@agenticprimitives/delegation 1.0.0-alpha.13 → 1.0.0-alpha.15

package/dist/quorum.js

@@ -0,0 +1,80 @@
+// Off-chain quorum verification (spec 291 §6b). For MCP-only operations that never
+// redeem on chain, verify a QuorumCaveat off-chain: threshold satisfied, every
+// signer authorized (in the caveat whitelist), every signature valid over the
+// bound payload — via the connection-agnostic signature verifier (EOA ECDSA /
+// ERC-1271 / ERC-6492). Fail-closed: any decode error, unbound payload, or
+// sub-threshold match rejects.
+//
+// Binding: the quorum signs over `expectedPayloadHash` (the delegation's EIP-712
+// hash) — i.e. the quorum approves THIS exact delegation. A proof minted for one
+// delegation cannot be replayed onto another (each has a unique hash).
+//
+// Port: smart-agent RecoveryEnforcer.sol (guardian threshold + per-signer +
+// intent-bound). Divergence: that verifies on-chain at redeem; this is the
+// off-chain equivalent for tools that never redeem.
+import { decodeAbiParameters } from 'viem';
+/** Split a 0x-prefixed blob of concatenated 65-byte signatures; null if malformed. */
+function splitPackedSignatures(packed) {
+    const hex = packed.startsWith('0x') ? packed.slice(2) : packed;
+    if (hex.length === 0 || hex.length % 130 !== 0)
+        return null; // 65 bytes = 130 hex chars
+    const out = [];
+    for (let i = 0; i < hex.length; i += 130)
+        out.push(`0x${hex.slice(i, i + 130)}`);
+    return out;
+}
+export async function verifyOffChainQuorum(input) {
+    // 1. Payload binding — the quorum must have signed THIS delegation's hash.
+    if (input.proof.payloadHash.toLowerCase() !== input.expectedPayloadHash.toLowerCase()) {
+        return { ok: false, reason: 'payload_unbound' };
+    }
+    // 2. Decode the caveat's authorized signer set + threshold.
+    let signers;
+    let threshold;
+    try {
+        const [s, t] = decodeAbiParameters([{ type: 'address[]' }, { type: 'uint8' }, { type: 'address' }], input.caveatTerms);
+        signers = s.map((a) => a);
+        threshold = Number(t);
+    }
+    catch {
+        return { ok: false, reason: 'bad_caveat_terms' };
+    }
+    if (!Number.isFinite(threshold) || threshold <= 0)
+        return { ok: false, reason: 'bad_threshold' };
+    if (signers.length < threshold)
+        return { ok: false, reason: 'whitelist_smaller_than_threshold' };
+    // 3. Split the packed signatures.
+    const sigs = splitPackedSignatures(input.proof.packedSignatures);
+    if (sigs === null)
+        return { ok: false, reason: 'bad_signatures' };
+    if (sigs.length < threshold)
+        return { ok: false, reason: 'insufficient_signatures' };
+    // 4. Match each signature to a UNIQUE authorized signer (no double-count).
+    const remaining = new Set(signers.map((a) => a.toLowerCase()));
+    const matched = [];
+    for (const sig of sigs) {
+        for (const signer of signers) {
+            if (!remaining.has(signer.toLowerCase()))
+                continue;
+            let ok = false;
+            try {
+                ok = await input.verifySignature(signer, input.proof.payloadHash, sig);
+            }
+            catch {
+                ok = false; // a throwing verifier is a failed check (fail-closed)
+            }
+            if (ok) {
+                remaining.delete(signer.toLowerCase());
+                matched.push(signer);
+                break;
+            }
+        }
+        if (matched.length >= threshold)
+            break;
+    }
+    if (matched.length < threshold) {
+        return { ok: false, reason: `threshold_unmet (${matched.length}/${threshold})` };
+    }
+    return { ok: true, matched };
+}
+//# sourceMappingURL=quorum.js.map

package/dist/quorum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quorum.js","sourceRoot":"","sources":["../src/quorum.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,oDAAoD;AAEpD,OAAO,EAAE,mBAAmB,EAA0B,MAAM,MAAM,CAAC;AAsBnE,sFAAsF;AACtF,SAAS,qBAAqB,CAAC,MAAW;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IACxF,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,EAAS,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAgC;IACzE,2EAA2E;IAC3E,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,4DAA4D;IAC5D,IAAI,OAAkB,CAAC;IACvB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,mBAAmB,CAChC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC/D,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,OAAO,GAAI,CAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,SAAS,GAAG,MAAM,CAAC,CAAoB,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjG,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAEjG,kCAAkC;IAClC,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAErF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAE,SAAS;YACnD,IAAI,EAAE,GAAG,KAAK,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,KAAK,CAAC,CAAC,sDAAsD;YACpE,CAAC;YACD,IAAI,EAAE,EAAE,CAAC;gBACP,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,OAAO,CAAC,MAAM,IAAI,SAAS,GAAG,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/token.d.ts

@@ -67,6 +67,68 @@ export interface VerifyOptsExt extends VerifyOpts {
      *   `process.env.NODE_ENV` is undefined).
