@kya-os/mcp-i-cloudflare 1.13.4 → 1.13.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/adapter.d.ts +12 -0
- package/dist/adapter.d.ts.map +1 -1
- package/dist/adapter.js +57 -15
- package/dist/adapter.js.map +1 -1
- package/dist/app.d.ts +1 -1
- package/dist/delegation-http/consent-anchor-bridge.d.ts.map +1 -1
- package/dist/delegation-http/consent-anchor-bridge.js +41 -3
- package/dist/delegation-http/consent-anchor-bridge.js.map +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +8 -8
- package/dist/index.js.map +1 -1
- package/dist/proof-generator.d.ts +4 -0
- package/dist/proof-generator.d.ts.map +1 -1
- package/dist/proof-generator.js +7 -0
- package/dist/proof-generator.js.map +1 -1
- package/dist/providers/crypto.d.ts +23 -6
- package/dist/providers/crypto.d.ts.map +1 -1
- package/dist/providers/crypto.js +47 -45
- package/dist/providers/crypto.js.map +1 -1
- package/dist/providers/kv-identity.d.ts +35 -0
- package/dist/providers/kv-identity.d.ts.map +1 -1
- package/dist/providers/kv-identity.js +30 -0
- package/dist/providers/kv-identity.js.map +1 -1
- package/dist/providers/storage.d.ts +84 -26
- package/dist/providers/storage.d.ts.map +1 -1
- package/dist/providers/storage.js +220 -83
- package/dist/providers/storage.js.map +1 -1
- package/package.json +2 -3
package/dist/index.js
CHANGED
|
@@ -21,7 +21,7 @@ import { WELL_KNOWN_CORS_HEADERS, AccessControlApiService, ProofVerifier, } from
|
|
|
21
21
|
export { MCPIRuntimeBase, WELL_KNOWN_CORS_HEADERS, createHmacRuntimeAuditContextFactory, } from "@kya-os/mcp-i-runtime";
|
|
22
22
|
import { WebCryptoProvider } from "./providers/crypto";
|
|
23
23
|
import { KVStorageProvider, KVNonceCacheProvider, WorkersClockProvider, WorkersFetchProvider, WorkersIdentityProvider, } from "./providers/storage";
|
|
24
|
-
import { KVIdentityProvider } from "./providers/kv-identity";
|
|
24
|
+
import { KVIdentityProvider, createCloudflareIdentityProvider, } from "./providers/kv-identity";
|
|
25
25
|
import { CloudflareRuntime } from "./runtime";
|
|
26
26
|
import { createCloudflareAuditRuntimeFromEnv, handleAuditRuntimeControlRequest, } from "./audit/deployment-binding";
|
|
27
27
|
// Re-export providers
|
|
@@ -81,14 +81,14 @@ export function createCloudflareRuntime(config) {
|
|
|
81
81
|
const fetchProvider = new WorkersFetchProvider();
|
|
82
82
|
const storageProvider = new KVStorageProvider((config.env.IDENTITY_STORAGE || config.env.NONCE_CACHE));
|
|
83
83
|
const nonceCacheProvider = new KVNonceCacheProvider(config.env.NONCE_CACHE);
|
|
84
|
-
//
|
|
85
|
-
|
|
84
|
+
// Identity: env triple (validated on every load) > DO state > generated.
|
|
85
|
+
// IDENTITY_STORAGE KV is layered on ONLY when there is no configured env
|
|
86
|
+
// identity. Env is global and authoritative; KV exists to persist a
|
|
87
|
+
// GENERATED identity across isolates, and wrapping a configured identity in
|
|
88
|
+
// it would let a stale `identity:primary` record shadow the env triple and
|
|
89
|
+
// bypass its consistency check. See `createCloudflareIdentityProvider`.
|
|
90
|
+
const identityProvider = createCloudflareIdentityProvider(config.env, cryptoProvider, config.env._durableObjectState // DO state for identity persistence
|
|
86
91
|
);
|
|
87
|
-
// ✅ Use KV-based identity provider if IDENTITY_STORAGE KV is available
|
|
88
|
-
// This ensures consistent identity across all Durable Object instances
|
|
89
|
-
const identityProvider = config.env.IDENTITY_STORAGE
|
|
90
|
-
? new KVIdentityProvider(config.env.IDENTITY_STORAGE, baseIdentityProvider, cryptoProvider)
|
|
91
|
-
: baseIdentityProvider;
|
|
92
92
|
// Instantiate ProofVerifier
|
|
93
93
|
const proofVerifier = new ProofVerifier({
|
|
94
94
|
cryptoProvider,
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,kFAAkF;AAClF,iGAAiG;AACjG,iGAAiG;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,iEAAiE;AACjE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,yBAAyB,GAAG,wBAAwB,EAAE,CAAC;AAE7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAGL,uBAAuB,EAEvB,uBAAuB,EACvB,aAAa,GAEd,MAAM,uBAAuB,CAAC,CAAC,+CAA+C;AAE/E,qFAAqF;AACrF,yFAAyF;AACzF,gFAAgF;AAChF,uFAAuF;AACvF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oCAAoC,GACrC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,kFAAkF;AAClF,iGAAiG;AACjG,iGAAiG;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,iEAAiE;AACjE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,yBAAyB,GAAG,wBAAwB,EAAE,CAAC;AAE7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAGL,uBAAuB,EAEvB,uBAAuB,EACvB,aAAa,GAEd,MAAM,uBAAuB,CAAC,CAAC,+CAA+C;AAE/E,qFAAqF;AACrF,yFAAyF;AACzF,gFAAgF;AAChF,uFAAuF;AACvF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oCAAoC,GACrC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAG9C,OAAO,EACL,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AAEpC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,GACnB,CAAC;AAEF,4BAA4B;AAC5B,OAAO,EACL,cAAc,GAKf,MAAM,4BAA4B,CAAC;AAEpC,qBAAqB;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,2BAA2B,GAG5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,+BAA+B,GAQhC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,EACxB,qBAAqB,GAKtB,MAAM,4BAA4B,CAAC;AAEpC,oCAAoC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,4BAA4B,EAC5B,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,6BAA6B;AAC7B,OAAO,EACL,wBAAwB,GAMzB,MAAM,mBAAmB,CAAC;AAE3B,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAwB,MAAM,WAAW,CAAC;AAEpE,kCAAkC;AAClC,OAAO,EACL,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAGnE,oCAAoC;AACpC,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAOvB,MAAM,yBAAyB,CAAC;AASjC,8CAA8C;AAC9C,OAAO,EACL,oBAAoB,GAErB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,6CAA6C;AAC7C,OAAO,EAAE,mBAAmB,EAA8B,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,aAAa,EAA6B,MAAM,OAAO,CAAC;AACjE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,mFAAmF;AACnF,4FAA4F;AAC5F,qFAAqF;AACrF,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAEpF,sBAAsB;AACtB,cAAc,aAAa,CAAC;AAE5B,6BAA6B;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAsBxC