inamprotocol 0.3.6 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +84 -84
- package/dist/core/schemas.d.ts +9 -9
- package/dist/core/schemas.js +3 -3
- package/dist/core/schemas.js.map +1 -1
- package/dist/crypto/secp256k1.d.ts +38 -0
- package/dist/crypto/secp256k1.js +41 -0
- package/dist/crypto/secp256k1.js.map +1 -0
- package/dist/index.d.ts +1 -0
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/types.d.ts +5 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,84 +1,84 @@
|
|
|
1
|
-
# inamprotocol (TypeScript/JavaScript SDK)
|
|
2
|
-
|
|
3
|
-
Reference TypeScript client for the [INAM Protocol](https://inamprotocol.org) — agent identity (`did:key`), execution receipts, jobs, and reputation. Parity with the Python SDK, [`sdk-python`](https://pypi.org/project/inamprotocol/). See [SPEC.md](https://github.com/inamprotocol/inam-protocol/blob/main/SPEC.md) for the full protocol specification.
|
|
4
|
-
|
|
5
|
-
This package is a standalone build of the same crypto/client code the [Node reference registry server](https://github.com/inamprotocol/inam-protocol) and its Cloudflare Workers deployment run in production — not a reimplementation with its own drift risk.
|
|
6
|
-
|
|
7
|
-
## Install
|
|
8
|
-
|
|
9
|
-
```
|
|
10
|
-
npm install inamprotocol
|
|
11
|
-
```
|
|
12
|
-
|
|
13
|
-
## Usage
|
|
14
|
-
|
|
15
|
-
```ts
|
|
16
|
-
import { InamClient, generateKeypair } from "inamprotocol";
|
|
17
|
-
|
|
18
|
-
const keypair = generateKeypair();
|
|
19
|
-
const client = new InamClient("https://api.inamprotocol.org", keypair);
|
|
20
|
-
|
|
21
|
-
const profile = await client.registerAgent(["document-extraction"], { name: "My Agent" });
|
|
22
|
-
console.log(profile.id); // did:key:z...
|
|
23
|
-
|
|
24
|
-
const reputation = await client.getReputation(profile.id);
|
|
25
|
-
```
|
|
26
|
-
|
|
27
|
-
### Jobs (post → offer → accept → execute → receipt)
|
|
28
|
-
|
|
29
|
-
```ts
|
|
30
|
-
const job = await poster.postJob({ capability: "document-extraction", specHash: "sha256:..." });
|
|
31
|
-
await worker.submitOffer(job.jobId, "I can do this in an hour");
|
|
32
|
-
await poster.acceptOffer(job.jobId, worker.did);
|
|
33
|
-
|
|
34
|
-
const receipt = await worker.submitWork(poster.did, {
|
|
35
|
-
jobId: job.jobId,
|
|
36
|
-
task: { capability: "document-extraction", specHash: "sha256:...", createdAt: new Date().toISOString() },
|
|
37
|
-
result: { outputHash: "sha256:...", completedAt: new Date().toISOString() },
|
|
38
|
-
verification: { method: "payer_confirmation", outcome: "success" },
|
|
39
|
-
});
|
|
40
|
-
await poster.acceptWork(receipt); // finalizes the receipt and auto-completes the job
|
|
41
|
-
```
|
|
42
|
-
|
|
43
|
-
`poster.cancelJob(job.jobId)` cancels a not-yet-completed job (poster only); `client.getJob(id)` / `client.searchJobs({ capability, status })` / `client.listOffers(jobId)` round out discovery.
|
|
44
|
-
|
|
45
|
-
### External identity linking (challenge-response)
|
|
46
|
-
|
|
47
|
-
Linking a key-derived external identity (`agentpass_id` / `aitp_id` / `passport_id`; SPEC.md §2.1) requires proving control of that external key via a single-use, ~60s challenge — a bare claim is no longer enough. `a2a_endpoint` isn't key-derived, so it skips straight to `linkIdentity(protocol, value)`.
|
|
48
|
-
|
|
49
|
-
```ts
|
|
50
|
-
// externalKeypair stands in for whatever key AgentPass/AITP/Passport Alliance
|
|
51
|
-
// already issued this agent -- not an INAM keypair.
