@agenticprimitives/delegation 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/method-authorization.d.ts

@@ -0,0 +1,120 @@
+import type { Address, Caveat, Delegation, EnforcerAddressMap, Hex } from './types.js';
+/**
+ * Map a method NAME to the 4-byte selector `allowedMethods` checks: `keccak256(utf8(name))[:4]`.
+ *
+ * Lives here because this package owns `encodeAllowedMethodsTerms` — the name→selector mapping and
+ * the encoding that consumes it must never drift apart. `@agenticprimitives/a2a`'s `skillSelector`
+ * is this function plus the A2A "any skill" sentinel.
+ */
+export declare function methodSelector(name: string): Hex;
+/** Injected on-chain reads. Both fail CLOSED — a read that errored did not verify (ADR-0013). */
+export interface MethodAuthorizationChecks {
+    /** `DelegationManager.isRevoked(hashDelegation(d))`. */
+    isRevoked: (delegation: Delegation) => Promise<boolean>;
+    /** ERC-1271 / ERC-6492 / ECDSA via `UniversalSignatureValidator`. */
+    verifySignature: (args: {
+        signer: Address;
+        digest: Hex;
+        signature: Hex;
+    }) => Promise<boolean>;
+    /** The EIP-712 digest the delegator signed — normally `hashDelegation(d)`. */
+    delegationDigest: (delegation: Delegation) => Hex;
+}
+export interface AuthorizeMethodInput {
+    delegation: Delegation;
+    /** The party claiming to act. MUST be the delegation's delegate. */
+    delegate: Address;
+    /** The agent being acted FOR. MUST be the delegator, and must satisfy allowedTargets. */
+    target: Address;
+    /** 4-byte selector of the method, e.g. `skillSelector('agent.discovery.grant.issue')`. */
+    selector: Hex;
+    enforcers: EnforcerAddressMap;
+    checks: MethodAuthorizationChecks;
+    /** Unix seconds. Injected so the decision is deterministic and testable. */
+    now: number;
+}
+export type AuthorizeMethodResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Decide whether `delegate` may perform `selector` on behalf of `target`.
+ *
+ * NEVER THROWS on a denial — returns a reason the caller keeps LOCAL. Planes that must not leak which
+ * check fired (private resolution) map every reason to one uniform wire code themselves.
+ */
+export declare function authorizeMethodDelegation(input: AuthorizeMethodInput): Promise<AuthorizeMethodResult>;
+/**
+ * Build the caveats a method authority needs — the exact mirror of what
+ * `authorizeMethodDelegation` reads back.
+ *
+ * WHY THIS SITS BESIDE THE VERIFIER: a minter and a verifier that live apart drift, and the drift is
+ * silent — the delegation still verifies as a signature, it just no longer authorizes what its issuer
+ * believed. Keeping both in one file means a change to one is a change you cannot make without seeing
+ * the other.
+ *
+ * NOTE WHAT `target` MEANS HERE: the agent being acted FOR, which is also the delegator. That is the
+ * opposite of the A2A reading, where the allowed target is the recipient you are CALLING. The
+ * encoding is identical; only the intent differs, so the distinction lives in the caller's naming and
+ * in `authorizeMethodDelegation`'s insistence that `delegator === target`.
+ */
+export declare function buildMethodAuthorityCaveats(args: {
+    /** The agent being acted for. MUST equal the delegation's delegator. */
+    target: Address;
+    /** Method NAME, e.g. `agent.discovery.grant.issue`. Reduced via `methodSelector`. */
+    method: string;
+    enforcers: Pick<EnforcerAddressMap, 'timestamp' | 'allowedTargets' | 'allowedMethods'>;
+    /** Unix seconds. A window is MANDATORY — `authorizeMethodDelegation` refuses uncaveated grants. */
+    window: {
+        validAfter: number;
+        validUntil: number;
+    };
+}): Caveat[];
+/**
+ * Is this delegation LIVE and genuinely signed by the party it names?
+ *
+ * THE QUESTION THIS ANSWERS, AND THE ONE IT DOES NOT. "Does this party hold a valid, unrevoked,
+ * in-window delegation from that party" — the silent-reauth / login-grade question. It is NOT "may
+ * they do X": for that, `authorizeMethodDelegation`, which additionally pins target and method.