;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA4B;IAE5B,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACjD,MAAM,aAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,IAAI,iBAAiB,CAC3C,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAQ,CAC/D,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,oBAAoB,CACjD,MAAM,CAAC,GAAG,CAAC,WAAkB,CAC9B,CAAC;IAEF,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,gCAAgC,CACvD,MAAM,CAAC,GAAG,EACV,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,mBAA0B,CAAC,oCAAoC;KAC3E,CAAC;IAEF,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,cAAc;QACd,aAAa;QACb,kBAAkB;QAClB,aAAa;QACb,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;KACzD,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,oBAAyD,CAAC;IAC9D,IAAI,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACnC,oBAAoB,GAAG,IAAI,uBAAuB,CAAC;YACjD,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,IAAI,wBAAwB;YACnE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;YACtC,aAAa,EAAE,aAAa;YAC5B,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBACpB,gEAAgE;gBAChE,MAAM,OAAO,GACX,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACnC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACpC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAE3C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC/C,CAAC;qBAAM,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;oBAChD,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC;IACnF,MAAM,YAAY,GAAG,oBAAoB,KAAK,SAAS;QACrD,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC,GAAG,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAA0B;QAC3C,cAAc;QACd,aAAa;QACb,aAAa;QACb,eAAe;QACf,kBAAkB;QAClB,gBAAgB;QAChB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY;QAC/C,OAAO,EAAE;YACP,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;YACxD,UAAU,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;SAC3C;QACD,UAAU,EAAE,oBAAoB,IAAI,YAAY,EAAE,UAAU;QAC5D,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,aAAa;KACnD,CAAC;IAEF,0DAA0D;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;IAE5C,uEAAuE;IACvE,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC;IAE9C,MAAM,OAAO,GAAG,IAAI,iBAAiB,CACnC,aAAa,EACb,SAAS,EACT,gBAAgB,CACjB,CAAC;IAEF,+BAA+B;IAC/B,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAExC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA4B;IAC5D,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEhD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB;YAC1B,sCAAsC;YACtC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEjC,MAAM,YAAY,GAAG,MAAM,gCAAgC,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACjF,IAAI,YAAY,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAC;YAE/C,8BAA8B;YAC9B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAE3C,IAAI,MAAM,EAAE,CAAC;oBACX,gEAAgE;oBAChE,IAAI,QAAQ,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;wBAClE,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;4BAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,OAAO,EAAE;gCACP,GAAG,MAAM,CAAC,OAAO;gCACjB,GAAG,uBAAuB;6BAC3B;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,uDAAuD;oBACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;wBAC1C,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,GAAG,uBAAuB;yBAC3B;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,sBAAsB;YACtB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAQ,CAAC;oBAE3C,mBAAmB;oBACnB,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;wBAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC1D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;4BAC1C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CAAC,CAAC;oBACL,CAAC;oBAED,oBAAoB;oBACpB,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;wBACjC,2CAA2C;wBAC3C,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;4BACb,MAAM,EAAE,mBAAmB;yBAC5B,CAAC,EACF;4BACE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CACF,CAAC;oBACJ,CAAC;oBAED,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,gBAAgB;qBACxB,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAU,EAAE,CAAC;oBACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,gBAAgB;qBACzC,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mDAAmD;AACnD,OAAO,EACL,2BAA2B,GAG5B,MAAM,WAAW,CAAC;AAEnB,2CAA2C;AAC3C,cAAc,UAAU,CAAC"}
|
|
@@ -23,6 +23,8 @@ export interface ProofMeta {
|
|
|
23
23
|
scopeId?: string;
|
|
24
24
|
delegationRef?: string;
|
|
25
25
|
clientDid?: string;
|
|
26
|
+
toolName?: string;
|
|
27
|
+
submissionOutcome?: 'success' | 'failure' | 'denied';
|
|
26
28
|
}
|
|
27
29
|
/**
|
|
28
30
|
* DetachedProof format (matches @kya-os/contracts/proof)
|
|
@@ -57,6 +59,8 @@ export interface ProofOptions {
|
|
|
57
59
|
scopeId?: string;
|
|
58
60
|
delegationRef?: string;
|
|
59
61
|
clientDid?: string;
|
|
62
|
+
toolName?: string;
|
|
63
|
+
submissionOutcome?: 'success' | 'failure' | 'denied';
|
|
60
64
|
}
|
|
61
65
|
/**
|
|
62
66
|
* Cloudflare-compatible Proof Generator
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proof-generator.d.ts","sourceRoot":"","sources":["../src/proof-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"proof-generator.d.ts","sourceRoot":"","sources":["../src/proof-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,GAAG,CAAC;IACV,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CACtD;AAED;;;;;GAKG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAgB;gBAEpB,QAAQ,EAAE,aAAa;IAInC;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IA0BzB;;OAEG;YACW,uBAAuB;IAuBrC;;;;OAIG;YACW,kBAAkB;IAgBhC;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAyBxB;;;;;OAKG;YACW,WAAW;IAoDzB;;;;;OAKG;YACW,WAAW;IAiCzB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;OAGG;IACH,OAAO,CAAC,YAAY;CAkBrB"}
|
package/dist/proof-generator.js
CHANGED
|
@@ -140,6 +140,11 @@ export class CloudflareProofGenerator {
|
|
|
140
140
|
aud: meta.audience, // Audience (who the token is for)
|
|
141
141
|
sub: meta.did, // Subject (agent DID)
|
|
142
142
|
iss: meta.did, // Issuer (agent DID - self-issued)
|
|
143
|
+
// Literal field names some verifiers (e.g. knowthat.ai) check by
