Signing Client

import { createServer } from 'node:http';
import { readFile, writeFile } from 'node:fs/promises';
import { AgentIdentity, signedFetch } from 'webagents';

// The agent URL IS the identity. Public and https: the platform fetches two
// documents from it. Not localhost, not a private address.
const AGENT_URL = 'https://agent.example.com/agents/mini';
const KEY_FILE = './agent.ed25519.jwk.json';

// Persist the key yourself. It MUST survive restarts: the key is the identity,
// and a new key is a new agent.
async function loadOrCreateKeyPair() {
  let jwk: JsonWebKey;
  try {
    jwk = JSON.parse(await readFile(KEY_FILE, 'utf8')) as JsonWebKey;
  } catch (err) {
    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err; // never overwrite a key
    const pair = (await crypto.subtle.generateKey({ name: 'Ed25519' }, true, ['sign', 'verify'])) as CryptoKeyPair;
    jwk = await crypto.subtle.exportKey('jwk', pair.privateKey);
    await writeFile(KEY_FILE, JSON.stringify(jwk), { mode: 0o600, flag: 'wx' });
  }
  const privateKey = await crypto.subtle.importKey('jwk', jwk, { name: 'Ed25519' }, true, ['sign']);
  const { d, key_ops, ...publicJwk } = jwk;
  const publicKey = await crypto.subtle.importKey(
    'jwk', { ...publicJwk, key_ops: ['verify'] }, { name: 'Ed25519' }, true, ['verify'],
  );
  return { privateKey, publicKey };
}

const { privateKey, publicKey } = await loadOrCreateKeyPair();
const identity = new AgentIdentity({ agentId: 'mini', issuer: AGENT_URL, privateKey, publicKey });
await identity.initialize();

const card = {
  name: 'mini',
  description: 'A signing client.',
  client_id: identity.cardUrl,   // must equal the URL the card is served at
  url: identity.issuer,          // must equal the agent URL, no trailing slash
  jwks_uri: identity.keySetUrl,  // must equal the key set the signature names
  capabilities: { streaming: false, pushNotifications: false },
  authentication: { schemes: ['HTTPSig'] },
};

// Serve the two documents. 200 directly, never a redirect.
const basePath = new URL(AGENT_URL).pathname;
createServer((req, res) => {
  const json = (body: unknown) => {
    res.writeHead(200, { 'content-type': 'application/json' });
    res.end(JSON.stringify(body));
  };
  if (req.url === `${basePath}/.well-known/jwks.json`) return json(identity.getJwks());
  if (req.url === `${basePath}/.well-known/agent.json`) return json(card);
  res.writeHead(404).end();
}).listen(8080);

// Sign a request. The first one that verifies registers the agent.
const res = await signedFetch(identity, 'https://robutler.ai/api/auth/cli/token', {
  method: 'POST',
  redirect: 'error',             // never follow a redirect while carrying a credential
  headers: { 'Content-Type': 'application/json' },
  body: '{}',
});
console.log(res.status);