@agenticprimitives/key-custody 1.0.0-alpha.21 → 1.0.0-alpha.23
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +27 -1
- package/dist/account.d.ts +2 -2
- package/dist/account.d.ts.map +1 -1
- package/dist/account.js.map +1 -1
- package/dist/derive-subject.d.ts +1 -0
- package/dist/derive-subject.d.ts.map +1 -1
- package/dist/derive-subject.js +11 -0
- package/dist/derive-subject.js.map +1 -1
- package/dist/factories.d.ts +17 -2
- package/dist/factories.d.ts.map +1 -1
- package/dist/factories.js +46 -2
- package/dist/factories.js.map +1 -1
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -1
- package/dist/index.js.map +1 -1
- package/dist/providers/agentic.d.ts +128 -0
- package/dist/providers/agentic.d.ts.map +1 -0
- package/dist/providers/agentic.js +331 -0
- package/dist/providers/agentic.js.map +1 -0
- package/dist/types.d.ts +9 -2
- package/dist/types.d.ts.map +1 -1
- package/package.json +9 -9
package/README.md
CHANGED
|
@@ -28,9 +28,35 @@ const kmsAccount = await createKmsAccount(signer);
|
|
|
28
28
|
|
|
29
29
|
Beyond the basics: per-OIDC-subject signer derivation via HKDF (`deriveSubjectSigner`, [spec 235](../../specs/235-google-kms-custody.md)), a relay-only master signer that throws on any signing call (`getRelayOnlySigner`), and HMAC providers under the `/mac` subpath. Every decrypt and signing operation emits an audit row with `keyVersion` and a hashed session ID — the raw session ID is never logged.
|
|
30
30
|
|
|
31
|
+
## `agentic-kms` — the Agentic Key Custody Service backend
|
|
32
|
+
|
|
33
|
+
`backend: 'agentic-kms'` routes envelope data keys, MAC, generated-key signing and per-subject
|
|
34
|
+
derived signers to an AKCS deployment (HSM-rooted, confidential-VM custody; repo `faithkms`).
|
|
35
|
+
The adapter is `fetch` + Web Crypto only — no cloud SDK — and keeps every package rule: secrets are
|
|
36
|
+
`Uint8Array`, private keys never exist in this process, and there is **no fallback** to `local-aes`
|
|
37
|
+
or `gcp-kms` on a remote error.
|
|
38
|
+
|
|
39
|
+
```ts
|
|
40
|
+
import { buildKeyProvider, deriveSubjectSigner, staticTokenProvider, loadSecret } from '@agenticprimitives/key-custody';
|
|
41
|
+
|
|
42
|
+
const agenticKms = {
|
|
43
|
+
baseUrl: 'https://akcs.example.internal',
|
|
44
|
+
tenantId: 'my-tenant',
|
|
45
|
+
tokenProvider: () => getWorkloadToken(), // short-lived JWT for the AKCS audience
|
|
46
|
+
// dev only: staticTokenProvider(loadSecret(env.AKCS_TOKEN))
|
|
47
|
+
acceptedProtectionLevels: ['CVM_DERIVED', 'CVM_WRAPPED'], // add 'DEV_LOCAL' only in dev
|
|
48
|
+
};
|
|
49
|
+
const provider = buildKeyProvider({ backend: 'agentic-kms', agenticKms });
|
|
50
|
+
const signer = deriveSubjectSigner({ backend: 'agentic-kms', agenticKms, subject: { iss, sub } });
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
The exact `ap-oidc-custodian-secp256k1-v1` derivation runs inside AKCS; a legacy
|
|
54
|
+
`A2A_MASTER_PRIVATE_KEY`/custody root is imported there through a verified operator ceremony so
|
|
55
|
+
existing addresses are preserved. Cross-language vectors live in `test/vectors/`.
|
|
56
|
+
|
|
31
57
|
## Production guard
|
|
32
58
|
|
|
33
|
-
`local-aes` refuses to boot when `NODE_ENV=production`. AWS and
|
|
59
|
+
`local-aes` refuses to boot when `NODE_ENV=production`. AWS, GCP and `agentic-kms` backends have **no local fallback** — they fail-closed on outage. This is intentional: a key-custody layer that silently downgrades to a weaker backend is not a custody layer.
|
|
34
60
|
|
|
35
61
|
## How it's different
|
|
36
62
|
|
package/dist/account.d.ts
CHANGED
|
@@ -3,7 +3,7 @@ import type { KmsAccountBackend } from './types.js';
|
|
|
3
3
|
interface KMSSignerShape {
|
|
4
4
|
readonly address: Address;
|
|
5
5
|
readonly keyId: string;
|
|
6
|
-
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
6
|
+
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
7
7
|
signMessage(msg: string | {
|
|
8
8
|
raw: Hex;
|
|
9
9
|
}): Promise<Hex>;
|
|
@@ -17,7 +17,7 @@ interface KMSSignerShape {
|
|
|
17
17
|
export declare function createKmsAccount(backend: KmsAccountBackend, opts?: {
|
|
18
18
|
sessionId?: string;
|
|
19
19
|
chainId?: number;
|
|
20
|
-
provider?: 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
20
|
+
provider?: 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
21
21
|
}): Promise<KMSSignerShape>;
|
|
22
22
|
export {};
|
|
23
23
|
//# sourceMappingURL=account.d.ts.map
|
package/dist/account.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;IACvE,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAWD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAA;CAAE,GAC9G,OAAO,CAAC,cAAc,CAAC,CA0CzB"}
|
package/dist/account.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAA0B,MAAM,MAAM,CAAC;AAgBrF,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,IAA+
|
|
1
|
+
{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAA0B,MAAM,MAAM,CAAC;AAgBrF,SAAS,YAAY,CAAC,OAA4B;IAChD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,IAA+G;IAE/G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACjD,uEAAuE;IACvE,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEpD,OAAO;QACL,OAAO;QACP,KAAK,EAAE,GAAG,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE;QAC7C,QAAQ;QAER,KAAK,CAAC,WAAW,CAAC,GAA0B;YAC1C,IAAI,MAAkB,CAAC;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBACzB,uBAAuB;oBACvB,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;gBAChD,MAAM;gBACN,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAC;YACH,OAAO,UAAU,CAAC,SAAS,CAAQ,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAI;YACtB,6EAA6E;YAC7E,MAAM,SAAS,GAAG,aAAa,CAAC,IAA2C,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;gBAChD,MAAM;gBACN,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAC;YACH,OAAO,UAAU,CAAC,SAAS,CAAQ,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/derive-subject.d.ts
CHANGED
|
@@ -32,6 +32,7 @@ export declare function deriveSubjectPrivateKeyHex(master: Uint8Array, subject:
|
|
|
32
32
|
* local-aes: HKDF-derive the key, wrap it in `LocalSecp256k1Signer` (which
|
|
33
33
|
* enforces the production guard — refuses NODE_ENV=production unless
|
|
34
34
|
* `A2A_ALLOW_LOCAL_MASTER_KEY=true`).
|
|
35
|
+
* agentic-kms: remote per-subject signer through AKCS (exact v1 derivation server-side).
|
|
35
36
|
* gcp-kms / aws-kms: not yet built — fail closed (spec 235 §10).
|
|
36
37
|
*/
|
|
37
38
|
export declare function deriveSubjectSigner(opts: DeriveSubjectOpts): KmsAccountBackend;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derive-subject.d.ts","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA0B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"derive-subject.d.ts","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA0B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAO3E,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,OAAO,EAAE,SAAS,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAUlE;AAkBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,GAAG,CAetF;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAsB9E"}
|
package/dist/derive-subject.js
CHANGED
|
@@ -29,6 +29,7 @@ import { sha256 } from '@noble/hashes/sha2.js';
|
|
|
29
29
|
import { secp256k1 } from '@noble/curves/secp256k1.js';
|
|
30
30
|
import { hexToBytes, bytesToHex } from 'viem';
|
|
31
31
|
import { LocalSecp256k1Signer } from './providers/local.js';
|
|
32
|
+
import { remoteSubjectSigner } from './providers/agentic.js';
|
|
32
33
|
const DERIVE_INFO_PREFIX = 'kms-custodian:v1';
|
|
33
34
|
const SECP256K1_N = secp256k1.Point.Fn.ORDER;
|
|
34
35
|
/**
|
|
@@ -120,6 +121,7 @@ function backendOf(opts) {
|
|
|
120
121
|
* local-aes: HKDF-derive the key, wrap it in `LocalSecp256k1Signer` (which
|
|
121
122
|
* enforces the production guard — refuses NODE_ENV=production unless
|
|
122
123
|
* `A2A_ALLOW_LOCAL_MASTER_KEY=true`).
|
|
124
|
+
* agentic-kms: remote per-subject signer through AKCS (exact v1 derivation server-side).
|
|
123
125
|
* gcp-kms / aws-kms: not yet built — fail closed (spec 235 §10).