|
|
144
|
+
// exact property, rather than the JWT-standard aliases above
|
|
145
|
+
did: meta.did,
|
|
146
|
+
kid: meta.kid,
|
|
147
|
+
audience: meta.audience,
|
|
143
148
|
// Custom MCP-I proof claims
|
|
144
149
|
requestHash: meta.requestHash,
|
|
145
150
|
responseHash: meta.responseHash,
|
|
@@ -150,6 +155,8 @@ export class CloudflareProofGenerator {
|
|
|
150
155
|
...(meta.scopeId && { scopeId: meta.scopeId }),
|
|
151
156
|
...(meta.delegationRef && { delegationRef: meta.delegationRef }),
|
|
152
157
|
...(meta.clientDid && { clientDid: meta.clientDid }),
|
|
158
|
+
...(meta.toolName && { toolName: meta.toolName }),
|
|
159
|
+
...(meta.submissionOutcome && { outcome: meta.submissionOutcome }),
|
|
153
160
|
};
|
|
154
161
|
const payloadBase64url = this.base64urlEncode(JSON.stringify(payload));
|
|
155
162
|
// Signing input (header.payload)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proof-generator.js","sourceRoot":"","sources":["../src/proof-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;
|
|
1
|
+
{"version":3,"file":"proof-generator.js","sourceRoot":"","sources":["../src/proof-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgEH;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IAC3B,QAAQ,CAAgB;IAEhC,YAAY,QAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAsB,EACtB,OAAuB,EACvB,UAAwB,EAAE;QAE1B,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErE,wBAAwB;QACxB,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,OAAO;SACX,CAAC;QAEF,gCAAgC;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO;YACL,GAAG;YACH,IAAI;SACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAsB;QAEtB,oDAAoD;QACpD,MAAM,gBAAgB,GAAG;YACvB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SAClD,CAAC;QAEF,kDAAkD;QAClD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC;QAExC,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAEtE,OAAO;YACL,WAAW;YACX,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,IAAS;QACxC,kCAAkC;QAClC,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAElD,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAErE,wBAAwB;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE7E,OAAO,UAAU,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACK,gBAAgB,CAAC,GAAQ;QAC/B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,OAAO,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,iDAAiD;YACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACxC,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,uEAAuE;QACvE,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,IAAI,CAAC,GAAG,EAAG,wCAAwC;SACzD,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAErE,4CAA4C;QAC5C,oEAAoE;QACpE,gEAAgE;QAChE,6EAA6E;QAC7E,MAAM,OAAO,GAAG;YACd,iCAAiC;YACjC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAI,kCAAkC;YACxD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAS,sBAAsB;YAC5C,GAAG,EAAE,IAAI,CAAC,GAAG,EAAS,mCAAmC;YAEzD,iEAAiE;YACjE,6DAA6D;YAC7D,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YAEvB,4BAA4B;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YAEzB,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;SACnE,CAAC;QACF,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEvE,iCAAiC;QACjC,MAAM,YAAY,GAAG,GAAG,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAE9D,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,kBAAkB,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAE3D,4BAA4B;QAC5B,OAAO,GAAG,eAAe,IAAI,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CAAC,IAAY;QACpC,wCAAwC;QACxC,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEpE,2CAA2C;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAExD,sCAAsC;QACtC,2EAA2E;QAC3E,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC9C,OAAO,EAAG,gCAAgC;QAC1C,KAAK,CAAC,MAAqB,EAC3B;YACE,IAAI,EAAE,SAAS;SAChB,EACD,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,gBAAgB;QAChB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAExC,wDAAwD;QACxD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9C,SAAS,EACT,UAAU,EACV,UAAU,CACX,CAAC;QAEF,OAAO,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,mBAAmB,CAAC,MAAkB;QAC5C,yCAAyC;QACzC,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC;YACjC,IAAI,EAAE,IAAI,EAAE,sBAAsB;YAClC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB;YACtC,IAAI,EAAE,IAAI,EAAE,iCAAiC;YAC7C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB;YAChD,IAAI,EAAE,IAAI,EAAE,0BAA0B;YACtC,IAAI,EAAE,IAAI,CAAE,2CAA2C;SACxD,CAAC,CAAC;QAEH,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,IAAyB;QAC/C,IAAI,MAAc,CAAC;QAEnB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,2BAA2B;YAC3B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,+BAA+B;YAC/B,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,6CAA6C;QAC7C,OAAO,MAAM;aACV,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,MAAc;QACjC,iDAAiD;QACjD,mDAAmD;QACnD,IAAI,cAAc,GAAG,MAAM;aACxB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEtB,wDAAwD;QACxD,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
|
|
@@ -20,6 +20,29 @@ export declare class WebCryptoProvider extends CryptoProvider {
|
|
|
20
20
|
privateKey: string;
|
|
21
21
|
publicKey: string;
|
|
22
22
|
}>;
|
|
23
|
+
/**
|
|
24
|
+
* Derive the Ed25519 public key that belongs to a private key.
|
|
25
|
+
*
|
|
26
|
+
* Ed25519 public keys are a deterministic function of the seed, so this
|
|
27
|
+
* recovers the REAL public key for the private key material, the only way
|
|
28
|
+
* to check that an operator-provisioned PRIVATE_KEY / PUBLIC_KEY pair is
|
|
29
|
+
* actually one key pair. Accepts the same encodings `sign()` does (raw
|
|
30
|
+
* 32-byte seed, 64-byte seed||pub, or PKCS#8; base64 or base64url).
|
|
31
|
+
*
|
|
32
|
+
* Returns the raw 32-byte public key, standard base64 (the same format
|
|
33
|
+
* `generateKeyPair()` returns).
|
|
34
|
+
*
|
|
35
|
+
* @throws if the material is not an importable Ed25519 private key
|
|
36
|
+
*/
|
|
37
|
+
derivePublicKey(privateKeyBase64: string): Promise<string>;
|
|
38
|
+
/**
|
|
39
|
+
* Import a base64/base64url-encoded Ed25519 private key as a Web Crypto key.