+ *
+ * WHY IT EXISTS. Apps kept writing this by hand, and the hand-rolled versions lost things. The one in
+ * `demo-sso-next` minted login-grade sessions while (a) never checking revocation, (b) never
+ * evaluating any caveat except timestamp, and (c) *falling through to the signature check* when the
+ * timestamp terms failed to parse — so malformed terms meant no window at all. Each omission is
+ * individually easy to make and invisible in review, which is exactly why this belongs in one place.
+ *
+ * ABOUT THE CAVEATS. Evaluated with a timestamp-only context, so `allowedTargets` / `allowedMethods`
+ * go INERT rather than denying — there is no target or selector to judge them against. That is
+ * correct for a liveness check and is precisely why the result must not be read as authorization: a
+ * delegation scoped to one method is *live* for every method. An unknown enforcer still DENIES.
+ */
+export interface VerifyLiveDelegationInput {
+    delegation: Delegation;
+    /** Refuse unless the delegation is FROM this party. */
+    expectedDelegator?: Address;
+    /** Refuse unless it is TO this party. */
+    expectedDelegate?: Address;
+    /**
+     * Caveat kinds the delegation MUST carry.
+     *
+     * The shape gate: a stewardship wire and a data grant are both valid delegations between the same
+     * pair, and accepting either where only one is meant is how a governance grant gets replayed as
+     * member access. Naming the required enforcer is what keeps them distinct.
+     */
+    requiredEnforcers?: readonly Address[];
+    enforcers: EnforcerAddressMap;
+    checks: MethodAuthorizationChecks;
+    /** Unix seconds. Injected so the decision is deterministic. */
+    now: number;
+}
+export type VerifyLiveDelegationResult = {
+    ok: true;
+    digest: Hex;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function verifyLiveDelegation(input: VerifyLiveDelegationInput): Promise<VerifyLiveDelegationResult>;
+//# sourceMappingURL=method-authorization.d.ts.map

package/dist/method-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-authorization.d.ts","sourceRoot":"","sources":["../src/method-authorization.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAiB,UAAU,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEtG;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAEhD;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,wDAAwD;IACxD,SAAS,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,qEAAqE;IACrE,eAAe,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC;QAAC,SAAS,EAAE,GAAG,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F,8EAA8E;IAC9E,gBAAgB,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,GAAG,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,UAAU,CAAC;IACvB,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,QAAQ,EAAE,GAAG,CAAC;IACd,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;IAClC,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAKlC;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAwDhC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,wEAAwE;IACxE,MAAM,EAAE,OAAO,CAAC;IAChB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAAC;IACvF,mGAAmG;IACnG,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD,GAAG,MAAM,EAAE,CASX;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,UAAU,CAAC;IACvB,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACvC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;IAClC,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAmErC"}

package/dist/method-authorization.js

@@ -0,0 +1,173 @@
+// Generic "may this delegate perform METHOD on behalf of TARGET?" (spec 338 W6-c).
+//
+// WHY THIS EXISTS: `authorizeA2aMessage` already answers exactly this question — but only for an A2A
+// message, with a message id, replay reservation and body hash bound in. Other planes need the same
+// decision without a message: may this steward PUBLISH for that agent, may it ISSUE a discovery grant
+// for that agent.
+//
+// Rather than each plane inventing its own authority record — which is what
+// `agent-resolution` did with `PublicationAuthorityRecordV1`, and what a discovery-authority record
+// would have repeated — they compose THIS, which is the same delegation + caveat rail everything else
+// uses. One authority mechanism, not three.
+//
+// The checks and their ORDER mirror `authorizeA2aMessage`:
+//   delegate identity → caveats (timestamp / allowedTargets / allowedMethods) → on-chain revocation
+//   → signature.
+// Cheap structural checks first so an unauthorized caller cannot make us do chain reads.
+import { keccak256, toBytes } from 'viem';
+import { buildCaveat, encodeAllowedMethodsTerms, encodeAllowedTargetsTerms, encodeTimestampTerms, } from './caveats.js';
+import { evaluateCaveats } from './evaluator.js';
+/**
+ * Map a method NAME to the 4-byte selector `allowedMethods` checks: `keccak256(utf8(name))[:4]`.
