@agentcred-ai/api 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 AgentCred Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,227 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  default: () => index_default
+});
+module.exports = __toCommonJS(index_exports);
+var import_hono = require("hono");
+var import_cors = require("hono/cors");
+var import_zod = require("zod");
+var import_jose = require("jose");
+var JwkSchema = import_zod.z.object({
+  kty: import_zod.z.literal("OKP"),
+  crv: import_zod.z.literal("Ed25519"),
+  x: import_zod.z.string(),
+  use: import_zod.z.literal("sig").optional(),
+  alg: import_zod.z.literal("EdDSA").optional()
+});
+var RegisterKeySchema = import_zod.z.object({
+  public_key: JwkSchema
+});
+var EnvelopeSchema = import_zod.z.object({
+  agentcred: import_zod.z.object({
+    v: import_zod.z.string(),
+    jws: import_zod.z.string(),
+    github: import_zod.z.string(),
+    agent: import_zod.z.string()
+  }),
+  content: import_zod.z.string()
+});
+async function checkRateLimit(kv, ip, endpoint, limit = 60) {
+  const minute = Math.floor(Date.now() / 6e4);
+  const key = `ratelimit:${ip}:${endpoint}:${minute}`;
+  const current = await kv.get(key);
+  const count = current ? parseInt(current, 10) : 0;
+  if (count >= limit) {
+    return false;
+  }
+  await kv.put(key, String(count + 1), { expirationTtl: 60 });
+  return true;
+}
+async function sha256Hex(content) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(content);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyGitHubToken(token) {
+  try {
+    const res = await fetch("https://api.github.com/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "User-Agent": "AgentCred-API/1.0"
+      }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return { login: data.login, id: data.id };
+  } catch {
+    return null;
+  }
+}
+var app = new import_hono.Hono();
+app.use(
+  "*",
+  (0, import_cors.cors)({
+    origin: "*",
+    allowMethods: ["GET", "POST"],
+    allowHeaders: ["Content-Type", "Authorization"]
+  })
+);
+app.post("/v1/keys", async (c) => {
+  const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+  const allowed = await checkRateLimit(c.env.KEYS, ip, "POST:/v1/keys", 10);
+  if (!allowed) {
+    return c.json({ error: "Rate limit exceeded" }, 429);
+  }
+  const authHeader = c.req.header("Authorization");
+  if (!authHeader?.startsWith("Bearer ")) {
+    return c.json({ error: "Missing or invalid Authorization header" }, 401);
+  }
+  const token = authHeader.slice(7);
+  const ghUser = await verifyGitHubToken(token);
+  if (!ghUser) {
+    return c.json({ error: "Invalid GitHub token" }, 401);
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const parsed = RegisterKeySchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: "Invalid request body", details: parsed.error.issues }, 400);
+  }
+  const storedKey = {
+    github: ghUser.login,
+    github_id: ghUser.id,
+    public_key: parsed.data.public_key,
+    registered_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await c.env.KEYS.put(`key:${ghUser.login}`, JSON.stringify(storedKey));
+  return c.json(
+    {
+      github: ghUser.login,
+      public_key: parsed.data.public_key,
+      registered_at: storedKey.registered_at
+    },
+    201
+  );
+});
+app.get("/v1/keys/:username", async (c) => {
+  const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+  const allowed = await checkRateLimit(c.env.KEYS, ip, "GET:/v1/keys", 120);
+  if (!allowed) {
+    return c.json({ error: "Rate limit exceeded" }, 429);
+  }
+  const username = c.req.param("username");
+  const stored = await c.env.KEYS.get(`key:${username}`);
+  if (!stored) {
+    return c.json({ error: "Key not found" }, 404);
+  }
+  const data = JSON.parse(stored);
+  return c.json({
+    github: data.github,
+    public_key: data.public_key,
+    registered_at: data.registered_at
+  });
+});
+app.post("/v1/verify", async (c) => {
+  const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+  const allowed = await checkRateLimit(c.env.KEYS, ip, "POST:/v1/verify", 60);
+  if (!allowed) {
+    return c.json({ error: "Rate limit exceeded" }, 429);
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  let envelopeData = body;
+  if (typeof body === "object" && body !== null && "envelope" in body) {
+    envelopeData = body.envelope;
+  }
+  const parsed = EnvelopeSchema.safeParse(envelopeData);
+  if (!parsed.success) {
+    return c.json(
+      { verified: false, error: "Invalid envelope format", details: parsed.error.issues },
+      400
+    );
+  }
+  const envelope = parsed.data;
+  const { jws, github: envelopeGithub } = envelope.agentcred;
+  const stored = await c.env.KEYS.get(`key:${envelopeGithub}`);
+  if (!stored) {
+    return c.json(
+      { verified: false, error: `No registered key for user: ${envelopeGithub}` },
+      404
+    );
+  }
+  const storedData = JSON.parse(stored);
+  try {
+    const publicKey = await (0, import_jose.importJWK)(
+      { ...storedData.public_key, kty: "OKP", crv: "Ed25519" },
+      "EdDSA"