|
|
52
|
-
const challenge = await client.requestLinkChallenge("agentpass_id", toBase64(externalKeypair.publicKey), "ed25519");
|
|
53
|
-
const proof = toBase64(sign(fromHex(challenge.challenge), externalKeypair.privateKey));
|
|
54
|
-
await client.completeLink("agentpass_id", "ap_my_external_id", challenge.challengeId, proof);
|
|
55
|
-
```
|
|
56
|
-
|
|
57
|
-
### Verification (independent attestation)
|
|
58
|
-
|
|
59
|
-
A third party — anyone but the receipt's own worker (`agentB`) — can attest that a finalized receipt's output actually holds up (SPEC.md §12), feeding a reputation boost:
|
|
60
|
-
|
|
61
|
-
```ts
|
|
62
|
-
const verification = await verifierClient.submitVerification({
|
|
63
|
-
receiptId: receipt.receiptId,
|
|
64
|
-
method: "deterministic", // or "agent_attestation"
|
|
65
|
-
outputHash: receipt.result.outputHash,
|
|
66
|
-
result: "verified", // or "rejected"
|
|
67
|
-
});
|
|
68
|
-
|
|
69
|
-
await verifierClient.getVerification(verification.verificationId);
|
|
70
|
-
await verifierClient.listReceiptVerifications(receipt.receiptId);
|
|
71
|
-
```
|
|
72
|
-
|
|
73
|
-
## What's exported
|
|
74
|
-
|
|
75
|
-
`InamClient`, `generateKeypair`/`keypairFromPrivateKey`/`publicKeyToDid`/`didToPublicKey`/`sign`/`verify`/`verifyRawEd25519`/`sha256Hex`, `generateP256Keypair`/`p256Sign`/`p256Verify` (used for external-identity link-challenge proofs, SPEC.md §2.1), `canonicalize` (the canonical-JSON serializer every INAM signature is computed over), `computeReceiptId`/`buildSignableContent`, `computeVerificationId`/`buildSignableVerificationContent`, and the full set of wire-format types (`AgentRecord`, `ExecutionReceipt`, `JobRecord`, `JobOffer`, `ReputationResult`, `LinkChallenge`, `VerificationRecord`, ...).
|
|
76
|
-
|
|
77
|
-
## Building from source
|
|
78
|
-
|
|
79
|
-
This package's `src/` is the actual source the registry server and Worker import directly (see `../src/services/receiptService.ts` and `../worker/src/receiptService.ts`) — there is exactly one implementation of the crypto/canonicalization/receipt-content logic across all TypeScript runtimes in this repo. The Python SDK is an independently maintained, interop-tested port (see `../sdk-python/tests/test_interop.py`).
|
|
80
|
-
|
|
81
|
-
```
|
|
82
|
-
npm install
|
|
83
|
-
npm run build # emits dist/ (declaration + sourcemaps)
|
|
84
|
-
```
|
|
1
|
+
# inamprotocol (TypeScript/JavaScript SDK)
|
|
2
|
+
|
|
3
|
+
Reference TypeScript client for the [INAM Protocol](https://inamprotocol.org) — agent identity (`did:key`), execution receipts, jobs, and reputation. Parity with the Python SDK, [`sdk-python`](https://pypi.org/project/inamprotocol/). See [SPEC.md](https://github.com/inamprotocol/inam-protocol/blob/main/SPEC.md) for the full protocol specification.
|
|
4
|
+
|
|
5
|
+
This package is a standalone build of the same crypto/client code the [Node reference registry server](https://github.com/inamprotocol/inam-protocol) and its Cloudflare Workers deployment run in production — not a reimplementation with its own drift risk.
|
|
6
|
+
|
|
7
|
+
## Install
|
|
8
|
+
|
|
9
|
+
```
|
|
10
|
+
npm install inamprotocol
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
## Usage
|
|
14
|
+
|
|
15
|
+
```ts
|
|
16
|
+
import { InamClient, generateKeypair } from "inamprotocol";
|
|
17
|
+
|
|
18
|
+
const keypair = generateKeypair();
|
|
19
|
+
const client = new InamClient("https://api.inamprotocol.org", keypair);
|
|
20
|
+
|
|
21
|
+
const profile = await client.registerAgent(["document-extraction"], { name: "My Agent" });
|
|
22
|
+
console.log(profile.id); // did:key:z...
