@kya-os/mcp-i 1.5.6-canary.1 → 1.5.6-canary.2

package/dist/runtime/proof.d.ts

@@ -72,6 +72,10 @@ export declare class ProofGenerator {
      * Verify a proof (for testing/validation)
      */
     verifyProof(proof: DetachedProof, request: ToolRequest, response: ToolResponse): Promise<boolean>;
+    /**
+     * Convert base64 public key to Ed25519 JWK format
+     */
+    private base64PublicKeyToJWK;
 }
 /**
  * Utility functions

package/dist/runtime/proof.js

@@ -12,6 +12,8 @@ exports.extractCanonicalData = extractCanonicalData;
 const crypto_1 = require("crypto");
 const jose_1 = require("jose");
 const json_canonicalize_1 = require("json-canonicalize");
+const mcp_i_core_1 = require("@kya-os/mcp-i-core");
+const node_providers_1 = require("../providers/node-providers");
 /**
  * Proof generator class
  */
@@ -174,15 +176,44 @@ class ProofGenerator {
                 proof.meta.responseHash !== expectedHashes.responseHash) {
                 return false;
             }
-            // TODO: Verify JWS signature (requires public key)
-            // For now, just validate the structure (compact JWS: header.payload.signature)
-            const jwsParts = proof.jws.split(".");
-            return jwsParts.length === 3 && jwsParts[0] !== "" && jwsParts[1] !== "" && jwsParts[2] !== "";
+            // Verify JWS signature using CryptoService
+            const publicKeyJwk = this.base64PublicKeyToJWK(this.identity.publicKey);
+            const cryptoProvider = new node_providers_1.NodeCryptoProvider();
+            const cryptoService = new mcp_i_core_1.CryptoService(cryptoProvider);
+            const isValid = await cryptoService.verifyJWS(proof.jws, publicKeyJwk, {
+                expectedKid: this.identity.kid,
+                alg: "EdDSA",
+            });
+            return isValid;
         }
-        catch {
+        catch (error) {
+            console.error("[ProofGenerator] Proof verification error:", error);
             return false;
         }
     }
+    /**
+     * Convert base64 public key to Ed25519 JWK format
+     */
+    base64PublicKeyToJWK(publicKeyBase64) {
+        // Decode base64 to bytes
+        const publicKeyBytes = Buffer.from(publicKeyBase64, "base64");
+        // Verify key length (Ed25519 public keys are 32 bytes)
+        if (publicKeyBytes.length !== 32) {
+            throw new Error(`Invalid Ed25519 public key length: ${publicKeyBytes.length}`);
+        }
+        // Convert to base64url encoding
+        const base64url = Buffer.from(publicKeyBytes)
+            .toString("base64")
+            .replace(/\+/g, "-")
+            .replace(/\//g, "_")
+            .replace(/=/g, "");
+        return {
+            kty: "OKP",
+            crv: "Ed25519",
+            x: base64url,
+            kid: this.identity.kid,
+        };
+    }
 }
 exports.ProofGenerator = ProofGenerator;
 /**