+    );
+    const { payload, protectedHeader } = await (0, import_jose.compactVerify)(jws, publicKey);
+    if (protectedHeader.alg !== "EdDSA") {
+      return c.json({ verified: false, error: "Invalid algorithm" }, 400);
+    }
+    const payloadStr = new TextDecoder().decode(payload);
+    const payloadObj = JSON.parse(payloadStr);
+    const expectedIss = `${envelopeGithub}@agentcred`;
+    if (payloadObj.iss !== expectedIss) {
+      return c.json({ verified: false, error: "Issuer mismatch" }, 400);
+    }
+    const contentHash = await sha256Hex(envelope.content);
+    const expectedHash = `sha256:${contentHash}`;
+    if (payloadObj.content_hash !== expectedHash) {
+      return c.json({ verified: false, error: "Content hash mismatch - content was tampered" }, 400);
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const maxAge = 24 * 60 * 60;
+    if (Math.abs(now - payloadObj.iat) > maxAge) {
+      return c.json({ verified: false, error: "Signature expired or timestamp out of range" }, 400);
+    }
+    return c.json({
+      verified: true,
+      github: {
+        username: storedData.github,
+        id: storedData.github_id
+      },
+      agent: envelope.agentcred.agent,
+      signed_at: new Date(payloadObj.iat * 1e3).toISOString()
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    return c.json({ verified: false, error: `Verification failed: ${message}` }, 400);
+  }
+});
+app.get("/v1/health", (c) => {
+  return c.json({ status: "ok", version: "1.0.0" });
+});
+var index_default = app;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { Hono } from 'hono'\nimport { cors } from 'hono/cors'\nimport { z } from 'zod'\nimport { compactVerify, importJWK } from 'jose'\n\nexport type Env = {\n  Bindings: {\n    KEYS: KVNamespace\n  }\n}\n\nexport interface StoredKey {\n  github: string\n  github_id: number\n  public_key: JsonWebKey\n  registered_at: string\n}\n\nconst JwkSchema = z.object({\n  kty: z.literal('OKP'),\n  crv: z.literal('Ed25519'),\n  x: z.string(),\n  use: z.literal('sig').optional(),\n  alg: z.literal('EdDSA').optional(),\n})\n\nconst RegisterKeySchema = z.object({\n  public_key: JwkSchema,\n})\n\nconst EnvelopeSchema = z.object({\n  agentcred: z.object({\n    v: z.string(),\n    jws: z.string(),\n    github: z.string(),\n    agent: z.string(),\n  }),\n  content: z.string(),\n})\n\nasync function checkRateLimit(\n  kv: KVNamespace,\n  ip: string,\n  endpoint: string,\n  limit: number = 60\n): Promise<boolean> {\n  const minute = Math.floor(Date.now() / 60000)\n  const key = `ratelimit:${ip}:${endpoint}:${minute}`\n  const current = await kv.get(key)\n  const count = current ? parseInt(current, 10) : 0\n\n  if (count >= limit) {\n    return false\n  }\n\n  await kv.put(key, String(count + 1), { expirationTtl: 60 })\n  return true\n}\n\nasync function sha256Hex(content: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(content)\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data)\n  const hashArray = Array.from(new Uint8Array(hashBuffer))\n  return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nasync function verifyGitHubToken(\n  token: string\n): Promise<{ login: string; id: number } | null> {\n  try {\n    const res = await fetch('https://api.github.com/user', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n        Accept: 'application/vnd.github+json',\n        'User-Agent': 'AgentCred-API/1.0',\n      },\n    })\n    if (!res.ok) return null\n    const data = (await res.json()) as { login: string; id: number }\n    return { login: data.login, id: data.id }\n  } catch {\n    return null\n  }\n}\n\nconst app = new Hono<Env>()\n\napp.use(\n  '*',\n  cors({\n    origin: '*',\n    allowMethods: ['GET', 'POST'],\n    allowHeaders: ['Content-Type', 'Authorization'],\n  })\n)\n\napp.post('/v1/keys', async (c) => {\n  const ip = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown'\n  const allowed = await checkRateLimit(c.env.KEYS, ip, 'POST:/v1/keys', 10)\n  if (!allowed) {\n    return c.json({ error: 'Rate limit exceeded' }, 429)\n  }\n\n  const authHeader = c.req.header('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return c.json({ error: 'Missing or invalid Authorization header' }, 401)\n  }\n  const token = authHeader.slice(7)\n\n  const ghUser = await verifyGitHubToken(token)\n  if (!ghUser) {\n    return c.json({ error: 'Invalid GitHub token' }, 401)\n  }\n\n  let body: unknown\n  try {\n    body = await c.req.json()\n  } catch {\n    return c.json({ error: 'Invalid JSON body' }, 400)\n  }\n\n  const parsed = RegisterKeySchema.safeParse(body)\n  if (!parsed.success) {\n    return c.json({ error: 'Invalid request body', details: parsed.error.issues }, 400)\n  }\n\n  const storedKey: StoredKey = {\n    github: ghUser.login,\n    github_id: ghUser.id,\n    public_key: parsed.data.public_key as JsonWebKey,\n    registered_at: new Date().toISOString(),\n  }\n\n  await c.env.KEYS.put(`key:${ghUser.login}`, JSON.stringify(storedKey))\n\n  return c.json(\n    {\n      github: ghUser.login,\n      public_key: parsed.data.public_key,\n      