aga_rotate_keys
Rotate cryptographic keypairs for issuers, portals, or chains to maintain security by replacing old keys with new ones and revoking the previous versions.
Instructions
Rotate a keypair (issuer, portal, or chain). Old key should be revoked.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| key_type | No | ||
| keypair | No | ||
| reason | No |
Implementation Reference
- src/tools/rotate-keys.ts:11-49 (handler)The handleRotateKeys function implements the logic for rotating keys in the aga_rotate_keys tool, handling different key types and updating the server context.
export async function handleRotateKeys(args: RotateKeysArgs, ctx: ServerContext) { const keyType = args.key_type ?? args.keypair; if (!keyType) return ctx.error('Provide key_type or keypair parameter.'); let result; switch (keyType) { case 'issuer': result = rotateKeys(ctx.issuerKP); (ctx as any).issuerKP = result.newKeyPair; break; case 'portal': result = rotateKeys(ctx.portalKP); (ctx as any).portalKP = result.newKeyPair; break; case 'chain': result = rotateKeys(ctx.chainKP); (ctx as any).chainKP = result.newKeyPair; break; default: return ctx.error(`Invalid key_type: ${keyType}. Must be issuer, portal, or chain.`); } await ctx.appendToChain('KEY_ROTATION', { key_type: keyType, old_public_key: result.oldPublicKeyHex, new_public_key: result.newPublicKeyHex, rotated_at: result.rotatedAt, reason: args.reason ?? 'Key rotation', }); return ctx.json({ success: true, key_type: keyType, old_public_key: result.oldPublicKeyHex, new_public_key: result.newPublicKeyHex, rotated_at: result.rotatedAt, reason: args.reason, }); } - src/tools/rotate-keys.ts:5-9 (schema)The RotateKeysArgs interface defines the expected input parameters for the aga_rotate_keys tool.
export interface RotateKeysArgs { key_type?: 'issuer' | 'portal' | 'chain'; keypair?: 'issuer' | 'portal' | 'chain'; reason?: string; } - src/server.ts:316-324 (registration)The aga_rotate_keys tool is registered in src/server.ts using the governedTool function.
governedTool('aga_rotate_keys', 'Rotate a keypair (issuer, portal, or chain). Old key should be revoked.', { key_type: z.enum(['issuer', 'portal', 'chain']).optional(), keypair: z.enum(['issuer', 'portal', 'chain']).optional(), reason: z.string().optional(), }, async (args) => handleRotateKeys(args, ctx), );