@agenticprimitives/key-custody 1.0.0-alpha.20 → 1.0.0-alpha.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +27 -1
- package/dist/account.d.ts +2 -2
- package/dist/account.d.ts.map +1 -1
- package/dist/account.js.map +1 -1
- package/dist/derive-subject.d.ts +1 -0
- package/dist/derive-subject.d.ts.map +1 -1
- package/dist/derive-subject.js +11 -0
- package/dist/derive-subject.js.map +1 -1
- package/dist/factories.d.ts.map +1 -1
- package/dist/factories.js +23 -1
- package/dist/factories.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/providers/agentic.d.ts +107 -0
- package/dist/providers/agentic.d.ts.map +1 -0
- package/dist/providers/agentic.js +297 -0
- package/dist/providers/agentic.js.map +1 -0
- package/dist/types.d.ts +9 -2
- package/dist/types.d.ts.map +1 -1
- package/package.json +9 -5
package/README.md
CHANGED
|
@@ -28,9 +28,35 @@ const kmsAccount = await createKmsAccount(signer);
|
|
|
28
28
|
|
|
29
29
|
Beyond the basics: per-OIDC-subject signer derivation via HKDF (`deriveSubjectSigner`, [spec 235](../../specs/235-google-kms-custody.md)), a relay-only master signer that throws on any signing call (`getRelayOnlySigner`), and HMAC providers under the `/mac` subpath. Every decrypt and signing operation emits an audit row with `keyVersion` and a hashed session ID — the raw session ID is never logged.
|
|
30
30
|
|
|
31
|
+
## `agentic-kms` — the Agentic Key Custody Service backend
|
|
32
|
+
|
|
33
|
+
`backend: 'agentic-kms'` routes envelope data keys, MAC, generated-key signing and per-subject
|
|
34
|
+
derived signers to an AKCS deployment (HSM-rooted, confidential-VM custody; repo `faithkms`).
|
|
35
|
+
The adapter is `fetch` + Web Crypto only — no cloud SDK — and keeps every package rule: secrets are
|
|
36
|
+
`Uint8Array`, private keys never exist in this process, and there is **no fallback** to `local-aes`
|
|
37
|
+
or `gcp-kms` on a remote error.
|
|
38
|
+
|
|
39
|
+
```ts
|
|
40
|
+
import { buildKeyProvider, deriveSubjectSigner, staticTokenProvider, loadSecret } from '@agenticprimitives/key-custody';
|
|
41
|
+
|
|
42
|
+
const agenticKms = {
|
|
43
|
+
baseUrl: 'https://akcs.example.internal',
|
|
44
|
+
tenantId: 'my-tenant',
|
|
45
|
+
tokenProvider: () => getWorkloadToken(), // short-lived JWT for the AKCS audience
|
|
46
|
+
// dev only: staticTokenProvider(loadSecret(env.AKCS_TOKEN))
|
|
47
|
+
acceptedProtectionLevels: ['CVM_DERIVED', 'CVM_WRAPPED'], // add 'DEV_LOCAL' only in dev
|
|
48
|
+
};
|
|
49
|
+
const provider = buildKeyProvider({ backend: 'agentic-kms', agenticKms });
|
|
50
|
+
const signer = deriveSubjectSigner({ backend: 'agentic-kms', agenticKms, subject: { iss, sub } });
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
The exact `ap-oidc-custodian-secp256k1-v1` derivation runs inside AKCS; a legacy
|
|
54
|
+
`A2A_MASTER_PRIVATE_KEY`/custody root is imported there through a verified operator ceremony so
|
|
55
|
+
existing addresses are preserved. Cross-language vectors live in `test/vectors/`.
|
|
56
|
+
|
|
31
57
|
## Production guard
|
|
32
58
|
|
|
33
|
-
`local-aes` refuses to boot when `NODE_ENV=production`. AWS and
|
|
59
|
+
`local-aes` refuses to boot when `NODE_ENV=production`. AWS, GCP and `agentic-kms` backends have **no local fallback** — they fail-closed on outage. This is intentional: a key-custody layer that silently downgrades to a weaker backend is not a custody layer.
|
|
34
60
|
|
|
35
61
|
## How it's different
|
|
36
62
|
|
package/dist/account.d.ts
CHANGED
|
@@ -3,7 +3,7 @@ import type { KmsAccountBackend } from './types.js';
|
|
|
3
3
|
interface KMSSignerShape {
|
|
4
4
|
readonly address: Address;
|
|
5
5
|
readonly keyId: string;
|
|
6
|
-
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
6
|
+
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
7
7
|
signMessage(msg: string | {
|
|
8
8
|
raw: Hex;
|
|
9
9
|
}): Promise<Hex>;
|
|
@@ -17,7 +17,7 @@ interface KMSSignerShape {
|
|
|
17
17
|
export declare function createKmsAccount(backend: KmsAccountBackend, opts?: {
|
|
18
18
|
sessionId?: string;
|
|
19
19
|
chainId?: number;
|
|
20
|
-
provider?: 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
20
|
+
provider?: 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
21
21
|
}): Promise<KMSSignerShape>;
|
|
22
22
|
export {};
|
|
23
23
|
//# sourceMappingURL=account.d.ts.map
|
package/dist/account.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;IACvE,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAWD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAA;CAAE,GAC9G,OAAO,CAAC,cAAc,CAAC,CA0CzB"}
|
package/dist/account.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAA0B,MAAM,MAAM,CAAC;AAgBrF,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,IAA+
|
|
1
|
+
{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAA0B,MAAM,MAAM,CAAC;AAgBrF,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,IAA+G;IAE/G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACjD,uEAAuE;IACvE,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEpD,OAAO;QACL,OAAO;QACP,KAAK,EAAE,GAAG,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE;QAC7C,QAAQ;QAER,KAAK,CAAC,WAAW,CAAC,GAA0B;YAC1C,IAAI,MAAkB,CAAC;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBACzB,uBAAuB;oBACvB,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;gBAChD,MAAM;gBACN,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAC;YACH,OAAO,UAAU,CAAC,SAAS,CAAQ,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAI;YACtB,6EAA6E;YAC7E,MAAM,SAAS,GAAG,aAAa,CAAC,IAA2C,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;gBAChD,MAAM;gBACN,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAC;YACH,OAAO,UAAU,CAAC,SAAS,CAAQ,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/derive-subject.d.ts
CHANGED
|
@@ -32,6 +32,7 @@ export declare function deriveSubjectPrivateKeyHex(master: Uint8Array, subject:
|
|
|
32
32
|
* local-aes: HKDF-derive the key, wrap it in `LocalSecp256k1Signer` (which
|
|
33
33
|
* enforces the production guard — refuses NODE_ENV=production unless
|
|
34
34
|
* `A2A_ALLOW_LOCAL_MASTER_KEY=true`).
|
|
35
|
+
* agentic-kms: remote per-subject signer through AKCS (exact v1 derivation server-side).
|
|
35
36
|
* gcp-kms / aws-kms: not yet built — fail closed (spec 235 §10).