|
|
124
126
|
*/
|
|
125
127
|
export function deriveSubjectSigner(opts) {
|
|
@@ -129,6 +131,15 @@ export function deriveSubjectSigner(opts) {
|
|
|
129
131
|
const privateKeyHex = deriveSubjectPrivateKeyHex(master, opts.subject);
|
|
130
132
|
return new LocalSecp256k1Signer({ privateKeyHex, auditSink: opts.auditSink });
|
|
131
133
|
}
|
|
134
|
+
if (backend === 'agentic-kms') {
|
|
135
|
+
// The exact v1 derivation (`ap-oidc-custodian-secp256k1-v1`) runs inside AKCS from the tenant
|
|
136
|
+
// signing seed; the private key never exists in this process. Legacy masters are imported into
|
|
137
|
+
// AKCS through an operator ceremony that verifies known addresses first.
|
|
138
|
+
if (!opts.agenticKms) {
|
|
139
|
+
throw new Error('deriveSubjectSigner (agentic-kms): opts.agenticKms { baseUrl, tenantId, tokenProvider } is required. No fallback (ADR-0013).');
|
|
140
|
+
}
|
|
141
|
+
return remoteSubjectSigner({ ...opts.agenticKms, ...(opts.auditSink ? { auditSink: opts.auditSink } : {}) }, opts.subject);
|
|
142
|
+
}
|
|
132
143
|
throw new Error(`deriveSubjectSigner: per-subject derivation is not yet implemented for backend "${backend}". ` +
|
|
133
144
|
`The KMS providers expose no per-subject MAC/key today. Use local-aes for the demo, or build ` +
|
|
134
145
|
`the production path per spec 235 §10 (a per-subject KMS HMAC or asymmetric key). ` +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derive-subject.js","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,4DAA4D;AAC5D,EAAE;AACF,4CAA4C;AAC5C,oEAAoE;AACpE,2FAA2F;AAC3F,4FAA4F;AAC5F,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"derive-subject.js","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,4DAA4D;AAC5D,EAAE;AACF,4CAA4C;AAC5C,oEAAoE;AACpE,2FAA2F;AAC3F,4FAA4F;AAC5F,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAgB7C;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAkB,EAAE,OAAkB;IAC/E,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CACd,MAAM,EACN,MAAM,EACN,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACnC,EAAE,CACH,CAAC;IACF,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,OAAO,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB;IACnD,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QACnE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,8EAA8E;IAC9E,yDAAyD;IACzD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,OAAO,IAAI,oBAAoB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,8FAA8F;QAC9F,+FAA+F;QAC/F,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,mBAAmB,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mFAAmF,OAAO,KAAK;QAC7F,8FAA8F;QAC9F,mFAAmF;QACnF,sDAAsD,CACzD,CAAC;AACJ,CAAC"}
|
package/dist/factories.d.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { AuditSink } from '@agenticprimitives/audit';
|
|
2
2
|
import type { A2AKeyProvider, BuildOpts, KmsAccountBackend } from './types.js';
|
|
3
|
+
import { type AgenticKmsConfig } from './providers/agentic.js';
|
|
3
4
|
export declare function buildKeyProvider(opts: BuildOpts): A2AKeyProvider;
|
|
4
5
|
/**
|
|
5
6
|
* Per-person vault KEK selection (spec 278 P3 / VKB-D1, VKB-D2). Returns the
|
|
@@ -14,10 +15,19 @@ export declare function buildKeyProvider(opts: BuildOpts): A2AKeyProvider;
|
|
|
14
15
|
* With neither a `kmsKeyRef` nor an explicit fixture allowance, this THROWS.
|
|
15
16
|
*/
|
|
16
17
|
export interface SelectVaultKeyProviderOpts {
|
|
17
|
-
/**
|
|
18
|
+
/**
|
|
19
|
+
* The person's KEK reference, from their `VaultKeyBinding`. Two shapes, told apart by prefix so a ref
|
|
20
|
+
* for one backend can never be handed to the other:
|
|
21
|
+
* • `akcs:<purpose>` — an AKCS ENVELOPE key. AKCS resolves `generate` by PURPOSE, so a per-person
|
|
22
|
+
* purpose (`vault-kek:0x…`) is a genuinely per-person KEY, not one tenant key separated by AAD.
|
|
23
|
+
* That is what spec 278 VKB-D1 requires, and AAD binding alone would not have satisfied it.
|
|
24
|
+
* • anything else — a GCP Cloud KMS cryptoKey name, wielded with `serviceAccountJson`.
|
|
25
|
+
*/
|
|
18
26
|
kmsKeyRef?: string;
|
|
19
|
-
/** Service-account JSON for the GCP KEK (required with `kmsKeyRef`). */
|
|
27
|
+
/** Service-account JSON for the GCP KEK (required with a GCP `kmsKeyRef`). */
|
|
20
28
|
serviceAccountJson?: string;
|
|
29
|
+
/** AKCS config — required when `kmsKeyRef` is an `akcs:` ref. */
|
|
30
|
+
agenticKms?: AgenticKmsConfig;
|
|
21
31
|
/** Audit sink → envelope wrap/unwrap emit `key-custody.envelope.*`. */
|
|
22
32
|
auditSink?: AuditSink;
|
|
23
33
|
/** Set ONLY for anonymous/seeded fixtures; uses local-aes. Never for a real person vault. */
|
|
@@ -25,6 +35,11 @@ export interface SelectVaultKeyProviderOpts {
|
|
|
25
35
|
/** Fixture master key (local-aes) — used only when `allowFixtureKey` is true. */
|
|
26
36
|
fixtureKeyHex?: string;
|
|
27
37
|
}
|
|
38
|
+
/** Marks a `kmsKeyRef` as an AKCS envelope purpose rather than a GCP key name. */
|
|
39
|
+
export declare const AKCS_KEY_REF_PREFIX = "akcs:";
|
|
40
|
+
/** The `kmsKeyRef` for a person's AKCS vault KEK. One ENVELOPE key per person, addressed by purpose —
|
|
41
|
+
* build it here so the string is identical at provision time and at read time. */
|
|
42
|
+
export declare function akcsVaultKeyRef(personSa: string): string;
|
|
28
43
|
export declare function selectVaultKeyProvider(opts: SelectVaultKeyProviderOpts): A2AKeyProvider;
|
|
29
44
|
export declare function buildSignerBackend(opts: BuildOpts): KmsAccountBackend;
|
|
30
45
|
/**
|
package/dist/factories.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAI3F,OAAO,EAAoD,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAoEjH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,CAiBhE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C;mFACmF;AACnF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,0BAA0B,GAAG,cAAc,CAsCvF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAwBrE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,iBAAiB,CAU7F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GACd,iBAAiB,CAyBnB;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,CAMlF"}
|
package/dist/factories.js
CHANGED
|
@@ -1,6 +1,18 @@
|
|
|
1
1
|
import { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
|
|
2
2
|
import { AwsKmsProvider, AwsKmsSigner } from './providers/aws.js';
|
|
3
3
|
import { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
|
|
4
|
+
import { RemoteAgenticKmsProvider, RemoteAgenticKmsSigner } from './providers/agentic.js';
|
|
5
|
+
/**
|
|
6
|
+
* `agentic-kms` (AKCS) requires the typed remote config. No fallback to
|
|
7
|
+
* `local-aes` or `gcp-kms` on a missing/invalid config (ADR-0013).
|
|
8
|
+
*/
|
|
9
|
+
function agenticConfig(opts) {
|
|
10
|
+
if (!opts.agenticKms) {
|
|
11
|
+
throw new Error('[key-custody] backend "agentic-kms" requires opts.agenticKms { baseUrl, tenantId, tokenProvider }. ' +
|
|
12
|
+
'There is no fallback to local-aes or gcp-kms (ADR-0013).');
|
|
13
|
+
}
|
|
14
|
+
return { ...opts.agenticKms, ...(opts.auditSink ? { auditSink: opts.auditSink } : {}) };
|
|
15
|
+
}
|
|
4
16
|
/**
|
|
5
17
|
* Resolve effective environment for production-default gates (audit H1).
|
|
6
18
|
* 1. Explicit `opts.environment` wins.
|
|
@@ -48,7 +60,7 @@ function backendOrEnv(opts) {
|
|
|
48
60
|
return envBackend;
|
|
49
61
|
if (inferEnvironment(opts) === 'production') {
|
|
50
62
|
throw new Error('[key-custody] No backend specified for production. Pass `opts.backend` ' +
|
|
51
|
-
'(`gcp-kms` for real deploys; `local-aes` for dev) or set ' +
|
|
63
|
+
'(`gcp-kms` or `agentic-kms` for real deploys; `local-aes` for dev) or set ' +
|
|
52
64
|
'the A2A_KMS_BACKEND env var. There is no implicit fallback in production — ' +
|
|
53
65
|
'pass `developmentMode: true` to opt into the dev default. ' +
|
|
54
66
|
'(`aws-kms` is reserved but NOT implemented — selecting it fails fast.)');
|
|
@@ -69,12 +81,36 @@ export function buildKeyProvider(opts) {
|
|
|
69
81
|
// `key-custody.envelope.{wrap,unwrap}` on the production path.
