@framers/agentos-ext-anchor-providers 1.1.0 → 1.2.1

package/dist/providers/RekorProvider.js

@@ -1,16 +1,62 @@
+// @ts-nocheck
 /**
  * @file RekorProvider.ts
- * @description Sigstore Rekor transparency log anchor provider.
- * Publishes anchor Merkle roots as hashedrekord entries to Rekor.
+ * @description Sigstore Rekor transparency-log anchor provider.
+ *
+ * Submits a `hashedrekord` entry to Rekor so each anchor is recorded
+ * in a public append-only log keyed by SHA-256 of the canonical
+ * anchor. Rekor cryptographically verifies the supplied signature
+ * against the supplied hash before accepting the entry, so the caller
+ * must provide an Ed25519 `signArtifact` function that signs over the
+ * raw hash bytes (Rekor's verification target) — **not** the
+ * AgentKeyManager's sign-over-merkleRoot-string output, which is the
+ * wrong byte sequence for Rekor's verifier.
  *
  * Proof level: `publicly-auditable`
- * Required peer dependency: `sigstore`
+ * Required dependencies: none for `publish` (uses global `fetch`).
  *
  * @module @framers/agentos-ext-anchor-providers
  */
 import { resolveBaseConfig } from '../types.js';
+import { fetchWithRetry } from '../utils/http-client.js';
 import { hashCanonicalAnchor } from '../utils/serialization.js';
 const DEFAULT_SERVER_URL = 'https://rekor.sigstore.dev';
+/**
+ * Encode the Rekor server URL into the externalRef so verify() reaches the
+ * same server that recorded the entry, even if config.serverUrl has been
+ * changed since publish. The serverUrl is base64-encoded so a `:` character
+ * in the URL doesn't collide with the externalRef field separator.
+ */
+function encodeExternalRef(serverUrl, logIndex, uuid) {
+    const encodedServer = Buffer.from(serverUrl, 'utf-8').toString('base64url');
+    return `rekor:${encodedServer}:${logIndex}:${uuid}`;
+}
+/** Decode an externalRef back to { serverUrl, uuid }. Tolerates the old
+ *  two-field `rekor:${logIndex}:${uuid}` shape by falling back to
+ *  `fallbackServerUrl` (typically `this.config.serverUrl`).
+ */
+function decodeExternalRef(externalRef, fallbackServerUrl) {
+    if (!externalRef.startsWith('rekor:'))
+        return null;
+    const parts = externalRef.split(':');
+    // New format: rekor:<base64url(serverUrl)>:<logIndex>:<uuid>  (>= 4 parts)
+    if (parts.length >= 4) {
+        try {
+            const serverUrl = Buffer.from(parts[1] ?? '', 'base64url').toString('utf-8');
+            const uuid = parts.slice(3).join(':');
+            if (serverUrl && uuid)
+                return { serverUrl, uuid };
+        }
+        catch {
+            // Falls through to legacy format check.