registered_at: storedKey.registered_at,\n    },\n    201\n  )\n})\n\napp.get('/v1/keys/:username', async (c) => {\n  const ip = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown'\n  const allowed = await checkRateLimit(c.env.KEYS, ip, 'GET:/v1/keys', 120)\n  if (!allowed) {\n    return c.json({ error: 'Rate limit exceeded' }, 429)\n  }\n\n  const username = c.req.param('username')\n  const stored = await c.env.KEYS.get(`key:${username}`)\n\n  if (!stored) {\n    return c.json({ error: 'Key not found' }, 404)\n  }\n\n  const data: StoredKey = JSON.parse(stored)\n  return c.json({\n    github: data.github,\n    public_key: data.public_key,\n    registered_at: data.registered_at,\n  })\n})\n\napp.post('/v1/verify', async (c) => {\n  const ip = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown'\n  const allowed = await checkRateLimit(c.env.KEYS, ip, 'POST:/v1/verify', 60)\n  if (!allowed) {\n    return c.json({ error: 'Rate limit exceeded' }, 429)\n  }\n\n  let body: unknown\n  try {\n    body = await c.req.json()\n  } catch {\n    return c.json({ error: 'Invalid JSON body' }, 400)\n  }\n\n  let envelopeData: unknown = body\n  if (\n    typeof body === 'object' &&\n    body !== null &&\n    'envelope' in body\n  ) {\n    envelopeData = (body as Record<string, unknown>).envelope\n  }\n\n  const parsed = EnvelopeSchema.safeParse(envelopeData)\n  if (!parsed.success) {\n    return c.json(\n      { verified: false, error: 'Invalid envelope format', details: parsed.error.issues },\n      400\n    )\n  }\n\n  const envelope = parsed.data\n  const { jws, github: envelopeGithub } = envelope.agentcred\n\n  const stored = await c.env.KEYS.get(`key:${envelopeGithub}`)\n  if (!stored) {\n    return c.json(\n      { verified: false, error: `No registered key for user: ${envelopeGithub}` },\n      404\n    )\n  }\n\n  const storedData: StoredKey = JSON.parse(stored)\n\n  try {\n    const publicKey = await importJWK(\n      { ...storedData.public_key, kty: 'OKP', crv: 'Ed25519' },\n      'EdDSA'\n    )\n\n    const { payload, protectedHeader } = await compactVerify(jws, publicKey)\n\n    if (protectedHeader.alg !== 'EdDSA') {\n      return c.json({ verified: false, error: 'Invalid algorithm' }, 400)\n    }\n\n    const payloadStr = new TextDecoder().decode(payload)\n    const payloadObj = JSON.parse(payloadStr) as {\n      iss: string\n      sub: string\n      iat: number\n      content_hash: string\n      content_type?: string\n      nonce?: string\n    }\n\n    const expectedIss = `${envelopeGithub}@agentcred`\n    if (payloadObj.iss !== expectedIss) {\n      return c.json({ verified: false, error: 'Issuer mismatch' }, 400)\n    }\n\n    const contentHash = await sha256Hex(envelope.content)\n    const expectedHash = `sha256:${contentHash}`\n    if (payloadObj.content_hash !== expectedHash) {\n      return c.json({ verified: false, error: 'Content hash mismatch - content was tampered' }, 400)\n    }\n\n    // ±24 hours window per spec section 6.2\n    const now = Math.floor(Date.now() / 1000)\n    const maxAge = 24 * 60 * 60\n    if (Math.abs(now - payloadObj.iat) > maxAge) {\n      return c.json({ verified: false, error: 'Signature expired or timestamp out of range' }, 400)\n    }\n\n    return c.json({\n      verified: true,\n      github: {\n        username: storedData.github,\n        id: storedData.github_id,\n      },\n      agent: envelope.agentcred.agent,\n      signed_at: new Date(payloadObj.iat * 1000).toISOString(),\n    })\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Unknown error'\n    return c.json({ verified: false, error: `Verification failed: ${message}` }, 400)\n  }\n})\n\napp.get('/v1/health', (c) => {\n  return c.json({ status: 'ok', version: '1.0.0' })\n})\n\nexport default app\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAqB;AACrB,kBAAqB;AACrB,iBAAkB;AAClB,kBAAyC;AAezC,IAAM,YAAY,aAAE,OAAO;AAAA,EACzB,KAAK,aAAE,QAAQ,KAAK;AAAA,EACpB,KAAK,aAAE,QAAQ,SAAS;AAAA,EACxB,GAAG,aAAE,OAAO;AAAA,EACZ,KAAK,aAAE,QAAQ,KAAK,EAAE,SAAS;AAAA,EAC/B,KAAK,aAAE,QAAQ,OAAO,EAAE,SAAS;AACnC,CAAC;AAED,IAAM,oBAAoB,aAAE,OAAO;AAAA,EACjC,YAAY;AACd,CAAC;AAED,IAAM,iBAAiB,aAAE,OAAO;AAAA,EAC9B,WAAW,aAAE,OAAO;AAAA,IAClB,GAAG,aAAE,OAAO;AAAA,IACZ,KAAK,aAAE,OAAO;AAAA,IACd,QAAQ,aAAE,OAAO;AAAA,IACjB,OAAO,aAAE,OAAO;AAAA,EAClB,CAAC;AAAA,EACD,SAAS,aAAE,OAAO;AACpB,CAAC;AAED,eAAe,eACb,IACA,IACA,UACA,QAAgB,IACE;AAClB,QAAM,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;AAC5C,QAAM,MAAM,aAAa,EAAE,IAAI,QAAQ,IAAI,MAAM;AACjD,QAAM,UAAU,MAAM,GAAG,IAAI,GAAG;AAChC,QAAM,QAAQ,UAAU,SAAS,SAAS,EAAE,IAAI;AAEhD,MAAI,SAAS,OAAO;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,GAAG,IAAI,KAAK,OAAO,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,CAAC;AAC1D,SAAO;AACT;AAEA,eAAe,UAAU,SAAkC;AACzD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,OAAO;AACnC,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAC7D,QAAM,YAAY,MAAM,KAAK,IAAI,WAAW,UAAU,CAAC;AACvD,SAAO,UAAU,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAEA,eAAe,kBACb,OAC+C;AAC/C,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,+BAA+B;AAAA,MACrD,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,EAAE,OAAO,KAAK,OAAO,IAAI,KAAK,GAAG;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,MAAM,IAAI,iBAAU;AAE1B,IAAI;AAAA,EACF;AAAA,MACA,kBAAK;AAAA,IACH,QAAQ;AAAA,IACR,cAAc,CAAC,OAAO,MAAM;AAAA,IAC5B,cAAc,CAAC,gBAAgB,eAAe;AAAA,EAChD,CAAC;AACH;AAEA,IAAI,KAAK,YAAY,OAAO,MAAM;AAChC,QAAM,KAAK,EAAE,IAAI,OAAO,kBAAkB,KAAK,EAAE,IAAI,OAAO,iBAAiB,KAAK;AAClF,QAAM,UAAU,MAAM,eAAe,EAAE,IAAI,MAAM,IAAI,iBAAiB,EAAE;AACxE,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;AAAA,EACrD;AAEA,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,WAAO,EAAE,KAAK,EAAE,OAAO,0CAA0C,GAAG,GAAG;AAAA,EACzE;AACA,QAAM,QAAQ,WAAW,MAAM,CAAC;AAEhC,QAAM,SAAS,MAAM,kBAAkB,KAAK;AAC5C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;AAAA,EACtD;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,EAAE,IAAI,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,EACnD;AAEA,QAAM,SAAS,kBAAkB,UAAU,IAAI;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,SAAS,OAAO,MAAM,OAAO,GAAG,GAAG;AAAA,EACpF;AAEA,QAAM,YAAuB;AAAA,IAC3B,QAAQ,OAAO;AAAA,IACf,WAAW,OAAO;AAAA,IAClB,YAAY,OAAO,KAAK;AAAA,IACxB,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,EACxC;AAEA,QAAM,EAAE,IAAI,KAAK,IAAI,OAAO,OAAO,KAAK,IAAI,KAAK,UAAU,SAAS,CAAC;AAErE,SAAO,EAAE;AAAA,IACP;AAAA,MACE,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO,KAAK;AAAA,MACxB,eAAe,UAAU;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACF,CAAC;AAED,IAAI,IAAI,sBAAsB,OAAO,MAAM;AACzC,QAAM,KAAK,EAAE,IAAI,OAAO,kBAAkB,KAAK,EAAE,IAAI,OAAO,iBAAiB,KAAK;AAClF,QAAM,UAAU,MAAM,eAAe,EAAE,IAAI,MAAM,IAAI,gBAAgB,GAAG;AACxE,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;AAAA,EACrD;AAEA,QAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,QAAM,SAAS,MAAM,EAAE,IAAI,KAAK,IAAI,OAAO,QAAQ,EAAE;AAErD,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;AAAA,EAC/C;AAEA,QAAM,OAAkB,KAAK,MAAM,MAAM;AACzC,SAAO,EAAE,KAAK;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,eAAe,KAAK;AAAA,EACtB,CAAC;AACH,CAAC;AAED,IAAI,KAAK,cAAc,OAAO,MAAM;AAClC,QAAM,KAAK,EAAE,IAAI,OAAO,kBAAkB,KAAK,EAAE,IAAI,OAAO,iBAAiB,KAAK;AAClF,QAAM,UAAU,MAAM,eAAe,EAAE,IAAI,MAAM,IAAI,mBAAmB,EAAE;AAC1E,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;AAAA,EACrD;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,EAAE,IAAI,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,EACnD;AAEA,MAAI,eAAwB;AAC5B,MACE,OAAO,SAAS,YAChB,SAAS,QACT,cAAc,MACd;AACA,mBAAgB,KAAiC;AAAA,EACnD;AAEA,QAAM,SAAS,eAAe,UAAU,YAAY;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE;AAAA,MACP,EAAE,UAAU,OAAO,OAAO,2BAA2B,SAAS,OAAO,MAAM,OAAO;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,OAAO;AACxB,QAAM,EAAE,KAAK,QAAQ,eAAe,IAAI,SAAS;AAEjD,QAAM,SAAS,MAAM,EAAE,IAAI,KAAK,IAAI,OAAO,cAAc,EAAE;AAC3D,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE;AAAA,MACP,EAAE,UAAU,OAAO,OAAO,+BAA+B,cAAc,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAwB,KAAK,MAAM,MAAM;AAE/C,MAAI;AACF,UAAM,YAAY,UAAM;AAAA,MACtB,EAAE,GAAG,WAAW,YAAY,KAAK,OAAO,KAAK,UAAU;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,gBAAgB,IAAI,UAAM,2BAAc,KAAK,SAAS;AAEvE,QAAI,gBAAgB,QAAQ,SAAS;AACnC,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,oBAAoB,GAAG,GAAG;AAAA,IACpE;AAEA,UAAM,aAAa,IAAI,YAAY,EAAE,OAAO,OAAO;AACnD,UAAM,aAAa,KAAK,MAAM,UAAU;AASxC,UAAM,cAAc,GAAG,cAAc;AACrC,QAAI,WAAW,QAAQ,aAAa;AAClC,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,kBAAkB,GAAG,GAAG;AAAA,IAClE;AAEA,UAAM,cAAc,MAAM,UAAU,SAAS,OAAO;AACpD,UAAM,eAAe,UAAU,WAAW;AAC1C,QAAI,WAAW,iBAAiB,cAAc;AAC5C,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,+CAA+C,GAAG,GAAG;AAAA,IAC/F;AAGA,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,SAAS,KAAK,KAAK;AACzB,QAAI,KAAK,IAAI,MAAM,WAAW,GAAG,IAAI,QAAQ;AAC3C,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,8CAA8C,GAAG,GAAG;AAAA,IAC9F;AAEA,WAAO,EAAE,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,QAAQ;AAAA,QACN,UAAU,WAAW;AAAA,QACrB,IAAI,WAAW;AAAA,MACjB;AAAA,MACA,OAAO,SAAS,UAAU;AAAA,MAC1B,WAAW,IAAI,KAAK,WAAW,MAAM,GAAI,EAAE,YAAY;AAAA,IACzD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,wBAAwB,OAAO,GAAG,GAAG,GAAG;AAAA,EAClF;AACF,CAAC;AAED,IAAI,IAAI,cAAc,CAAC,MAAM;AAC3B,SAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,SAAS,QAAQ,CAAC;AAClD,CAAC;AAED,IAAO,gBAAQ;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,17 @@
+import * as hono_types from 'hono/types';
+import { Hono } from 'hono';
+
+type Env = {
+    Bindings: {
+        KEYS: KVNamespace;
+    };
+};
+interface StoredKey {
+    github: string;
+    github_id: number;
+    public_key: JsonWebKey;
+    registered_at: string;
+}
+declare const app: Hono<Env, hono_types.BlankSchema, "/">;
+
+export { type Env, type StoredKey, app as default };

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+import * as hono_types from 'hono/types';
+import { Hono } from 'hono';
+
+type Env = {
+    Bindings: {
+        KEYS: KVNamespace;
+    };
+};
+interface StoredKey {
+    github: string;
+    github_id: number;
+    public_key: JsonWebKey;
+    registered_at: string;
+}
+declare const app: Hono<Env, hono_types.BlankSchema, "/">;
+