|
|
36
37
|
*/
|
|
37
38
|
export declare function deriveSubjectSigner(opts: DeriveSubjectOpts): KmsAccountBackend;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derive-subject.d.ts","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA0B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"derive-subject.d.ts","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA0B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAO3E,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,OAAO,EAAE,SAAS,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAUlE;AAkBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,GAAG,CAetF;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAsB9E"}
|
package/dist/derive-subject.js
CHANGED
|
@@ -29,6 +29,7 @@ import { sha256 } from '@noble/hashes/sha2.js';
|
|
|
29
29
|
import { secp256k1 } from '@noble/curves/secp256k1.js';
|
|
30
30
|
import { hexToBytes, bytesToHex } from 'viem';
|
|
31
31
|
import { LocalSecp256k1Signer } from './providers/local.js';
|
|
32
|
+
import { remoteSubjectSigner } from './providers/agentic.js';
|
|
32
33
|
const DERIVE_INFO_PREFIX = 'kms-custodian:v1';
|
|
33
34
|
const SECP256K1_N = secp256k1.Point.Fn.ORDER;
|
|
34
35
|
/**
|
|
@@ -120,6 +121,7 @@ function backendOf(opts) {
|
|
|
120
121
|
* local-aes: HKDF-derive the key, wrap it in `LocalSecp256k1Signer` (which
|
|
121
122
|
* enforces the production guard — refuses NODE_ENV=production unless
|
|
122
123
|
* `A2A_ALLOW_LOCAL_MASTER_KEY=true`).
|
|
124
|
+
* agentic-kms: remote per-subject signer through AKCS (exact v1 derivation server-side).
|
|
123
125
|
* gcp-kms / aws-kms: not yet built — fail closed (spec 235 §10).
|
|
124
126
|
*/
|
|
125
127
|
export function deriveSubjectSigner(opts) {
|
|
@@ -129,6 +131,15 @@ export function deriveSubjectSigner(opts) {
|
|
|
129
131
|
const privateKeyHex = deriveSubjectPrivateKeyHex(master, opts.subject);
|
|
130
132
|
return new LocalSecp256k1Signer({ privateKeyHex, auditSink: opts.auditSink });
|
|
131
133
|
}
|
|
134
|
+
if (backend === 'agentic-kms') {
|
|
135
|
+
// The exact v1 derivation (`ap-oidc-custodian-secp256k1-v1`) runs inside AKCS from the tenant
|
|
136
|
+
// signing seed; the private key never exists in this process. Legacy masters are imported into
|
|
137
|
+
// AKCS through an operator ceremony that verifies known addresses first.
|
|
138
|
+
if (!opts.agenticKms) {
|
|
139
|
+
throw new Error('deriveSubjectSigner (agentic-kms): opts.agenticKms { baseUrl, tenantId, tokenProvider } is required. No fallback (ADR-0013).');
|
|
140
|
+
}
|
|
141
|
+
return remoteSubjectSigner({ ...opts.agenticKms, ...(opts.auditSink ? { auditSink: opts.auditSink } : {}) }, opts.subject);
|
|
142
|
+
}
|
|
132
143
|
throw new Error(`deriveSubjectSigner: per-subject derivation is not yet implemented for backend "${backend}". ` +
|
|
133
144
|
`The KMS providers expose no per-subject MAC/key today. Use local-aes for the demo, or build ` +
|
|
134
145
|
`the production path per spec 235 §10 (a per-subject KMS HMAC or asymmetric key). ` +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derive-subject.js","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,4DAA4D;AAC5D,EAAE;AACF,4CAA4C;AAC5C,oEAAoE;AACpE,2FAA2F;AAC3F,4FAA4F;AAC5F,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"derive-subject.js","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,4DAA4D;AAC5D,EAAE;AACF,4CAA4C;AAC5C,oEAAoE;AACpE,2FAA2F;AAC3F,4FAA4F;AAC5F,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAgB7C;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAkB,EAAE,OAAkB;IAC/E,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CACd,MAAM,EACN,MAAM,EACN,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACnC,EAAE,CACH,CAAC;IACF,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,OAAO,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB;IACnD,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QACnE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,8EAA8E;IAC9E,yDAAyD;IACzD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,OAAO,IAAI,oBAAoB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,8FAA8F;QAC9F,+FAA+F;QAC/F,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,mBAAmB,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mFAAmF,OAAO,KAAK;QAC7F,8FAA8F;QAC9F,mFAAmF;QACnF,sDAAsD,CACzD,CAAC;AACJ,CAAC"}
|
package/dist/factories.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAwE3F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,CAiBhE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,0BAA0B,GAAG,cAAc,CAqBvF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAwBrE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,iBAAiB,CAU7F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GACd,iBAAiB,CAyBnB;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,CAMlF"}
|
package/dist/factories.js
CHANGED
|
@@ -1,6 +1,18 @@
|
|
|
1
1
|
import { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
|
|
2
2
|
import { AwsKmsProvider, AwsKmsSigner } from './providers/aws.js';
|
|
3
3
|
import { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
|
|
4
|
+
import { RemoteAgenticKmsProvider, RemoteAgenticKmsSigner } from './providers/agentic.js';
|
|
5
|
+
/**
|
|
6
|
+
* `agentic-kms` (AKCS) requires the typed remote config. No fallback to
|
|
7
|
+
* `local-aes` or `gcp-kms` on a missing/invalid config (ADR-0013).
|
|
8
|
+
*/
|
|
9
|
+
function agenticConfig(opts) {
|
|
10
|
+
if (!opts.agenticKms) {
|
|
11
|
+
throw new Error('[key-custody] backend "agentic-kms" requires opts.agenticKms { baseUrl, tenantId, tokenProvider }. ' +
|
|
12
|
+
'There is no fallback to local-aes or gcp-kms (ADR-0013).');
|
|
13
|
+
}
|
|
14
|
+
return { ...opts.agenticKms, ...(opts.auditSink ? { auditSink: opts.auditSink } : {}) };
|
|
15
|
+
}
|
|
4
16
|
/**
|
|
5
17
|
* Resolve effective environment for production-default gates (audit H1).
|
|
6
18
|
* 1. Explicit `opts.environment` wins.
|
|
@@ -48,7 +60,7 @@ function backendOrEnv(opts) {
|
|
|
48
60
|
return envBackend;
|
|
49
61
|
if (inferEnvironment(opts) === 'production') {
|
|
50
62
|
throw new Error('[key-custody] No backend specified for production. Pass `opts.backend` ' +
|
|
51
|
-
'(`gcp-kms` for real deploys; `local-aes` for dev) or set ' +
|
|
63
|
+
'(`gcp-kms` or `agentic-kms` for real deploys; `local-aes` for dev) or set ' +
|
|
52
64
|
'the A2A_KMS_BACKEND env var. There is no implicit fallback in production — ' +
|
|
53
65
|
'pass `developmentMode: true` to opt into the dev default. ' +
|
|
54
66
|
'(`aws-kms` is reserved but NOT implemented — selecting it fails fast.)');
|
|
@@ -69,6 +81,8 @@ export function buildKeyProvider(opts) {
|
|
|
69
81
|
// `key-custody.envelope.{wrap,unwrap}` on the production path.