|
|
40
|
+
*
|
|
41
|
+
* Auto-detects the key format:
|
|
42
|
+
* - PKCS#8: 48 bytes starting with 0x30 (SEQUENCE tag)
|
|
43
|
+
* - Raw Ed25519: 32-byte seed, or 64-byte seed || public key
|
|
44
|
+
*/
|
|
45
|
+
private importPrivateKey;
|
|
23
46
|
/**
|
|
24
47
|
* Calculate SHA-256 hash
|
|
25
48
|
*/
|
|
@@ -32,11 +55,5 @@ export declare class WebCryptoProvider extends CryptoProvider {
|
|
|
32
55
|
private wrapPublicKeySPKI;
|
|
33
56
|
private extractRawPrivateKey;
|
|
34
57
|
private extractRawPublicKey;
|
|
35
|
-
/**
|
|
36
|
-
* Decode base64 or base64url string to Uint8Array
|
|
37
|
-
* Handles both standard base64 (+/) and base64url (-_) formats
|
|
38
|
-
*/
|
|
39
|
-
private base64ToBytes;
|
|
40
|
-
private bytesToBase64;
|
|
41
58
|
}
|
|
42
59
|
//# sourceMappingURL=crypto.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/providers/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,
|
|
1
|
+
{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/providers/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAgC,MAAM,aAAa,CAAC;AAE3E,qBAAa,iBAAkB,SAAQ,cAAc;IACnD;;OAEG;IACG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAY3E;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;IA6BnB;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB3E;;;;;;;;;;;;;OAaG;IACG,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhE;;;;;;OAMG;YACW,gBAAgB;IAyB9B;;OAEG;IACG,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAY7C;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQtD,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,mBAAmB;CAK5B"}
|
package/dist/providers/crypto.js
CHANGED
|
@@ -3,26 +3,13 @@
|
|
|
3
3
|
*
|
|
4
4
|
* Implements CryptoProvider using the Web Crypto API available in Workers.
|
|
5
5
|
*/
|
|
6
|
-
import { CryptoProvider } from '@kya-os/mcp';
|
|
6
|
+
import { CryptoProvider, base64ToBytes, bytesToBase64 } from '@kya-os/mcp';
|
|
7
7
|
export class WebCryptoProvider extends CryptoProvider {
|
|
8
8
|
/**
|
|
9
9
|
* Sign data using Ed25519
|
|
10
10
|
*/
|
|
11
11
|
async sign(data, privateKeyBase64) {
|
|
12
|
-
const
|
|
13
|
-
// Auto-detect key format:
|
|
14
|
-
// - PKCS#8 format: 48 bytes starting with 0x30 (SEQUENCE tag)
|
|
15
|
-
// - Raw Ed25519: 32 or 64 bytes
|
|
16
|
-
// If already PKCS#8, extract raw key; otherwise use as-is
|
|
17
|
-
const rawKey = privateKeyBytes.length === 48 && privateKeyBytes[0] === 0x30
|
|
18
|
-
? this.extractRawPrivateKey(privateKeyBytes)
|
|
19
|
-
: (privateKeyBytes.length === 64 ? privateKeyBytes.slice(0, 32) : privateKeyBytes);
|
|
20
|
-
// Convert raw Ed25519 key to PKCS8 format for Web Crypto
|
|
21
|
-
const pkcs8 = this.wrapPrivateKeyPKCS8(rawKey);
|
|
22
|
-
const cryptoKey = await crypto.subtle.importKey('pkcs8', pkcs8.buffer.slice(pkcs8.byteOffset, pkcs8.byteOffset + pkcs8.byteLength), {
|
|
23
|
-
name: 'Ed25519',
|
|
24
|
-
namedCurve: 'Ed25519'
|
|
25
|
-
}, false, ['sign']);
|
|
12
|
+
const cryptoKey = await this.importPrivateKey(privateKeyBase64, false);
|
|
26
13
|
const signature = await crypto.subtle.sign('Ed25519', cryptoKey, data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength));
|
|
27
14
|
return new Uint8Array(signature);
|
|
28
15
|
}
|
|
@@ -31,7 +18,7 @@ export class WebCryptoProvider extends CryptoProvider {
|
|
|
31
18
|
*/
|
|
32
19
|
async verify(data, signature, publicKeyBase64) {
|
|
33
20
|
try {
|
|
34
|
-
const publicKeyBytes =
|
|
21
|
+
const publicKeyBytes = base64ToBytes(publicKeyBase64);
|
|
35
22
|
// Convert raw Ed25519 key to SubjectPublicKeyInfo format
|
|
36
23
|
const spki = this.wrapPublicKeySPKI(publicKeyBytes);
|
|
37
24
|
const cryptoKey = await crypto.subtle.importKey('spki', spki.buffer.slice(spki.byteOffset, spki.byteOffset + spki.byteLength), {
|
|
@@ -59,10 +46,52 @@ export class WebCryptoProvider extends CryptoProvider {
|
|
|
59
46
|
const publicKeySPKI = await crypto.subtle.exportKey('spki', keyPair.publicKey);
|
|
60
47
|
const publicKeyBytes = this.extractRawPublicKey(new Uint8Array(publicKeySPKI));
|
|
61
48
|
return {
|
|
62
|
-
privateKey:
|
|
63
|
-
publicKey:
|
|
49
|
+
privateKey: bytesToBase64(privateKeyBytes),
|
|
50
|
+
publicKey: bytesToBase64(publicKeyBytes)
|
|
64
51
|
};
|
|
65
52
|
}
|
|
53
|
+
/**
|
|
54
|
+
* Derive the Ed25519 public key that belongs to a private key.
|
|
55
|
+
*
|
|
56
|
+
* Ed25519 public keys are a deterministic function of the seed, so this
|
|
57
|
+
* recovers the REAL public key for the private key material, the only way
|
|
58
|
+
* to check that an operator-provisioned PRIVATE_KEY / PUBLIC_KEY pair is
|
|
59
|
+
* actually one key pair. Accepts the same encodings `sign()` does (raw
|
|
60
|
+
* 32-byte seed, 64-byte seed||pub, or PKCS#8; base64 or base64url).
|
|
61
|
+
*
|
|
62
|
+
* Returns the raw 32-byte public key, standard base64 (the same format
|
|
63
|
+
* `generateKeyPair()` returns).
|
|
64
|
+
*
|
|
65
|
+
* @throws if the material is not an importable Ed25519 private key
|
|
66
|
+
*/
|
|
67
|
+
async derivePublicKey(privateKeyBase64) {
|
|
68
|
+
// Extractable import so the JWK export carries `x` (the public key).