+ *
+ * Lives here because this package owns `encodeAllowedMethodsTerms` — the name→selector mapping and
+ * the encoding that consumes it must never drift apart. `@agenticprimitives/a2a`'s `skillSelector`
+ * is this function plus the A2A "any skill" sentinel.
+ */
+export function methodSelector(name) {
+    return keccak256(toBytes(name)).slice(0, 10); // 0x + 8 hex = 4 bytes
+}
+const eq = (a, b) => !!a && !!b && a.toLowerCase() === b.toLowerCase();
+/**
+ * Decide whether `delegate` may perform `selector` on behalf of `target`.
+ *
+ * NEVER THROWS on a denial — returns a reason the caller keeps LOCAL. Planes that must not leak which
+ * check fired (private resolution) map every reason to one uniform wire code themselves.
+ */
+export async function authorizeMethodDelegation(input) {
+    const d = input.delegation;
+    // 1. The delegation must be FROM the agent being acted for. A delegation by anyone else is
+    //    irrelevant no matter how well-formed — this is the check that stops a steward appointing
+    //    itself over an agent that never appointed it.
+    if (!eq(d.delegator, input.target)) {
+        return { ok: false, reason: 'delegation delegator is not the target agent' };
+    }
+    // 2. The delegate IS the actor (mirrors authorizeA2aMessage FR-4.1).
+    if (!eq(d.delegate, input.delegate)) {
+        return { ok: false, reason: 'delegation delegate is not the acting party' };
+    }
+    // 3. Caveats — the substrate's own evaluator, not a hand-rolled reading of terms. `target` and
+    //    `selector` drive allowedTargets / allowedMethods; `timestamp` drives the window.
+    const ctx = {
+        timestamp: input.now,
+        target: input.target,
+        selector: input.selector,
+    };
+    const verdicts = evaluateCaveats(d.caveats, ctx, input.enforcers);
+    const denied = verdicts.find((v) => !v.allowed);
+    if (denied)
+        return { ok: false, reason: `caveat denied: ${denied.reason}` };
+    // 4. An UNCAVEATED delegation is refused for this use. Elsewhere a bare delegation may be
+    //    meaningful; here it would mean "this steward may do anything, forever, for this agent", which
+    //    is never what an operator intends to sign and is not something we should let them sign by
+    //    omission.
+    if (d.caveats.length === 0) {
+        return { ok: false, reason: 'delegation carries no caveats — refuse an unbounded authority' };
+    }
+    // 5. Revocation, then signature. Both on-chain, both fail-closed.
+    let revoked = true;
+    try {
+        revoked = await input.checks.isRevoked(d);
+    }
+    catch {
+        revoked = true; // could not confirm live ⇒ treat as revoked
+    }
+    if (revoked)
+        return { ok: false, reason: 'delegation is revoked' };
+    let valid = false;
+    try {
+        valid = await input.checks.verifySignature({
+            signer: d.delegator,
+            digest: input.checks.delegationDigest(d),
+            signature: d.signature,
+        });
+    }
+    catch {
+        valid = false;
+    }
+    if (!valid)
+        return { ok: false, reason: 'delegation signature did not verify' };
+    return { ok: true };
+}
+/**
+ * Build the caveats a method authority needs — the exact mirror of what
+ * `authorizeMethodDelegation` reads back.
+ *
+ * WHY THIS SITS BESIDE THE VERIFIER: a minter and a verifier that live apart drift, and the drift is
+ * silent — the delegation still verifies as a signature, it just no longer authorizes what its issuer
+ * believed. Keeping both in one file means a change to one is a change you cannot make without seeing
+ * the other.
+ *
+ * NOTE WHAT `target` MEANS HERE: the agent being acted FOR, which is also the delegator. That is the
+ * opposite of the A2A reading, where the allowed target is the recipient you are CALLING. The
+ * encoding is identical; only the intent differs, so the distinction lives in the caller's naming and
+ * in `authorizeMethodDelegation`'s insistence that `delegator === target`.