|
|
70
82
|
auditSink: opts.auditSink,
|
|
71
83
|
});
|
|
84
|
+
case 'agentic-kms':
|
|
85
|
+
return new RemoteAgenticKmsProvider(agenticConfig(opts));
|
|
72
86
|
}
|
|
73
87
|
}
|
|
88
|
+
/** Marks a `kmsKeyRef` as an AKCS envelope purpose rather than a GCP key name. */
|
|
89
|
+
export const AKCS_KEY_REF_PREFIX = 'akcs:';
|
|
90
|
+
/** The `kmsKeyRef` for a person's AKCS vault KEK. One ENVELOPE key per person, addressed by purpose —
|
|
91
|
+
* build it here so the string is identical at provision time and at read time. */
|
|
92
|
+
export function akcsVaultKeyRef(personSa) {
|
|
93
|
+
return `${AKCS_KEY_REF_PREFIX}vault-kek:${personSa.toLowerCase()}`;
|
|
94
|
+
}
|
|
74
95
|
export function selectVaultKeyProvider(opts) {
|
|
96
|
+
if (opts.kmsKeyRef?.startsWith(AKCS_KEY_REF_PREFIX)) {
|
|
97
|
+
const purpose = opts.kmsKeyRef.slice(AKCS_KEY_REF_PREFIX.length).trim();
|
|
98
|
+
if (!purpose) {
|
|
99
|
+
throw new Error(`[key-custody] selectVaultKeyProvider: "${opts.kmsKeyRef}" names no AKCS envelope purpose.`);
|
|
100
|
+
}
|
|
101
|
+
if (!opts.agenticKms) {
|
|
102
|
+
throw new Error('[key-custody] selectVaultKeyProvider: an akcs: kmsKeyRef requires opts.agenticKms '
|
|
103
|
+
+ '{ baseUrl, tenantId, tokenProvider }. No fallback to GCP or local-aes (ADR-0013).');
|
|
104
|
+
}
|
|
105
|
+
return new RemoteAgenticKmsProvider({
|
|
106
|
+
...opts.agenticKms,
|
|
107
|
+
envelopePurpose: purpose,
|
|
108
|
+
...(opts.auditSink ? { auditSink: opts.auditSink } : {}),
|
|
109
|
+
});
|
|
110
|
+
}
|
|
75
111
|
if (opts.kmsKeyRef) {
|
|
76
112
|
if (!opts.serviceAccountJson) {
|
|
77
|
-
throw new Error('[key-custody] selectVaultKeyProvider: serviceAccountJson is required with a kmsKeyRef (per-person KEK).');
|
|
113
|
+
throw new Error('[key-custody] selectVaultKeyProvider: serviceAccountJson is required with a GCP kmsKeyRef (per-person KEK).');
|
|
78
114
|
}
|
|
79
115
|
return new GcpKmsProvider({
|
|
80
116
|
cryptoKeyName: opts.kmsKeyRef,
|
|
@@ -106,6 +142,14 @@ export function buildSignerBackend(opts) {
|
|
|
106
142
|
serviceAccountJson: opts.config?.serviceAccountJson,
|
|
107
143
|
auditSink: opts.auditSink,
|
|
108
144
|
});
|
|
145
|
+
case 'agentic-kms': {
|
|
146
|
+
// A generated SIGNING key in AKCS, addressed by its logical key id (UUID).
|
|
147
|
+
const keyId = opts.config?.agenticKeyId;
|
|
148
|
+
if (!keyId) {
|
|
149
|
+
throw new Error('[key-custody] agentic-kms signer requires config.agenticKeyId (an AKCS SIGNING key id). No fallback (ADR-0013).');
|
|
150
|
+
}
|
|
151
|
+
return new RemoteAgenticKmsSigner(agenticConfig(opts), { kind: 'key', keyId });
|
|
152
|
+
}
|
|
109
153
|
}
|
|
110
154
|
}
|
|
111
155
|
/**
|
package/dist/factories.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"factories.js","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"factories.js","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAyB,MAAM,wBAAwB,CAAC;AAEjH;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAe;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,qGAAqG;YACnG,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAe;IACvC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC9C,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAe;IACnC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,4EAA4E;YAC5E,6EAA6E;YAC7E,4DAA4D;YAC5D,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAe;IAC9C,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,EAAE,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,CAAC;gBACxB,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;gBACnD,qEAAqE;gBACrE,+DAA+D;gBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,aAAa;YAChB,OAAO,IAAI,wBAAwB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAoCD,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C;mFACmF;AACnF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,GAAG,mBAAmB,aAAa,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAgC;IACrE,IAAI,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,mCAAmC,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,oFAAoF;kBAChF,mFAAmF,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,wBAAwB,CAAC;YAClC,GAAG,IAAI,CAAC,UAAU;YAClB,eAAe,EAAE,OAAO;YACxB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;QACjI,CAAC;QACD,OAAO,IAAI,cAAc,CAAC;YACxB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,iFAAiF;QACjF,kFAAkF;QAClF,OAAO,IAAI,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+FAA+F;QAC7F,4FAA4F;QAC5F,mEAAmE,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,CAAC;gBACtB,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB;gBACvD,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;gBACnD,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,2EAA2E;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;YACrI,CAAC;YACD,OAAO,IAAI,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAgB;IACxE,MAAM,IAAI,KAAK,CACb,8FAA8F;QAC5F,0FAA0F;QAC1F,0EAA0E;QAC1E,sFAAsF;QACtF,8DAA8D;QAC9D,6DAA6D;QAC7D,uEAAuE,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAc,EACd,IAAe;IAEf,KAAK,MAAM,CAAC;IACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,sFAAsF;YACtF,mFAAmF;YACnF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,0BAA0B,KAAK,MAAM,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,8EAA8E;YAC9E,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAe;IAChE,uDAAuD;IACvD,4EAA4E;IAC5E,gCAAgC;IAChC,KAAK,QAAQ,CAAC;IACd,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ import type { Address, Hex } from '@agenticprimitives/types';
|
|
|
2
2
|
export type { Address, Hex };
|
|
3
3
|
export type { A2AKeyProvider, KmsAccountBackend, BuildOpts, KmsBackend, Secret } from './types.js';
|
|
4
4
|
export { loadSecret, loadSecretFromEnv, unwrapSecret, isSecret } from './types.js';
|
|
5
|
-
export { buildKeyProvider, buildSignerBackend, buildToolExecutorBackendNoIsolation, buildMacProvider, selectVaultKeyProvider, type SelectVaultKeyProviderOpts, } from './factories.js';
|
|
5
|
+
export { buildKeyProvider, buildSignerBackend, buildToolExecutorBackendNoIsolation, buildMacProvider, selectVaultKeyProvider, akcsVaultKeyRef, AKCS_KEY_REF_PREFIX, type SelectVaultKeyProviderOpts, } from './factories.js';
|
|
6
6
|
export { deriveSubjectSigner, subjectCanonicalMessage, type SubjectId, type DeriveSubjectOpts, } from './derive-subject.js';
|
|
7
7
|
export { getRelayOnlySigner } from './relay-only.js';
|
|
8
8
|
export { createKmsAccount } from './account.js';
|
|
@@ -12,4 +12,5 @@ export { createSpendCappedAccount, SpendCapExceededError, type CreateSpendCapped
|
|
|
12
12
|
export { canonicalContextBytes } from './aad.js';
|
|
13
13
|
export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
|
|
14
14
|
export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
|
|
15
|
+
export { RemoteAgenticKmsProvider, provisionEnvelopeKey, RemoteAgenticKmsSigner, remoteSubjectSigner, staticTokenProvider, AgenticKmsError, type AgenticKmsConfig, type TokenProvider, type AkcsProtectionLevel, type AkcsSigningPurpose, } from './providers/agentic.js';
|
|
15
16
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAWlB,mCAAmC,EACnC,gBAAgB,EAEhB,sBAAsB,EACtB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAU9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAWlB,mCAAmC,EACnC,gBAAgB,EAEhB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAU9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -15,7 +15,7 @@ export { buildKeyProvider, buildSignerBackend,
|
|
|
15
15
|
// then, the public surface is the explicit-name one only.
|
|
16
16
|
buildToolExecutorBackendNoIsolation, buildMacProvider,
|
|
17
17
|
// spec 278 P3 — per-person vault KEK selection (fail-closed; no global key for person data).
|
|
18
|
-
selectVaultKeyProvider, } from './factories.js';
|
|
18
|
+
selectVaultKeyProvider, akcsVaultKeyRef, AKCS_KEY_REF_PREFIX, } from './factories.js';
|
|
19
19
|
// `deriveSubjectPrivateKeyHex` is intentionally NOT re-exported here — it returns
|
|
20
20
|
// a per-subject raw private key (security-sensitive). It stays exported from
|
|
21
21
|
// `./derive-subject` for in-package unit tests but is not part of the public API.