+export { type Env, type StoredKey, app as default };

package/dist/index.js

@@ -0,0 +1,206 @@
+// src/index.ts
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { z } from "zod";
+import { compactVerify, importJWK } from "jose";
+var JwkSchema = z.object({
+  kty: z.literal("OKP"),
+  crv: z.literal("Ed25519"),
+  x: z.string(),
+  use: z.literal("sig").optional(),
+  alg: z.literal("EdDSA").optional()
+});
+var RegisterKeySchema = z.object({
+  public_key: JwkSchema
+});
+var EnvelopeSchema = z.object({
+  agentcred: z.object({
+    v: z.string(),
+    jws: z.string(),
+    github: z.string(),
+    agent: z.string()
+  }),
+  content: z.string()
+});
+async function checkRateLimit(kv, ip, endpoint, limit = 60) {
+  const minute = Math.floor(Date.now() / 6e4);
+  const key = `ratelimit:${ip}:${endpoint}:${minute}`;
+  const current = await kv.get(key);
+  const count = current ? parseInt(current, 10) : 0;
+  if (count >= limit) {
+    return false;
+  }
+  await kv.put(key, String(count + 1), { expirationTtl: 60 });
+  return true;
+}
+async function sha256Hex(content) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(content);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyGitHubToken(token) {
+  try {
+    const res = await fetch("https://api.github.com/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "User-Agent": "AgentCred-API/1.0"
+      }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return { login: data.login, id: data.id };
+  } catch {
+    return null;
+  }
+}
+var app = new Hono();
+app.use(
+  "*",
+  cors({
+    origin: "*",
+    allowMethods: ["GET", "POST"],
+    allowHeaders: ["Content-Type", "Authorization"]
+  })
+);
+app.post("/v1/keys", async (c) => {
+  const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+  const allowed = await checkRateLimit(c.env.KEYS, ip, "POST:/v1/keys", 10);
+  if (!allowed) {
+    return c.json({ error: "Rate limit exceeded" }, 429);
+  }
+  const authHeader = c.req.header("Authorization");
+  if (!authHeader?.startsWith("Bearer ")) {
+    return c.json({ error: "Missing or invalid Authorization header" }, 401);
+  }
+  const token = authHeader.slice(7);
+  const ghUser = await verifyGitHubToken(token);
+  if (!ghUser) {
+    return c.json({ error: "Invalid GitHub token" }, 401);
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const parsed = RegisterKeySchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: "Invalid request body", details: parsed.error.issues }, 400);
+  }
+  const storedKey = {
+    github: ghUser.login,
+    github_id: ghUser.id,
+    public_key: parsed.data.public_key,
+    registered_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await c.env.KEYS.put(`key:${ghUser.login}`, JSON.stringify(storedKey));
+  return c.json(
+    {
+      github: ghUser.login,
+      public_key: parsed.data.public_key,
+      registered_at: storedKey.registered_at
+    },
+    201
+  );
+});
+app.get("/v1/keys/:username", async (c) => {
+  const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+  const allowed = await checkRateLimit(c.env.KEYS, ip, "GET:/v1/keys", 120);
+  if (!allowed) {
+    return c.json({ error: "Rate limit exceeded" }, 429);
+  }
+  const username = c.req.param("username");
+  const stored = await c.env.KEYS.get(`key:${username}`);
+  if (!stored) {
+    return c.json({ error: "Key not found" }, 404);
+  }
+  const data = JSON.parse(stored);
+  return c.json({
+    github: data.github,
+    public_key: data.public_key,
+    registered_at: data.registered_at
+  });
+});
+app.post("/v1/verify", async (c) => {
+  const ip = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for") || "unknown";
+  const allowed = await checkRateLimit(c.env.KEYS, ip, "POST:/v1/verify", 60);
+  if (!allowed) {
+    return c.json({ error: "Rate limit exceeded" }, 429);
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  let envelopeData = body;
+  if (typeof body === "object" && body !== null && "envelope" in body) {
+    envelopeData = body.envelope;
+  }
+  const parsed = EnvelopeSchema.safeParse(envelopeData);
+  if (!parsed.success) {
+    return c.json(
+      { verified: false, error: "Invalid envelope format", details: parsed.error.issues },
+      400
+    );
+  }
+  const envelope = parsed.data;
+  const { jws, github: envelopeGithub } = envelope.agentcred;
+  const stored = await c.env.KEYS.get(`key:${envelopeGithub}`);
+  if (!stored) {
+    return c.json(
+      { verified: false, error: `No registered key for user: ${envelopeGithub}` },
+      404
+    );
+  }
+  const storedData = JSON.parse(stored);
+  try {
+    const publicKey = await importJWK(
+      { ...storedData.public_key, kty: "OKP", crv: "Ed25519" },
+      "EdDSA"
+    );
+    const { payload, protectedHeader } = await compactVerify(jws, publicKey);
+    if (protectedHeader.alg !== "EdDSA") {
+      return c.json({ verified: false, error: "Invalid algorithm" }, 400);
+    }
+    const payloadStr = new TextDecoder().decode(payload);
+    const payloadObj = JSON.parse(payloadStr);
+    const expectedIss = `${envelopeGithub}@agentcred`;