+ */
+export function buildMethodAuthorityCaveats(args) {
+    return [
+        buildCaveat(args.enforcers.timestamp, encodeTimestampTerms(args.window.validAfter, args.window.validUntil)),
+        buildCaveat(args.enforcers.allowedTargets, encodeAllowedTargetsTerms([args.target])),
+        buildCaveat(args.enforcers.allowedMethods, encodeAllowedMethodsTerms([methodSelector(args.method)])),
+    ];
+}
+export async function verifyLiveDelegation(input) {
+    const d = input.delegation;
+    if (input.expectedDelegator && !eq(d.delegator, input.expectedDelegator)) {
+        return { ok: false, reason: 'delegation is not from the expected delegator' };
+    }
+    if (input.expectedDelegate && !eq(d.delegate, input.expectedDelegate)) {
+        return { ok: false, reason: 'delegation is not to the expected delegate' };
+    }
+    for (const required of input.requiredEnforcers ?? []) {
+        if (!d.caveats.some((c) => eq(c.enforcer, required))) {
+            return { ok: false, reason: `delegation does not carry the required caveat ${required}` };
+        }
+    }
+    if (d.caveats.length === 0) {
+        // An unbounded delegation has no window, so "live" would mean "forever".
+        return { ok: false, reason: 'delegation carries no caveats — refuse an unbounded authority' };
+    }
+    // Timestamp-only context, with `enforceOnChain` — and that opt is doing real work, so read it:
+    //
+    // The evaluator is STRICT by default. A caveat it cannot judge (allowedTargets with no target,
+    // allowedMethods with no selector) DENIES rather than passing. That is the right default for an
+    // authorization decision and the wrong one here, because a liveness check has no target or selector
+    // to judge against — it would refuse every scoped delegation.
+    //
+    // `enforceOnChain: true` is the declaration that those caveats are enforced where they actually
+    // bite: on-chain at redeem. It is safe HERE and only here, because the answer this function returns
+    // is "authenticated", never "authorized". A caller that treats a live delegation as permission to
+    // act has misread the result, which is why the return type carries a digest and nothing else.
+    //
+    // A malformed term is still a DENY, not a fall-through — the exact hole the hand-rolled versions
+    // had. Unknown enforcers still DENY.
+    const verdicts = evaluateCaveats(d.caveats, { timestamp: input.now }, input.enforcers, { enforceOnChain: true });
+    const denied = verdicts.find((v) => !v.allowed);
+    if (denied)
+        return { ok: false, reason: `caveat denied: ${denied.reason}` };
+    const digest = input.checks.delegationDigest(d);
+    let revoked = true;
+    try {
+        revoked = await input.checks.isRevoked(d);
+    }
+    catch {
+        revoked = true; // could not confirm live ⇒ treat as revoked
+    }
+    if (revoked)
+        return { ok: false, reason: 'delegation is revoked' };
+    let valid = false;
+    try {
+        valid = await input.checks.verifySignature({
+            signer: d.delegator,
+            digest,
+            signature: d.signature,
+        });
+    }
+    catch {
+        valid = false;
+    }
+    if (!valid)
+        return { ok: false, reason: 'delegation signature did not verify' };
+    return { ok: true, digest };
+}
+//# sourceMappingURL=method-authorization.js.map

package/dist/method-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-authorization.js","sourceRoot":"","sources":["../src/method-authorization.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,sGAAsG;AACtG,kBAAkB;AAClB,EAAE;AACF,4EAA4E;AAC5E,oGAAoG;AACpG,sGAAsG;AACtG,4CAA4C;AAC5C,EAAE;AACF,2DAA2D;AAC3D,oGAAoG;AACpG,iBAAiB;AACjB,yFAAyF;AAEzF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGjD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAQ,CAAC,CAAC,uBAAuB;AAC9E,CAAC;AA8BD,MAAM,EAAE,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAC7C,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA2B;IAE3B,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IAE3B,2FAA2F;IAC3F,8FAA8F;IAC9F,mDAAmD;IACnD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IAC/E,CAAC;IAED,qEAAqE;IACrE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAC9E,CAAC;IAED,+FAA+F;IAC/F,sFAAsF;IACtF,MAAM,GAAG,GAAkB;QACzB,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,OAAmB,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAE5E,0FAA0F;IAC1F,mGAAmG;IACnG,+FAA+F;IAC/F,eAAe;IACf,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IAChG,CAAC;IAED,kEAAkE;IAClE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC,CAAC,4CAA4C;IAC9D,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAEnE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACxC,SAAS,EAAE,CAAC,CAAC,SAAgB;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAEhF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAQ3C;IACC,OAAO;QACL,WAAW,CACT,IAAI,CAAC,SAAS,CAAC,SAAS,EACxB,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CACrE;QACD,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpF,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;KACrG,CAAC;AACJ,CAAC;AA4CD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IAE3B,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,QAAQ,EAAE,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,yEAAyE;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IAChG,CAAC;IAED,+FAA+F;IAC/F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,oGAAoG;IACpG,8DAA8D;IAC9D,EAAE;IACF,gGAAgG;IAChG,oGAAoG;IACpG,kGAAkG;IAClG,8FAA8F;IAC9F,EAAE;IACF,iGAAiG;IACjG,qCAAqC;IACrC,MAAM,QAAQ,GAAG,eAAe,CAC9B,CAAC,CAAC,OAAmB,EACrB,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,EACxB,KAAK,CAAC,SAAS,EACf,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAE5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAEhD,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC,CAAC,4CAA4C;IAC9D,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAEnE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,MAAM;YACN,SAAS,EAAE,CAAC,CAAC,SAAgB;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAEhF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/onchain.d.ts

@@ -1,8 +1,44 @@
-import type { Hex, Address } from '@agenticprimitives/types';
-import type { TxContext } from './types';
-export declare function isRevoked(_hash: Hex, _opts: {
+import { type Hex, type Address } from 'viem';
+import type { Delegation } from './types.js';
+/**
+ * Validate a signature by `signer` over `digest`, connection-agnostically
+ * (spec 270 v4 / spec 287 §7). The verification primitive is selected by the
+ * signer's TYPE — a deterministic branch on whether the signer has code, NOT a
+ * try-strong-catch-weak fallback (ADR-0013):
+ *   - **EOA** (no code) → local ECDSA `recoverAddress` (the deployed
+ *     `UniversalSignatureValidator` reverts on bare EOAs, and a session-key
+ *     delegate is typically an EOA — same local-recover path `token.ts` uses for
+ *     the token's own session-key signature).
+ *   - **Contract** (has code) → on-chain `UniversalSignatureValidator.isValidSig`
+ *     (ERC-1271 deployed / ERC-6492 counterfactual) via one `eth_call`.
+ *
+ * Reusable signature surface (spec 287 injects this as the invocation-proof
+ * verifier). `readContract` only — no log scans (ADR-0012). Returns `false` on a
+ * recover/RPC error rather than throwing, so callers fail closed cleanly.
+ */
+export declare function verifyUniversalSignature(args: {
+    signer: Address;
+    digest: Hex;
+    signature: Hex;
+    rpcUrl: string;
+    universalSignatureValidator: Address;
+}): Promise<boolean>;
+/** Is this delegation hash revoked on-chain? The canonical, single mechanism (ADR-0013): reads the
+ *  DelegationManager's `_revoked` map. Returns `false` if absent — never escalates to a second path. */
+export declare function isRevoked(hash: Hex, opts: {
     delegationManager: Address;
     rpcUrl: string;
 }): Promise<boolean>;
-export declare function revokeDelegation(_hash: Hex, _ctx: TxContext): Promise<Hex>;
+/**
+ * Build the call that revokes a delegation on-chain: `DelegationManager.revokeDelegationByOwner(d)`.
+ * The caller (the delegator OR the delegate) submits this through their Smart Account's `execute`
+ * (this package owns delegation semantics, not tx/UserOp submission — agent-account/app layer does).
+ * Once mined, `isRevoked(hash)` is true and `redeemDelegation` reverts. The on-chain function
+ * re-verifies the delegation's signature, so a forged hash cannot be marked revoked.
