@loopingai/core 0.1.0

package/package.json

@@ -0,0 +1,147 @@
+{
+  "name": "@loopingai/core",
+  "version": "0.1.0",
+  "description": "Shared, mandatory foundation for Looping agents on Cloudflare Workers: zero-trust A2A, durable task lifecycle, delegation and subagent runtime, test harness.",
+  "keywords": [
+    "a2a",
+    "agent2agent",
+    "ai-agents",
+    "cloudflare-workers",
+    "durable-objects",
+    "agents-sdk",
+    "zero-trust",
+    "jwks",
+    "eddsa",
+    "workflows"
+  ],
+  "license": "GPL-3.0-only",
+  "author": "Looping AI",
+  "homepage": "https://github.com/Looping-AI/looping-core#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Looping-AI/looping-core.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Looping-AI/looping-core/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "bin": {
+    "looping-keys": "scripts/generate-keys.mjs"
+  },
+  "files": [
+    "dist",
+    "eslint-rules",
+    "scripts/generate-keys.mjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./a2a": {
+      "types": "./dist/a2a/index.d.ts",
+      "import": "./dist/a2a/index.js"
+    },
+    "./worker": {
+      "types": "./dist/worker/index.d.ts",
+      "import": "./dist/worker/index.js"
+    },
+    "./agent": {
+      "types": "./dist/agent/index.d.ts",
+      "import": "./dist/agent/index.js"
+    },
+    "./subtasks": {
+      "types": "./dist/subtasks/index.d.ts",
+      "import": "./dist/subtasks/index.js"
+    },
+    "./subagent": {
+      "types": "./dist/subagent/index.d.ts",
+      "import": "./dist/subagent/index.js"
+    },
+    "./db": {
+      "types": "./dist/db/index.d.ts",
+      "import": "./dist/db/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js"
+    },
+    "./testing/node": {
+      "types": "./dist/testing/node.d.ts",
+      "import": "./dist/testing/node.js"
+    },
+    "./testing/vcr-global-setup": {
+      "types": "./dist/testing/vcr-global-setup.d.ts",
+      "import": "./dist/testing/vcr-global-setup.js"
+    },
+    "./eslint": "./eslint-rules/index.js",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "db:generate": "drizzle-kit generate && node scripts/build-migrations.mjs",
+    "keys": "node scripts/generate-keys.mjs",
+    "types": "wrangler types",
+    "format": "prettier --write .",
+    "lint": "eslint .",
+    "check": "prettier --check . && eslint . && tsc && tsc -p test/tsconfig.json && npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "verify:exports": "node scripts/verify-exports.mjs",
+    "prepack": "npm run build && npm run verify:exports",
+    "prepublishOnly": "npm run check && npm test && npm run verify:exports"
+  },
+  "dependencies": {
+    "@a2a-js/sdk": "^1.0.0",
+    "@cloudflare/workers-types": "^5.20260801.1",
+    "drizzle-orm": "^0.45.2",
+    "jose": "^6.2.7",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "agents": "^0.20.0",
+    "ai": "^7.0.40",
+    "undici": ">=8",
+    "vitest": ">=4",
+    "workers-ai-provider": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "undici": {
+      "optional": true
+    },
+    "vitest": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.20.1",
+    "@types/node": "^26.1.1",
+    "agents": "^0.20.0",
+    "ai": "^7.0.40",
+    "drizzle-kit": "^0.31.10",
+    "eslint": "^10.8.0",
+    "prettier": "^3.9.6",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.65.0",
+    "undici": "8.9.0",
+    "vitest": "^4.1.10",
+    "workers-ai-provider": "^4.0.0",
+    "wrangler": "^4.114.0"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "allowScripts": {
+    "esbuild": false,
+    "fsevents": false,
+    "sharp": false,
+    "workerd": false,
+    "core-js-pure": false
+  }
+}

package/scripts/generate-keys.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/**
+ * Generate the Ed25519 keypair an agent signs its AgentCard with.
+ *
+ * The private half becomes the `A2A_SIGNING_KEY` secret; the public half is
+ * served at the agent's JWKS path and pinned by the gateway on first
+ * registration (Trust-On-First-Use). No secret is shared in either direction —
+ * see `src/a2a/verify.ts` for the other half of the contract.
+ *
+ *   node scripts/generate-keys.mjs              # print both halves
+ *   node scripts/generate-keys.mjs --kid my-key # choose the key id
+ *
+ * The `kid` is required, not decorative: it goes in the JWS protected header and
+ * is what a gateway pins, so `parsePrivateJwk` refuses a key without one. Rotate
+ * by generating a new key with a *new* kid and serving both public keys until
+ * every gateway has re-fetched.
+ */
+import { generateKeyPair, exportJWK } from "jose";
+
+const args = process.argv.slice(2);
+const kidFlag = args.indexOf("--kid");
+const kid =
+  kidFlag !== -1 && args[kidFlag + 1]
+    ? args[kidFlag + 1]
+    : `a2a-${new Date().toISOString().slice(0, 10)}`;
+
+// `extractable` is required to export the private half at all.
+const { privateKey, publicKey } = await generateKeyPair("EdDSA", {
+  crv: "Ed25519",
+  extractable: true
+});
+
+const priv = { ...(await exportJWK(privateKey)), kid };
+const pub = { ...(await exportJWK(publicKey)), kid, use: "sig", alg: "EdDSA" };
+
+console.log("A2A_SIGNING_KEY (private — set as a secret, never commit):\n");
+console.log(JSON.stringify(priv));
+console.log(
+  "\nPublic JWKS (served at the card's `jku`, derived at runtime):\n"
+);
+console.log(JSON.stringify({ keys: [pub] }, null, 2));
+console.log(`
+Next:
+
+  # local
+  echo 'A2A_SIGNING_KEY=<the private JSON above>' >> .dev.vars
+
+  # deployed
+  npx wrangler secret put A2A_SIGNING_KEY
+
+The public half is not configured anywhere — the Worker derives it from the
+private key and serves it at the JWKS route.
+`);