      */
     revocationFailMode?: 'closed' | 'open';
+    /**
+     * spec 289 §5 — optional injected revocation reader. When provided, the
+     * revocation check routes through it (resilient, multi-provider, evidence-
+     * bearing, with the bounded-freshness invariant) INSTEAD of the inline
+     * single-client `isRevoked` read. Structurally compatible with chain-state's
+     * `ChainAuthorityReader` (so delegation needs no chain-state dependency). A
+     * fail-closed reader result (evidence.source begins `fail-closed`) is treated
+     * exactly like the inline read's RPC-throw: rejected under `revocationFailMode:
+     * 'closed'` (default), tolerated under `'open'`. Omit ⇒ unchanged inline read.
+     */
+    chainRevocationReader?: {
+        isDelegationRevoked(hash: Hex): Promise<{
+            revoked: boolean;
+            evidence?: {
+                source: string;
+            };
+        }>;
+    };
+    /**
+     * spec 289 §5 (W2) — optional injected acceptance reader. When provided AND `requireAcceptedOnChain`,
+     * the `hasAcceptedSessionDelegation` high-risk gate routes through it (resilient, multi-provider,
+     * evidence-bearing) INSTEAD of the inline single-client read. Structurally compatible with chain-state's
+     * `ChainAuthorityReader` (so delegation needs no chain-state dependency). Acceptance is inherently
+     * fail-closed (the tier REQUIRES `accepted === true`): a fail-closed reader result (evidence.source
+     * begins `fail-closed`) or a throw is rejected, exactly like the inline read's RPC-throw. Omit ⇒
+     * unchanged inline read.
+     */
+    chainAcceptanceReader?: {
+        isSessionDelegationAccepted(principal: Address, hash: Hex): Promise<{
+            accepted: boolean;
+            evidence?: {
+                source: string;
+            };
+        }>;
+    };
+    /**
+     * spec 289 §5 (W3) — optional injected signature reader. When provided, BOTH signature-verify sites
+     * (the main delegator signature AND the DEL-001 session-delegation leaf) route through it (resilient,
+     * multi-provider, evidence-bearing) INSTEAD of the inline single-client USV/ERC-1271 read. Structurally
+     * compatible with chain-state's `ChainAuthorityReader.verifySmartAgentSignature` (so delegation needs no
+     * chain-state dependency). The reader validates via the UniversalSignatureValidator (connection-agnostic:
+     * ECDSA / ERC-1271 / ERC-6492) and reports `deployed` as a FACT; this verifier keeps the POLICY:
+     *   - a fail-closed reader result (evidence.source begins `fail-closed`) or a throw → reject (signature
+     *     is critical — fail closed, like the inline read's revert);
+     *   - `valid === false` → reject;
+     *   - `requireDeployed && !deployed` → reject (a counterfactual/undeployed SA; the caller must opt into
+     *     it explicitly with `requireDeployed: false`, exactly as the legacy inline path required).
+     * Omit ⇒ unchanged inline read (USV when `universalSignatureValidator` is set, else legacy ERC-1271).