+        }
+    }
+    // Legacy format: rekor:<logIndex>:<uuid> (exactly 3 parts)
+    if (parts.length === 3) {
+        return { serverUrl: fallbackServerUrl, uuid: parts[2] ?? '' };
+    }
+    return null;
+}
 export class RekorProvider {
     id = 'rekor';
     name = 'Sigstore Rekor Transparency Log';
@@ -23,46 +69,187 @@ export class RekorProvider {
             timeoutMs: config.timeoutMs ?? 30_000,
             retries: config.retries ?? 3,
             retryDelayMs: config.retryDelayMs ?? 1_000,
+            publicKeyPem: config.publicKeyPem,
+            signArtifact: config.signArtifact,
         };
         this.baseConfig = resolveBaseConfig(config);
     }
     async publish(anchor) {
-        // TODO: Implement using sigstore SDK or direct HTTP to Rekor API
-        //
-        // Implementation outline:
-        //   1. Compute SHA-256 hash of canonical anchor: hashCanonicalAnchor(anchor)
-        //   2. Create a hashedrekord entry:
-        //      POST ${serverUrl}/api/v1/log/entries
-        //      Body: { kind: 'hashedrekord', apiVersion: '0.0.1',
-        //              spec: { data: { hash: { algorithm: 'sha256', value: anchorHash } },
-        //                      signature: { content: anchor.signature, publicKey: { content: ... } } } }
-        //   3. Parse response for log index and entry UUID
-        //   4. Return { success: true, externalRef: `rekor:${logIndex}:${entryUUID}`,
-        //              metadata: { logIndex, serverUrl, inclusionProof } }
+        if (!this.config.publicKeyPem || !this.config.signArtifact) {
+            return {
+                providerId: this.id,
+                success: false,
+                error: 'RekorProvider.publish requires both publicKeyPem (PEM-encoded Ed25519 public key) and signArtifact (function signing the raw hash bytes).',
+                metadata: { serverUrl: this.config.serverUrl },
+            };
+        }
+        const digestHex = await hashCanonicalAnchor(anchor);
+        const digestBytes = Buffer.from(digestHex, 'hex');
+        let signatureBytes;
+        try {
+            const raw = await this.config.signArtifact(new Uint8Array(digestBytes));
+            signatureBytes = raw instanceof Uint8Array ? raw : new Uint8Array(raw);
+        }
+        catch (e) {
+            return {
+                providerId: this.id,
+                success: false,
+                error: `RekorProvider signArtifact failed: ${e instanceof Error ? e.message : String(e)}`,
+                metadata: { serverUrl: this.config.serverUrl },
+            };
+        }
+        // hashedrekord v0.0.1 entry. The signature MUST be valid for
+        // (publicKey, digestBytes) under Ed25519; Rekor refuses entries
+        // whose signature does not verify against the supplied hash.
+        const entry = {
+            apiVersion: '0.0.1',
+            kind: 'hashedrekord',
+            spec: {
+                data: {
+                    hash: {
+                        algorithm: 'sha256',
+                        value: digestHex,
+                    },
+                },
+                signature: {
+                    content: Buffer.from(signatureBytes).toString('base64'),
+                    publicKey: {
+                        content: Buffer.from(this.config.publicKeyPem, 'utf-8').toString('base64'),
+                    },
+                },
+            },
+        };
+        let response;
+        try {
+            response = await fetchWithRetry(`${this.config.serverUrl.replace(/\/$/, '')}/api/v1/log/entries`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                },
+                body: JSON.stringify(entry),
+            }, {
+                timeoutMs: this.config.timeoutMs,
+                retries: this.config.retries,
+                retryDelayMs: this.config.retryDelayMs,
+            });
+        }
+        catch (e) {
+            return {
+                providerId: this.id,
+                success: false,
+                error: `Rekor submit failed: ${e instanceof Error ? e.message : String(e)}`,
+                metadata: { serverUrl: this.config.serverUrl },
+            };
+        }
+        if (!response.ok) {
+            let body = '';
+            try {
+                body = (await response.text()).slice(0, 500);
+            }
+            catch {
+                // ignore
+            }
+            return {
+                providerId: this.id,
+                success: false,
+                error: `Rekor rejected entry: HTTP ${response.status} ${response.statusText}${body ? ` — ${body}` : ''}`,
+                metadata: { serverUrl: this.config.serverUrl, status: response.status },
+            };
+        }
+        let entryMap;
         try {
-            const _hash = await hashCanonicalAnchor(anchor);
-            throw new Error('RekorProvider is not yet implemented. ' +
-                'Install sigstore SDK and implement the Rekor transparency log integration.');
+            entryMap = (await response.json());
         }
         catch (e) {
             return {
                 providerId: this.id,
                 success: false,
-                error: e instanceof Error ? e.message : String(e),
+                error: `Rekor returned unparseable JSON: ${e instanceof Error ? e.message : String(e)}`,
+                metadata: { serverUrl: this.config.serverUrl },
             };
         }
+        // Rekor responses are keyed by entry UUID with the entry as the
+        // value. There's exactly one key in a single-submit response.