|
|
69
|
+
const cryptoKey = await this.importPrivateKey(privateKeyBase64, true);
|
|
70
|
+
const jwk = await crypto.subtle.exportKey('jwk', cryptoKey);
|
|
71
|
+
if (!jwk.x) {
|
|
72
|
+
throw new Error('Ed25519 JWK export did not include the public key (x)');
|
|
73
|
+
}
|
|
74
|
+
return bytesToBase64(base64ToBytes(jwk.x));
|
|
75
|
+
}
|
|
76
|
+
/**
|
|
77
|
+
* Import a base64/base64url-encoded Ed25519 private key as a Web Crypto key.
|
|
78
|
+
*
|
|
79
|
+
* Auto-detects the key format:
|
|
80
|
+
* - PKCS#8: 48 bytes starting with 0x30 (SEQUENCE tag)
|
|
81
|
+
* - Raw Ed25519: 32-byte seed, or 64-byte seed || public key
|
|
82
|
+
*/
|
|
83
|
+
async importPrivateKey(privateKeyBase64, extractable) {
|
|
84
|
+
const privateKeyBytes = base64ToBytes(privateKeyBase64);
|
|
85
|
+
const rawKey = privateKeyBytes.length === 48 && privateKeyBytes[0] === 0x30
|
|
86
|
+
? this.extractRawPrivateKey(privateKeyBytes)
|
|
87
|
+
: (privateKeyBytes.length === 64 ? privateKeyBytes.slice(0, 32) : privateKeyBytes);
|
|
88
|
+
// Convert raw Ed25519 key to PKCS8 format for Web Crypto
|
|
89
|
+
const pkcs8 = this.wrapPrivateKeyPKCS8(rawKey);
|
|
90
|
+
return await crypto.subtle.importKey('pkcs8', pkcs8.buffer.slice(pkcs8.byteOffset, pkcs8.byteOffset + pkcs8.byteLength), {
|
|
91
|
+
name: 'Ed25519',
|
|
92
|
+
namedCurve: 'Ed25519'
|
|
93
|
+
}, extractable, ['sign']);
|
|
94
|
+
}
|
|
66
95
|
/**
|
|
67
96
|
* Calculate SHA-256 hash
|
|
68
97
|
*/
|
|
@@ -124,32 +153,5 @@ export class WebCryptoProvider extends CryptoProvider {
|
|
|
124
153
|
// The key starts at offset 12 (after headers)
|
|
125
154
|
return spki.slice(12, 44);
|
|
126
155
|
}
|
|
127
|
-
/**
|
|
128
|
-
* Decode base64 or base64url string to Uint8Array
|
|
129
|
-
* Handles both standard base64 (+/) and base64url (-_) formats
|
|
130
|
-
*/
|
|
131
|
-
base64ToBytes(base64) {
|
|
132
|
-
// Convert base64url to standard base64 if needed
|
|
133
|
-
// Base64url uses - instead of + and _ instead of /
|
|
134
|
-
let standardBase64 = base64
|
|
135
|
-
.replace(/-/g, '+')
|
|
136
|
-
.replace(/_/g, '/');
|
|
137
|
-
// Add padding if needed (base64url often omits padding)
|
|
138
|
-
const paddingNeeded = (4 - (standardBase64.length % 4)) % 4;
|
|
139
|
-
standardBase64 += '='.repeat(paddingNeeded);
|
|
140
|
-
const binaryString = atob(standardBase64);
|
|
141
|
-
const bytes = new Uint8Array(binaryString.length);
|
|
142
|
-
for (let i = 0; i < binaryString.length; i++) {
|
|
143
|
-
bytes[i] = binaryString.charCodeAt(i);
|
|
144
|
-
}
|
|
145
|
-
return bytes;
|
|
146
|
-
}
|
|
147
|
-
bytesToBase64(bytes) {
|
|
148
|
-
let binaryString = '';
|
|
149
|
-
for (let i = 0; i < bytes.length; i++) {
|
|
150
|
-
binaryString += String.fromCharCode(bytes[i]);
|
|
151
|
-
}
|
|
152
|
-
return btoa(binaryString);
|
|
153
|
-
}
|
|
154
156
|
}
|
|
155
157
|
//# sourceMappingURL=crypto.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/providers/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/providers/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3E,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAEvE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,SAAS,EACT,SAAS,EACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAA2B,CAChG,CAAC;QAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAEtD,yDAAyD;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAEpD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAA2B,EAC/F;gBACE,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,SAAS;aACtB,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,SAAS,EACT,SAAS,EACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAA2B,EACnH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAA2B,CAChG,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7C;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,SAAS;SACtB,EACD,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;QAEF,8BAA8B;QAC9B,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnF,4BAA4B;QAC5B,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/E,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;QAE/E,OAAO;YACL,UAAU,EAAE,aAAa,CAAC,eAAe,CAAC;YAC1C,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,eAAe,CAAC,gBAAwB;QAC5C,qEAAqE;QACrE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,gBAAwB,EACxB,WAAoB;QAEpB,MAAM,eAAe,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,KAAK,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,IAAI;YACzE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC;YAC5C,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAErF,yDAAyD;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAA2B,EACnG;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,SAAS;SACtB,EACD,WAAW,EACX,CAAC,MAAM,CAAC,CACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC3C,SAAS,EACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAA2B,CAChG,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2CAA2C;IAEnC,mBAAmB,CAAC,MAAkB;QAC5C,wCAAwC;QACxC,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC;YACjC,IAAI,EAAE,IAAI,EAAE,sBAAsB;YAClC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB;YACtC,IAAI,EAAE,IAAI,EAAE,iCAAiC;YAC7C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB;YAChD,IAAI,EAAE,IAAI,EAAE,0BAA0B;YACtC,IAAI,EAAE,IAAI,CAAE,2CAA2C;SACxD,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CAAC,MAAkB;QAC1C,sDAAsD;QACtD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;YAChC,IAAI,EAAE,IAAI,EAAE,sBAAsB;YAClC,IAAI,EAAE,IAAI,EAAE,iCAAiC;YAC7C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB;YAChD,IAAI,EAAE,IAAI,EAAE,wBAAwB;YACpC,IAAI,CAAC,iBAAiB;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,oBAAoB,CAAC,KAAiB;QAC5C,gDAAgD;QAChD,8CAA8C;QAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,mBAAmB,CAAC,IAAgB;QAC1C,+CAA+C;QAC/C,8CAA8C;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;CACF"}
|
|
@@ -9,11 +9,46 @@
|
|
|
9
9
|
*/
|
|
10
10
|
import { IdentityProvider, AgentIdentity } from '@kya-os/mcp';
|
|
11
11
|
import type { CryptoProvider } from '@kya-os/mcp';
|
|
12
|
+
import type { KVNamespace } from '@cloudflare/workers-types';
|
|
13
|
+
import { WorkersIdentityProvider } from './storage';
|
|
14
|
+
/**
|
|
15
|
+
* Env shape `createCloudflareIdentityProvider` reads from (structural subset
|
|
16
|
+
* of `CloudflareEnv`).