+ */
+export declare function buildRevokeDelegationCall(delegation: Delegation, delegationManager: Address): {
+    to: Address;
+    value: bigint;
+    data: Hex;
+};
 //# sourceMappingURL=onchain.d.ts.map

package/dist/onchain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onchain.d.ts","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,wBAAsB,SAAS,CAC7B,KAAK,EAAE,GAAG,EACV,KAAK,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAIhF"}
+{"version":3,"file":"onchain.d.ts","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgE,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA2B7C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,GAAG,CAAC;IACZ,SAAS,EAAE,GAAG,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B,EAAE,OAAO,CAAC;CACtC,GAAG,OAAO,CAAC,OAAO,CAAC,CA6BnB;AAkCD;wGACwG;AACxG,wBAAsB,SAAS,CAC7B,IAAI,EAAE,GAAG,EACT,IAAI,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,OAAO,GACzB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CAgB3C"}

package/dist/onchain.js

@@ -1,9 +1,143 @@
-// On-chain revocation helpers. v0 demo doesn't exercise revocation (step 2
-// just packages a session). Stubs preserve the public-export surface.
-export async function isRevoked(_hash, _opts) {
-    throw new Error('isRevoked: not implemented in v0 demo step 2 (lands with demo step 3 / mcp-runtime commit).');
+// On-chain revocation helpers (spec 272 PAY-DEL-3). `isRevoked` is the read the x402 rail executor
+// MUST run before settling (off-chain check); the DelegationManager ALSO enforces revocation in
+// `redeemDelegation` (on-chain), so revocation is checked twice and is never off-chain-only.
+import { createPublicClient, http, encodeFunctionData, recoverAddress } from 'viem';
+const IS_REVOKED_ABI = [
+    {
+        type: 'function',
+        name: 'isRevoked',
+        stateMutability: 'view',
+        inputs: [{ name: 'delegationHash', type: 'bytes32' }],
+        outputs: [{ type: 'bool' }],
+    },
+];
+// spec 270 v4 — the one connection-agnostic signature surface (ERC-1271 / ERC-6492 / ECDSA).
+const UNIVERSAL_SIG_VALIDATOR_ABI = [
+    {
+        type: 'function',
+        name: 'isValidSig',
+        stateMutability: 'view',
+        inputs: [
+            { name: 'signer', type: 'address' },
+            { name: 'hash', type: 'bytes32' },
+            { name: 'sig', type: 'bytes' },
+        ],
+        outputs: [{ name: '', type: 'bool' }],
+    },
+];
+/**
+ * Validate a signature by `signer` over `digest`, connection-agnostically
+ * (spec 270 v4 / spec 287 §7). The verification primitive is selected by the
+ * signer's TYPE — a deterministic branch on whether the signer has code, NOT a
+ * try-strong-catch-weak fallback (ADR-0013):
+ *   - **EOA** (no code) → local ECDSA `recoverAddress` (the deployed
+ *     `UniversalSignatureValidator` reverts on bare EOAs, and a session-key
+ *     delegate is typically an EOA — same local-recover path `token.ts` uses for
+ *     the token's own session-key signature).
+ *   - **Contract** (has code) → on-chain `UniversalSignatureValidator.isValidSig`
+ *     (ERC-1271 deployed / ERC-6492 counterfactual) via one `eth_call`.
+ *
+ * Reusable signature surface (spec 287 injects this as the invocation-proof
+ * verifier). `readContract` only — no log scans (ADR-0012). Returns `false` on a
+ * recover/RPC error rather than throwing, so callers fail closed cleanly.
+ */
+export async function verifyUniversalSignature(args) {
+    const client = createPublicClient({ transport: http(args.rpcUrl) });
+    let code;
+    try {
+        code = await client.getCode({ address: args.signer });
+    }
+    catch {
+        return false;
+    }
+    const isContract = !!code && code !== '0x' && code.length > 2;
+    if (!isContract) {
+        // EOA signer → local ECDSA recovery.
+        try {
+            const recovered = await recoverAddress({ hash: args.digest, signature: args.signature });
+            return recovered.toLowerCase() === args.signer.toLowerCase();
+        }
+        catch {
+            return false;
+        }
+    }
+    // Contract signer → ERC-1271 / ERC-6492 via the on-chain validator.
