@kya-os/mcp-i 1.5.6-canary.1 → 1.5.6-canary.3

package/dist/runtime/verifier-middleware.d.ts

@@ -1,7 +1,8 @@
 import type { Request, Response, NextFunction } from "express";
-import type { ProofMeta } from "@kya-os/contracts/proof";
+import type { ProofMeta, DetachedProof } from "@kya-os/contracts/proof";
 import type { Receipt } from "@kya-os/contracts/registry";
 import { type StructuredError } from "@kya-os/contracts/verifier";
+import { type CryptoProvider } from "@kya-os/mcp-i-core";
 /**
  * Verifier middleware for proof and receipt validation
  */
@@ -26,6 +27,11 @@ export interface VerifierConfig {
      * Allow mock data for testing
      */
     allowMockData?: boolean;
+    /**
+     * Optional CryptoProvider for signature verification
+     * If provided, enables full JWS signature verification when DetachedProof is available
+     */
+    cryptoProvider?: CryptoProvider;
 }
 export interface LocalVerifierResult {
     success: boolean;
@@ -36,6 +42,11 @@ export interface VerifierContext {
     proof: ProofMeta;
     receipt?: Receipt;
     delegationRef?: string;
+    /**
+     * Optional full DetachedProof with JWS for signature verification
+     * If provided, enables full cryptographic signature verification
+     */
+    detachedProof?: DetachedProof;
 }
 /**
  * Core verifier implementation
@@ -44,15 +55,27 @@ export declare class CoreVerifier {
     private config;
     private receiptVerifier;
     private delegationManager;
+    private cryptoService?;
     constructor(config?: VerifierConfig);
     /**
      * Verify proof with optional receipt checking
      */
     verify(context: VerifierContext): Promise<LocalVerifierResult>;
     /**
-     * Verify proof signature (placeholder implementation)
+     * Verify proof signature
+     *
+     * Note: Full signature verification requires DetachedProof with JWS.
+     * If only ProofMeta is available, performs structure validation only.
+     * To enable full verification, provide detachedProof in VerifierContext.
      */
     private verifySignature;
+    /**
+     * Fetch public key from DID document
+     *
+     * Note: This is a simplified implementation. Production code should use
+     * a proper DID resolver that supports multiple DID methods (did:key, did:web, etc.)
+     */
+    private fetchPublicKeyFromDID;
     /**
      * Verify delegation status
      */