|
|
@@ -38,4 +38,6 @@ export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
|
|
|
38
38
|
// local-aes (dev). When AWS lands, re-add the export alongside the
|
|
39
39
|
// LocalAes + Gcp providers.
|
|
40
40
|
export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
|
|
41
|
+
// AKCS remote backend (`agentic-kms`): thin fetch + Web Crypto adapter, no cloud SDK, no fallback.
|
|
42
|
+
export { RemoteAgenticKmsProvider, provisionEnvelopeKey, RemoteAgenticKmsSigner, remoteSubjectSigner, staticTokenProvider, AgenticKmsError, } from './providers/agentic.js';
|
|
41
43
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAM5D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB;AAClB,qEAAqE;AACrE,wEAAwE;AACxE,iDAAiD;AACjD,6DAA6D;AAC7D,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,yDAAyD;AACzD,qEAAqE;AACrE,0DAA0D;AAC1D,mCAAmC,EACnC,gBAAgB;AAChB,6FAA6F;AAC7F,sBAAsB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAM5D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB;AAClB,qEAAqE;AACrE,wEAAwE;AACxE,iDAAiD;AACjD,6DAA6D;AAC7D,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,yDAAyD;AACzD,qEAAqE;AACrE,0DAA0D;AAC1D,mCAAmC,EACnC,gBAAgB;AAChB,6FAA6F;AAC7F,sBAAsB,EACtB,eAAe,EACf,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,mGAAmG;AACnG,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,mEAAmE;AACnE,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,mGAAmG;AACnG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAKhB,MAAM,wBAAwB,CAAC"}
|
|
@@ -0,0 +1,128 @@
|
|
|
1
|
+
import type { Address } from '@agenticprimitives/types';
|
|
2
|
+
import { type AuditSink } from '@agenticprimitives/audit';
|
|
3
|
+
import type { A2AKeyProvider, KmsAccountBackend, Secret } from '../types.js';
|
|
4
|
+
/** Acquire a short-lived workload token for the AKCS audience, just in time. */
|
|
5
|
+
export type TokenProvider = () => Promise<string>;
|
|
6
|
+
export type AkcsProtectionLevel = 'DEV_LOCAL' | 'CVM_DERIVED' | 'CVM_WRAPPED' | 'AZURE_HSM_DIRECT' | 'FUTURE_PKCS11_DIRECT';
|
|
7
|
+
export type AkcsSigningPurpose = 'EIP712' | 'ERC4337_USER_OPERATION' | 'EIP7702_AUTHORIZATION' | 'PERSONAL_SIGN_DIGEST' | 'RAW_32_BYTE_DIGEST';
|
|
8
|
+
/**
|
|
9
|
+
* Typed remote configuration (spec §2.4 item 4): no bearer tokens in a plain
|
|
10
|
+
* `Record<string,string>`. Static tokens are not accepted; supply a
|
|
11
|
+
* `tokenProvider`, or a `Secret` holding a token for dev fixtures only.
|
|
12
|
+
*/
|
|
13
|
+
export interface AgenticKmsConfig {
|
|
14
|
+
baseUrl: string;
|
|
15
|
+
tenantId: string;
|
|
16
|
+
tokenProvider: TokenProvider;
|
|
17
|
+
/** Accepted protection levels. Defaults to CVM/HSM levels; add DEV_LOCAL only for dev. */
|
|
18
|
+
acceptedProtectionLevels?: AkcsProtectionLevel[];
|
|
19
|
+
/** Purpose for envelope operations (an ACTIVE ENVELOPE key with this purpose must exist in the tenant). */
|
|
20
|
+
envelopePurpose?: string;
|
|
21
|
+
/** Default signing purpose for `signA2AAction` (32-byte digests of userOps / EIP-712). */
|
|
22
|
+
signingPurpose?: AkcsSigningPurpose;
|
|
23
|
+
chainId?: number;
|
|
24
|
+
timeoutMs?: number;
|
|
25
|
+
maxRetries?: number;
|
|
26
|
+
fetch?: typeof fetch;
|
|
27
|
+
}
|
|
28
|
+
/** Dev helper: wrap a fixture token `Secret` as a provider. Never use in production. */
|
|
29
|
+
export declare function staticTokenProvider(token: Secret<'akcs-token'>): TokenProvider;
|
|
30
|
+
export declare class AgenticKmsError extends Error {
|
|
31
|
+
readonly httpStatus: number;
|
|
32
|
+
readonly code: string;
|
|
33
|
+
readonly requestId: string;
|
|
34
|
+
readonly retryable: boolean;
|
|
35
|
+
constructor(httpStatus: number, code: string, message: string, requestId: string, retryable: boolean);
|
|
36
|
+
}
|
|
37
|
+
/** Envelope data keys + domain-separated MAC via AKCS. Implements `A2AKeyProvider`. */
|
|
38
|
+
export declare class RemoteAgenticKmsProvider implements A2AKeyProvider {
|
|
39
|
+
#private;
|
|
40
|
+
readonly keyVersion: string;
|
|
41
|
+
constructor(cfg: AgenticKmsConfig & {
|
|
42
|
+
auditSink?: AuditSink;
|
|
43
|
+
});
|
|
44
|
+
generateSessionDataKey(input: {
|
|
45
|
+
aadContext: Record<string, string>;
|
|
46
|
+
}): Promise<{
|
|
47
|
+
plaintextDataKey: Uint8Array<ArrayBufferLike>;
|
|
48
|
+
encryptedDataKey: Uint8Array<ArrayBufferLike>;
|
|
49
|
+
keyId: string;
|
|
50
|
+
keyVersion: string;
|
|
51
|
+
}>;
|
|
52
|
+
decryptSessionDataKey(input: {
|
|
53
|
+
encryptedDataKey: Uint8Array;
|
|
54
|
+
aadContext: Record<string, string>;
|
|
55
|
+
keyId: string;
|
|
56
|
+
keyVersion: string;
|
|
57
|
+
}): Promise<Uint8Array<ArrayBufferLike>>;
|
|
58
|
+
generateMac(input: {
|
|
59
|
+
canonicalMessage: Uint8Array;
|
|
60
|
+
service: string;
|
|
61
|
+
audience: string;
|
|
62
|
+
routeFamily?: string;
|
|
63
|
+
}): Promise<{
|
|
64
|
+
mac: Uint8Array<ArrayBufferLike>;
|
|
65
|
+
keyId: string;
|
|
66
|
+
}>;
|
|
67
|
+
}
|
|
68
|
+
type SignerTarget = {
|
|
69
|
+
kind: 'key';
|
|
70
|
+
keyId: string;
|
|
71
|
+
} | {
|
|
72
|
+
kind: 'subject';
|
|
73
|
+
iss: string;
|
|
74
|
+
sub: string;
|
|
75
|
+
rotation: number;
|
|
76
|
+
};
|
|
77
|
+
/** secp256k1 signer via AKCS (generated key or per-subject derived signer). Implements `KmsAccountBackend`. */
|
|
78
|
+
export declare class RemoteAgenticKmsSigner implements KmsAccountBackend {
|
|
79
|
+
#private;
|
|
80
|
+
readonly provider: "agentic-kms";
|
|
81
|
+
constructor(cfg: AgenticKmsConfig & {
|
|
82
|
+
auditSink?: AuditSink;
|
|
83
|
+
}, target: SignerTarget);
|
|
84
|
+
getSignerAddress(): Promise<Address>;
|
|
85
|
+
signA2AAction(input: {
|
|
86
|
+
digest: Uint8Array;
|
|
87
|
+
auditContext?: {
|
|
88
|
+
toolId?: string;
|
|
89
|
+
sessionId?: string;
|
|
90
|
+
actionId?: string;
|
|
91
|
+
};
|
|
92
|
+
}): Promise<{
|
|
93
|
+
signature: Uint8Array<ArrayBufferLike>;
|
|
94
|
+
keyId: string;
|
|
95
|
+
signerAddress: `0x${string}`;
|
|
96
|
+
}>;
|
|
97
|
+
}
|
|
98
|
+
/** Build a per-subject remote signer (used by `deriveSubjectSigner` for `agentic-kms`). */
|
|
99
|
+
/**
|
|
100
|
+
* Provision the ENVELOPE key an owner's data keys are generated under, and return whether it already
|
|
101
|
+
* existed. Idempotent by AKCS's own 409, so a re-run is a no-op.
|
|
102
|
+
*
|
|
103
|
+
* This lives here rather than in the calling app because AKCS requires a set of headers on EVERY
|
|
104
|
+
* request (tenant, request id, timestamp, body digest) that only `Transport` knows about — a hand-rolled
|
|
105
|
+
* `fetch` in an app gets `INVALID_HEADERS` and, worse, silently skips the retry and no-redirect rules a
|
|
106
|
+
* custody call is supposed to have.