|
|
70
82
|
auditSink: opts.auditSink,
|
|
71
83
|
});
|
|
84
|
+
case 'agentic-kms':
|
|
85
|
+
return new RemoteAgenticKmsProvider(agenticConfig(opts));
|
|
72
86
|
}
|
|
73
87
|
}
|
|
74
88
|
export function selectVaultKeyProvider(opts) {
|
|
@@ -106,6 +120,14 @@ export function buildSignerBackend(opts) {
|
|
|
106
120
|
serviceAccountJson: opts.config?.serviceAccountJson,
|
|
107
121
|
auditSink: opts.auditSink,
|
|
108
122
|
});
|
|
123
|
+
case 'agentic-kms': {
|
|
124
|
+
// A generated SIGNING key in AKCS, addressed by its logical key id (UUID).
|
|
125
|
+
const keyId = opts.config?.agenticKeyId;
|
|
126
|
+
if (!keyId) {
|
|
127
|
+
throw new Error('[key-custody] agentic-kms signer requires config.agenticKeyId (an AKCS SIGNING key id). No fallback (ADR-0013).');
|
|
128
|
+
}
|
|
129
|
+
return new RemoteAgenticKmsSigner(agenticConfig(opts), { kind: 'key', keyId });
|
|
130
|
+
}
|
|
109
131
|
}
|
|
110
132
|
}
|
|
111
133
|
/**
|
package/dist/factories.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"factories.js","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"factories.js","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAyB,MAAM,wBAAwB,CAAC;AAEjH;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAe;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,qGAAqG;YACnG,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAe;IACvC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC9C,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAe;IACnC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,4EAA4E;YAC5E,6EAA6E;YAC7E,4DAA4D;YAC5D,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAe;IAC9C,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,EAAE,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,CAAC;gBACxB,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;gBACnD,qEAAqE;gBACrE,+DAA+D;gBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,aAAa;YAChB,OAAO,IAAI,wBAAwB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AA2BD,MAAM,UAAU,sBAAsB,CAAC,IAAgC;IACrE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,IAAI,cAAc,CAAC;YACxB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,iFAAiF;QACjF,kFAAkF;QAClF,OAAO,IAAI,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+FAA+F;QAC7F,4FAA4F;QAC5F,mEAAmE,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,CAAC;gBACtB,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB;gBACvD,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;gBACnD,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,2EAA2E;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;YACrI,CAAC;YACD,OAAO,IAAI,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAgB;IACxE,MAAM,IAAI,KAAK,CACb,8FAA8F;QAC5F,0FAA0F;QAC1F,0EAA0E;QAC1E,sFAAsF;QACtF,8DAA8D;QAC9D,6DAA6D;QAC7D,uEAAuE,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAc,EACd,IAAe;IAEf,KAAK,MAAM,CAAC;IACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,sFAAsF;YACtF,mFAAmF;YACnF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,0BAA0B,KAAK,MAAM,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,8EAA8E;YAC9E,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAe;IAChE,uDAAuD;IACvD,4EAA4E;IAC5E,gCAAgC;IAChC,KAAK,QAAQ,CAAC;IACd,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -12,4 +12,5 @@ export { createSpendCappedAccount, SpendCapExceededError, type CreateSpendCapped
|
|
|
12
12
|
export { canonicalContextBytes } from './aad.js';
|
|
13
13
|
export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
|
|
14
14
|
export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
|
|
15
|
+
export { RemoteAgenticKmsProvider, RemoteAgenticKmsSigner, remoteSubjectSigner, staticTokenProvider, AgenticKmsError, type AgenticKmsConfig, type TokenProvider, type AkcsProtectionLevel, type AkcsSigningPurpose, } from './providers/agentic.js';
|
|
15
16
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAWlB,mCAAmC,EACnC,gBAAgB,EAEhB,sBAAsB,EACtB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAU9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAWlB,mCAAmC,EACnC,gBAAgB,EAEhB,sBAAsB,EACtB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAU9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -38,4 +38,6 @@ export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
|
|
|
38
38
|
// local-aes (dev). When AWS lands, re-add the export alongside the
|
|
39
39
|
// LocalAes + Gcp providers.
|
|
40
40
|
export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
|
|
41
|
+
// AKCS remote backend (`agentic-kms`): thin fetch + Web Crypto adapter, no cloud SDK, no fallback.
|
|
42
|
+
export { RemoteAgenticKmsProvider, RemoteAgenticKmsSigner, remoteSubjectSigner, staticTokenProvider, AgenticKmsError, } from './providers/agentic.js';
|
|
41
43
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAM5D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB;AAClB,qEAAqE;AACrE,wEAAwE;AACxE,iDAAiD;AACjD,6DAA6D;AAC7D,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,yDAAyD;AACzD,qEAAqE;AACrE,0DAA0D;AAC1D,mCAAmC,EACnC,gBAAgB;AAChB,6FAA6F;AAC7F,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AACxB,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,mGAAmG;AACnG,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,mEAAmE;AACnE,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAM5D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB;AAClB,qEAAqE;AACrE,wEAAwE;AACxE,iDAAiD;AACjD,6DAA6D;AAC7D,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,yDAAyD;AACzD,qEAAqE;AACrE,0DAA0D;AAC1D,mCAAmC,EACnC,gBAAgB;AAChB,6FAA6F;AAC7F,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AACxB,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,mGAAmG;AACnG,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,mEAAmE;AACnE,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,mGAAmG;AACnG,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAKhB,MAAM,wBAAwB,CAAC"}
|
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
import type { Address } from '@agenticprimitives/types';
|
|
2
|
+
import { type AuditSink } from '@agenticprimitives/audit';
|
|
3
|
+
import type { A2AKeyProvider, KmsAccountBackend, Secret } from '../types.js';
|
|
4
|
+
/** Acquire a short-lived workload token for the AKCS audience, just in time. */
|
|
5
|
+
export type TokenProvider = () => Promise<string>;
|
|
6
|
+
export type AkcsProtectionLevel = 'DEV_LOCAL' | 'CVM_DERIVED' | 'CVM_WRAPPED' | 'AZURE_HSM_DIRECT' | 'FUTURE_PKCS11_DIRECT';
|
|
7
|
+
export type AkcsSigningPurpose = 'EIP712' | 'ERC4337_USER_OPERATION' | 'EIP7702_AUTHORIZATION' | 'PERSONAL_SIGN_DIGEST' | 'RAW_32_BYTE_DIGEST';
|
|
8
|
+
/**
|
|
9
|
+
* Typed remote configuration (spec §2.4 item 4): no bearer tokens in a plain
|
|
10
|
+
* `Record<string,string>`. Static tokens are not accepted; supply a
|
|
11
|
+
* `tokenProvider`, or a `Secret` holding a token for dev fixtures only.