|
|
23
|
+
|
|
24
|
+
const reputation = await client.getReputation(profile.id);
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
### Jobs (post → offer → accept → execute → receipt)
|
|
28
|
+
|
|
29
|
+
```ts
|
|
30
|
+
const job = await poster.postJob({ capability: "document-extraction", specHash: "sha256:..." });
|
|
31
|
+
await worker.submitOffer(job.jobId, "I can do this in an hour");
|
|
32
|
+
await poster.acceptOffer(job.jobId, worker.did);
|
|
33
|
+
|
|
34
|
+
const receipt = await worker.submitWork(poster.did, {
|
|
35
|
+
jobId: job.jobId,
|
|
36
|
+
task: { capability: "document-extraction", specHash: "sha256:...", createdAt: new Date().toISOString() },
|
|
37
|
+
result: { outputHash: "sha256:...", completedAt: new Date().toISOString() },
|
|
38
|
+
verification: { method: "payer_confirmation", outcome: "success" },
|
|
39
|
+
});
|
|
40
|
+
await poster.acceptWork(receipt); // finalizes the receipt and auto-completes the job
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
`poster.cancelJob(job.jobId)` cancels a not-yet-completed job (poster only); `client.getJob(id)` / `client.searchJobs({ capability, status })` / `client.listOffers(jobId)` round out discovery.
|
|
44
|
+
|
|
45
|
+
### External identity linking (challenge-response)
|
|
46
|
+
|
|
47
|
+
Linking a key-derived external identity (`agentpass_id` / `aitp_id` / `passport_id`; SPEC.md §2.1) requires proving control of that external key via a single-use, ~60s challenge — a bare claim is no longer enough. `a2a_endpoint` isn't key-derived, so it skips straight to `linkIdentity(protocol, value)`.
|
|
48
|
+
|
|
49
|
+
```ts
|
|
50
|
+
// externalKeypair stands in for whatever key AgentPass/AITP/Passport Alliance
|
|
51
|
+
// already issued this agent -- not an INAM keypair.
|
|
52
|
+
const challenge = await client.requestLinkChallenge("agentpass_id", toBase64(externalKeypair.publicKey), "ed25519");
|
|
53
|
+
const proof = toBase64(sign(fromHex(challenge.challenge), externalKeypair.privateKey));
|
|
54
|
+
await client.completeLink("agentpass_id", "ap_my_external_id", challenge.challengeId, proof);
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
### Verification (independent attestation)
|
|
58
|
+
|
|
59
|
+
A third party — anyone but the receipt's own worker (`agentB`) — can attest that a finalized receipt's output actually holds up (SPEC.md §12), feeding a reputation boost:
|
|
60
|
+
|
|
61
|
+
```ts
|
|
62
|
+
const verification = await verifierClient.submitVerification({
|
|
63
|
+
receiptId: receipt.receiptId,
|
|
64
|
+
method: "deterministic", // or "agent_attestation"
|
|
65
|
+
outputHash: receipt.result.outputHash,
|
|
66
|
+
result: "verified", // or "rejected"
|
|
67
|
+
});
|
|
68
|
+
|
|
69
|
+
await verifierClient.getVerification(verification.verificationId);
|
|
70
|
+
await verifierClient.listReceiptVerifications(receipt.receiptId);
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
## What's exported
|
|
74
|
+
|
|
75
|
+
`InamClient`, `generateKeypair`/`keypairFromPrivateKey`/`publicKeyToDid`/`didToPublicKey`/`sign`/`verify`/`verifyRawEd25519`/`sha256Hex`, `generateP256Keypair`/`p256Sign`/`p256Verify` (used for external-identity link-challenge proofs, SPEC.md §2.1), `canonicalize` (the canonical-JSON serializer every INAM signature is computed over), `computeReceiptId`/`buildSignableContent`, `computeVerificationId`/`buildSignableVerificationContent`, and the full set of wire-format types (`AgentRecord`, `ExecutionReceipt`, `JobRecord`, `JobOffer`, `ReputationResult`, `LinkChallenge`, `VerificationRecord`, ...).