|
|
107
|
+
*
|
|
108
|
+
* `purpose` is the SELECTOR: `data-keys/generate` resolves the tenant's ACTIVE ENVELOPE key with that
|
|
109
|
+
* purpose. A per-owner purpose therefore yields a genuinely per-owner KEY, which is what spec 278's
|
|
110
|
+
* per-person KEK requirement means (one tenant key separated by AAD would not be).
|
|
111
|
+
*/
|
|
112
|
+
export declare function provisionEnvelopeKey(cfg: AgenticKmsConfig, input: {
|
|
113
|
+
purpose: string;
|
|
114
|
+
externalName: string;
|
|
115
|
+
protectionLevel?: AkcsProtectionLevel;
|
|
116
|
+
}): Promise<{
|
|
117
|
+
keyId?: string;
|
|
118
|
+
alreadyExisted: boolean;
|
|
119
|
+
}>;
|
|
120
|
+
export declare function remoteSubjectSigner(cfg: AgenticKmsConfig & {
|
|
121
|
+
auditSink?: AuditSink;
|
|
122
|
+
}, subject: {
|
|
123
|
+
iss: string;
|
|
124
|
+
sub: string;
|
|
125
|
+
rotation?: number;
|
|
126
|
+
}): RemoteAgenticKmsSigner;
|
|
127
|
+
export {};
|
|
128
|
+
//# sourceMappingURL=agentic.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agentic.d.ts","sourceRoot":"","sources":["../../src/providers/agentic.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG7E,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;AAC5H,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,oBAAoB,CAAC;AAE/I;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,0FAA0F;IAC1F,wBAAwB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjD,2GAA2G;IAC3G,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,aAAa,CAE9E;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO;gBAAnH,UAAU,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM,EAAW,SAAS,EAAE,OAAO;CAIzI;AAyID,uFAAuF;AACvF,qBAAa,wBAAyB,YAAW,cAAc;;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAKhB,GAAG,EAAE,gBAAgB,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IAQvD,sBAAsB,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;IAWpE,qBAAqB,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAWpI,WAAW,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;;CAWnH;AAID,KAAK,YAAY,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAErH,+GAA+G;AAC/G,qBAAa,sBAAuB,YAAW,iBAAiB;;IAC9D,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;gBAQ/B,GAAG,EAAE,gBAAgB,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,EAAE,MAAM,EAAE,YAAY;IAQ7E,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAiBpC,aAAa,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;;;;;CA2C7H;AAED,2FAA2F;AAC3F;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,mBAAmB,CAAA;CAAE,GACtF,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAAC,CAkBtD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG;IAAE,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,sBAAsB,CAEvK"}
|
|
@@ -0,0 +1,331 @@
|
|
|
1
|
+
// RemoteAgenticKmsProvider / RemoteAgenticKmsSigner — the `agentic-kms` backend.
|
|
2
|
+
//
|
|
3
|
+
// Thin remote adapter for the Agentic Key Custody Service (AKCS). It keeps the
|
|
4
|
+
// package's rules: no cloud SDK, no private key material in TypeScript, no
|
|
5
|
+
// fallback to any other backend on failure (ADR-0013), secrets as Uint8Array,
|
|
6
|
+
// raw sessionId never logged. Private keys are never reconstructed here — AKCS
|
|
7
|
+
// signs and returns `r||s||v`.
|
|
8
|
+
//
|
|
9
|
+
// Transport: `fetch` + Web Crypto only (runs on Workers/Node). Every crypto call
|
|
10
|
+
// carries Idempotency-Key, X-AKCS-Timestamp and X-AKCS-Body-SHA256 (AKCS
|
|
11
|
+
// contract v1). Retries happen only for `retryable` errors with the SAME
|
|
12
|
+
// idempotency key, so a retry can never double-execute.
|
|
13
|
+
import { keccak_256 } from '@noble/hashes/sha3.js';
|
|
14
|
+
import { buildEvent } from '@agenticprimitives/audit';
|
|
15
|
+
import { unwrapSecret } from '../types.js';
|
|
16
|
+
/** Dev helper: wrap a fixture token `Secret` as a provider. Never use in production. */
|
|
17
|
+
export function staticTokenProvider(token) {
|
|
18
|
+
return async () => unwrapSecret(token);
|
|
19
|
+
}
|
|
20
|
+
export class AgenticKmsError extends Error {
|
|
21
|
+
httpStatus;
|
|
22
|
+
code;
|
|
23
|
+
requestId;
|
|
24
|
+
retryable;
|
|
25
|
+
constructor(httpStatus, code, message, requestId, retryable) {
|
|
26
|
+
super(`[agentic-kms] ${code}: ${message} (request ${requestId})`);
|
|
27
|
+
this.httpStatus = httpStatus;
|
|
28
|
+
this.code = code;
|
|
29
|
+
this.requestId = requestId;
|
|
30
|
+
this.retryable = retryable;
|
|
31
|
+
this.name = 'AgenticKmsError';
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
const DEFAULT_LEVELS = ['CVM_DERIVED', 'CVM_WRAPPED', 'AZURE_HSM_DIRECT'];
|
|
35
|
+
// ---------------------------------------------------------------- transport
|
|
36
|
+
function b64url(bytes) {
|
|
37
|
+
let s = '';
|
|
38
|
+
for (let i = 0; i < bytes.length; i++)
|
|
39
|
+
s += String.fromCharCode(bytes[i]);
|
|
40
|
+
return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
41
|
+
}
|
|
42
|
+
function b64urlDecode(s) {
|
|
43
|
+
const pad = s.length % 4 === 0 ? '' : '='.repeat(4 - (s.length % 4));
|
|
44
|
+
const bin = atob(s.replace(/-/g, '+').replace(/_/g, '/') + pad);
|
|
45
|
+
const out = new Uint8Array(bin.length);
|
|
46
|
+
for (let i = 0; i < bin.length; i++)
|
|
47
|
+
out[i] = bin.charCodeAt(i);
|
|
48
|
+
return out;
|
|
49
|
+
}
|
|
50
|
+
function hex(bytes) {
|
|
51
|
+
let s = '';
|
|
52
|
+
for (let i = 0; i < bytes.length; i++)
|
|
53
|
+
s += bytes[i].toString(16).padStart(2, '0');
|
|
54
|
+
return `0x${s}`;
|
|
55
|
+
}
|
|
56
|
+
function unhex(h) {
|
|
57
|
+
const s = h.startsWith('0x') ? h.slice(2) : h;
|
|
58
|
+
const out = new Uint8Array(s.length / 2);
|
|
59
|
+
for (let i = 0; i < out.length; i++)
|
|
60
|
+
out[i] = parseInt(s.slice(i * 2, i * 2 + 2), 16);
|
|
61
|
+
return out;
|
|
62
|
+
}
|
|
63
|
+
function randomKey() {
|
|
64
|
+
const r = new Uint8Array(24);
|
|
65
|
+
crypto.getRandomValues(r);
|
|
66
|
+
return b64url(r);
|
|
67
|
+
}
|
|
68
|
+
function uuid() {
|
|
69
|
+
const b = new Uint8Array(16);
|
|
70
|
+
crypto.getRandomValues(b);
|
|
71
|
+
b[6] = (b[6] & 0x0f) | 0x40;
|
|
72
|
+
b[8] = (b[8] & 0x3f) | 0x80;
|
|
73
|
+
const h = Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
|
|
74
|
+
return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
|
|
75
|
+
}
|
|
76
|
+
class Transport {
|
|
77
|
+
#cfg;
|
|
78
|
+
constructor(cfg) {
|
|
79
|
+
if (!cfg.baseUrl || !cfg.tenantId || typeof cfg.tokenProvider !== 'function') {
|
|
80
|
+
throw new Error('[agentic-kms] baseUrl, tenantId and tokenProvider are required');
|
|
81
|
+
}
|
|
82
|
+
// Never store a detached reference to the platform fetch: Cloudflare Workers (workerd) throws
|
|
83
|
+
// "Illegal invocation: incorrect `this`" when a stored `globalThis.fetch` is called as a method.
