Identity-Based Authentication for AWS Bedrock AI

npm install @private.me/aws-bedrock-xlink @aws-sdk/client-bedrock-runtime

import { BedrockXLinkClient } from '@private.me/aws-bedrock-xlink';

// Create client (generates identity automatically)
const client = new BedrockXLinkClient({
  region: 'us-east-1',
  modelId: 'anthropic.claude-v2'
});

// Simple chat with auto-signed message
const result = await client.chat('Explain quantum computing simply');

if (result.ok) {
  console.log(result.value.content);
  console.log('Tokens:', result.value.usage);
}

┌─────────────┐
│ Agent A     │
│ DID: z6Mk.. │
└──────┬──────┘
       │
       ├── Message: "Analyze this data"
       │   Signed: Ed25519 signature
       │
       ▼
┌────────────────────────────┐
│ AWS Bedrock                │
│ - Claude v2                │
│ - Receives signed message  │
│ - Processes request        │
└────────────────────────────┘
       │
       ├── Response with agent metadata
       │
       ▼
┌─────────────┐
│ Agent B     │
│ Verifies    │
│ signature   │
└─────────────┘

const client = new BedrockXLinkClient({ region: 'us-east-1', modelId: 'anthropic.claude-v2' });
// Automatically:
// - Generates Ed25519 keypair
// - Creates DID (did:key:z6Mk...)
// - Ready for secure communication

console.log('Agent DID:', client.did);

const conv = client.createConversation();

await client.chatInConversation(conv, 'My name is Alice');
await client.chatInConversation(conv, 'What is my name?');
// Model responds: "Your name is Alice"

await client.streamChat(
  'Write a story about a robot',
  undefined,
  {
    onDelta: (chunk) => process.stdout.write(chunk),
    onComplete: (full) => console.log('\n\nGenerated', full.length, 'characters'),
    onError: (error) => console.error('Stream failed:', error.message)
  }
);

// Create two agents with separate identities
const researcher = new BedrockXLinkClient({
  region: 'us-east-1',
  modelId: 'anthropic.claude-v2',
  agentName: 'researcher'
});

const writer = new BedrockXLinkClient({
  region: 'us-east-1',
  modelId: 'amazon.titan-text-express-v1',
  agentName: 'writer'
});

// Each has a unique DID
console.log('Researcher DID:', researcher.did);
console.log('Writer DID:', writer.did);

// They can verify each other's messages
const researchResult = await researcher.chat('Find facts about AI');
// Writer can verify researcher's signature

curl -X POST https://private.me/api/purchase \
  -H "Content-Type: application/json" \
  -d '{
    "product": "aws-bedrock-xlink",
    "tier": "basic",
    "customer": {
      "email": "user@example.com",
      "connection_id": "conn_abc123"
    }
  }'

{
  "type": "https://private.me/errors/invalid-tier",
  "title": "Invalid subscription tier",
  "status": 400,
  "fields": {
    "tier": "Provided value 'premium' is not valid"
  }
}

client.did        // The xLink DID for this client
client.agent      // The underlying xLink Agent instance

interface BedrockXLinkConfig {
  region: string;              // AWS region (e.g., "us-east-1")
  modelId: string;             // Model ID (e.g., "anthropic.claude-v2")
  accessKeyId?: string;        // AWS access key (optional)
  secretAccessKey?: string;    // AWS secret key (optional)
  sessionToken?: string;       // Session token for temporary credentials
  agentName?: string;          // Name for xLink identity
  registryUrl?: string;        // Trust registry URL
  verbose?: boolean;           // Enable debug logging
}

const client = new BedrockXLinkClient({
  region: 'us-west-2',
  modelId: 'amazon.titan-text-express-v1'
});

const result = await client.chat('Generate a product description for headphones');

┌─────────────────────────────┐
│ Your Application            │
└──────────┬──────────────────┘
           │
           ▼
┌─────────────────────────────┐
│ BedrockXLinkClient          │
│ - Auto-generates DID        │
│ - Signs messages            │
│ - Verifies responses        │
└──────────┬──────────────────┘
           │
           ├─────────┬─────────
           │         │
           ▼         ▼
    ┌──────────┐  ┌──────────┐
    │ xLink    │  │ AWS SDK  │
    │ Agent    │  │ Bedrock  │
    └──────────┘  └──────────┘
           │         │
           └─────────┘
                 │
                 ▼
         ┌──────────────┐
         │ AWS Bedrock  │
         │ Claude/Titan │
         └──────────────┘

// Export identity
const identity = await client.agent.exportIdentity();
// Store securely (OS keychain, secrets manager)

// Restore later (same DID, same access rights)
const restoredClient = new BedrockXLinkClient({
  region: 'us-east-1',
  modelId: 'anthropic.claude-v2',
  identity: identity.value  // Pass existing identity
});