|
|
17
|
+
*/
|
|
18
|
+
export interface CloudflareIdentityEnv {
|
|
19
|
+
IDENTITY_STORAGE?: KVNamespace;
|
|
20
|
+
MCP_IDENTITY_PRIVATE_KEY?: string;
|
|
21
|
+
MCP_IDENTITY_PUBLIC_KEY?: string;
|
|
22
|
+
MCP_IDENTITY_AGENT_DID?: string;
|
|
23
|
+
}
|
|
24
|
+
/**
|
|
25
|
+
* The identity provider `createCloudflareRuntime` hands to the runtime.
|
|
26
|
+
*
|
|
27
|
+
* Env is global and authoritative. When the `MCP_IDENTITY_*` triple is present
|
|
28
|
+
* the provider is the bare `WorkersIdentityProvider` and is NEVER wrapped in
|
|
29
|
+
* `KVIdentityProvider`: the Workers provider re-validates the triple on every
|
|
30
|
+
* load (`getConfiguredIdentity` fails closed on an inconsistent one), whereas
|
|
31
|
+
* the KV wrapper answers from its in-memory cache or the `identity:primary`
|
|
32
|
+
* record BEFORE it ever consults its fallback. Wrapped, a stale identity left
|
|
33
|
+
* in KV by an earlier deploy, or one generated before the identity was
|
|
34
|
+
* provisioned, would silently shadow the configured identity and skip the
|
|
35
|
+
* consistency check entirely; the worker would then sign as a DID nobody
|
|
36
|
+
* registered. That is exactly the hardware-world live path (its prefixed
|
|
37
|
+
* `*_IDENTITY_STORAGE` binding is mapped to `IDENTITY_STORAGE`).
|
|
38
|
+
*
|
|
39
|
+
* KV exists only to persist a GENERATED identity across isolates and Durable
|
|
40
|
+
* Object instances, so it is wired in exactly when there is no configured
|
|
41
|
+
* identity to persist.
|
|
42
|
+
*/
|
|
43
|
+
export declare function createCloudflareIdentityProvider(env: CloudflareIdentityEnv, cryptoProvider: CryptoProvider, durableObjectState?: ConstructorParameters<typeof WorkersIdentityProvider>[2]): IdentityProvider;
|
|
12
44
|
/**
|
|
13
45
|
* KV Identity Provider for Cloudflare Workers
|
|
14
46
|
*
|
|
15
47
|
* Uses KV namespace to store identity, ensuring all DO instances
|
|
16
48
|
* share the same agent identity.
|
|
49
|
+
*
|
|
50
|
+
* Only for GENERATED identities: see `createCloudflareIdentityProvider` for
|
|
51
|
+
* why an env-configured identity must never sit behind this wrapper.
|
|
17
52
|
*/
|
|
18
53
|
export declare class KVIdentityProvider extends IdentityProvider {
|
|
19
54
|
private kv;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kv-identity.d.ts","sourceRoot":"","sources":["../../src/providers/kv-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"kv-identity.d.ts","sourceRoot":"","sources":["../../src/providers/kv-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAA4B,MAAM,WAAW,CAAC;AAE9E;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,qBAAqB,EAC1B,cAAc,EAAE,cAAc,EAC9B,kBAAkB,CAAC,EAAE,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAC5E,gBAAgB,CAgBlB;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD,OAAO,CAAC,EAAE,CAAc;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,MAAM,CAAC,CAAiB;IAChC,OAAO,CAAC,cAAc,CAAC,CAAgB;IACvC,OAAO,CAAC,WAAW,CAAsB;gBAGvC,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,CAAC,EAAE,cAAc;IAQzB;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAiC3C;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAc1D;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAU1C;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBtC"}
|
|
@@ -8,11 +8,41 @@
|
|
|
8
8
|
* session-based or shard-based Durable Object routing.
|
|
9
9
|
*/
|
|
10
10
|
import { IdentityProvider } from '@kya-os/mcp';
|
|
11
|
+
import { WorkersIdentityProvider, hasConfiguredIdentityEnv } from './storage';
|
|
12
|
+
/**
|
|
13
|
+
* The identity provider `createCloudflareRuntime` hands to the runtime.
|
|
14
|
+
*
|
|
15
|
+
* Env is global and authoritative. When the `MCP_IDENTITY_*` triple is present
|
|
16
|
+
* the provider is the bare `WorkersIdentityProvider` and is NEVER wrapped in
|
|
17
|
+
* `KVIdentityProvider`: the Workers provider re-validates the triple on every
|
|
18
|
+
* load (`getConfiguredIdentity` fails closed on an inconsistent one), whereas
|
|
19
|
+
* the KV wrapper answers from its in-memory cache or the `identity:primary`
|
|
20
|
+
* record BEFORE it ever consults its fallback. Wrapped, a stale identity left
|
|
21
|
+
* in KV by an earlier deploy, or one generated before the identity was
|
|
22
|
+
* provisioned, would silently shadow the configured identity and skip the
|
|
23
|
+
* consistency check entirely; the worker would then sign as a DID nobody
|
|
24
|
+
* registered. That is exactly the hardware-world live path (its prefixed
|
|
25
|
+
* `*_IDENTITY_STORAGE` binding is mapped to `IDENTITY_STORAGE`).
|
|
26
|
+
*
|
|
27
|
+
* KV exists only to persist a GENERATED identity across isolates and Durable
|
|
28
|
+
* Object instances, so it is wired in exactly when there is no configured
|
|
29
|
+
* identity to persist.