+    if (payloadObj.iss !== expectedIss) {
+      return c.json({ verified: false, error: "Issuer mismatch" }, 400);
+    }
+    const contentHash = await sha256Hex(envelope.content);
+    const expectedHash = `sha256:${contentHash}`;
+    if (payloadObj.content_hash !== expectedHash) {
+      return c.json({ verified: false, error: "Content hash mismatch - content was tampered" }, 400);
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const maxAge = 24 * 60 * 60;
+    if (Math.abs(now - payloadObj.iat) > maxAge) {
+      return c.json({ verified: false, error: "Signature expired or timestamp out of range" }, 400);
+    }
+    return c.json({
+      verified: true,
+      github: {
+        username: storedData.github,
+        id: storedData.github_id
+      },
+      agent: envelope.agentcred.agent,
+      signed_at: new Date(payloadObj.iat * 1e3).toISOString()
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    return c.json({ verified: false, error: `Verification failed: ${message}` }, 400);
+  }
+});
+app.get("/v1/health", (c) => {
+  return c.json({ status: "ok", version: "1.0.0" });
+});
+var index_default = app;
+export {
+  index_default as default
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { Hono } from 'hono'\nimport { cors } from 'hono/cors'\nimport { z } from 'zod'\nimport { compactVerify, importJWK } from 'jose'\n\nexport type Env = {\n  Bindings: {\n    KEYS: KVNamespace\n  }\n}\n\nexport interface StoredKey {\n  github: string\n  github_id: number\n  public_key: JsonWebKey\n  registered_at: string\n}\n\nconst JwkSchema = z.object({\n  kty: z.literal('OKP'),\n  crv: z.literal('Ed25519'),\n  x: z.string(),\n  use: z.literal('sig').optional(),\n  alg: z.literal('EdDSA').optional(),\n})\n\nconst RegisterKeySchema = z.object({\n  public_key: JwkSchema,\n})\n\nconst EnvelopeSchema = z.object({\n  agentcred: z.object({\n    v: z.string(),\n    jws: z.string(),\n    github: z.string(),\n    agent: z.string(),\n  }),\n  content: z.string(),\n})\n\nasync function checkRateLimit(\n  kv: KVNamespace,\n  ip: string,\n  endpoint: string,\n  limit: number = 60\n): Promise<boolean> {\n  const minute = Math.floor(Date.now() / 60000)\n  const key = `ratelimit:${ip}:${endpoint}:${minute}`\n  const current = await kv.get(key)\n  const count = current ? parseInt(current, 10) : 0\n\n  if (count >= limit) {\n    return false\n  }\n\n  await kv.put(key, String(count + 1), { expirationTtl: 60 })\n  return true\n}\n\nasync function sha256Hex(content: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(content)\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data)\n  const hashArray = Array.from(new Uint8Array(hashBuffer))\n  return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nasync function verifyGitHubToken(\n  token: string\n): Promise<{ login: string; id: number } | null> {\n  try {\n    const res = await fetch('https://api.github.com/user', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n        Accept: 'application/vnd.github+json',\n        'User-Agent': 'AgentCred-API/1.0',\n      },\n    })\n    if (!res.ok) return null\n    const data = (await res.json()) as { login: string; id: number }\n    return { login: data.login, id: data.id }\n  } catch {\n    return null\n  }\n}\n\nconst app = new Hono<Env>()\n\napp.use(\n  '*',\n  cors({\n    origin: '*',\n    allowMethods: ['GET', 'POST'],\n    allowHeaders: ['Content-Type', 'Authorization'],\n  })\n)\n\napp.post('/v1/keys', async (c) => {\n  const ip = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown'\n  const allowed = await checkRateLimit(c.env.KEYS, ip, 'POST:/v1/keys', 10)\n  if (!allowed) {\n    return c.json({ error: 'Rate limit exceeded' }, 429)\n  }\n\n  const authHeader = c.req.header('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return c.json({ error: 'Missing or invalid Authorization header' }, 401)\n  }\n  const token = authHeader.slice(7)\n\n  const ghUser = await verifyGitHubToken(token)\n  if (!ghUser) {\n    return c.json({ error: 'Invalid GitHub token' }, 401)\n  }\n\n  let body: unknown\n  try {\n    body = await c.req.json()\n  } catch {\n    return c.json({ error: 'Invalid JSON body' }, 400)\n  }\n\n  const parsed = RegisterKeySchema.safeParse(body)\n  if (!parsed.success) {\n    return c.json({ error: 'Invalid request body', details: parsed.error.issues }, 400)\n  }\n\n  const storedKey: StoredKey = {\n    github: ghUser.login,\n    github_id: ghUser.id,\n    public_key: parsed.data.public_key as JsonWebKey,\n    registered_at: new Date().toISOString(),\n  }\n\n  await c.env.KEYS.put(`key:${ghUser.login}`, JSON.stringify(storedKey))\n\n  return c.json(\n    {\n      github: ghUser.login,\n      public_key: parsed.data.public_key,\n      registered_at: storedKey.registered_at,\n    },\n    201\n  )\n})\n\napp.get('/v1/keys/:username', async (c) => {\n  const ip = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown'\n  const allowed = await checkRateLimit(c.env.KEYS, ip, 'GET:/v1/keys', 120)\n  if (!allowed) {\n    return c.json({ error: 'Rate limit exceeded' }, 