|
|
76
|
+
|
|
77
|
+
## Building from source
|
|
78
|
+
|
|
79
|
+
This package's `src/` is the actual source the registry server and Worker import directly (see `../src/services/receiptService.ts` and `../worker/src/receiptService.ts`) — there is exactly one implementation of the crypto/canonicalization/receipt-content logic across all TypeScript runtimes in this repo. The Python SDK is an independently maintained, interop-tested port (see `../sdk-python/tests/test_interop.py`).
|
|
80
|
+
|
|
81
|
+
```
|
|
82
|
+
npm install
|
|
83
|
+
npm run build # emits dist/ (declaration + sourcemaps)
|
|
84
|
+
```
|
package/dist/core/schemas.d.ts
CHANGED
|
@@ -39,31 +39,31 @@ export declare const registerAgentSchema: z.ZodObject<{
|
|
|
39
39
|
metadata?: Record<string, unknown> | undefined;
|
|
40
40
|
}>;
|
|
41
41
|
export declare const linkChallengeSchema: z.ZodObject<{
|
|
42
|
-
protocol: z.ZodEnum<["agentpass_id", "aitp_id", "passport_id"]>;
|
|
42
|
+
protocol: z.ZodEnum<["agentpass_id", "aitp_id", "passport_id", "erc8004_id"]>;
|
|
43
43
|
externalPublicKey: z.ZodString;
|
|
44
|
-
keyType: z.ZodEnum<["ed25519", "p256"]>;
|
|
44
|
+
keyType: z.ZodEnum<["ed25519", "p256", "secp256k1"]>;
|
|
45
45
|
}, "strip", z.ZodTypeAny, {
|
|
46
|
-
protocol: "agentpass_id" | "aitp_id" | "passport_id";
|
|
46
|
+
protocol: "agentpass_id" | "aitp_id" | "passport_id" | "erc8004_id";
|
|
47
47
|
externalPublicKey: string;
|
|
48
|
-
keyType: "ed25519" | "p256";
|
|
48
|
+
keyType: "ed25519" | "p256" | "secp256k1";
|
|
49
49
|
}, {
|
|
50
|
-
protocol: "agentpass_id" | "aitp_id" | "passport_id";
|
|
50
|
+
protocol: "agentpass_id" | "aitp_id" | "passport_id" | "erc8004_id";
|
|
51
51
|
externalPublicKey: string;
|
|
52
|
-
keyType: "ed25519" | "p256";
|
|
52
|
+
keyType: "ed25519" | "p256" | "secp256k1";
|
|
53
53
|
}>;
|
|
54
54
|
export declare const linkSchema: z.ZodObject<{
|
|
55
|
-
protocol: z.ZodEnum<["agentpass_id", "aitp_id", "passport_id", "a2a_endpoint"]>;
|
|
55
|
+
protocol: z.ZodEnum<["agentpass_id", "aitp_id", "passport_id", "erc8004_id", "a2a_endpoint"]>;
|
|
56
56
|
value: z.ZodString;
|
|
57
57
|
challengeId: z.ZodOptional<z.ZodString>;
|
|
58
58
|
proofSignature: z.ZodOptional<z.ZodString>;
|
|
59
59
|
}, "strip", z.ZodTypeAny, {
|
|
60
60
|
value: string;
|
|
61
|
-
protocol: "agentpass_id" | "aitp_id" | "passport_id" | "a2a_endpoint";
|
|
61
|
+
protocol: "agentpass_id" | "aitp_id" | "passport_id" | "erc8004_id" | "a2a_endpoint";
|
|
62
62
|
challengeId?: string | undefined;
|
|
63
63
|
proofSignature?: string | undefined;
|
|
64
64
|
}, {
|
|
65
65
|
value: string;
|
|
66
|
-
protocol: "agentpass_id" | "aitp_id" | "passport_id" | "a2a_endpoint";
|
|
66
|
+
protocol: "agentpass_id" | "aitp_id" | "passport_id" | "erc8004_id" | "a2a_endpoint";
|
|
67
67
|
challengeId?: string | undefined;
|
|
68
68
|
proofSignature?: string | undefined;
|
|
69
69
|
}>;
|
package/dist/core/schemas.js
CHANGED
|
@@ -25,12 +25,12 @@ export const registerAgentSchema = z.object({
|
|
|
25
25
|
metadata: z.record(z.unknown()).optional(),
|
|
26
26
|
});
|
|
27
27
|
export const linkChallengeSchema = z.object({
|
|
28