|
|
12
|
+
*/
|
|
13
|
+
export interface AgenticKmsConfig {
|
|
14
|
+
baseUrl: string;
|
|
15
|
+
tenantId: string;
|
|
16
|
+
tokenProvider: TokenProvider;
|
|
17
|
+
/** Accepted protection levels. Defaults to CVM/HSM levels; add DEV_LOCAL only for dev. */
|
|
18
|
+
acceptedProtectionLevels?: AkcsProtectionLevel[];
|
|
19
|
+
/** Purpose for envelope operations (an ACTIVE ENVELOPE key with this purpose must exist in the tenant). */
|
|
20
|
+
envelopePurpose?: string;
|
|
21
|
+
/** Default signing purpose for `signA2AAction` (32-byte digests of userOps / EIP-712). */
|
|
22
|
+
signingPurpose?: AkcsSigningPurpose;
|
|
23
|
+
chainId?: number;
|
|
24
|
+
timeoutMs?: number;
|
|
25
|
+
maxRetries?: number;
|
|
26
|
+
fetch?: typeof fetch;
|
|
27
|
+
}
|
|
28
|
+
/** Dev helper: wrap a fixture token `Secret` as a provider. Never use in production. */
|
|
29
|
+
export declare function staticTokenProvider(token: Secret<'akcs-token'>): TokenProvider;
|
|
30
|
+
export declare class AgenticKmsError extends Error {
|
|
31
|
+
readonly httpStatus: number;
|
|
32
|
+
readonly code: string;
|
|
33
|
+
readonly requestId: string;
|
|
34
|
+
readonly retryable: boolean;
|
|
35
|
+
constructor(httpStatus: number, code: string, message: string, requestId: string, retryable: boolean);
|
|
36
|
+
}
|
|
37
|
+
/** Envelope data keys + domain-separated MAC via AKCS. Implements `A2AKeyProvider`. */
|
|
38
|
+
export declare class RemoteAgenticKmsProvider implements A2AKeyProvider {
|
|
39
|
+
#private;
|
|
40
|
+
readonly keyVersion: string;
|
|
41
|
+
constructor(cfg: AgenticKmsConfig & {
|
|
42
|
+
auditSink?: AuditSink;
|
|
43
|
+
});
|
|
44
|
+
generateSessionDataKey(input: {
|
|
45
|
+
aadContext: Record<string, string>;
|
|
46
|
+
}): Promise<{
|
|
47
|
+
plaintextDataKey: Uint8Array<ArrayBufferLike>;
|
|
48
|
+
encryptedDataKey: Uint8Array<ArrayBufferLike>;
|
|
49
|
+
keyId: string;
|
|
50
|
+
keyVersion: string;
|
|
51
|
+
}>;
|
|
52
|
+
decryptSessionDataKey(input: {
|
|
53
|
+
encryptedDataKey: Uint8Array;
|
|
54
|
+
aadContext: Record<string, string>;
|
|
55
|
+
keyId: string;
|
|
56
|
+
keyVersion: string;
|
|
57
|
+
}): Promise<Uint8Array<ArrayBufferLike>>;
|
|
58
|
+
generateMac(input: {
|
|
59
|
+
canonicalMessage: Uint8Array;
|
|
60
|
+
service: string;
|
|
61
|
+
audience: string;
|
|
62
|
+
routeFamily?: string;
|
|
63
|
+
}): Promise<{
|
|
64
|
+
mac: Uint8Array<ArrayBufferLike>;
|
|
65
|
+
keyId: string;
|
|
66
|
+
}>;
|
|
67
|
+
}
|
|
68
|
+
type SignerTarget = {
|
|
69
|
+
kind: 'key';
|
|
70
|
+
keyId: string;
|
|
71
|
+
} | {
|
|
72
|
+
kind: 'subject';
|
|
73
|
+
iss: string;
|
|
74
|
+
sub: string;
|
|
75
|
+
rotation: number;
|
|
76
|
+
};
|
|
77
|
+
/** secp256k1 signer via AKCS (generated key or per-subject derived signer). Implements `KmsAccountBackend`. */
|
|
78
|
+
export declare class RemoteAgenticKmsSigner implements KmsAccountBackend {
|
|
79
|
+
#private;
|
|
80
|
+
readonly provider: "agentic-kms";
|
|
81
|
+
constructor(cfg: AgenticKmsConfig & {
|
|
82
|
+
auditSink?: AuditSink;
|
|
83
|
+
}, target: SignerTarget);
|
|
84
|
+
getSignerAddress(): Promise<Address>;
|
|
85
|
+
signA2AAction(input: {
|
|
86
|
+
digest: Uint8Array;
|
|
87
|
+
auditContext?: {
|
|
88
|
+
toolId?: string;
|
|
89
|
+
sessionId?: string;
|
|
90
|
+
actionId?: string;
|
|
91
|
+
};
|
|
92
|
+
}): Promise<{
|
|
93
|
+
signature: Uint8Array<ArrayBufferLike>;
|
|
94
|
+
keyId: string;
|
|
95
|
+
signerAddress: `0x${string}`;
|
|
96
|
+
}>;
|
|
97
|
+
}
|
|
98
|
+
/** Build a per-subject remote signer (used by `deriveSubjectSigner` for `agentic-kms`). */
|
|
99
|
+
export declare function remoteSubjectSigner(cfg: AgenticKmsConfig & {
|
|
100
|
+
auditSink?: AuditSink;
|
|
101
|
+
}, subject: {
|
|
102
|
+
iss: string;
|
|
103
|
+
sub: string;
|
|
104
|
+
rotation?: number;
|
|
105
|
+
}): RemoteAgenticKmsSigner;
|
|
106
|
+
export {};
|
|
107
|
+
//# sourceMappingURL=agentic.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agentic.d.ts","sourceRoot":"","sources":["../../src/providers/agentic.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG7E,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;AAC5H,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,oBAAoB,CAAC;AAE/I;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,0FAA0F;IAC1F,wBAAwB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjD,2GAA2G;IAC3G,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,aAAa,CAE9E;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO;gBAAnH,UAAU,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM,EAAW,SAAS,EAAE,OAAO;CAIzI;AAyID,uFAAuF;AACvF,qBAAa,wBAAyB,YAAW,cAAc;;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAKhB,GAAG,EAAE,gBAAgB,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IAQvD,sBAAsB,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;IAWpE,qBAAqB,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAWpI,WAAW,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;;CAWnH;AAID,KAAK,YAAY,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAErH,+GAA+G;AAC/G,qBAAa,sBAAuB,YAAW,iBAAiB;;IAC9D,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;gBAQ/B,GAAG,EAAE,gBAAgB,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,EAAE,MAAM,EAAE,YAAY;IAQ7E,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAiBpC,aAAa,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;;;;;CA2C7H;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG;IAAE,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAEvK"}
|
|
@@ -0,0 +1,297 @@
|
|
|
1
|
+
// RemoteAgenticKmsProvider / RemoteAgenticKmsSigner — the `agentic-kms` backend.
|
|
2
|
+
//
|
|
3
|
+
// Thin remote adapter for the Agentic Key Custody Service (AKCS). It keeps the
|
|
4
|
+
// package's rules: no cloud SDK, no private key material in TypeScript, no
|
|
5
|
+
// fallback to any other backend on failure (ADR-0013), secrets as Uint8Array,
|
|
6
|
+
// raw sessionId never logged. Private keys are never reconstructed here — AKCS
|
|
7
|
+
// signs and returns `r||s||v`.