429)\n  }\n\n  const username = c.req.param('username')\n  const stored = await c.env.KEYS.get(`key:${username}`)\n\n  if (!stored) {\n    return c.json({ error: 'Key not found' }, 404)\n  }\n\n  const data: StoredKey = JSON.parse(stored)\n  return c.json({\n    github: data.github,\n    public_key: data.public_key,\n    registered_at: data.registered_at,\n  })\n})\n\napp.post('/v1/verify', async (c) => {\n  const ip = c.req.header('cf-connecting-ip') || c.req.header('x-forwarded-for') || 'unknown'\n  const allowed = await checkRateLimit(c.env.KEYS, ip, 'POST:/v1/verify', 60)\n  if (!allowed) {\n    return c.json({ error: 'Rate limit exceeded' }, 429)\n  }\n\n  let body: unknown\n  try {\n    body = await c.req.json()\n  } catch {\n    return c.json({ error: 'Invalid JSON body' }, 400)\n  }\n\n  let envelopeData: unknown = body\n  if (\n    typeof body === 'object' &&\n    body !== null &&\n    'envelope' in body\n  ) {\n    envelopeData = (body as Record<string, unknown>).envelope\n  }\n\n  const parsed = EnvelopeSchema.safeParse(envelopeData)\n  if (!parsed.success) {\n    return c.json(\n      { verified: false, error: 'Invalid envelope format', details: parsed.error.issues },\n      400\n    )\n  }\n\n  const envelope = parsed.data\n  const { jws, github: envelopeGithub } = envelope.agentcred\n\n  const stored = await c.env.KEYS.get(`key:${envelopeGithub}`)\n  if (!stored) {\n    return c.json(\n      { verified: false, error: `No registered key for user: ${envelopeGithub}` },\n      404\n    )\n  }\n\n  const storedData: StoredKey = JSON.parse(stored)\n\n  try {\n    const publicKey = await importJWK(\n      { ...storedData.public_key, kty: 'OKP', crv: 'Ed25519' },\n      'EdDSA'\n    )\n\n    const { payload, protectedHeader } = await compactVerify(jws, publicKey)\n\n    if (protectedHeader.alg !== 'EdDSA') {\n      return c.json({ verified: false, error: 'Invalid algorithm' }, 400)\n    }\n\n    const payloadStr = new TextDecoder().decode(payload)\n    const payloadObj = JSON.parse(payloadStr) as {\n      iss: string\n      sub: string\n      iat: number\n      content_hash: string\n      content_type?: string\n      nonce?: string\n    }\n\n    const expectedIss = `${envelopeGithub}@agentcred`\n    if (payloadObj.iss !== expectedIss) {\n      return c.json({ verified: false, error: 'Issuer mismatch' }, 400)\n    }\n\n    const contentHash = await sha256Hex(envelope.content)\n    const expectedHash = `sha256:${contentHash}`\n    if (payloadObj.content_hash !== expectedHash) {\n      return c.json({ verified: false, error: 'Content hash mismatch - content was tampered' }, 400)\n    }\n\n    // ±24 hours window per spec section 6.2\n    const now = Math.floor(Date.now() / 1000)\n    const maxAge = 24 * 60 * 60\n    if (Math.abs(now - payloadObj.iat) > maxAge) {\n      return c.json({ verified: false, error: 'Signature expired or timestamp out of range' }, 400)\n    }\n\n    return c.json({\n      verified: true,\n      github: {\n        username: storedData.github,\n        id: storedData.github_id,\n      },\n      agent: envelope.agentcred.agent,\n      signed_at: new Date(payloadObj.iat * 1000).toISOString(),\n    })\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Unknown error'\n    return c.json({ verified: false, error: `Verification failed: ${message}` }, 400)\n  }\n})\n\napp.get('/v1/health', (c) => {\n  return c.json({ status: 'ok', version: '1.0.0' })\n})\n\nexport default app\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAS,SAAS;AAClB,SAAS,eAAe,iBAAiB;AAezC,IAAM,YAAY,EAAE,OAAO;AAAA,EACzB,KAAK,EAAE,QAAQ,KAAK;AAAA,EACpB,KAAK,EAAE,QAAQ,SAAS;AAAA,EACxB,GAAG,EAAE,OAAO;AAAA,EACZ,KAAK,EAAE,QAAQ,KAAK,EAAE,SAAS;AAAA,EAC/B,KAAK,EAAE,QAAQ,OAAO,EAAE,SAAS;AACnC,CAAC;AAED,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,YAAY;AACd,CAAC;AAED,IAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,WAAW,EAAE,OAAO;AAAA,IAClB,GAAG,EAAE,OAAO;AAAA,IACZ,KAAK,EAAE,OAAO;AAAA,IACd,QAAQ,EAAE,OAAO;AAAA,IACjB,OAAO,EAAE,OAAO;AAAA,EAClB,CAAC;AAAA,EACD,SAAS,EAAE,OAAO;AACpB,CAAC;AAED,eAAe,eACb,IACA,IACA,UACA,QAAgB,IACE;AAClB,QAAM,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;AAC5C,QAAM,MAAM,aAAa,EAAE,IAAI,QAAQ,IAAI,MAAM;AACjD,QAAM,UAAU,MAAM,GAAG,IAAI,GAAG;AAChC,QAAM,QAAQ,UAAU,SAAS,SAAS,EAAE,IAAI;AAEhD,MAAI,SAAS,OAAO;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,GAAG,IAAI,KAAK,OAAO,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,CAAC;AAC1D,SAAO;AACT;AAEA,eAAe,UAAU,SAAkC;AACzD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,OAAO;AACnC,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAC7D,QAAM,YAAY,MAAM,KAAK,IAAI,WAAW,UAAU,CAAC;AACvD,SAAO,UAAU,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAEA,eAAe,kBACb,OAC+C;AAC/C,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,+BAA+B;AAAA,MACrD,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,QACR,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,EAAE,OAAO,KAAK,OAAO,IAAI,KAAK,GAAG;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,MAAM,IAAI,KAAU;AAE1B,IAAI;AAAA,EACF;AAAA,EACA,