+        const uuid = Object.keys(entryMap)[0];
+        const entryData = uuid ? entryMap[uuid] : undefined;
+        if (!uuid || !entryData) {
+            return {
+                providerId: this.id,
+                success: false,
+                error: 'Rekor returned a response without an entry UUID',
+                metadata: { serverUrl: this.config.serverUrl },
+            };
+        }
+        const logIndex = entryData.logIndex;
+        return {
+            providerId: this.id,
+            success: true,
+            externalRef: encodeExternalRef(this.config.serverUrl, logIndex, uuid),
+            publishedAt: new Date().toISOString(),
+            metadata: {
+                serverUrl: this.config.serverUrl,
+                logIndex,
+                uuid,
+                integratedTime: entryData.integratedTime,
+                hasInclusionProof: Boolean(entryData.verification?.inclusionProof),
+            },
+        };
     }
+    /**
+     * Confirm the anchor's Rekor entry exists and its body hash matches a
+     * fresh canonical anchor digest. Does NOT cryptographically verify
+     * the inclusion proof against the signed tree head — that needs the
+     * sigstore SDK; for compliance workflows wire up
+     * `sigstore.verify(bundle)` after this method returns true.
+     */
     async verify(anchor) {
-        // TODO: Retrieve entry from Rekor by externalRef and verify inclusion proof
-        //   GET ${serverUrl}/api/v1/log/entries/${entryUUID}
-        //   Verify inclusion proof against the transparency log root
         if (!anchor.externalRef)
             return false;
-        console.warn('[RekorProvider] verify() is not yet implemented');
-        return false;
+        const decoded = decodeExternalRef(anchor.externalRef, this.config.serverUrl);
+        if (!decoded)
+            return false;
+        try {
+            const response = await fetchWithRetry(`${decoded.serverUrl.replace(/\/$/, '')}/api/v1/log/entries/${decoded.uuid}`, undefined, {
+                timeoutMs: this.config.timeoutMs,
+                retries: this.config.retries,
+                retryDelayMs: this.config.retryDelayMs,
+            });
+            if (!response.ok)
+                return false;
+            const entryMap = (await response.json());
+            const entry = entryMap[decoded.uuid];
+            if (!entry?.body)
+                return false;
+            // Body is base64-encoded JSON of the hashedrekord spec.
+            const bodyJson = Buffer.from(entry.body, 'base64').toString('utf-8');
+            const body = JSON.parse(bodyJson);
+            const storedHash = body.spec?.data?.hash?.value;
+            if (typeof storedHash !== 'string')
+                return false;
+            const recomputed = await hashCanonicalAnchor(anchor);
+            // Compare hashes; canonical equality of the SHA-256 hex is the
+            // integrity signal for the recorded artifact.
+            return constantTimeEqual(storedHash.toLowerCase(), recomputed.toLowerCase());
+        }
+        catch {
+            return false;
+        }
     }
     async dispose() {
-        // No persistent resources in current implementation
+        // No persistent resources.
     }
 }
+/**
+ * Constant-time string equality (over hex digests) to avoid leaking
+ * digest prefixes via timing differences when called in a tight loop.