|
|
30
|
+
*/
|
|
31
|
+
export function createCloudflareIdentityProvider(env, cryptoProvider, durableObjectState) {
|
|
32
|
+
const workersIdentityProvider = new WorkersIdentityProvider(env, cryptoProvider, durableObjectState);
|
|
33
|
+
if (hasConfiguredIdentityEnv(env) || !env.IDENTITY_STORAGE) {
|
|
34
|
+
return workersIdentityProvider;
|
|
35
|
+
}
|
|
36
|
+
return new KVIdentityProvider(env.IDENTITY_STORAGE, workersIdentityProvider, cryptoProvider);
|
|
37
|
+
}
|
|
11
38
|
/**
|
|
12
39
|
* KV Identity Provider for Cloudflare Workers
|
|
13
40
|
*
|
|
14
41
|
* Uses KV namespace to store identity, ensuring all DO instances
|
|
15
42
|
* share the same agent identity.
|
|
43
|
+
*
|
|
44
|
+
* Only for GENERATED identities: see `createCloudflareIdentityProvider` for
|
|
45
|
+
* why an env-configured identity must never sit behind this wrapper.
|
|
16
46
|
*/
|
|
17
47
|
export class KVIdentityProvider extends IdentityProvider {
|
|
18
48
|
kv;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kv-identity.js","sourceRoot":"","sources":["../../src/providers/kv-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAiB,MAAM,aAAa,CAAC;AAG9D
|
|
1
|
+
{"version":3,"file":"kv-identity.js","sourceRoot":"","sources":["../../src/providers/kv-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAiB,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAa9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAA0B,EAC1B,cAA8B,EAC9B,kBAA6E;IAE7E,MAAM,uBAAuB,GAAG,IAAI,uBAAuB,CACzD,GAAG,EACH,cAAc,EACd,kBAAkB,CACnB,CAAC;IAEF,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3D,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,kBAAkB,CAC3B,GAAG,CAAC,gBAAgB,EACpB,uBAAuB,EACvB,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAC9C,EAAE,CAAc;IAChB,QAAQ,CAAmB;IAC3B,MAAM,CAAkB;IACxB,cAAc,CAAiB;IAC/B,WAAW,GAAG,kBAAkB,CAAC;IAEzC,YACE,EAAe,EACf,QAA0B,EAC1B,MAAuB;QAEvB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,sCAAsC;QACtC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,eAAe;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC;gBACrD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;YAC5E,mDAAmD;QACrD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAE/B,aAAa;QACb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC;QAED,4BAA4B;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,sDAAsD;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAErD,+BAA+B;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,iBAAiB;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QACjF,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAC;YACrF,wDAAwD;QAC1D,CAAC;IACH,CAAC;CACF"}
|
|
@@ -4,7 +4,8 @@
|
|
|
4
4
|
* Implements StorageProvider and NonceCacheProvider using Cloudflare KV.
|
|
5
5
|
*/
|
|
6
6
|
import { StorageProvider, NonceCacheProvider, ClockProvider, FetchProvider, IdentityProvider, AgentIdentity } from "@kya-os/mcp";
|
|
7
|
-
|
|
7
|
+
import { WebCryptoProvider } from "./crypto.js";
|
|
8
|
+
export { WebCryptoProvider };
|
|
8
9
|
/**
|
|
9
10
|
* Minimal KV interface for compatibility across @cloudflare/workers-types versions
|
|
10
11
|
* Only includes the methods we actually use
|
|
@@ -76,18 +77,85 @@ interface ConfiguredIdentityEnv {
|
|
|
76
77
|
MCP_IDENTITY_PUBLIC_KEY?: string;
|
|
77
78
|
MCP_IDENTITY_AGENT_DID?: string;
|
|
78
79
|
}
|
|
80
|
+
/**
|
|
81
|
+
* Which part of a configured `MCP_IDENTITY_*` triple failed the consistency
|
|
82
|
+
* check. Surfaced on {@link ConfiguredIdentityError} so callers and logs can
|
|
83
|
+
* name the exact pair an operator has to fix.
|
|
84
|
+
*/
|
|
85
|
+
export type ConfiguredIdentityMismatch = "PRIVATE_KEY" | "PUBLIC_KEY" | "PRIVATE_KEY/PUBLIC_KEY" | "AGENT_DID/PUBLIC_KEY";
|
|
86
|
+
/**
|
|
87
|
+
* Thrown by {@link getConfiguredIdentity} when all three `MCP_IDENTITY_*` vars
|
|
88
|
+
* are present but do not describe ONE Ed25519 key pair. Distinct from the
|
|
89
|
+
* `null` "not configured" result on purpose: see the fail-closed note on
|
|
90
|
+
* `getConfiguredIdentity`.
|
|
91
|
+
*/
|
|
92
|
+
export declare class ConfiguredIdentityError extends Error {
|
|
93
|
+
readonly mismatch: ConfiguredIdentityMismatch;
|
|
94
|
+
constructor(mismatch: ConfiguredIdentityMismatch, detail: string);
|
|
95
|
+
}
|
|
96
|
+
/**
|
|
97
|
+
* The verification-method id (`kid`) for a DID, by DID method.
|
|
98
|
+
*
|
|
99
|
+
* - `did:key` → `<did>#<multibase>`: the did:key spec fixes the fragment to the
|
|
100
|
+
* multibase public-key value. That is what `@kya-os/mcp`'s
|
|
101
|
+
* `createDidKeyResolver`, the contracts fixtures and this package's
|
|
102
|
+
* `WorkersFetchProvider.resolveDID` publish, so a proof carrying this kid
|
|
103
|
+
* resolves to a verification method on every path that verifies this
|
|
104
|
+
* package's proofs. Not yet universal: `@kya-os/mcp-i-runtime`'s
|
|
105
|
+
* `createDIDDocument` and `@kya-os/mcp-i`'s `NodeFetchProvider.resolveDID`
|
|
106
|
+
* still emit `#key-1` for every DID method (known follow-up, not changed
|
|
107
|
+
* here).
|
|
108
|
+
* - everything else (`did:web` in practice) → `<did>#key-1`, which is the id
|
|
109
|
+
* the runtime's own `createDIDDocument` serves at `/.well-known/did.json`.
|
|
110
|
+
*/
|
|
111
|
+
export declare function kidForDid(did: string): string;
|
|
112
|
+
/**
|
|
113
|
+
* Whether `env` carries a complete `MCP_IDENTITY_*` triple. Presence only,
|
|
114
|
+
* no validation: use it to decide WHICH identity path a deployment is on
|
|
115
|
+
* (env-configured vs generated/persisted), then let `getConfiguredIdentity`
|
|
116
|
+
* decide whether that triple is actually usable.