|
-
protocol: z.enum(["agentpass_id", "aitp_id", "passport_id"]),
|
|
28
|
+
protocol: z.enum(["agentpass_id", "aitp_id", "passport_id", "erc8004_id"]),
|
|
29
29
|
externalPublicKey: z.string().min(1),
|
|
30
|
-
keyType: z.enum(["ed25519", "p256"]),
|
|
30
|
+
keyType: z.enum(["ed25519", "p256", "secp256k1"]),
|
|
31
31
|
});
|
|
32
32
|
export const linkSchema = z.object({
|
|
33
|
-
protocol: z.enum(["agentpass_id", "aitp_id", "passport_id", "a2a_endpoint"]),
|
|
33
|
+
protocol: z.enum(["agentpass_id", "aitp_id", "passport_id", "erc8004_id", "a2a_endpoint"]),
|
|
34
34
|
value: z.string().min(1),
|
|
35
35
|
challengeId: z.string().min(1).optional(),
|
|
36
36
|
proofSignature: z.string().min(1).optional(),
|
package/dist/core/schemas.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/core/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/core/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,oEAAoE;AACpE,uDAAuD;AACvD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;AAC/F,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;AAC9F,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;AAE1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,WAAW;KACvB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,WAAW;KACzB,CAAC;IACF,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,WAAW;KACf,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;QAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;KAClD,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC"}
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* ECDSA secp256k1, offered alongside Ed25519/P-256 (SPEC.md §2.1) so an
|
|
3
|
+
* ERC-8004 (EVM) identity can prove control of its key without any bridge
|
|
4
|
+
* curve — secp256k1 is the curve every Ethereum wallet already uses.
|
|
5
|
+
*
|
|
6
|
+
* Digest = keccak256("\x19Ethereum Signed Message:\n32" + challenge), i.e.
|
|
7
|
+
* Ethereum's standard `personal_sign` prefix over the 32 raw challenge bytes.
|
|
8
|
+
* This means a real EVM wallet (MetaMask, viem, ethers `signMessage`) can
|
|
9
|
+
* produce a valid proof signature with zero custom code on the caller's
|
|
10
|
+
* side — the whole point of adding this curve.
|
|
11
|
+
*
|
|
12
|
+
* `secp256k1.sign`/`.verify` return/accept the 64-byte compact r||s encoding
|
|
13
|
+
* and enforce low-S by default (same as p256.ts) — no manual canonicalization
|
|
14
|
+
* needed here. Unlike p256.sign/verify, though, noble's secp256k1 defaults to
|
|
15
|
+
* `prehash: true` (it SHA-256-hashes whatever `message` you pass before
|
|
16
|
+
* signing/verifying) — since this module already hashes the challenge itself
|
|
17
|
+
* (keccak256, not SHA-256, per Ethereum's `personal_sign` convention above),
|
|
18
|
+
* every call below passes `{ prehash: false }` to say "this is already a
|
|
19
|
+
* digest, don't hash it again." Omitting it doesn't break same-language
|
|
20
|
+
* round-trips (sign and verify would both silently double-hash, cancelling
|
|
21
|
+
* out) but breaks cross-language verification against sdk-python's digest —
|
|
22
|
+
* caught live via the v0.18 cross-language proof before this shipped.