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,cAAc,CAAC,OAAO,MAAM;AAAA,IAC5B,cAAc,CAAC,gBAAgB,eAAe;AAAA,EAChD,CAAC;AACH;AAEA,IAAI,KAAK,YAAY,OAAO,MAAM;AAChC,QAAM,KAAK,EAAE,IAAI,OAAO,kBAAkB,KAAK,EAAE,IAAI,OAAO,iBAAiB,KAAK;AAClF,QAAM,UAAU,MAAM,eAAe,EAAE,IAAI,MAAM,IAAI,iBAAiB,EAAE;AACxE,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;AAAA,EACrD;AAEA,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,WAAO,EAAE,KAAK,EAAE,OAAO,0CAA0C,GAAG,GAAG;AAAA,EACzE;AACA,QAAM,QAAQ,WAAW,MAAM,CAAC;AAEhC,QAAM,SAAS,MAAM,kBAAkB,KAAK;AAC5C,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;AAAA,EACtD;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,EAAE,IAAI,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,EACnD;AAEA,QAAM,SAAS,kBAAkB,UAAU,IAAI;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,SAAS,OAAO,MAAM,OAAO,GAAG,GAAG;AAAA,EACpF;AAEA,QAAM,YAAuB;AAAA,IAC3B,QAAQ,OAAO;AAAA,IACf,WAAW,OAAO;AAAA,IAClB,YAAY,OAAO,KAAK;AAAA,IACxB,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,EACxC;AAEA,QAAM,EAAE,IAAI,KAAK,IAAI,OAAO,OAAO,KAAK,IAAI,KAAK,UAAU,SAAS,CAAC;AAErE,SAAO,EAAE;AAAA,IACP;AAAA,MACE,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO,KAAK;AAAA,MACxB,eAAe,UAAU;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACF,CAAC;AAED,IAAI,IAAI,sBAAsB,OAAO,MAAM;AACzC,QAAM,KAAK,EAAE,IAAI,OAAO,kBAAkB,KAAK,EAAE,IAAI,OAAO,iBAAiB,KAAK;AAClF,QAAM,UAAU,MAAM,eAAe,EAAE,IAAI,MAAM,IAAI,gBAAgB,GAAG;AACxE,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;AAAA,EACrD;AAEA,QAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,QAAM,SAAS,MAAM,EAAE,IAAI,KAAK,IAAI,OAAO,QAAQ,EAAE;AAErD,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;AAAA,EAC/C;AAEA,QAAM,OAAkB,KAAK,MAAM,MAAM;AACzC,SAAO,EAAE,KAAK;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,eAAe,KAAK;AAAA,EACtB,CAAC;AACH,CAAC;AAED,IAAI,KAAK,cAAc,OAAO,MAAM;AAClC,QAAM,KAAK,EAAE,IAAI,OAAO,kBAAkB,KAAK,EAAE,IAAI,OAAO,iBAAiB,KAAK;AAClF,QAAM,UAAU,MAAM,eAAe,EAAE,IAAI,MAAM,IAAI,mBAAmB,EAAE;AAC1E,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;AAAA,EACrD;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,EAAE,IAAI,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,EACnD;AAEA,MAAI,eAAwB;AAC5B,MACE,OAAO,SAAS,YAChB,SAAS,QACT,cAAc,MACd;AACA,mBAAgB,KAAiC;AAAA,EACnD;AAEA,QAAM,SAAS,eAAe,UAAU,YAAY;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE;AAAA,MACP,EAAE,UAAU,OAAO,OAAO,2BAA2B,SAAS,OAAO,MAAM,OAAO;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,OAAO;AACxB,QAAM,EAAE,KAAK,QAAQ,eAAe,IAAI,SAAS;AAEjD,QAAM,SAAS,MAAM,EAAE,IAAI,KAAK,IAAI,OAAO,cAAc,EAAE;AAC3D,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE;AAAA,MACP,EAAE,UAAU,OAAO,OAAO,+BAA+B,cAAc,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAwB,KAAK,MAAM,MAAM;AAE/C,MAAI;AACF,UAAM,YAAY,MAAM;AAAA,MACtB,EAAE,GAAG,WAAW,YAAY,KAAK,OAAO,KAAK,UAAU;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,gBAAgB,IAAI,MAAM,cAAc,KAAK,SAAS;AAEvE,QAAI,gBAAgB,QAAQ,SAAS;AACnC,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,oBAAoB,GAAG,GAAG;AAAA,IACpE;AAEA,UAAM,aAAa,IAAI,YAAY,EAAE,OAAO,OAAO;AACnD,UAAM,aAAa,KAAK,MAAM,UAAU;AASxC,UAAM,cAAc,GAAG,cAAc;AACrC,QAAI,WAAW,QAAQ,aAAa;AAClC,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,kBAAkB,GAAG,GAAG;AAAA,IAClE;AAEA,UAAM,cAAc,MAAM,UAAU,SAAS,OAAO;AACpD,UAAM,eAAe,UAAU,WAAW;AAC1C,QAAI,WAAW,iBAAiB,cAAc;AAC5C,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,+CAA+C,GAAG,GAAG;AAAA,IAC/F;AAGA,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,SAAS,KAAK,KAAK;AACzB,QAAI,KAAK,IAAI,MAAM,WAAW,GAAG,IAAI,QAAQ;AAC3C,aAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,8CAA8C,GAAG,GAAG;AAAA,IAC9F;AAEA,WAAO,EAAE,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,QAAQ;AAAA,QACN,UAAU,WAAW;AAAA,QACrB,IAAI,WAAW;AAAA,MACjB;AAAA,MACA,OAAO,SAAS,UAAU;AAAA,MAC1B,WAAW,IAAI,KAAK,WAAW,MAAM,GAAI,EAAE,YAAY;AAAA,IACzD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,EAAE,KAAK,EAAE,UAAU,OAAO,OAAO,wBAAwB,OAAO,GAAG,GAAG,GAAG;AAAA,EAClF;AACF,CAAC;AAED,IAAI,IAAI,cAAc,CAAC,MAAM;AAC3B,SAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,SAAS,QAAQ,CAAC;AAClD,CAAC;AAED,IAAO,gBAAQ;","names":[]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@agentcred-ai/api",
+  "version": "0.1.0",
+  "description": "AgentCred API - Cloudflare Worker for credential verification",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.12.8",
+    "@cloudflare/workers-types": "^4.20260131.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.0.0",
+    "wrangler": "^4.61.1"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/agentcred-ai/agentcred",
+    "directory": "packages/api"
+  },
+  "homepage": "https://agentcred.dev",
+  "bugs": {
+    "url": "https://github.com/agentcred-ai/agentcred/issues"
+  },
+  "keywords": [
+    "agentcred",
+    "ai-agent",
+    "mcp",
+    "cryptography",
+    "ed25519",
+    "identity",
+    "signature"
+  ],
+  "author": "AgentCred Contributors",
+  "dependencies": {
+    "hono": "^4.11.7",
+    "jose": "^6.1.3",
+    "zod": "^4.3.6"
+  },
+  "scripts": {
+    "dev": "wrangler dev",
+    "build": "tsup",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}