+ */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
 //# sourceMappingURL=RekorProvider.js.map

package/dist/providers/RekorProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"RekorProvider.js","sourceRoot":"","sources":["../../src/providers/RekorProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAOhE,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,MAAM,OAAO,aAAa;IACf,EAAE,GAAG,OAAO,CAAC;IACb,IAAI,GAAG,iCAAiC,CAAC;IACzC,UAAU,GAAe,oBAAoB,CAAC;IAEtC,MAAM,CAAgC;IACtC,UAAU,CAA+B;IAE1D,YAAY,SAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,kBAAkB;YACjD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SAC3C,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,iEAAiE;QACjE,EAAE;QACF,0BAA0B;QAC1B,6EAA6E;QAC7E,oCAAoC;QACpC,4CAA4C;QAC5C,0DAA0D;QAC1D,mFAAmF;QACnF,iGAAiG;QACjG,mDAAmD;QACnD,8EAA8E;QAC9E,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,wCAAwC;gBACxC,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,4EAA4E;QAC5E,qDAAqD;QACrD,6DAA6D;QAC7D,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO;QACX,oDAAoD;IACtD,CAAC;CACF"}
+{"version":3,"file":"RekorProvider.js","sourceRoot":"","sources":["../../src/providers/RekorProvider.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAqBhE,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAY;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,SAAS,aAAa,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACxB,WAAmB,EACnB,iBAAyB;IAEzB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,2EAA2E;IAC3E,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IACD,2DAA2D;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,aAAa;IACf,EAAE,GAAG,OAAO,CAAC;IACb,IAAI,GAAG,iCAAiC,CAAC;IACzC,UAAU,GAAe,oBAAoB,CAAC;IAEtC,MAAM,CAGrB;IACe,UAAU,CAA+B;IAE1D,YAAY,SAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,kBAAkB;YACjD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3D,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EACH,2IAA2I;gBAC7I,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;aAC/C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,cAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;YACxE,cAAc,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sCAAsC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACzF,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;aAC/C,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,gEAAgE;QAChE,6DAA6D;QAC7D,MAAM,KAAK,GAAG;YACZ,UAAU,EAAE,OAAO;YACnB,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE;gBACJ,IAAI,EAAE;oBACJ,IAAI,EAAE;wBACJ,SAAS,EAAE,QAAQ;wBACnB,KAAK,EAAE,SAAS;qBACjB;iBACF;gBACD,SAAS,EAAE;oBACT,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACvD,SAAS,EAAE;wBACT,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;qBAC3E;iBACF;aACF;SACF,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,cAAc,CAC7B,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,EAChE;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC5B,EACD;gBACE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACvC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAC3E,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8BAA8B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxG,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;aACxE,CAAC;QACJ,CAAC;QAED,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,oCAAoC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACvF,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;aAC/C,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,8DAA8D;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,iDAAiD;gBACxD,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;aAC/C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QACpC,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;YACrE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,QAAQ,EAAE;gBACR,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,QAAQ;gBACR,IAAI;gBACJ,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC;aACnE;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,OAAO,CAAC,IAAI,EAAE,EAC5E,SAAS,EACT;gBACE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACvC,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;YAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE,IAAI;gBAAE,OAAO,KAAK,CAAC;YAE/B,wDAAwD;YACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwD,CAAC;YACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;YAChD,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAEjD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACrD,+DAA+D;YAC/D,8CAA8C;YAC9C,OAAO,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,2BAA2B;IAC7B,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/providers/SolanaProvider.d.ts

@@ -20,21 +20,71 @@ export interface SolanaProviderConfig extends BaseProviderConfig {
     /** Wunderland on-chain program ID. */
     programId: string;
     /**
-     * Signer secret key (Solana Keypair secretKey bytes) as a JSON number array.
+     * Owner wallet signer used for agent registration (`initialize_agent`).
+     *
+     * This wallet:
+     * - signs `initialize_agent`
+     * - pays the mint fee + rent
+     *
+     * Notes:
+     * - Registration is permissionless (not registrar-gated).
+     * - The owner wallet must be different from the agent signer (on-chain invariant).
+     */
+    ownerSecretKeyJson?: number[];
+    ownerKeypairPath?: string;
+    ownerPrivateKeyBase58?: string;
+    /**
+     * @deprecated Use `owner*` fields instead.
+     *
+     * Legacy alias for the owner wallet used for agent registration.