|
|
23
|
+
*/
|
|
24
|
+
export interface Secp256k1Keypair {
|
|
25
|
+
publicKey: Uint8Array;
|
|
26
|
+
privateKey: Uint8Array;
|
|
27
|
+
}
|
|
28
|
+
export declare function generateSecp256k1Keypair(): Secp256k1Keypair;
|
|
29
|
+
/** Ethereum's `personal_sign` prefix, applied before hashing — see module doc. */
|
|
30
|
+
export declare function ethPersonalSignDigest(message: Uint8Array): Uint8Array;
|
|
31
|
+
export declare function secp256k1Sign(message: Uint8Array, privateKey: Uint8Array): Uint8Array;
|
|
32
|
+
export declare function secp256k1Verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
|
|
33
|
+
/** Derives the lowercase 0x-prefixed Ethereum address for an uncompressed
|
|
34
|
+
* secp256k1 public key: `"0x" + hex(keccak256(pubkey[1:]))[-40:]` — the same
|
|
35
|
+
* self-certifying principle INAM's own did:key (§2) uses. Required so an
|
|
36
|
+
* `erc8004_id` link (SPEC.md §2.1) can't claim an address unrelated to the
|
|
37
|
+
* key it just proved possession of. */
|
|
38
|
+
export declare function ethAddressFromUncompressedPublicKey(publicKey: Uint8Array): string;
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
import { secp256k1 } from "@noble/curves/secp256k1.js";
|
|
2
|
+
import { keccak_256 } from "@noble/hashes/sha3.js";
|
|
3
|
+
import { toHex } from "./keys.js";
|
|
4
|
+
export function generateSecp256k1Keypair() {
|
|
5
|
+
const privateKey = secp256k1.utils.randomSecretKey();
|
|
6
|
+
const publicKey = secp256k1.getPublicKey(privateKey, false);
|
|
7
|
+
return { privateKey, publicKey };
|
|
8
|
+
}
|
|
9
|
+
/** Ethereum's `personal_sign` prefix, applied before hashing — see module doc. */
|
|
10
|
+
export function ethPersonalSignDigest(message) {
|
|
11
|
+
const prefix = new TextEncoder().encode(`\x19Ethereum Signed Message:\n${message.length}`);
|
|
12
|
+
const prefixed = new Uint8Array(prefix.length + message.length);
|
|
13
|
+
prefixed.set(prefix, 0);
|
|
14
|
+
prefixed.set(message, prefix.length);
|
|
15
|
+
return keccak_256(prefixed);
|
|
16
|
+
}
|
|
17
|
+
export function secp256k1Sign(message, privateKey) {
|
|
18
|
+
return secp256k1.sign(ethPersonalSignDigest(message), privateKey, { prehash: false });
|
|
19
|
+
}
|
|
20
|
+
export function secp256k1Verify(signature, message, publicKey) {
|
|
21
|
+
try {
|
|
22
|
+
return secp256k1.verify(signature, ethPersonalSignDigest(message), publicKey, { prehash: false });
|
|
23
|
+
}
|
|
24
|
+
catch {
|
|
25
|
+
return false;
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
/** Derives the lowercase 0x-prefixed Ethereum address for an uncompressed
|
|
29
|
+
* secp256k1 public key: `"0x" + hex(keccak256(pubkey[1:]))[-40:]` — the same
|
|
30
|
+
* self-certifying principle INAM's own did:key (§2) uses. Required so an
|
|
31
|
+
* `erc8004_id` link (SPEC.md §2.1) can't claim an address unrelated to the
|
|
32
|
+
* key it just proved possession of. */
|
|
33
|
+
export function ethAddressFromUncompressedPublicKey(publicKey) {
|
|
34
|
+
if (publicKey.length !== 65 || publicKey[0] !== 0x04) {
|
|
35
|
+
throw new Error("expected an uncompressed secp256k1 public key (65 bytes, 0x04 prefix)");
|
|
36
|
+
}
|
|
37
|
+
const hash = keccak_256(publicKey.slice(1));
|
|
38
|
+
const addressBytes = hash.slice(-20);
|
|
39
|
+
return "0x" + toHex(addressBytes);
|
|
40
|
+
}
|
|
41
|
+
//# sourceMappingURL=secp256k1.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"secp256k1.js","sourceRoot":"","sources":["../../src/crypto/secp256k1.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AA+BlC,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACvD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,UAAsB;IACvE,OAAO,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IAC/F,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;uCAIuC;AACvC,MAAM,UAAU,mCAAmC,CAAC,SAAqB;IACvE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;AACpC,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
