTF-8). Undefined =
+ *  leave plaintext (a longer value can't be OPRF'd; contextual PII + the proven
+ *  identity are the model's/plaintext call). */
+export function defaultSensitiveHash(value) {
+    const hashable = isCanonicalPii(value)
+        && isOprfHashable(value)
+        && Buffer.byteLength(value, 'utf8') <= OPRF_MAX_BYTES;
+    return hashable ? DEFAULT_SENSITIVE_HASH : undefined;
+}
+/** Request headers that must NOT survive into the provider params. Three kinds:
  *  - Conditional headers (`if-none-match`/`if-modified-since`/…): a captured
  *    cached ETag/date makes the origin answer 304/412 when the attestor
  *    re-issues, and the attestor treats non-2xx as failure. We always want the
@@ -8,7 +37,14 @@ import { splitSecrets } from "./secrets.js";
  *  - Transfer headers the ATTESTOR sets itself (`connection: close`,
  *    `accept-encoding: identity`). Passing our own duplicates/collides with the
  *    request the attestor builds, so leave them out — the attestor already
- *    forces `identity` (uncompressed, so its byte-matching works). */
+ *    forces `identity` (uncompressed, so its byte-matching works).
+ *  - Host / framing headers the TRANSPORT owns (`host`, `content-length`,
+ *    `transfer-encoding`) and HTTP/2 pseudo-headers (`:authority`/`:method`/…,
+ *    which CDP surfaces on h2 captures). The attestor derives `Host` from the
+ *    URL and sets its own; a baked `Host` produces a DUPLICATE
+ *    (`found: h,h`) that fails the receipt check / 400s the origin. A stale
+ *    `content-length` breaks a re-serialized body. Pseudo-headers aren't valid
+ *    real headers at all. */
 const STRIP_REQUEST_HEADERS = new Set([
     'if-none-match',
     'if-modified-since',
@@ -17,14 +53,22 @@ const STRIP_REQUEST_HEADERS = new Set([
     'if-range',
     'connection',
     'accept-encoding',
+    'host',
+    'content-length',
+    'transfer-encoding',
 ]);
+/** True for an HTTP/2 pseudo-header (`:authority`, `:method`, `:path`,
+ *  `:scheme`) — never a valid request header the attestor can replay. */
+function isPseudoHeader(name) {
+    return name.startsWith(':');
+}
 /** Drop the headers the attestor manages or that would 304 at proof time
  *  (see {@link STRIP_REQUEST_HEADERS}); keep every other captured header so the
  *  attestor's replay looks like the browser's request. */
 function sanitizeRequestHeaders(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers)) {
-        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase())) {
+        if (STRIP_REQUEST_HEADERS.has(k.toLowerCase()) || isPseudoHeader(k)) {
             continue;
         }
         out[k] = v;
@@ -103,7 +147,12 @@ export function draftProvider(req, targets, name, hash) {
                 + 'give them distinct names');
         }
         seenParams.add(paramName);
-        const synthesis = synthesizeMatcher(req.responseBody, req.contentType, t.value, paramName, t.hash ?? hash);
+        // Precedence: explicit per-target hash → explicit request-wide hash →
+        // the anti-leak floor (force-OPRF values whose SHAPE is unambiguous PII).
+        // The model makes the contextual calls (which named fields are sensitive)
+        // via an explicit per-target hash; this floor only guarantees the obvious.
+        const effectiveHash = t.hash ?? hash ?? defaultSensitiveHash(t.value);
+        const synthesis = synthesizeMatcher(req.responseBody, req.contentType, t.value, paramName, effectiveHash);
         if (!synthesis) {
             throw new Error(`target value "${t.value}" not found in`
                 + ` response body for request ${req.requestId}`);

package/lib/provider/matcher.d.ts

@@ -31,3 +31,7 @@ export interface MatcherSynthesis {
  * proof time. Throws when `hash` is set on a free-form value (no safe class).
  */
 export declare function synthesizeMatcher(body: string, contentType: string, target: string, paramName: string, hash?: OprfMode): MatcherSynthesis | undefined;
+/** True when `target` has a character class safe to OPRF-hash. Free-form values
+ *  (names with spaces, arbitrary unicode/punctuation) return false — the caller
+ *  must NOT default them to a hash (it would throw in synthesizeMatcher). */
+export declare function isOprfHashable(target: string): boolean;

package/lib/provider/matcher.js

@@ -548,3 +548,9 @@ function inferValueClass(target) {
     }
     return undefined;
 }
+/** True when `target` has a character class safe to OPRF-hash. Free-form values
+ *  (names with spaces, arbitrary unicode/punctuation) return false — the caller
+ *  must NOT default them to a hash (it would throw in synthesizeMatcher). */
+export function isOprfHashable(target) {
+    return inferValueClass(target) !== undefined;
+}

package/lib/provider/to-version.d.ts

@@ -25,6 +25,19 @@ export interface AllowedJsRequest extends DraftRequest {
     multiple?: boolean;
     /** Fail validation if no request matches this template. Default true. */
     required?: boolean;
+    /** Names of `${var}` placeholders in this template's `responseMatches`/
+     *  `responseRedactions` that get substituted at verify time from the
+     *  submitted proof's own witness params (e.g. an index list a
+     *  `Reclaim.requestClaim` call attached alongside its `{{var}}`
+     *  extractions). Omit (or leave empty) when the template has no such
+     *  placeholders — verification then matches it literally as-is. */
+    templateParams?: string[];
+    /** How multiple values for `templateParams` expand into request specs.
+     *  `'separate'` (default): one independent spec per value, each expected
+     *  to match its own proof. `'merge'`: all values folded into ONE spec
+     *  with one `responseMatches`/`responseRedactions` entry per value,
+     *  matching a single proof that bundles them all into one claim. */
+    templateParamsMode?: 'separate' | 'merge';
 }
 /** Optional extras for a create-version body beyond the request list. */
 export interface CreateVersionOptions {

package/package.json

@@ -1,8 +1,8 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.9",
-	"description": "Reclaim Protocol agent — SDK, CLI, and MCP server in one package. SDK + CLI talk to the builder backend; MCP server adds Chrome CDP capture, provider synthesis, replay, and zkTLS proof.",
+	"version": "0.1.11",
+	"description": "Reclaim Protocol's tools for agents — Reclaim Protocol lets your app verify **data points** about its users — a follower count, an account balance, an order history. This package gives your AI coding agent the tools to **find, build, test and fix the _data verification providers_** (the recipes that verify a data point) by inspecting and replaying captured requests, checking sessions, evaluate proofs, publishing updates, and much more.",
 	"type": "module",
 	"main": "./lib/index.js",
 	"types": "./lib/index.d.ts",