+     *
+     * Kept for backward compatibility with older configs that used the term "registrar".
+     */
+    registrarSecretKeyJson?: number[];
+    registrarKeypairPath?: string;
+    registrarPrivateKeyBase58?: string;
+    /**
+     * Agent signer wallet secret key (Solana Keypair secretKey bytes) as a JSON number array.
+     *
+     * This keypair is used to:
+     * - pay transaction fees/rent (fee payer)
+     * - ed25519-sign Wunderland payload messages (agent signer)
+     *
      * Example: the contents of a Solana CLI keypair file.
      */
     signerSecretKeyJson?: number[];
-    /** Path to Solana keypair JSON file (array of numbers). */
+    /** Path to agent signer wallet keypair JSON file (array of numbers). */
     signerKeypairPath?: string;
-    /** Base58-encoded signer secret key bytes (64 bytes). */
+    /** Base58-encoded agent signer wallet secret key bytes (64 bytes). */
     signerPrivateKeyBase58?: string;
     /** Solana cluster label used only for `externalRef` formatting. */
     cluster?: 'devnet' | 'testnet' | 'mainnet-beta' | 'localnet';
     /** Commitment level (e.g. 'confirmed', 'finalized'). Default: 'confirmed'. */
     commitment?: string;
+    /**
+     * Enclave name to publish into.
+     *
+     * Default: 'wunderland'
+     */
+    enclaveName?: string;
+    /**
+     * If true, automatically creates the enclave (create_enclave) when missing.
+     *
+     * Default: false
+     */
+    autoCreateEnclave?: boolean;
+    /**
+     * Optional explicit agent_id (32-byte hex string).
+     *
+     * If omitted, a deterministic id is derived from the signer public key.
+     */
+    agentIdHex?: string;
     /**
      * If true, automatically initializes the agent (initialize_agent) when missing.
-     * Default: true
+     *
+     * Requires owner wallet signer configuration (see `owner*` fields).
+     *
+     * Default: false
      */
     autoInitializeAgent?: boolean;
     /** Display name used when auto-initializing the agent. Default: 'AgentOS'. */
@@ -57,6 +107,10 @@ export declare class SolanaProvider implements AnchorProvider {
     dispose(): Promise<void>;
     private loadWeb3;
     private loadSigner;
+    private loadRegistrarSigner;
     private loadBs58;
+    private tryLoadOwnerSigner;
+    private loadOwnerSigner;
+    private findAgentIdentityBySearch;
 }
 //# sourceMappingURL=SolanaProvider.d.ts.map

package/dist/providers/SolanaProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SolanaProvider.d.ts","sourceRoot":"","sources":["../../src/providers/SolanaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAItD,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,yDAAyD;IACzD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,mEAAmE;IACnE,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,UAAU,CAAC;IAE7D,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;CACtE;AA4CD,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,EAAE,YAAY;IACvB,QAAQ,CAAC,IAAI,yCAAyC;IACtD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAA0B;IAEzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;gBAE9C,MAAM,EAAE,oBAAoB;IAWlC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6I5D,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IA8B9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAIhB,QAAQ;YAYR,UAAU;YAwBV,QAAQ;CASvB"}
+{"version":3,"file":"SolanaProvider.d.ts","sourceRoot":"","sources":["../../src/providers/SolanaProvider.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAItD,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,sEAAsE;IACtE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,mEAAmE;IACnE,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,UAAU,CAAC;IAE7D,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;CACtE;AAyHD,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,EAAE,YAAY;IACvB,QAAQ,CAAC,IAAI,yCAAyC;IACtD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAA0B;IAEzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;gBAE9C,MAAM,EAAE,oBAAoB;IAalC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+U5D,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IA6B9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAIhB,QAAQ;YAYR,UAAU;YAwBV,mBAAmB;YAKnB,QAAQ;YAUR,kBAAkB;YAQlB,eAAe;YA2Cf,yBAAyB;CA0CxC"}