|
|
8
|
+
//
|
|
9
|
+
// Transport: `fetch` + Web Crypto only (runs on Workers/Node). Every crypto call
|
|
10
|
+
// carries Idempotency-Key, X-AKCS-Timestamp and X-AKCS-Body-SHA256 (AKCS
|
|
11
|
+
// contract v1). Retries happen only for `retryable` errors with the SAME
|
|
12
|
+
// idempotency key, so a retry can never double-execute.
|
|
13
|
+
import { keccak_256 } from '@noble/hashes/sha3.js';
|
|
14
|
+
import { buildEvent } from '@agenticprimitives/audit';
|
|
15
|
+
import { unwrapSecret } from '../types.js';
|
|
16
|
+
/** Dev helper: wrap a fixture token `Secret` as a provider. Never use in production. */
|
|
17
|
+
export function staticTokenProvider(token) {
|
|
18
|
+
return async () => unwrapSecret(token);
|
|
19
|
+
}
|
|
20
|
+
export class AgenticKmsError extends Error {
|
|
21
|
+
httpStatus;
|
|
22
|
+
code;
|
|
23
|
+
requestId;
|
|
24
|
+
retryable;
|
|
25
|
+
constructor(httpStatus, code, message, requestId, retryable) {
|
|
26
|
+
super(`[agentic-kms] ${code}: ${message} (request ${requestId})`);
|
|
27
|
+
this.httpStatus = httpStatus;
|
|
28
|
+
this.code = code;
|
|
29
|
+
this.requestId = requestId;
|
|
30
|
+
this.retryable = retryable;
|
|
31
|
+
this.name = 'AgenticKmsError';
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
const DEFAULT_LEVELS = ['CVM_DERIVED', 'CVM_WRAPPED', 'AZURE_HSM_DIRECT'];
|
|
35
|
+
// ---------------------------------------------------------------- transport
|
|
36
|
+
function b64url(bytes) {
|
|
37
|
+
let s = '';
|
|
38
|
+
for (let i = 0; i < bytes.length; i++)
|
|
39
|
+
s += String.fromCharCode(bytes[i]);
|
|
40
|
+
return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
41
|
+
}
|
|
42
|
+
function b64urlDecode(s) {
|
|
43
|
+
const pad = s.length % 4 === 0 ? '' : '='.repeat(4 - (s.length % 4));
|
|
44
|
+
const bin = atob(s.replace(/-/g, '+').replace(/_/g, '/') + pad);
|
|
45
|
+
const out = new Uint8Array(bin.length);
|
|
46
|
+
for (let i = 0; i < bin.length; i++)
|
|
47
|
+
out[i] = bin.charCodeAt(i);
|
|
48
|
+
return out;
|
|
49
|
+
}
|
|
50
|
+
function hex(bytes) {
|
|
51
|
+
let s = '';
|
|
52
|
+
for (let i = 0; i < bytes.length; i++)
|
|
53
|
+
s += bytes[i].toString(16).padStart(2, '0');
|
|
54
|
+
return `0x${s}`;
|
|
55
|
+
}
|
|
56
|
+
function unhex(h) {
|
|
57
|
+
const s = h.startsWith('0x') ? h.slice(2) : h;
|
|
58
|
+
const out = new Uint8Array(s.length / 2);
|
|
59
|
+
for (let i = 0; i < out.length; i++)
|
|
60
|
+
out[i] = parseInt(s.slice(i * 2, i * 2 + 2), 16);
|
|
61
|
+
return out;
|
|
62
|
+
}
|
|
63
|
+
function randomKey() {
|
|
64
|
+
const r = new Uint8Array(24);
|
|
65
|
+
crypto.getRandomValues(r);
|
|
66
|
+
return b64url(r);
|
|
67
|
+
}
|
|
68
|
+
function uuid() {
|
|
69
|
+
const b = new Uint8Array(16);
|
|
70
|
+
crypto.getRandomValues(b);
|
|
71
|
+
b[6] = (b[6] & 0x0f) | 0x40;
|
|
72
|
+
b[8] = (b[8] & 0x3f) | 0x80;
|
|
73
|
+
const h = Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
|
|
74
|
+
return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
|
|
75
|
+
}
|
|
76
|
+
class Transport {
|
|
77
|
+
#cfg;
|
|
78
|
+
constructor(cfg) {
|
|
79
|
+
if (!cfg.baseUrl || !cfg.tenantId || typeof cfg.tokenProvider !== 'function') {
|
|
80
|
+
throw new Error('[agentic-kms] baseUrl, tenantId and tokenProvider are required');
|
|
81
|
+
}
|
|
82
|
+
// Never store a detached reference to the platform fetch: Cloudflare Workers (workerd) throws
|
|
83
|
+
// "Illegal invocation: incorrect `this`" when a stored `globalThis.fetch` is called as a method.
|
|
84
|
+
const f = cfg.fetch ?? ((input, init) => globalThis.fetch(input, init));
|
|
85
|
+
if (typeof globalThis.fetch !== 'function' && !cfg.fetch)
|
|
86
|
+
throw new Error('[agentic-kms] fetch is not available');
|
|
87
|
+
this.#cfg = {
|
|
88
|
+
baseUrl: cfg.baseUrl.replace(/\/+$/, ''),
|
|
89
|
+
tenantId: cfg.tenantId,
|
|
90
|
+
tokenProvider: cfg.tokenProvider,
|
|
91
|
+
timeoutMs: cfg.timeoutMs ?? 10_000,
|
|
92
|
+
maxRetries: cfg.maxRetries ?? 2,
|
|
93
|
+
fetch: f,
|
|
94
|
+
levels: cfg.acceptedProtectionLevels ?? DEFAULT_LEVELS,
|
|
95
|
+
};
|
|
96
|
+
}
|
|
97
|
+
checkLevel(level) {
|
|
98
|
+
if (typeof level !== 'string' || !this.#cfg.levels.includes(level)) {
|
|
99
|
+
throw new Error(`[agentic-kms] protection level ${String(level)} not accepted (no downgrade; accepted: ${this.#cfg.levels.join(',')})`);
|
|
100
|
+
}
|
|
101
|
+
return level;
|
|
102
|
+
}
|
|
103
|
+
async get(path) {
|
|
104
|
+
return this.#once(path, undefined, undefined);
|
|
105
|
+
}
|
|
106
|
+
async post(path, body, idempotent) {
|
|
107
|
+
const idem = idempotent ? randomKey() : undefined;
|
|
108
|
+
const attempts = idempotent ? this.#cfg.maxRetries + 1 : 1;
|
|
109
|
+
let last;
|
|
110
|
+
for (let a = 0; a < attempts; a++) {
|
|
111
|
+
try {
|
|
112
|
+
return await this.#once(path, body, idem);
|
|
113
|
+
}
|
|
114
|
+
catch (e) {
|
|
115
|
+
last = e;
|
|
116
|
+
if (e instanceof AgenticKmsError && e.retryable && a + 1 < attempts) {
|
|
117
|
+
await new Promise((r) => setTimeout(r, 100 * 2 ** a));
|
|
118
|
+
continue;
|
|
119
|
+
}
|
|
120
|
+
throw e;
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
throw last;
|
|
124
|
+
}
|
|
125
|
+
async #once(path, body, idem) {
|
|
126
|
+
const isPost = body !== undefined;
|
|
127
|
+
const bytes = isPost ? new TextEncoder().encode(JSON.stringify(body)) : undefined;
|
|
128
|
+
const requestId = uuid();
|
|
129
|
+
const headers = {
|
|
130
|
+
authorization: `Bearer ${await this.#cfg.tokenProvider()}`,
|
|
131
|
+
'x-akcs-tenant-id': this.#cfg.tenantId,
|
|
132
|
+
'x-akcs-request-id': requestId,
|
|
133
|
+
};
|
|
134
|
+
if (bytes) {
|
|
135
|
+
const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
|
|
136
|
+
headers['content-type'] = 'application/json';
|
|
137
|
+
headers['x-akcs-timestamp'] = new Date().toISOString();
|
|
138
|
+
headers['x-akcs-body-sha256'] = b64url(digest);
|
|
139
|
+
if (idem)
|
|
140
|
+
headers['idempotency-key'] = idem;
|
|
141
|
+
}
|
|
142
|
+
const ctrl = new AbortController();
|
|
143
|
+
const t = setTimeout(() => ctrl.abort(), this.#cfg.timeoutMs);
|
|
144
|
+
let res;
|
|
145
|
+
try {
|
|
146
|
+
// redirect: 'manual' (workerd does not implement 'error'); any 3xx is rejected below — a custody
|
|
147
|
+
// call must never follow a redirect.