|
|
84
|
+
const f = cfg.fetch ?? ((input, init) => globalThis.fetch(input, init));
|
|
85
|
+
if (typeof globalThis.fetch !== 'function' && !cfg.fetch)
|
|
86
|
+
throw new Error('[agentic-kms] fetch is not available');
|
|
87
|
+
this.#cfg = {
|
|
88
|
+
baseUrl: cfg.baseUrl.replace(/\/+$/, ''),
|
|
89
|
+
tenantId: cfg.tenantId,
|
|
90
|
+
tokenProvider: cfg.tokenProvider,
|
|
91
|
+
timeoutMs: cfg.timeoutMs ?? 10_000,
|
|
92
|
+
maxRetries: cfg.maxRetries ?? 2,
|
|
93
|
+
fetch: f,
|
|
94
|
+
levels: cfg.acceptedProtectionLevels ?? DEFAULT_LEVELS,
|
|
95
|
+
};
|
|
96
|
+
}
|
|
97
|
+
checkLevel(level) {
|
|
98
|
+
if (typeof level !== 'string' || !this.#cfg.levels.includes(level)) {
|
|
99
|
+
throw new Error(`[agentic-kms] protection level ${String(level)} not accepted (no downgrade; accepted: ${this.#cfg.levels.join(',')})`);
|
|
100
|
+
}
|
|
101
|
+
return level;
|
|
102
|
+
}
|
|
103
|
+
async get(path) {
|
|
104
|
+
return this.#once(path, undefined, undefined);
|
|
105
|
+
}
|
|
106
|
+
async post(path, body, idempotent) {
|
|
107
|
+
const idem = idempotent ? randomKey() : undefined;
|
|
108
|
+
const attempts = idempotent ? this.#cfg.maxRetries + 1 : 1;
|
|
109
|
+
let last;
|
|
110
|
+
for (let a = 0; a < attempts; a++) {
|
|
111
|
+
try {
|
|
112
|
+
return await this.#once(path, body, idem);
|
|
113
|
+
}
|
|
114
|
+
catch (e) {
|
|
115
|
+
last = e;
|
|
116
|
+
if (e instanceof AgenticKmsError && e.retryable && a + 1 < attempts) {
|
|
117
|
+
await new Promise((r) => setTimeout(r, 100 * 2 ** a));
|
|
118
|
+
continue;
|
|
119
|
+
}
|
|
120
|
+
throw e;
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
throw last;
|
|
124
|
+
}
|
|
125
|
+
async #once(path, body, idem) {
|
|
126
|
+
const isPost = body !== undefined;
|
|
127
|
+
const bytes = isPost ? new TextEncoder().encode(JSON.stringify(body)) : undefined;
|
|
128
|
+
const requestId = uuid();
|
|
129
|
+
const headers = {
|
|
130
|
+
authorization: `Bearer ${await this.#cfg.tokenProvider()}`,
|
|
131
|
+
'x-akcs-tenant-id': this.#cfg.tenantId,
|
|
132
|
+
'x-akcs-request-id': requestId,
|
|
133
|
+
};
|
|
134
|
+
if (bytes) {
|
|
135
|
+
const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
|
|
136
|
+
headers['content-type'] = 'application/json';
|
|
137
|
+
headers['x-akcs-timestamp'] = new Date().toISOString();
|
|
138
|
+
headers['x-akcs-body-sha256'] = b64url(digest);
|
|
139
|
+
if (idem)
|
|
140
|
+
headers['idempotency-key'] = idem;
|
|
141
|
+
}
|
|
142
|
+
const ctrl = new AbortController();
|
|
143
|
+
const t = setTimeout(() => ctrl.abort(), this.#cfg.timeoutMs);
|
|
144
|
+
let res;
|
|
145
|
+
try {
|
|
146
|
+
// redirect: 'manual' (workerd does not implement 'error'); any 3xx is rejected below — a custody
|
|
147
|
+
// call must never follow a redirect.
|
|
148
|
+
res = await this.#cfg.fetch(`${this.#cfg.baseUrl}${path}`, { method: isPost ? 'POST' : 'GET', headers, body: bytes ?? null, signal: ctrl.signal, cache: 'no-store', redirect: 'manual' });
|
|
149
|
+
}
|
|
150
|
+
catch (e) {
|
|
151
|
+
throw new Error(`[agentic-kms] request failed (request ${requestId}): ${e instanceof Error ? e.message : String(e)}`);
|
|
152
|
+
}
|
|
153
|
+
finally {
|
|
154
|
+
clearTimeout(t);
|
|
155
|
+
}
|
|
156
|
+
if (res.status >= 300 && res.status < 400) {
|
|
157
|
+
throw new Error(`[agentic-kms] AKCS answered with a redirect (HTTP ${res.status}, request ${requestId}); refusing to follow`);
|
|
158
|
+
}
|
|
159
|
+
const json = (await res.json().catch(() => ({})));
|
|
160
|
+
if (!res.ok) {
|
|
161
|
+
const err = json['error'];
|
|
162
|
+
throw new AgenticKmsError(res.status, err?.code ?? 'HTTP_ERROR', err?.message ?? `HTTP ${res.status}`, err?.requestId ?? requestId, err?.retryable === true);
|
|
163
|
+
}
|
|
164
|
+
return json;
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
// ----------------------------------------------------------------- provider
|
|
168
|
+
/** Envelope data keys + domain-separated MAC via AKCS. Implements `A2AKeyProvider`. */
|
|
169
|
+
export class RemoteAgenticKmsProvider {
|
|
170
|
+
keyVersion;
|
|
171
|
+
#t;
|
|
172
|
+
#purpose;
|
|
173
|
+
#auditSink;
|
|
174
|
+
constructor(cfg) {
|
|
175
|
+
this.#t = new Transport(cfg);
|
|
176
|
+
this.#purpose = cfg.envelopePurpose ?? 'session-data-key';
|
|
177
|
+
this.#auditSink = cfg.auditSink;
|
|
178
|
+
// The concrete version is per-response; this label identifies the backend.
|
|
179
|
+
this.keyVersion = 'agentic-kms';
|
|
180
|
+
}
|
|
181
|
+
async generateSessionDataKey(input) {
|
|
182
|
+
const r = await this.#t.post('/v1/data-keys/generate', { purpose: this.#purpose, aadContext: input.aadContext, canonicalizationScheme: 'ap-context-v1' }, true);
|
|
183
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
184
|
+
const plaintextDataKey = b64urlDecode(String(r['plaintextDataKey']));
|
|
185
|
+
if (plaintextDataKey.length !== 32)
|
|
186
|
+
throw new Error('[agentic-kms] malformed data key');
|
|
187
|
+
const keyId = String(r['keyId']);
|
|
188
|
+
const keyVersion = String(r['keyVersion']);
|
|
189
|
+
await this.#audit('key-custody.envelope.wrap', keyId, keyVersion, input.aadContext);
|
|
190
|
+
return { plaintextDataKey, encryptedDataKey: b64urlDecode(String(r['wrappedDataKey'])), keyId, keyVersion };
|
|
191
|
+
}
|
|
192
|
+
async decryptSessionDataKey(input) {
|
|
193
|
+
const keyVersion = Number(input.keyVersion);
|
|
194
|
+
if (!Number.isInteger(keyVersion) || keyVersion < 1)
|
|
195
|
+
throw new Error('[agentic-kms] keyVersion must be a positive integer');
|
|
196
|
+
const r = await this.#t.post('/v1/data-keys/unwrap', { wrappedDataKey: b64url(input.encryptedDataKey), keyId: input.keyId, keyVersion, aadContext: input.aadContext, canonicalizationScheme: 'ap-context-v1' }, true);
|
|
197
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
198
|
+
const dk = b64urlDecode(String(r['plaintextDataKey']));
|
|
199
|
+
if (dk.length !== 32)
|
|
200
|
+
throw new Error('[agentic-kms] malformed data key');
|
|
201
|
+
await this.#audit('key-custody.envelope.unwrap', input.keyId, input.keyVersion, input.aadContext);
|
|
202
|
+
return dk;
|
|
203
|
+
}
|
|
204
|
+
async generateMac(input) {
|
|
205
|
+
const r = await this.#t.post('/v1/mac/generate', { canonicalMessage: b64url(input.canonicalMessage), service: input.service, audience: input.audience, routeFamily: input.routeFamily ?? 'default' }, true);
|
|
206
|
+
return { mac: b64urlDecode(String(r['mac'])), keyId: `${String(r['keyId'])}:${String(r['keyVersion'])}` };
|
|
207
|
+
}
|
|
208
|
+
async #audit(action, keyId, keyVersion, aad) {
|
|
209
|
+
if (!this.#auditSink)
|
|
210
|
+
return;
|
|
211
|
+
// refs/hashes only (spec 278 P0): AAD is hashed, never logged raw.