+     */
+    chainSignatureReader?: {
+        verifySmartAgentSignature(input: {
+            signer: Address;
+            digest: Hex;
+            signature: Hex;
+        }): Promise<{
+            valid: boolean;
+            deployed: boolean;
+            evidence?: {
+                source: string;
+            };
+        }>;
+    };
     /**
      * Audit sink (audit C3 pass 3b). When provided, every verify outcome
      * emits a `delegation.verify.{accept,reject}` event. The principal
@@ -133,6 +195,17 @@ export interface VerifyOptsExt extends VerifyOpts {
         payloadHash: Hex;
         packedSignatures: Hex;
     };
+    /**
+     * Usage-accounting mode for the delegation token's `usageLimit`/JTI (spec 290 §3).
+     * - `'consume'` (DEFAULT — unchanged): atomically consume one use at verify.
+     * - `'reserve'`: reserve an in-flight use at verify and return a
+     *   `JtiReservation` on the success result; the caller `commit()`s ONLY after
+     *   the call is admitted + executed, and `release()`s on any later rejection
+     *   (rate limit, budget, policy) so a post-verify failure never burns a use.
+     *   Requires the `jtiStore` to implement `reserveUsage` (else verify fails
+     *   closed — no silent fallback to consume).
+     */
+    usageMode?: 'consume' | 'reserve';
     /**
      * When `true`, verify that the delegator's smart account has
      * pre-blessed this delegation hash on-chain via
@@ -165,6 +238,8 @@ export declare function sessionDelegateBindingError(delegation: Delegation, sess
  */
 export declare function verifyDelegationToken(token: string, opts: VerifyOptsExt): Promise<{
     principal: Address;
+    sessionKeyAddress: Address;
     grants?: DataScopeGrant[];
+    usage?: import('./types.js').JtiReservation;
 } | VerifyError>;
 //# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAeA,OAAO,EAA4B,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxE,OAAO,KAAK,EACV,UAAU,EACV,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAkDtE;;;;;;;gBAOgB;AAChB,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsBpD;AAiDD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAClG,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,EAC1C,IAAI,CAAC,EAAE;IACL,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA8EzC;AA2DD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACvC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IASvB;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,WAAW,CAAC,EACR;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC;QAAC,gBAAgB,EAAE,GAAG,CAAA;KAAE,CAAC;IAEnE;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AA+BD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,UAAU,GAAG,SAAS,EACzC,iBAAiB,EAAE,OAAO,GACzB,MAAM,GAAG,IAAI,CASf;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;CAAE,GAAG,WAAW,CAAC,CAmU1E"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAeA,OAAO,EAA4B,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxE,OAAO,KAAK,EACV,UAAU,EACV,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,cAAc,EACf,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAkDtE;;;;;;;gBAOgB;AAChB,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsBpD;AAiDD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAClG,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,EAC1C,IAAI,CAAC,EAAE;IACL,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA8EzC;AA2DD,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACvC;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE;QACtB,mBAAmB,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC9F,CAAC;IACF;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE;QACtB,2BAA2B,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC3H,CAAC;IACF;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE;QACrB,yBAAyB,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,GAAG,CAAC;YAAC,SAAS,EAAE,GAAG,CAAA;SAAE,GAAG,OAAO,CAAC;YAC1F,KAAK,EAAE,OAAO,CAAC;YACf,QAAQ,EAAE,OAAO,CAAC;YAClB,QAAQ,CAAC,EAAE;gBAAE,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IASvB;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,WAAW,CAAC,EACR;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAC7B;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC;QAAC,gBAAgB,EAAE,GAAG,CAAA;KAAE,CAAC;IAEnE;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAElC;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AA+BD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,UAAU,GAAG,SAAS,EACzC,iBAAiB,EAAE,OAAO,GACzB,MAAM,GAAG,IAAI,CASf;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CACN;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,YAAY,EAAE,cAAc,CAAA;CAAE,GAC1H,WAAW,CACd,CA4eA"}

package/dist/token.js

@@ -15,6 +15,9 @@ import { keccak_256 } from '@noble/hashes/sha3.js';
 import { createPublicClient, http } from 'viem';
 import { hashDelegation } from './hash.js';
 import { evaluateCaveats } from './evaluator.js';
+import { DATA_SCOPE_ENFORCER, decodeDataScopeTerms } from './caveats.js';
+import { verifyUniversalSignature } from './onchain.js';