|
|
148
|
+
res = await this.#cfg.fetch(`${this.#cfg.baseUrl}${path}`, { method: isPost ? 'POST' : 'GET', headers, body: bytes ?? null, signal: ctrl.signal, cache: 'no-store', redirect: 'manual' });
|
|
149
|
+
}
|
|
150
|
+
catch (e) {
|
|
151
|
+
throw new Error(`[agentic-kms] request failed (request ${requestId}): ${e instanceof Error ? e.message : String(e)}`);
|
|
152
|
+
}
|
|
153
|
+
finally {
|
|
154
|
+
clearTimeout(t);
|
|
155
|
+
}
|
|
156
|
+
if (res.status >= 300 && res.status < 400) {
|
|
157
|
+
throw new Error(`[agentic-kms] AKCS answered with a redirect (HTTP ${res.status}, request ${requestId}); refusing to follow`);
|
|
158
|
+
}
|
|
159
|
+
const json = (await res.json().catch(() => ({})));
|
|
160
|
+
if (!res.ok) {
|
|
161
|
+
const err = json['error'];
|
|
162
|
+
throw new AgenticKmsError(res.status, err?.code ?? 'HTTP_ERROR', err?.message ?? `HTTP ${res.status}`, err?.requestId ?? requestId, err?.retryable === true);
|
|
163
|
+
}
|
|
164
|
+
return json;
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
// ----------------------------------------------------------------- provider
|
|
168
|
+
/** Envelope data keys + domain-separated MAC via AKCS. Implements `A2AKeyProvider`. */
|
|
169
|
+
export class RemoteAgenticKmsProvider {
|
|
170
|
+
keyVersion;
|
|
171
|
+
#t;
|
|
172
|
+
#purpose;
|
|
173
|
+
#auditSink;
|
|
174
|
+
constructor(cfg) {
|
|
175
|
+
this.#t = new Transport(cfg);
|
|
176
|
+
this.#purpose = cfg.envelopePurpose ?? 'session-data-key';
|
|
177
|
+
this.#auditSink = cfg.auditSink;
|
|
178
|
+
// The concrete version is per-response; this label identifies the backend.
|
|
179
|
+
this.keyVersion = 'agentic-kms';
|
|
180
|
+
}
|
|
181
|
+
async generateSessionDataKey(input) {
|
|
182
|
+
const r = await this.#t.post('/v1/data-keys/generate', { purpose: this.#purpose, aadContext: input.aadContext, canonicalizationScheme: 'ap-context-v1' }, true);
|
|
183
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
184
|
+
const plaintextDataKey = b64urlDecode(String(r['plaintextDataKey']));
|
|
185
|
+
if (plaintextDataKey.length !== 32)
|
|
186
|
+
throw new Error('[agentic-kms] malformed data key');
|
|
187
|
+
const keyId = String(r['keyId']);
|
|
188
|
+
const keyVersion = String(r['keyVersion']);
|
|
189
|
+
await this.#audit('key-custody.envelope.wrap', keyId, keyVersion, input.aadContext);
|
|
190
|
+
return { plaintextDataKey, encryptedDataKey: b64urlDecode(String(r['wrappedDataKey'])), keyId, keyVersion };
|
|
191
|
+
}
|
|
192
|
+
async decryptSessionDataKey(input) {
|
|
193
|
+
const keyVersion = Number(input.keyVersion);
|
|
194
|
+
if (!Number.isInteger(keyVersion) || keyVersion < 1)
|
|
195
|
+
throw new Error('[agentic-kms] keyVersion must be a positive integer');
|
|
196
|
+
const r = await this.#t.post('/v1/data-keys/unwrap', { wrappedDataKey: b64url(input.encryptedDataKey), keyId: input.keyId, keyVersion, aadContext: input.aadContext, canonicalizationScheme: 'ap-context-v1' }, true);
|
|
197
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
198
|
+
const dk = b64urlDecode(String(r['plaintextDataKey']));
|
|
199
|
+
if (dk.length !== 32)
|
|
200
|
+
throw new Error('[agentic-kms] malformed data key');
|
|
201
|
+
await this.#audit('key-custody.envelope.unwrap', input.keyId, input.keyVersion, input.aadContext);
|
|
202
|
+
return dk;
|
|
203
|
+
}
|
|
204
|
+
async generateMac(input) {
|
|
205
|
+
const r = await this.#t.post('/v1/mac/generate', { canonicalMessage: b64url(input.canonicalMessage), service: input.service, audience: input.audience, routeFamily: input.routeFamily ?? 'default' }, true);
|
|
206
|
+
return { mac: b64urlDecode(String(r['mac'])), keyId: `${String(r['keyId'])}:${String(r['keyVersion'])}` };
|
|
207
|
+
}
|
|
208
|
+
async #audit(action, keyId, keyVersion, aad) {
|
|
209
|
+
if (!this.#auditSink)
|
|
210
|
+
return;
|
|
211
|
+
// refs/hashes only (spec 278 P0): AAD is hashed, never logged raw.