|
|
212
|
+
const aadHash = hex(keccak_256(new TextEncoder().encode(JSON.stringify(Object.keys(aad).sort().map((k) => [k, aad[k]]))))).slice(0, 18);
|
|
213
|
+
await this.#auditSink.write(buildEvent({ action, outcome: 'success', actor: { type: 'system', id: 'agentic-kms' }, subject: { type: 'envelope', id: keyId }, context: { keyId, keyVersion, aadHash, provider: 'agentic-kms' } }));
|
|
214
|
+
}
|
|
215
|
+
}
|
|
216
|
+
/** secp256k1 signer via AKCS (generated key or per-subject derived signer). Implements `KmsAccountBackend`. */
|
|
217
|
+
export class RemoteAgenticKmsSigner {
|
|
218
|
+
provider = 'agentic-kms';
|
|
219
|
+
#t;
|
|
220
|
+
#target;
|
|
221
|
+
#purpose;
|
|
222
|
+
#chainId;
|
|
223
|
+
#auditSink;
|
|
224
|
+
#address;
|
|
225
|
+
constructor(cfg, target) {
|
|
226
|
+
this.#t = new Transport(cfg);
|
|
227
|
+
this.#target = target;
|
|
228
|
+
this.#purpose = cfg.signingPurpose ?? 'ERC4337_USER_OPERATION';
|
|
229
|
+
this.#chainId = cfg.chainId;
|
|
230
|
+
this.#auditSink = cfg.auditSink;
|
|
231
|
+
}
|
|
232
|
+
async getSignerAddress() {
|
|
233
|
+
if (this.#address)
|
|
234
|
+
return this.#address;
|
|
235
|
+
const r = this.#target.kind === 'subject'
|
|
236
|
+
? await this.#t.post('/v1/derived-signers/resolve', { subject: { iss: this.#target.iss, sub: this.#target.sub, rotation: this.#target.rotation }, derivationScheme: 'ap-oidc-custodian-secp256k1-v1' }, false)
|
|
237
|
+
: await this.#getPublicKey(this.#target.keyId);
|
|
238
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
239
|
+
const addr = String(r['ethereumAddress']);
|
|
240
|
+
if (!/^0x[0-9a-fA-F]{40}$/.test(addr))
|
|
241
|
+
throw new Error('[agentic-kms] malformed address');
|
|
242
|
+
this.#address = addr;
|
|
243
|
+
return this.#address;
|
|
244
|
+
}
|
|
245
|
+
async #getPublicKey(keyId) {
|
|
246
|
+
return this.#t.get(`/v1/keys/${encodeURIComponent(keyId)}/public-key`);
|
|
247
|
+
}
|
|
248
|
+
async signA2AAction(input) {
|
|
249
|
+
if (input.digest.length !== 32)
|
|
250
|
+
throw new Error(`[agentic-kms] signA2AAction expects a 32-byte digest; got ${input.digest.length}`);
|
|
251
|
+
const body = this.#target.kind === 'subject'
|
|
252
|
+
? { subject: { iss: this.#target.iss, sub: this.#target.sub, rotation: this.#target.rotation }, derivationScheme: 'ap-oidc-custodian-secp256k1-v1', digest: hex(input.digest), signingPurpose: this.#purpose, ...(this.#chainId ? { chainId: this.#chainId } : {}) }
|
|
253
|
+
: { digest: hex(input.digest), signingPurpose: this.#purpose, ...(this.#chainId ? { chainId: this.#chainId } : {}) };
|
|
254
|
+
const path = this.#target.kind === 'subject' ? '/v1/derived-signers/sign' : `/v1/keys/${encodeURIComponent(this.#target.keyId)}/sign`;
|
|
255
|
+
const r = await this.#t.post(path, body, true);
|
|
256
|
+
this.#t.checkLevel(r['protectionLevel']);
|
|
257
|
+
if (r['signatureEncoding'] !== 'RSV_65')
|
|
258
|
+
throw new Error('[agentic-kms] unexpected signature encoding');
|
|
259
|
+
const signature = unhex(String(r['signature']));
|
|
260
|
+
if (signature.length !== 65 || (signature[64] !== 27 && signature[64] !== 28))
|
|
261
|
+
throw new Error('[agentic-kms] malformed signature');
|
|
262
|
+
const signerAddress = String(r['signerAddress']);
|
|
263
|
+
this.#address = signerAddress;
|
|
264
|
+
const keyId = String(r['keyId']);
|
|
265
|
+
if (this.#auditSink) {
|
|
266
|
+
const ctx = input.auditContext ?? {};
|
|
267
|
+
try {
|
|
268
|
+
await this.#auditSink.write(buildEvent({
|
|
269
|
+
action: 'key-custody.sign',
|
|
270
|
+
outcome: 'success',
|
|
271
|
+
actor: { type: 'system', id: 'agentic-kms' },
|
|
272
|
+
subject: { type: 'sign-digest', id: hex(input.digest) },
|
|
273
|
+
context: {
|
|
274
|
+
keyId,
|
|
275
|
+
keyVersion: String(r['keyVersion']),
|
|
276
|
+
signerAddress,
|
|
277
|
+
provider: 'agentic-kms',
|
|
278
|
+
protectionLevel: String(r['protectionLevel']),
|
|
279
|
+
toolId: ctx.toolId ?? null,
|
|
280
|
+
actionId: ctx.actionId ?? null,
|
|
281
|
+
// Raw sessionId MUST NEVER be logged.
|
|
282
|
+
sessionHash: ctx.sessionId ? hex(keccak_256(new TextEncoder().encode(ctx.sessionId))).slice(0, 18) : null,
|
|
283
|
+
},
|
|
284
|
+
}));
|
|
285
|
+
}
|
|
286
|
+
catch {
|
|
287
|
+
/* fail-soft, matching the local signer */
|
|
288
|
+
}
|
|
289
|
+
}
|
|
290
|
+
return { signature, keyId, signerAddress };
|
|
291
|
+
}
|
|
292
|
+
}
|
|
293
|
+
/** Build a per-subject remote signer (used by `deriveSubjectSigner` for `agentic-kms`). */
|
|
294
|
+
/**
|
|
295
|
+
* Provision the ENVELOPE key an owner's data keys are generated under, and return whether it already
|
|
296
|
+
* existed. Idempotent by AKCS's own 409, so a re-run is a no-op.
|
|
297
|
+
*
|
|
298
|
+
* This lives here rather than in the calling app because AKCS requires a set of headers on EVERY
|
|
299
|
+
* request (tenant, request id, timestamp, body digest) that only `Transport` knows about — a hand-rolled
|
|
300
|
+
* `fetch` in an app gets `INVALID_HEADERS` and, worse, silently skips the retry and no-redirect rules a
|
|
301
|
+
* custody call is supposed to have.
|
|
302
|
+
*
|
|
303
|
+
* `purpose` is the SELECTOR: `data-keys/generate` resolves the tenant's ACTIVE ENVELOPE key with that
|
|
304
|
+
* purpose. A per-owner purpose therefore yields a genuinely per-owner KEY, which is what spec 278's
|
|
305
|
+
* per-person KEK requirement means (one tenant key separated by AAD would not be).
|
|
306
|
+
*/
|
|
307
|
+
export async function provisionEnvelopeKey(cfg, input) {
|
|
308
|
+
const t = new Transport(cfg);
|
|
309
|
+
try {
|
|
310
|
+
const r = await t.post('/v1/keys', {
|
|
311
|
+
externalName: input.externalName,
|
|
312
|
+
kind: 'ENVELOPE',
|
|
313
|
+
algorithm: 'AES_256_GCM',
|
|
314
|
+
purpose: input.purpose,
|
|
315
|
+
protectionLevel: input.protectionLevel ?? 'CVM_WRAPPED',
|
|
316
|
+
}, true); // AKCS REQUIRES an Idempotency-Key on key creation; it also buys the retry-on-retryable path.
|
|
317
|
+
// Re-running provision is deduped by AKCS's 409 on the duplicate purpose, not by that key.
|
|
318
|
+
return { keyId: typeof r['keyId'] === 'string' ? r['keyId'] : undefined, alreadyExisted: false };
|
|
319
|
+
}
|
|
320
|
+
catch (e) {
|
|
321
|
+
// 409 = this owner already has their key. Any other failure propagates: a provisioning error must
|
|
322
|
+
// never look like success, or the binding that follows references a key that does not exist.