+import { verifyOffChainQuorum } from './quorum.js';
 import { buildEvent } from '@agenticprimitives/audit';
 // ─── base64url + canonical JSON helpers ──────────────────────────────────
 //
@@ -255,7 +258,7 @@ const UNIVERSAL_SIG_VALIDATOR_ABI = [
 const ACCEPTED_SESSION_DELEGATION_ABI = [
     {
         type: 'function',
-        name: 'isAcceptedSessionDelegation',
+        name: 'hasAcceptedSessionDelegation',
         stateMutability: 'view',
         inputs: [{ name: 'sessionDelegationHash', type: 'bytes32' }],
         outputs: [{ name: '', type: 'bool' }],
@@ -380,24 +383,100 @@ export async function verifyDelegationToken(token, opts) {
             args: [signer, hash, sig],
         }))
         : null;
-    try {
-        const revoked = (await publicClient.readContract({
-            address: opts.delegationManager,
-            abi: DELEGATION_MANAGER_ABI,
-            functionName: 'isRevoked',
-            args: [eip712Hash],
-        }));
-        if (revoked) {
-            return rejectWith('delegation revoked', claims.delegation.delegator, eip712Hash);
+    // spec 289 §5 (W3) — validate an SA signature through the resilient, evidence-bearing port when a
+    // `chainSignatureReader` is injected. The port surfaces FACTS ({valid, deployed}); this closure keeps
+    // the POLICY: fail-closed/throw → reject (signature is critical); !valid → reject; requireDeployed &&
+    // !deployed → reject (counterfactual needs explicit requireDeployed=false). Returns null on success,
+    // else a rejection reason. Used by BOTH signature sites below.
+    const validateSaSigViaReader = async (signer, hash, sig) => {
+        let valid = false;
+        let deployed = false;
+        let failClosed = false;
+        try {
+            const r = await opts.chainSignatureReader.verifySmartAgentSignature({ signer, digest: hash, signature: sig });
+            valid = r.valid;
+            deployed = r.deployed;
+            failClosed = r.evidence?.source?.startsWith('fail-closed') ?? false;
         }
-    }
-    catch (e) {
-        if (revocationFailMode === 'closed') {
-            return rejectWith('revocation check unavailable; refusing to verify (set revocationFailMode=open only for explicit dev/demo paths)', claims.delegation.delegator, eip712Hash);
+        catch {
+            // A throwing reader is itself an unconfirmable signature check.
+            failClosed = true;
+        }
+        if (failClosed)
+            return 'signature check unavailable; refusing to verify';
+        if (!valid)
+            return 'signature validation failed';
+        if (requireDeployed && !deployed) {
+            return 'delegator smart account is not deployed — cannot honor requireDeployed. Set verifyDelegationToken opt requireDeployed=false only for explicit counterfactual-demo use cases.';
+        }
+        return null;
+    };
+    // DEL-002 (seam audit): the SAME fail-closed revocation check, applied to a given delegation hash so it
+    // can gate BOTH the root delegation AND the DEL-001 session-delegation LEAF. Returns a rejection reason
+    // or null. spec 289 §5: the resilient reader is fail-closed by construction (an unconfirmable read comes
+    // back revoked:true with evidence.source='fail-closed:*'); map that to the inline read's RPC-throw —
+    // reject under 'closed', tolerate under 'open'.
+    const revocationRejection = async (hash) => {
+        if (opts.chainRevocationReader) {
+            let revoked = true;
+            let failClosed = false;
+            try {
+                const r = await opts.chainRevocationReader.isDelegationRevoked(hash);
+                revoked = r.revoked;
+                failClosed = r.evidence?.source?.startsWith('fail-closed') ?? false;
+            }
+            catch {
+                revoked = true;
+                failClosed = true;
+            }
+            if (revoked) {
+                if (failClosed && revocationFailMode === 'open')
+                    return null; // dev/demo tolerates an unconfirmable read
+                return failClosed
+                    ? 'revocation check unavailable; refusing to verify (set revocationFailMode=open only for explicit dev/demo paths)'
+                    : 'delegation revoked';
+            }
+            return null;
+        }
+        try {
+            const revoked = (await publicClient.readContract({
+                address: opts.delegationManager,
+                abi: DELEGATION_MANAGER_ABI,
+                functionName: 'isRevoked',
+                args: [hash],
+            }));
+            return revoked ? 'delegation revoked' : null;
         }
-        void e;
+        catch (e) {
+            void e;
+            return revocationFailMode === 'closed'
+                ? 'revocation check unavailable; refusing to verify (set revocationFailMode=open only for explicit dev/demo paths)'
+                : null;
+        }
+    };
+    {
+        // Root delegation revocation (unchanged semantics).