|
|
212
|
+
const aadHash = hex(keccak_256(new TextEncoder().encode(JSON.stringify(Object.keys(aad).sort().map((k) => [k, aad[k]]))))).slice(0, 18);
|
|
213
|
+
await this.#auditSink.write(buildEvent({ action, outcome: 'success', actor: { type: 'system', id: 'agentic-kms' }, subject: { type: 'envelope', id: keyId }, context: { keyId, keyVersion, aadHash, provider: 'agentic-kms' } }));
|
|
214
|
+
}
|
|
215
|
+
}
|
|
216
|
+
/** secp256k1 signer via AKCS (generated key or per-subject derived signer). Implements `KmsAccountBackend`. */
|
|
217
|
+
export class RemoteAgenticKmsSigner {
|
|
218
|
+
provider = 'agentic-kms';
|
|
219
|
+
#t;
|
|
220
|
+
#target;
|
|
221
|
+
#purpose;
|
|
222
|
+
#chainId;
|
|
223
|
+
#auditSink;
|
|
224
|
+
#address;
|
|
225
|
+
constructor(cfg, target) {
|
|
226
|
+
this.#t = new Transport(cfg);
|
|
227
|
+
this.#target = target;
|
|
228
|
+
this.#purpose = cfg.signingPurpose ?? 'ERC4337_USER_OPERATION';
|
|
229
|
+
this.#chainId = cfg.chainId;
|
|
230
|
+
this.#auditSink = cfg.auditSink;
|
|
231
|
+
}
|
|
232
|
+
async getSignerAddress() {
|
|
233
|
+
if (this.#address)
|
|
234
|
+
return this.#address;
|
|
235
|
+
const r = this.#target.kind === 'subject'
|
|
236
|
+
? await this.#t.post('/v1/derived-signers/resolve', { subject: { iss: this.#target.iss, sub: this.#target.sub, rotation: this.#target.rotation }, derivationScheme: 'ap-oidc-custodian-secp256k1-v1' }, false)
|
|
237
|
+
: await this.#getPublicKey(this.#target.keyId);
|
|
238
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
239
|
+
const addr = String(r['ethereumAddress']);
|
|
240
|
+
if (!/^0x[0-9a-fA-F]{40}$/.test(addr))
|
|
241
|
+
throw new Error('[agentic-kms] malformed address');
|
|
242
|
+
this.#address = addr;
|
|
243
|
+
return this.#address;
|
|
244
|
+
}
|
|
245
|
+
async #getPublicKey(keyId) {
|
|
246
|
+
return this.#t.get(`/v1/keys/${encodeURIComponent(keyId)}/public-key`);
|
|
247
|
+
}
|
|
248
|
+
async signA2AAction(input) {
|
|
249
|
+
if (input.digest.length !== 32)
|
|
250
|
+
throw new Error(`[agentic-kms] signA2AAction expects a 32-byte digest; got ${input.digest.length}`);
|
|
251
|
+
const body = this.#target.kind === 'subject'
|
|
252
|
+
? { subject: { iss: this.#target.iss, sub: this.#target.sub, rotation: this.#target.rotation }, derivationScheme: 'ap-oidc-custodian-secp256k1-v1', digest: hex(input.digest), signingPurpose: this.#purpose, ...(this.#chainId ? { chainId: this.#chainId } : {}) }
|
|
253
|
+
: { digest: hex(input.digest), signingPurpose: this.#purpose, ...(this.#chainId ? { chainId: this.#chainId } : {}) };
|
|
254
|
+
const path = this.#target.kind === 'subject' ? '/v1/derived-signers/sign' : `/v1/keys/${encodeURIComponent(this.#target.keyId)}/sign`;
|
|
255
|
+
const r = await this.#t.post(path, body, true);
|
|
256
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
257
|
+
if (r['signatureEncoding'] !== 'RSV_65')
|
|
258
|
+
throw new Error('[agentic-kms] unexpected signature encoding');
|
|
259
|
+
const signature = unhex(String(r['signature']));
|
|
260
|
+
if (signature.length !== 65 || (signature[64] !== 27 && signature[64] !== 28))
|
|
261
|
+
throw new Error('[agentic-kms] malformed signature');
|
|
262
|
+
const signerAddress = String(r['signerAddress']);
|
|
263
|
+
this.#address = signerAddress;
|
|
264
|
+
const keyId = String(r['keyId']);
|
|
265
|
+
if (this.#auditSink) {
|
|
266
|
+
const ctx = input.auditContext ?? {};
|
|
267
|
+
try {
|
|
268
|
+
await this.#auditSink.write(buildEvent({
|
|
269
|
+
action: 'key-custody.sign',
|
|
270
|
+
outcome: 'success',
|
|
271
|
+
actor: { type: 'system', id: 'agentic-kms' },
|
|
272
|
+
subject: { type: 'sign-digest', id: hex(input.digest) },
|
|
273
|
+
context: {
|
|
274
|
+
keyId,
|
|
275
|
+
keyVersion: String(r['keyVersion']),
|
|
276
|
+
signerAddress,
|
|
277
|
+
provider: 'agentic-kms',
|
|
278
|
+
protectionLevel: String(r['protectionLevel']),
|
|
279
|
+
toolId: ctx.toolId ?? null,
|
|
280
|
+
actionId: ctx.actionId ?? null,
|
|
281
|
+
// Raw sessionId MUST NEVER be logged.
|
|
282
|
+
sessionHash: ctx.sessionId ? hex(keccak_256(new TextEncoder().encode(ctx.sessionId))).slice(0, 18) : null,
|
|
283
|
+
},
|
|
284
|
+
}));
|
|
285
|
+
}
|
|
286
|
+
catch {
|
|
287
|
+
/* fail-soft, matching the local signer */
|
|
288
|
+
}
|
|
289
|
+
}
|
|
290
|
+
return { signature, keyId, signerAddress };
|
|
291
|
+
}
|
|
292
|
+
}
|
|
293
|
+
/** Build a per-subject remote signer (used by `deriveSubjectSigner` for `agentic-kms`). */
|
|
294
|
+
export function remoteSubjectSigner(cfg, subject) {
|
|
295
|
+
return new RemoteAgenticKmsSigner(cfg, { kind: 'subject', iss: subject.iss, sub: subject.sub, rotation: subject.rotation ?? 0 });
|
|
296
|
+
}
|
|
297
|
+
//# sourceMappingURL=agentic.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agentic.js","sourceRoot":"","sources":["../../src/providers/agentic.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,yEAAyE;AACzE,yEAAyE;AACzE,wDAAwD;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA6B3C,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,OAAO,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAA6B;IAAwC;IAA4B;IAAtH,YAAqB,UAAkB,EAAW,IAAY,EAAE,OAAe,EAAW,SAAiB,EAAW,SAAkB;QACtI,KAAK,CAAC,iBAAiB,IAAI,KAAK,OAAO,aAAa,SAAS,GAAG,CAAC,CAAC;QAD/C,eAAU,GAAV,UAAU,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAA4B,cAAS,GAAT,SAAS,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAS;QAEtI,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,cAAc,GAA0B,CAAC,aAAa,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAEjG,6EAA6E;AAE7E,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AACD,SAAS,KAAK,CAAC,CAAS;IACtB,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AACD,SAAS,IAAI;IACX,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,SAAS;IACJ,IAAI,CAAmK;IAEhL,YAAY,GAAqB;QAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,8FAA8F;QAC9F,iGAAiG;QACjG,MAAM,CAAC,GAAiB,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClH,IAAI,CAAC,IAAI,GAAG;YACV,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,MAAM;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;YAC/B,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,GAAG,CAAC,wBAAwB,IAAI,cAAc;SACvD,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,KAAc;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAA4B,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,KAA4B,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmB;QACzD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAa,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,CAAC;gBACT,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;oBACpE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAa,EAAE,IAAwB;QAC/D,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE;YAC1D,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YACtC,mBAAmB,EAAE,SAAS;SAC/B,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACvD,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,IAAI;gBAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,iGAAiG;YACjG,qCAAqC;YACrC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5L,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,CAAC,MAAM,aAAa,SAAS,uBAAuB,CAAC,CAAC;QAChI,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAA6F,CAAC;YACtH,