@enbox/agent 0.1.3 → 0.1.4

package/src/types/key-manager.ts

@@ -1,16 +1,29 @@
-import type { Cipher, Jwk, KeyIdentifier, KeyWrapper, KmsExportKeyParams, KmsImportKeyParams, PublicKeyJwk } from '@enbox/crypto';
+import type {
+  Cipher,
+  Jwk,
+  KeyDeleter,
+  KeyExporter,
+  KeyIdentifier,
+  KeyImporter,
+  KeyManager,
+  KeyWrapper,
+  KmsCipherParams,
+  KmsDeleteKeyParams,
+  KmsExportKeyParams,
+  KmsImportKeyParams,
+  KmsUriUnwrapKeyParams,
+  KmsUriWrapKeyParams,
+  PublicKeyJwk,
+} from '@enbox/crypto';
 
-import type { KeyManager } from '../prototyping/crypto/types/key-manager.js';
 import type { Web5PlatformAgent } from './agent.js';
-import type { KeyDeleter, KeyExporter, KeyImporter } from '../prototyping/crypto/types/key-io.js';
-import type { KmsCipherParams, KmsDeleteKeyParams, KmsUnwrapKeyParams, KmsWrapKeyParams } from '../prototyping/crypto/types/params-kms.js';
 
 export interface AgentKeyManager extends KeyManager,
   Cipher<KmsCipherParams, KmsCipherParams>,
   KeyImporter<KmsImportKeyParams, KeyIdentifier>,
   KeyExporter<KmsExportKeyParams, Jwk>,
   KeyDeleter<KmsDeleteKeyParams>,
-  KeyWrapper<KmsWrapKeyParams, KmsUnwrapKeyParams> {
+  KeyWrapper<KmsUriWrapKeyParams, KmsUriUnwrapKeyParams> {
 
   agent: Web5PlatformAgent;
 
@@ -20,7 +33,7 @@ export interface AgentKeyManager extends KeyManager,
    *
    * The private key never leaves the KMS boundary — only the public key is returned.
    *
-   * @param params.keyUri - URI of the stored ancestor private key (secp256k1)
+   * @param params.keyUri - URI of the stored ancestor private key (X25519)
    * @param params.derivationPath - Array of HKDF path segments to derive through
    * @returns The derived child public key as a JWK
    */
@@ -30,30 +43,26 @@ export interface AgentKeyManager extends KeyManager,
   }): Promise<PublicKeyJwk>;
 
   /**
-   * Decrypts an ECIES-SECP256K1 encrypted payload using a derived private key.
+   * Unwraps a JWE-encrypted Content Encryption Key (CEK) using a derived X25519 private key.
    *
    * This method:
    * 1. Derives the leaf private key via HKDF through the derivation path
-   * 2. Performs ECIES decryption using the derived key
-   * 3. Returns the decrypted plaintext (typically a 32-byte DEK)
+   * 2. Performs ECDH-ES key agreement with the ephemeral public key
+   * 3. Derives the KEK via Concat KDF and unwraps the CEK with AES-256 Key Unwrap
    *
-   * The derived private key is used internally and discarded after decryption.
+   * The derived private key is used internally and discarded after unwrapping.
    *
-   * @param params.keyUri - URI of the stored ancestor private key (secp256k1)
+   * @param params.keyUri - URI of the stored ancestor private key (X25519)
    * @param params.derivationPath - Array of HKDF path segments to derive the leaf key
-   * @param params.ciphertext - The ECIES encrypted payload
-   * @param params.ephemeralPublicKey - Ephemeral public key from ECIES encryption
-   * @param params.initializationVector - IV for the symmetric encryption step
-   * @param params.messageAuthenticationCode - MAC tag for integrity verification
-   * @returns The decrypted plaintext bytes
+   * @param params.encryptedKey - The wrapped CEK bytes from the JWE recipient
+   * @param params.ephemeralPublicKey - Ephemeral X25519 public key from the JWE recipient header
+   * @returns The unwrapped CEK bytes (typically 32 bytes for AES-256)
    */
-  eciesSecp256k1Decrypt(params: {
+  jweKeyUnwrap(params: {
     keyUri: KeyIdentifier;
     derivationPath: string[];
-    ciphertext: Uint8Array;
-    ephemeralPublicKey: Uint8Array;
-    initializationVector: Uint8Array;
-    messageAuthenticationCode: Uint8Array;
+    encryptedKey: Uint8Array;
+    ephemeralPublicKey: PublicKeyJwk;
   }): Promise<Uint8Array>;
 
   /**
@@ -70,7 +79,7 @@ export interface AgentKeyManager extends KeyManager,
    * immediately encrypted with the recipient's public key and the raw bytes
    * are discarded after encryption.
    *
-   * @param params.keyUri - URI of the stored ancestor private key (secp256k1)
+   * @param params.keyUri - URI of the stored ancestor private key (X25519)
    * @param params.derivationPath - Array of HKDF path segments to derive through
    * @returns The derived child private key as raw bytes
    */

package/src/utils-internal.ts

@@ -61,7 +61,7 @@ export class DeterministicKeyGenerator extends LocalKeyManager {
   }
 
   public async generateKey(_params: {
-    algorithm: 'Ed25519' | 'secp256k1' | 'secp256r1'
+    algorithm: 'Ed25519' | 'secp256k1' | 'secp256r1' | 'X25519'
   }): Promise<KeyIdentifier> {
     // Get the next key from the array of predefined keys.
     const { value: keyUri, done } = this._keyGenerator.next();

package/src/web5-user-agent.ts

@@ -1,7 +1,7 @@
 import type { AgentKeyManager } from './types/key-manager.js';
 import type { BearerDid } from '@enbox/dids';
 import type { Web5PlatformAgent } from './types/agent.js';
-import type { Web5Rpc } from './rpc-client.js';
+import type { Web5Rpc } from '@enbox/dwn-clients';
 import type { DidInterface, DidRequest, DidResponse } from './did-api.js';
 import type { DwnInterface, DwnResponse, ProcessDwnRequest, SendDwnRequest } from './types/dwn.js';
 import type { ProcessVcRequest, SendVcRequest, VcResponse } from './types/vc.js';
@@ -20,7 +20,7 @@ import { HdIdentityVault } from './hd-identity-vault.js';
 import { LevelStore } from '@enbox/common';
 import { LocalKeyManager } from './local-key-manager.js';
 import { SyncEngineLevel } from './sync-engine-level.js';
-import { Web5RpcClient } from './rpc-client.js';
+import { Web5RpcClient } from '@enbox/dwn-clients';
 import { DidDht, DidJwk } from '@enbox/dids';
 
 /**