|
|
117
|
+
*/
|
|
118
|
+
export declare function hasConfiguredIdentityEnv(env: ConfiguredIdentityEnv): env is ConfiguredIdentityEnv & {
|
|
119
|
+
MCP_IDENTITY_PRIVATE_KEY: string;
|
|
120
|
+
MCP_IDENTITY_PUBLIC_KEY: string;
|
|
121
|
+
MCP_IDENTITY_AGENT_DID: string;
|
|
122
|
+
};
|
|
79
123
|
/**
|
|
80
124
|
* The deployment's own provisioned identity, read directly from env vars — or
|
|
81
125
|
* `null` when any of the three are absent (an older/undeployed-identity worker).
|
|
82
126
|
*
|
|
83
|
-
*
|
|
84
|
-
*
|
|
85
|
-
*
|
|
86
|
-
*
|
|
87
|
-
*
|
|
88
|
-
*
|
|
127
|
+
* When all three are present they are CHECKED, not trusted: the three values
|
|
128
|
+
* are provisioned as independent secrets/vars and nothing else ever confirms
|
|
129
|
+
* they belong together. The public key is re-derived from
|
|
130
|
+
* `MCP_IDENTITY_PRIVATE_KEY` and must equal `MCP_IDENTITY_PUBLIC_KEY`; for a
|
|
131
|
+
* did:key, the DID is re-derived from that public key and must equal
|
|
132
|
+
* `MCP_IDENTITY_AGENT_DID`. (A did:web DID cannot be checked offline - its key
|
|
133
|
+
* lives in a remotely hosted did.json - so only the key pair is verified.)
|
|
134
|
+
*
|
|
135
|
+
* FAIL-CLOSED DECISION: an inconsistent triple THROWS `ConfiguredIdentityError`
|
|
136
|
+
* rather than returning `null`. `null` means "this deployment has no configured
|
|
137
|
+
* identity", and every caller reads it that way - `WorkersIdentityProvider`
|
|
138
|
+
* falls through to DO state or generates a fresh did:key, and the consent
|
|
139
|
+
* anchor bridge mints with an ephemeral issuer. A misprovisioned identity must
|
|
140
|
+
* not silently take either path: the worker would then sign as some DID other
|
|
141
|
+
* than the one operators registered and advertised, which is the exact drift
|
|
142
|
+
* that made the hardware-world worker's response proofs unverifiable. Throwing
|
|
143
|
+
* surfaces the misconfiguration at the first signing attempt, with the
|
|
144
|
+
* offending pair named, instead of hiding it behind a working-looking worker.
|
|
145
|
+
*
|
|
146
|
+
* Side-effect-free (no logging, no storage) apart from a per-env memo of the
|
|
147
|
+
* result (see `configuredIdentityMemo`): callers that want the DO-state-
|
|
148
|
+
* caching/fallback-generation behavior on top of this should use
|
|
149
|
+
* `WorkersIdentityProvider`, which is built on this same check. Extracted so a
|
|
150
|
+
* caller that only needs "is there a real configured identity, and if so what
|
|
151
|
+
* is it", with its OWN fallback strategy when there isn't one, doesn't have
|
|
152
|
+
* to instantiate a class designed for a different concern (DO-state
|
|
153
|
+
* persistence across cold starts).
|
|
154
|
+
*
|
|
155
|
+
* Async because the Web Crypto API (the only Ed25519 implementation available
|
|
156
|
+
* in Workers) is async.
|
|
89
157
|
*/
|
|
90
|
-
export declare function getConfiguredIdentity(env: ConfiguredIdentityEnv): AgentIdentity | null
|
|
158
|
+
export declare function getConfiguredIdentity(env: ConfiguredIdentityEnv): Promise<AgentIdentity | null>;
|
|
91
159
|
/**
|
|
92
160
|
* Workers Identity Provider with Durable Object state persistence
|
|
93
161
|
*
|
|
@@ -100,28 +168,18 @@ export declare class WorkersIdentityProvider extends IdentityProvider {
|
|
|
100
168
|
private env;
|
|
101
169
|
private cryptoProvider?;
|
|
102
170
|
private state?;
|
|
171
|
+
/**
|
|
172
|
+
* The env-configured identity this instance last wrote to DO state.
|
|
173
|
+
* `getConfiguredIdentity` memoizes per env object, so while the triple is
|
|
174
|
+
* unchanged it resolves to the SAME object: compare by reference to persist
|
|
175
|
+
* once per (instance, triple) instead of on every `getIdentity()` call (the
|
|
176
|
+
* McpAgent path calls it several times per tool call).
|
|
177
|
+
*/
|
|
178
|
+
private persistedConfiguredIdentity?;
|
|
103
179
|
constructor(env: any, cryptoProvider?: any | undefined, state?: DurableObjectState | undefined);
|
|
104
180
|
getIdentity(): Promise<AgentIdentity>;
|
|
105
181
|
saveIdentity(identity: AgentIdentity): Promise<void>;
|
|
106
182
|
rotateKeys(): Promise<AgentIdentity>;
|
|
107
183
|
deleteIdentity(): Promise<void>;
|
|
108
|
-
/**
|
|
109
|
-
* Generate did:key from Ed25519 public key
|
|
110
|
-
* Following spec: https://w3c-ccg.github.io/did-method-key/
|
|
111
|
-
*
|
|
112
|
-
* Format: did:key:z<multibase-base58btc(<multicodec-ed25519-pub><publicKey>)>
|
|
113
|
-
* Ed25519 multicodec prefix: 0xed 0x01
|
|
114
|
-
* Result starts with: did:key:z6Mk (for Ed25519 keys)
|
|
115
|
-
*/
|
|
116
|
-
private generateDIDFromPublicKey;
|
|
117
|
-
/**
|
|
118
|
-
* Base58 encode (Bitcoin alphabet) using base-x library
|
|
119
|
-
*/
|
|
120
|
-
private base58Encode;
|
|
121
|
-
/**
|
|
122
|
-
* Convert base64 or base64url to bytes
|
|
123
|
-
* Handles both standard base64 (+/) and base64url (-_) formats
|
|
124
|
-
*/
|
|
125
|
-
private base64ToBytes;
|
|
126
184
|
}
|
|
127
185
|
//# sourceMappingURL=storage.d.ts.map
|