@kya-os/cli/dist/utils/dco/ssh-key.d.ts

CLI for MCP-I setup and management

export interface SshKeyMaterial {
    /** PEM-armored OpenSSH private key (unencrypted, 0600 it on disk). */
    privateKeyPem: string;
    /** Single-line authorized_keys style public key: "ssh-ed25519 AAAA... comment". */
    publicKeyLine: string;
    /** OpenSSH-style fingerprint: "SHA256:<base64 without padding>". */
    fingerprint: string;
    /** Raw 32-byte public key, base64 encoded (matches identity.json publicKey). */
    publicKeyBase64: string;
}
/** Derive the Ed25519 public key from a raw 32-byte seed using Node crypto. */
export declare function deriveEd25519PublicKey(seed: Buffer): Buffer;
export declare function sshFingerprint(publicKey: Buffer): string;
/**
 * Decode a stored Ed25519 public key into its raw 32 bytes, tolerating the two
 * encodings that appear across the ecosystem:
 *  - raw base64 (32 bytes) as written by the local mcp-i IdentityManager, and
 *  - multibase base64url with an "m" prefix as returned by the KTA registry
 *    (see know-that-ai cli-register `encodePublicKey`).
 * Returns null when the value is neither, so a defense-in-depth cross-check can
 * skip rather than reject an unrecognized format. Disambiguation is exact: a
 * raw 32-byte key always base64-decodes to 32 bytes, while a 44-char multibase
 * string decodes to 33 under raw base64, so only the "m" branch yields 32.
 */
export declare function decodeEd25519PublicKey(value: string): Buffer | null;
export declare function sshPublicKeyLine(publicKey: Buffer, comment: string): string;
export interface ConvertOptions {
    /**
     * Raw public key (base64) to cross-check against the derived key. Guards
     * against a corrupted identity file producing a signing key that does not
     * match the registered DID.
     */
    expectedPublicKeyBase64?: string;
    /** Fixed check bytes for deterministic output in tests. */
    checkBytes?: Buffer;
}
/**
 * Convert a base64 Ed25519 private key from identity.json into OpenSSH
 * signing key material. Accepts either a 32-byte seed or a 64-byte
 * libsodium-style secret key (seed || public key).
 */
export declare function convertEd25519ToSshKey(privateKeyBase64: string, comment: string, options?: ConvertOptions): SshKeyMaterial;
//# sourceMappingURL=ssh-key.d.ts.map