|
|
323
|
+
if (e instanceof AgenticKmsError && e.httpStatus === 409)
|
|
324
|
+
return { alreadyExisted: true };
|
|
325
|
+
throw e;
|
|
326
|
+
}
|
|
327
|
+
}
|
|
328
|
+
export function remoteSubjectSigner(cfg, subject) {
|
|
329
|
+
return new RemoteAgenticKmsSigner(cfg, { kind: 'subject', iss: subject.iss, sub: subject.sub, rotation: subject.rotation ?? 0 });
|
|
330
|
+
}
|
|
331
|
+
//# sourceMappingURL=agentic.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agentic.js","sourceRoot":"","sources":["../../src/providers/agentic.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,yEAAyE;AACzE,yEAAyE;AACzE,wDAAwD;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA6B3C,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,OAAO,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAA6B;IAAwC;IAA4B;IAAtH,YAAqB,UAAkB,EAAW,IAAY,EAAE,OAAe,EAAW,SAAiB,EAAW,SAAkB;QACtI,KAAK,CAAC,iBAAiB,IAAI,KAAK,OAAO,aAAa,SAAS,GAAG,CAAC,CAAC;QAD/C,eAAU,GAAV,UAAU,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAA4B,cAAS,GAAT,SAAS,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAS;QAEtI,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,cAAc,GAA0B,CAAC,aAAa,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAEjG,6EAA6E;AAE7E,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AACD,SAAS,KAAK,CAAC,CAAS;IACtB,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AACD,SAAS,IAAI;IACX,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,SAAS;IACJ,IAAI,CAAmK;IAEhL,YAAY,GAAqB;QAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,8FAA8F;QAC9F,iGAAiG;QACjG,MAAM,CAAC,GAAiB,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClH,IAAI,CAAC,IAAI,GAAG;YACV,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,MAAM;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;YAC/B,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,GAAG,CAAC,wBAAwB,IAAI,cAAc;SACvD,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,KAAc;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAA4B,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,KAA4B,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmB;QACzD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAa,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,CAAC;gBACT,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;oBACpE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAa,EAAE,IAAwB;QAC/D,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE;YAC1D,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YACtC,mBAAmB,EAAE,SAAS;SAC/B,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACvD,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,IAAI;gBAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,iGAAiG;YACjG,qCAAqC;YACrC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5L,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,CAAC,MAAM,aAAa,SAAS,uBAAuB,CAAC,CAAC;QAChI,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAA6F,CAAC;YACtH,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,YAAY,EAAE,GAAG,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,IAAI,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;QAC/J,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,6EAA6E;AAE7E,uFAAuF;AACvF,MAAM,OAAO,wBAAwB;IAC1B,UAAU,CAAS;IACnB,EAAE,CAAY;IACd,QAAQ,CAAS;IACjB,UAAU,CAAwB;IAE3C,YAAY,GAAiD;QAC3D,IAAI,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAC1D,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC;QAChC,2EAA2E;QAC3E,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAA6C;QACxE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;QAChK,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,gBAAgB,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACpF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC9G,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAA8G;QACxI,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5H,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;QACtN,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAClG,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAgG;QAChH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5M,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAa,EAAE,UAAkB,EAAE,GAA2B;QACzF,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,mEAAmE;QACnE,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxI,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IACpO,CAAC;CACF;AAMD,+GAA+G;AAC/G,MAAM,OAAO,sBAAsB;IACxB,QAAQ,GAAG,aAAsB,CAAC;IAClC,EAAE,CAAY;IACd,OAAO,CAAe;IACtB,QAAQ,CAAqB;IAC7B,QAAQ,CAAqB;IAC7B,UAAU,CAAwB;IAC3C,QAAQ,CAAsB;IAE9B,YAAY,GAAiD,EAAE,MAAoB;QACjF,IAAI,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,cAAc,IAAI,wBAAwB,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,CAAC,GACL,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,EAAE,KAAK,CAAC;YAC9M,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,GAAG,IAAe,CAAC;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAwG;QAC1H,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpI,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,gCAAgC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpQ,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACtI,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxG,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpI,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAY,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE;oBAC5C,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBACvD,OAAO,EAAE;wBACP,KAAK;wBACL,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;wBACnC,aAAa;wBACb,QAAQ,EAAE,aAAa;wBACvB,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;wBAC7C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,sCAAsC;wBACtC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;qBAC1G;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,2FAA2F;AAC3F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAqB,EACrB,KAAuF;IAEvF,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE;YACjC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,aAAa;SACxD,EAAE,IAAI,CAAC,CAAC,CAAC,8FAA8F;QAC9F,2FAA2F;QACrG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACnG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,kGAAkG;QAClG,6FAA6F;QAC7F,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG;YAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAC1F,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAiD,EAAE,OAAwD;IAC7I,OAAO,IAAI,sBAAsB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;AACnI,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import type { Address } from '@agenticprimitives/types';
|
|
2
2
|
import type { AuditSink } from '@agenticprimitives/audit';
|
|
3
|
-
export type KmsBackend = 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
3
|
+
export type KmsBackend = 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
4
4
|
/**
|
|
5
5
|
* H7-F.5 / PKG-KEY-CUSTODY-005 closure — opaque branded type for
|
|
6
6
|
* sensitive config values (raw private keys, KMS service-account JSON,
|
|
@@ -62,6 +62,13 @@ export interface BuildOpts {
|
|
|
62
62
|
* latest possible moment + never store the unwrapped value.
|
|
63
63
|
*/
|
|
64
64
|
secretConfig?: Record<string, Secret<string>>;
|
|
65
|
+
/**
|
|
66
|
+
* Typed remote configuration for the `agentic-kms` backend (spec 203 §2;
|
|
67
|
+
* AKCS design §2.4). Bearer tokens are acquired just in time through
|
|
68
|
+
* `tokenProvider` and are never placed in `config`. Required when
|
|
69
|
+
* `backend === 'agentic-kms'`; there is no fallback to another backend.
|
|
70
|
+
*/
|
|
71
|
+
agenticKms?: import('./providers/agentic.js').AgenticKmsConfig;
|
|
65
72
|
/**
|
|
66
73
|
* Optional audit sink threaded into signers so every signing op emits
|
|
67
74
|
* `key-custody.sign`. Consumers share one sink across all primitives
|
|
@@ -126,7 +133,7 @@ export interface KmsAccountBackend {
|
|
|
126
133
|
* provenance), instead of a defaulted `'local-aes'` label that could
|
|
127
134
|
* mislabel a production GCP signer (audit F-6).
|
|
128
135
|
*/
|
|
129
|
-
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms';
|
|
136
|
+
readonly provider: 'local-aes' | 'aws-kms' | 'gcp-kms' | 'agentic-kms';
|
|
130
137
|
signA2AAction: NonNullable<A2AKeyProvider['signA2AAction']>;
|
|
131
138
|
getSignerAddress(): Promise<Address>;
|
|
132
139
|
}
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,QAAA,MAAM,YAAY,EAAE,OAAO,MAA+C,CAAC;AAE3E,MAAM,WAAW,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM;IAC/C,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CACpB;AAQD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAqB9E;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAWpF;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAEnE;AAED,kBAAkB;AAClB,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAE9E;AAED,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;IAC/D;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,aAAa,CAAC;IAC3C,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,KAAK,EAAE;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,qBAAqB,CAAC,KAAK,EAAE;QAC3B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,aAAa,CAAC,CAAC,KAAK,EAAE;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9E,WAAW,CAAC,CAAC,KAAK,EAAE;QAClB,gBAAgB,EAAE,UAAU,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;IACvE,aAAa,EAAE,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5D,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agenticprimitives/key-custody",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
4
|
-
"description": "Pluggable envelope encryption + signers + HMAC providers (local-AES / AWS KMS / GCP KMS). Pure crypto primitives; no session lifecycle (that's in delegation).",
|
|
3
|
+
"version": "1.0.0-alpha.23",
|
|
4
|
+
"description": "Pluggable envelope encryption + signers + HMAC providers (local-AES / AWS KMS / GCP KMS / AKCS agentic-kms). Pure crypto primitives; no session lifecycle (that's in delegation).",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
@@ -35,6 +35,10 @@
|
|
|
35
35
|
"types": "./dist/providers/gcp.d.ts",
|
|
36
36
|
"import": "./dist/providers/gcp.js"
|
|
37
37
|
},
|
|
38
|
+
"./agentic": {
|
|
39
|
+
"types": "./dist/providers/agentic.d.ts",
|
|
40
|
+
"import": "./dist/providers/agentic.js"
|
|
41
|
+
},
|
|
38
42
|
"./kms-core": {
|
|
39
43
|
"types": "./dist/kms/kms-core.d.ts",
|
|
40
44
|
"import": "./dist/kms/kms-core.js"
|
|
@@ -43,10 +47,6 @@
|
|
|
43
47
|
"types": "./dist/kms/provision-gcp.d.ts",
|
|
44
48
|
"import": "./dist/kms/provision-gcp.js"
|
|
45
49
|
},
|
|
46
|
-
"./mac": {
|
|
47
|
-
"types": "./dist/mac.d.ts",
|
|
48
|
-
"import": "./dist/mac.js"
|
|
49
|
-
},
|
|
50
50
|
"./kms-viem": {
|
|
51
51
|
"types": "./dist/kms-viem-account.d.ts",
|
|
52
52
|
"import": "./dist/kms-viem-account.js"
|
|
@@ -76,9 +76,9 @@
|
|
|
76
76
|
},
|
|
77
77
|
"peerDependencies": {
|
|
78
78
|
"viem": "^2.52.2",
|
|
79
|
-
"@agenticprimitives/audit": "1.0.0-alpha.
|
|
80
|
-
"@agenticprimitives/connect-auth": "1.0.0-alpha.
|
|
81
|
-
"@agenticprimitives/types": "1.0.0-alpha.
|
|
79
|
+
"@agenticprimitives/audit": "1.0.0-alpha.23",
|
|
80
|
+
"@agenticprimitives/connect-auth": "1.0.0-alpha.23",
|
|
81
|
+
"@agenticprimitives/types": "1.0.0-alpha.23"
|
|
82
82
|
},
|
|
83
83
|
"peerDependenciesMeta": {
|
|
84
84
|
"@agenticprimitives/audit": {
|