export { InamClient } from "./client.js";
|
|
2
2
|
export { generateKeypair, keypairFromPrivateKey, publicKeyToDid, didToPublicKey, sign, verify, verifyRawEd25519, sha256Hex, toBase64, fromBase64, toHex, fromHex, type Keypair, } from "./crypto/keys.js";
|
|
3
3
|
export { generateP256Keypair, p256Sign, p256Verify, type P256Keypair } from "./crypto/p256.js";
|
|
4
|
+
export { generateSecp256k1Keypair, secp256k1Sign, secp256k1Verify, ethAddressFromUncompressedPublicKey, ethPersonalSignDigest, type Secp256k1Keypair, } from "./crypto/secp256k1.js";
|
|
4
5
|
export { canonicalize } from "./crypto/canonical.js";
|
|
5
6
|
export { computeReceiptId, buildSignableContent, type ReceiptContentInput } from "./core/receiptContent.js";
|
|
6
7
|
export { computeVerificationId, buildSignableVerificationContent, type VerificationContentInput } from "./core/verificationContent.js";
|
package/dist/index.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
export { InamClient } from "./client.js";
|
|
2
2
|
export { generateKeypair, keypairFromPrivateKey, publicKeyToDid, didToPublicKey, sign, verify, verifyRawEd25519, sha256Hex, toBase64, fromBase64, toHex, fromHex, } from "./crypto/keys.js";
|
|
3
3
|
export { generateP256Keypair, p256Sign, p256Verify } from "./crypto/p256.js";
|
|
4
|
+
export { generateSecp256k1Keypair, secp256k1Sign, secp256k1Verify, ethAddressFromUncompressedPublicKey, ethPersonalSignDigest, } from "./crypto/secp256k1.js";
|
|
4
5
|
export { canonicalize } from "./crypto/canonical.js";
|
|
5
6
|
export { computeReceiptId, buildSignableContent } from "./core/receiptContent.js";
|
|
6
7
|
export { computeVerificationId, buildSignableVerificationContent } from "./core/verificationContent.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,OAAO,GAER,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE5G,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAEvI,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,OAAO,GAER,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,mCAAmC,EACnC,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE5G,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAEvI,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -8,13 +8,15 @@ export interface LinkedIdentities {
|
|
|
8
8
|
agentpass_id?: string;
|
|
9
9
|
aitp_id?: string;
|
|
10
10
|
passport_id?: string;
|
|
11
|
+
erc8004_id?: string;
|
|
11
12
|
a2a_endpoint?: string;
|
|
12
13
|
}
|
|
13
14
|
/** Key type used to prove control of an external identity's public key
|
|
14
15
|
* before linking it (SPEC.md's external-identity linking section). P-256
|
|
15
16
|
* matches ATTP (the protocol AgentPass is built on); Ed25519 is offered as
|
|
16
|
-
* the same primitive INAM's own did:key already uses
|
|
17
|
-
|
|
17
|
+
* the same primitive INAM's own did:key already uses; secp256k1 is the curve
|
|
18
|
+
* ERC-8004 (EVM) identities use. */
|
|
19
|
+
export type ExternalKeyType = "ed25519" | "p256" | "secp256k1";
|
|
18
20
|
/** How one `linked` entry was verified when it was recorded (SPEC.md §2.1).
|
|
19
21
|
* - `key_possession`: the caller proved control of `externalPublicKey` via a
|
|
20
22
|
* signed challenge at `verifiedAt`. This does NOT confirm that key is the
|
|
@@ -35,6 +37,7 @@ export interface LinkedIdentityProofs {
|
|
|
35
37
|
agentpass_id?: LinkProof;
|
|
36
38
|
aitp_id?: LinkProof;
|
|
37
39
|
passport_id?: LinkProof;
|
|
40
|
+
erc8004_id?: LinkProof;
|
|
38
41
|
a2a_endpoint?: LinkProof;
|
|
39
42
|
}
|
|
40
43
|
/** Response shape from POST /agents/:id/link/challenge. */
|
package/package.json
CHANGED