+        const rootReason = await revocationRejection(eip712Hash);
+        if (rootReason)
+            return rejectWith(rootReason, claims.delegation.delegator, eip712Hash);
+        // DEL-002: the session-delegation LEAF (DEL-001 session-key binding) is separately revocable on-chain
+        // (revokeDelegation(leafHash)), but was NEVER checked — so revoking the session-key binding did not
+        // invalidate the token until the ROOT was also revoked. Check the leaf with the SAME fail-closed model
+        // so a revoked (e.g. compromised) session key is rejected as tightly as a revoked root.
+        if (claims.sessionDelegation) {
+            const leafHash = hashDelegation(claims.sessionDelegation, opts.chainId, opts.delegationManager);
+            const leafReason = await revocationRejection(leafHash);
+            if (leafReason)
+                return rejectWith(`session-delegation leaf: ${leafReason}`, claims.delegation.delegator, leafHash);
+        }
+    }
+    if (opts.chainSignatureReader) {
+        // spec 289 §5 (W3) — main delegator signature through the resilient port.
+        const reason = await validateSaSigViaReader(claims.delegation.delegator, eip712Hash, claims.delegation.signature);
+        if (reason)
+            return rejectWith(reason, claims.delegation.delegator, eip712Hash);
     }
-    if (validateSaSig) {
+    else if (validateSaSig) {
         // spec 270 v4 — one connection-agnostic surface; counterfactual delegators verify via ERC-6492, so
         // no requireDeployed hard-reject.
         try {
@@ -457,7 +536,13 @@ export async function verifyDelegationToken(token, opts) {
         // strategy passes through one surface), else legacy deployed-ERC-1271.
         const sdHash = hashDelegation(sd, opts.chainId, opts.delegationManager);
         try {
-            if (validateSaSig) {
+            if (opts.chainSignatureReader) {
+                // spec 289 §5 (W3) — DEL-001 leaf signature through the resilient port.
+                const reason = await validateSaSigViaReader(sd.delegator, sdHash, sd.signature);
+                if (reason)
+                    return rejectWith(`session-delegation ${reason} (DEL-001)`, claims.delegation.delegator, eip712Hash);
+            }
+            else if (validateSaSig) {
                 if (!(await validateSaSig(sd.delegator, sdHash, sd.signature))) {
                     return rejectWith('session-delegation signature validation failed (DEL-001)', claims.delegation.delegator, eip712Hash);
                 }
@@ -520,42 +605,99 @@ export async function verifyDelegationToken(token, opts) {
             return rejectWith('quorum caveat present but no quorumProof supplied — refusing to assume on-chain enforcement', claims.delegation.delegator, eip712Hash);
         }
         if (opts.quorumProof.mode === 'off-chain') {
-            // Off-chain verification is a planned mode; the wire-format
-            // (payloadHash + packedSignatures) is reserved here so consumers
-            // can migrate when the implementation lands. Failing closed
-            // until the spec'd off-chain payload format is implemented.
-            return rejectWith('quorum_off_chain_not_implemented', claims.delegation.delegator, eip712Hash);
+            // Spec 291 §6b — verify the QuorumCaveat off-chain (threshold + authorized
+            // signers + signatures bound to THIS delegation's hash). For tools that
+            // never redeem on chain. Requires the UniversalSignatureValidator surface
+            // so any signer credential strategy (EOA / ERC-1271 / ERC-6492) works.
+            if (!opts.universalSignatureValidator) {
+                return rejectWith('quorum_off_chain_requires_universalSignatureValidator', claims.delegation.delegator, eip712Hash);
+            }
+            const usv = opts.universalSignatureValidator;
+            const quorumCaveat = claims.delegation.caveats.find((c) => c.enforcer.toLowerCase() === target);
+            if (!quorumCaveat) {
+                // Defensive — hasQuorum above already guaranteed presence.