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,YAAY,EAAE,GAAG,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,IAAI,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;QAC/J,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,6EAA6E;AAE7E,uFAAuF;AACvF,MAAM,OAAO,wBAAwB;IAC1B,UAAU,CAAS;IACnB,EAAE,CAAY;IACd,QAAQ,CAAS;IACjB,UAAU,CAAwB;IAE3C,YAAY,GAAiD;QAC3D,IAAI,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAC1D,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC;QAChC,2EAA2E;QAC3E,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAA6C;QACxE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;QAChK,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,gBAAgB,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACpF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC9G,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAA8G;QACxI,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5H,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;QACtN,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAClG,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAgG;QAChH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5M,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAa,EAAE,UAAkB,EAAE,GAA2B;QACzF,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,mEAAmE;QACnE,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxI,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IACpO,CAAC;CACF;AAMD,+GAA+G;AAC/G,MAAM,OAAO,sBAAsB;IACxB,QAAQ,GAAG,aAAsB,CAAC;IAClC,EAAE,CAAY;IACd,OAAO,CAAe;IACtB,QAAQ,CAAqB;IAC7B,QAAQ,CAAqB;IAC7B,UAAU,CAAwB;IAC3C,QAAQ,CAAsB;IAE9B,YAAY,GAAiD,EAAE,MAAoB;QACjF,IAAI,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,cAAc,IAAI,wBAAwB,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,CAAC,GACL,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,EAAE,KAAK,CAAC;YAC9M,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,GAAG,IAAe,CAAC;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAwG;QAC1H,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpI,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpQ,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACtI,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxG,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpI,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAY,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE;oBAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBACvD,OAAO,EAAE;wBACP,KAAK;wBACL,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;wBACnC,aAAa;wBACb,QAAQ,EAAE,aAAa;wBACvB,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;wBAC7C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,sCAAsC;wBACtC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;qBAC1G;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,GAAiD,EAAE,OAAwD;IAC7I,OAAO,IAAI,sBAAsB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;AACnI,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import type { Address } from '@agenticprimitives/types';
|
|
2
2
|
import type { AuditSink } from '@agenticprimitives/audit';
|
|
3
|
-
export type KmsBackend = 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
3
|
+
export type KmsBackend = 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
4
4
|
/**
|
|
5
5
|
* H7-F.5 / PKG-KEY-CUSTODY-005 closure — opaque branded type for
|
|
6
6
|
* sensitive config values (raw private keys, KMS service-account JSON,
|
|
@@ -62,6 +62,13 @@ export interface BuildOpts {
|
|
|
62
62
|
* latest possible moment + never store the unwrapped value.
|
|
63
63
|
*/
|
|
64
64
|
secretConfig?: Record<string, Secret<string>>;
|
|
65
|
+
/**
|
|
66
|
+
* Typed remote configuration for the `agentic-kms` backend (spec 203 §2;
|
|
67
|
+
* AKCS design §2.4). Bearer tokens are acquired just in time through
|
|
68
|
+
* `tokenProvider` and are never placed in `config`. Required when
|
|
69
|
+
* `backend === 'agentic-kms'`; there is no fallback to another backend.
|
|
70
|
+
*/
|
|
71
|
+
agenticKms?: import('./providers/agentic.js').AgenticKmsConfig;
|
|
65
72
|
/**
|
|
66
73
|
* Optional audit sink threaded into signers so every signing op emits
|
|
67
74
|
* `key-custody.sign`. Consumers share one sink across all primitives
|
|
@@ -126,7 +133,7 @@ export interface KmsAccountBackend {
|
|
|
126
133
|
* provenance), instead of a defaulted `'local-aes'` label that could
|
|
127
134
|
* mislabel a production GCP signer (audit F-6).
|
|
128
135
|
*/
|
|
129
|
-
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
136
|
+
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
130
137
|
signA2AAction: NonNullable<A2AKeyProvider['signA2AAction']>;
|
|
131
138
|
getSignerAddress(): Promise<Address>;
|
|
132
139
|
}
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,QAAA,MAAM,YAAY,EAAE,OAAO,MAA+C,CAAC;AAE3E,MAAM,WAAW,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM;IAC/C,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CACpB;AAQD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAqB9E;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAWpF;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAEnE;AAED,kBAAkB;AAClB,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAE9E;AAED,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;IAC/D;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,aAAa,CAAC;IAC3C,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,KAAK,EAAE;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,qBAAqB,CAAC,KAAK,EAAE;QAC3B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,aAAa,CAAC,CAAC,KAAK,EAAE;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9E,WAAW,CAAC,CAAC,KAAK,EAAE;QAClB,gBAAgB,EAAE,UAAU,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;IACvE,aAAa,EAAE,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agenticprimitives/key-custody",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
4
|
-
"description": "Pluggable envelope encryption + signers + HMAC providers (local-AES / AWS KMS / GCP KMS). Pure crypto primitives; no session lifecycle (that's in delegation).",
|
|
3
|
+
"version": "1.0.0-alpha.22",
|
|
4
|
+
"description": "Pluggable envelope encryption + signers + HMAC providers (local-AES / AWS KMS / GCP KMS / AKCS agentic-kms). Pure crypto primitives; no session lifecycle (that's in delegation).",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
@@ -35,6 +35,10 @@
|
|
|
35
35
|
"types": "./dist/providers/gcp.d.ts",
|
|
36
36
|
"import": "./dist/providers/gcp.js"
|
|
37
37
|
},
|
|
38
|
+
"./agentic": {
|
|
39
|
+
"types": "./dist/providers/agentic.d.ts",
|
|
40
|
+
"import": "./dist/providers/agentic.js"
|
|
41
|
+
},
|
|
38
42
|
"./kms-core": {
|
|
39
43
|
"types": "./dist/kms/kms-core.d.ts",
|
|
40
44
|
"import": "./dist/kms/kms-core.js"
|
|
@@ -76,9 +80,9 @@
|
|
|
76
80
|
},
|
|
77
81
|
"peerDependencies": {
|
|
78
82
|
"viem": "^2.52.2",
|
|
79
|
-
"@agenticprimitives/audit": "1.0.0-alpha.
|
|
80
|
-
"@agenticprimitives/connect-auth": "1.0.0-alpha.
|
|
81
|
-
"@agenticprimitives/types": "1.0.0-alpha.
|
|
83
|
+
"@agenticprimitives/audit": "1.0.0-alpha.22",
|
|
84
|
+
"@agenticprimitives/connect-auth": "1.0.0-alpha.22",
|
|
85
|
+
"@agenticprimitives/types": "1.0.0-alpha.22"
|
|
82
86
|
},
|
|
83
87
|
"peerDependenciesMeta": {
|
|
84
88
|
"@agenticprimitives/audit": {
|