package/dist/runtime/verifier-middleware.js

@@ -6,6 +6,7 @@ exports.verifyExpress = verifyExpress;
 const verifier_1 = require("@kya-os/contracts/verifier");
 const merkle_verifier_1 = require("../storage/merkle-verifier");
 const delegation_1 = require("../storage/delegation");
+const mcp_i_core_1 = require("@kya-os/mcp-i-core");
 /**
  * Core verifier implementation
  */
@@ -13,6 +14,7 @@ class CoreVerifier {
     config;
     receiptVerifier;
     delegationManager;
+    cryptoService;
     constructor(config = {}) {
         this.config = config;
         this.receiptVerifier = (0, merkle_verifier_1.createReceiptVerifier)({
@@ -23,6 +25,10 @@ class CoreVerifier {
         this.delegationManager = (0, delegation_1.createDelegationManager)({
             ktaBaseURL: config.ktaBaseUrl || "https://knowthat.ai",
         });
+        // Initialize CryptoService if cryptoProvider is provided
+        if (config.cryptoProvider) {
+            this.cryptoService = new mcp_i_core_1.CryptoService(config.cryptoProvider);
+        }
     }
     /**
      * Verify proof with optional receipt checking
@@ -30,7 +36,7 @@ class CoreVerifier {
     async verify(context) {
         try {
             // 1. Verify proof signature (placeholder - would use actual crypto verification)
-            const signatureValid = await this.verifySignature(context.proof);
+            const signatureValid = await this.verifySignature(context.proof, context.detachedProof);
             if (!signatureValid) {
                 return {
                     success: false,
@@ -89,12 +95,15 @@ class CoreVerifier {
         }
     }
     /**
-     * Verify proof signature (placeholder implementation)
+     * Verify proof signature
+     *
+     * Note: Full signature verification requires DetachedProof with JWS.
+     * If only ProofMeta is available, performs structure validation only.
+     * To enable full verification, provide detachedProof in VerifierContext.
      */
-    async verifySignature(proof) {
-        // TODO: Implement actual Ed25519 signature verification
-        // This is a placeholder that checks basic proof structure
-        return !!(proof.did &&
+    async verifySignature(proof, detachedProof) {
+        // Basic structure validation
+        const hasRequiredFields = !!(proof.did &&
             proof.kid &&
             proof.ts &&
             proof.nonce &&
@@ -102,6 +111,73 @@ class CoreVerifier {
             proof.sessionId &&
             proof.requestHash &&
             proof.responseHash);
+        if (!hasRequiredFields) {
+            return false;
+        }
+        // If we have full DetachedProof with JWS and CryptoService, verify signature
+        if (detachedProof?.jws && this.cryptoService) {
+            try {
+                // Fetch public key from DID document
+                // Note: This is a simplified implementation - production should use proper DID resolver
+                const publicKeyJwk = await this.fetchPublicKeyFromDID(proof.did, proof.kid);
+                if (!publicKeyJwk) {
+                    console.warn("[CoreVerifier] Could not resolve public key from DID, skipping signature verification");
+                    return true; // Fall back to structure validation only
+                }
+                // Verify JWS signature
+                return await this.cryptoService.verifyJWS(detachedProof.jws, publicKeyJwk, {
+                    expectedKid: proof.kid,
+                    alg: "EdDSA",
+                });
+            }
+            catch (error) {
+                console.error("[CoreVerifier] Signature verification error:", error);
+                return false;
+            }
+        }
+        // Fallback: structure validation only (when JWS not available)
+        return true;
+    }
+    /**
+     * Fetch public key from DID document
+     *
+     * Note: This is a simplified implementation. Production code should use
+     * a proper DID resolver that supports multiple DID methods (did:key, did:web, etc.)
+     */
+    async fetchPublicKeyFromDID(did, kid) {
+        // For now, only support did:web resolution
+        // TODO: Add support for did:key and other DID methods
+        if (!did.startsWith("did:web:")) {
+            console.warn(`[CoreVerifier] Unsupported DID method: ${did}`);
+            return null;
+        }
+        try {
+            const domain = did.replace("did:web:", "").replace(/:/g, "/");
+            const didDocUrl = `https://${domain}/.well-known/did.json`;
+            const response = await fetch(didDocUrl);
+            if (!response.ok) {
+                console.warn(`[CoreVerifier] Failed to fetch DID document: ${response.status}`);
+                return null;
+            }
+            const didDoc = await response.json();
+            // Find verification method
+            const verificationMethod = didDoc.verificationMethod?.find((vm) => vm.id === `#${kid}` || vm.id === `${did}#${kid}` || vm.id === kid);
+            if (!verificationMethod?.publicKeyJwk) {
+                console.warn(`[CoreVerifier] Verification method ${kid} not found in DID document`);
+                return null;
+            }
+            // Validate JWK format
+            const jwk = verificationMethod.publicKeyJwk;
+            if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519") {
+                console.warn(`[CoreVerifier] Invalid JWK format: expected Ed25519, got ${jwk.kty}/${jwk.crv}`);
+                return null;
+            }
+            return jwk;
+        }
+        catch (error) {
+            console.error("[CoreVerifier] DID resolution error:", error);
+            return null;
+        }
     }
     /**
      * Verify delegation status

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i",
-  "version": "1.5.6-canary.1",
+  "version": "1.5.6-canary.3",
   "description": "The TypeScript MCP framework with identity features built-in",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -58,8 +58,8 @@
     "model-context-protocol"
   ],
   "dependencies": {
-    "@kya-os/contracts": "1.5.2-canary.0",
-    "@kya-os/mcp-i-core": "1.1.13-canary.1",
+    "@kya-os/contracts": "1.5.2-canary.3",
+    "@kya-os/mcp-i-core": "1.1.14-canary.1",
     "@modelcontextprotocol/sdk": "^1.11.4",
     "@swc/core": "^1.11.24",
     "@types/express": "^5.0.1",