+                return rejectWith('quorum caveat vanished', claims.delegation.delegator, eip712Hash);
+            }
+            const quorumResult = await verifyOffChainQuorum({
+                caveatTerms: quorumCaveat.terms,
+                proof: opts.quorumProof,
+                // Bind the quorum to THIS delegation (its EIP-712 hash) — replay onto a
+                // different delegation fails the payload-binding check.
+                expectedPayloadHash: eip712Hash,
+                verifySignature: (signer, digest, signature) => verifyUniversalSignature({ signer, digest, signature, rpcUrl: opts.rpcUrl, universalSignatureValidator: usv }),
+            });
+            if (!quorumResult.ok) {
+                return rejectWith(`quorum_off_chain: ${quorumResult.reason}`, claims.delegation.delegator, eip712Hash);
+            }
+            // Verified — fall through to the rest of the pipeline.
         }
         // mode === 'on-chain-redeemed' — caller asserts the call will
         // pass through QuorumEnforcer.beforeHook on chain. Accept; the
         // on-chain layer is responsible for the actual signature check.
     }
-    //   - requireAcceptedOnChain: account.isAcceptedSessionDelegation(hash)
+    //   - requireAcceptedOnChain: account.hasAcceptedSessionDelegation(hash)
     //     must return true. Spec § 6 high-risk gate. Single extra chain
     //     read; only fires when the tool-policy decision flips this on
     //     (typically critical-tier tools).
     let acceptedOnChain = false;
     if (opts.requireAcceptedOnChain) {
-        try {
-            acceptedOnChain = (await publicClient.readContract({
-                address: claims.delegation.delegator,
-                abi: ACCEPTED_SESSION_DELEGATION_ABI,
-                functionName: 'isAcceptedSessionDelegation',
-                args: [eip712Hash],
-            }));
-        }
-        catch (e) {
-            return rejectWith(`acceptSessionDelegation check reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
+        if (opts.chainAcceptanceReader) {
+            // spec 289 §5 (W2) — acceptance through the resilient, evidence-bearing port. Inherently
+            // fail-closed: not-accepted OR an unconfirmable read (fail-closed evidence / throw) both reject,
+            // mapping the inline read's RPC-throw → reject (this gate has no 'open' mode — the tier requires it).
+            let failClosed = false;
+            try {
+                const r = await opts.chainAcceptanceReader.isSessionDelegationAccepted(claims.delegation.delegator, eip712Hash);
+                acceptedOnChain = r.accepted;
+                failClosed = r.evidence?.source?.startsWith('fail-closed') ?? false;
+            }
+            catch {
+                acceptedOnChain = false;
+                failClosed = true;
+            }
+            if (!acceptedOnChain) {
+                return rejectWith(failClosed
+                    ? 'acceptSessionDelegation check unavailable; refusing to verify'
+                    : 'tier requires on-chain acceptSessionDelegation blessing; not present', claims.delegation.delegator, eip712Hash);
+            }
         }
-        if (!acceptedOnChain) {
-            return rejectWith('tier requires on-chain acceptSessionDelegation blessing; not present', claims.delegation.delegator, eip712Hash);
+        else {
+            try {
+                acceptedOnChain = (await publicClient.readContract({
+                    address: claims.delegation.delegator,
+                    abi: ACCEPTED_SESSION_DELEGATION_ABI,
+                    functionName: 'hasAcceptedSessionDelegation',
+                    args: [eip712Hash],
+                }));
+            }
+            catch (e) {
+                return rejectWith(`acceptSessionDelegation check reverted: ${e instanceof Error ? e.message : e}`, claims.delegation.delegator, eip712Hash);
+            }
+            if (!acceptedOnChain) {
+                return rejectWith('tier requires on-chain acceptSessionDelegation blessing; not present', claims.delegation.delegator, eip712Hash);
+            }
         }
     }
-    // 5. JTI replay
+    // 5. JTI replay + usage accounting.
     const limit = claims.usageLimit ?? 10;
-    const usage = await opts.jtiStore.trackUsage(claims.jti, limit);
-    if (!usage.allowed) {
-        return rejectWith('token usage limit exceeded', claims.delegation.delegator, eip712Hash);
+    let usageHandle;
+    if (opts.usageMode === 'reserve') {
+        // Two-phase (spec 290 §3): reserve in-flight now; caller commits on success,
+        // releases on a later reject so a post-verify failure doesn't burn a use.
+        if (!opts.jtiStore.reserveUsage) {
+            return rejectWith("usageMode='reserve' requires a JtiStore implementing reserveUsage", claims.delegation.delegator, eip712Hash);
+        }
+        const reserved = await opts.jtiStore.reserveUsage(claims.jti, limit);
+        if (!reserved.allowed) {
+            return rejectWith('token usage limit exceeded', claims.delegation.delegator, eip712Hash);
+        }
+        usageHandle = reserved.reservation;
+    }
+    else {
+        const usage = await opts.jtiStore.trackUsage(claims.jti, limit);
+        if (!usage.allowed) {
+            return rejectWith('token usage limit exceeded', claims.delegation.delegator, eip712Hash);
+        }
     }
     // Accept emit — extended context to capture the threshold-policy
     // outcome (`acceptedOnChain`) for forensics + dashboards. Reuses the
@@ -569,19 +711,53 @@ export async function verifyDelegationToken(token, opts) {
         if (opts.requireAcceptedOnChain !== undefined) {
             context.acceptedOnChain = acceptedOnChain;
         }
-        await opts.auditSink.write(buildEvent({
-            action: 'delegation.verify.accept',
-            outcome: 'success',
-            correlationId: opts.correlationId,
-            actor: { type: 'user', id: claims.delegation.delegator },
-            subject: { type: 'delegation', id: eip712Hash },
-            audience: opts.audience,
-            chainId: opts.chainId,
-            digest: eip712Hash,
-            context: Object.keys(context).length > 0 ? context : undefined,
-        }));
+        try {
+            await opts.auditSink.write(buildEvent({
+                action: 'delegation.verify.accept',
+                outcome: 'success',
+                correlationId: opts.correlationId,
+                actor: { type: 'user', id: claims.delegation.delegator },
+                subject: { type: 'delegation', id: eip712Hash },
+                audience: opts.audience,
+                chainId: opts.chainId,
+                digest: eip712Hash,
+                context: Object.keys(context).length > 0 ? context : undefined,
+            }));
+        }
+        catch (e) {
+            // A fail-hard audit sink throwing AFTER we reserved must not leak the
+            // in-flight slot — release before propagating (spec 290 §3).
+            if (usageHandle) {
+                try {
+                    await usageHandle.release();
+                }
+                catch { /* best-effort */ }
+            }
+            throw e;
+        }
     }
-    return { principal: claims.delegation.delegator };
+    // Off-chain DATA_SCOPE caveats (field-scoping, spec 291-A): decode any present into `grants` so the
+    // resource server (the vault/MCP runtime) can RESTRICT the field projection to what the issuer granted.
+    // The on-chain evaluator treats the sentinel as inert; enforcement is here, off-chain (ADR-0041 — the
+    // scope rides in the SAME signed delegation that conveys authority, so it can't be replayed without it).
+    // Authentic (decoded only AFTER the signature verified) — a malformed scope in a signed delegation throws.
+    const grants = [];
+    for (const cav of claims.delegation.caveats ?? []) {
+        if (cav.enforcer.toLowerCase() === DATA_SCOPE_ENFORCER.toLowerCase()) {
+            grants.push(...decodeDataScopeTerms(cav.terms));
+        }
+    }
+    // `sessionKeyAddress` is surfaced (additive) so callers can cross-check a
+    // per-call proof's signer against the bound session key (spec 287 §6). It
+    // equals `recovered` (verified above to match `claims.sessionKeyAddress`).
+    // `usage` is present only in reserve mode — the caller commits on success,
+    // releases on a later reject (spec 290 §3).
+    return {
+        principal: claims.delegation.delegator,
+        sessionKeyAddress: claims.sessionKeyAddress,
+        ...(grants.length ? { grants } : {}),
+        ...(usageHandle ? { usage: usageHandle } : {}),
+    };
 }
 // H7-B.8 (XPKG-002 / EXT-024 closure) — `verifyCrossDelegation` was a
 // public stub that unconditionally returned a "not implemented" error