+    try {
+        return (await client.readContract({
+            address: args.universalSignatureValidator,
+            abi: UNIVERSAL_SIG_VALIDATOR_ABI,
+            functionName: 'isValidSig',
+            args: [args.signer, args.digest, args.signature],
+        }));
+    }
+    catch {
+        return false;
+    }
 }
-export async function revokeDelegation(_hash, _ctx) {
-    throw new Error('revokeDelegation: not implemented in v0 demo step 2 (lands with on-chain redeem path).');
+// Matches IDelegationManager.Delegation / Caveat (enforcer, terms, args).
+const REVOKE_BY_OWNER_ABI = [
+    {
+        type: 'function',
+        name: 'revokeDelegationByOwner',
+        stateMutability: 'nonpayable',
+        inputs: [
+            {
+                name: 'delegation',
+                type: 'tuple',
+                components: [
+                    { name: 'delegator', type: 'address' },
+                    { name: 'delegate', type: 'address' },
+                    { name: 'authority', type: 'bytes32' },
+                    {
+                        name: 'caveats',
+                        type: 'tuple[]',
+                        components: [
+                            { name: 'enforcer', type: 'address' },
+                            { name: 'terms', type: 'bytes' },
+                            { name: 'args', type: 'bytes' },
+                        ],
+                    },
+                    { name: 'salt', type: 'uint256' },
+                    { name: 'signature', type: 'bytes' },
+                ],
+            },
+        ],
+        outputs: [],
+    },
+];
+/** Is this delegation hash revoked on-chain? The canonical, single mechanism (ADR-0013): reads the
+ *  DelegationManager's `_revoked` map. Returns `false` if absent — never escalates to a second path. */
+export async function isRevoked(hash, opts) {
+    const client = createPublicClient({ transport: http(opts.rpcUrl) });
+    return (await client.readContract({
+        address: opts.delegationManager,
+        abi: IS_REVOKED_ABI,
+        functionName: 'isRevoked',
+        args: [hash],
+    }));
+}
+/**
+ * Build the call that revokes a delegation on-chain: `DelegationManager.revokeDelegationByOwner(d)`.
+ * The caller (the delegator OR the delegate) submits this through their Smart Account's `execute`
+ * (this package owns delegation semantics, not tx/UserOp submission — agent-account/app layer does).
+ * Once mined, `isRevoked(hash)` is true and `redeemDelegation` reverts. The on-chain function
+ * re-verifies the delegation's signature, so a forged hash cannot be marked revoked.
+ */
+export function buildRevokeDelegationCall(delegation, delegationManager) {
+    const data = encodeFunctionData({
+        abi: REVOKE_BY_OWNER_ABI,
+        functionName: 'revokeDelegationByOwner',
+        args: [
+            {
+                delegator: delegation.delegator,
+                delegate: delegation.delegate,
+                authority: delegation.authority,
+                caveats: delegation.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, args: c.args ?? '0x' })),
+                salt: delegation.salt,
+                signature: delegation.signature,
+            },
+        ],
+    });
+    return { to: delegationManager, value: 0n, data };
 }
 //# sourceMappingURL=onchain.js.map

package/dist/onchain.js.map

@@ -1 +1 @@
-{"version":3,"file":"onchain.js","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,sEAAsE;AAKtE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAU,EACV,KAAqD;IAErD,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAU,EAAE,IAAe;IAChE,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"onchain.js","sourceRoot":"","sources":["../src/onchain.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAE7F,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAA0B,MAAM,MAAM,CAAC;AAG5G,MAAM,cAAc,GAAG;IACrB;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC5B;CACO,CAAC;AAEX,6FAA6F;AAC7F,MAAM,2BAA2B,GAAG;IAClC;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,YAAY;QAClB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;SAC/B;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACtC;CACO,CAAC;AAEX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAM9C;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACzF,OAAO,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,oEAAoE;IACpE,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,2BAA2B;YACzC,GAAG,EAAE,2BAA2B;YAChC,YAAY,EAAE,YAAY;YAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACjD,CAAC,CAAY,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG;IAC1B;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,yBAAyB;QAC/B,eAAe,EAAE,YAAY;QAC7B,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;oBACrC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;4BACrC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;4BAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;yBAChC;qBACF;oBACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;oBACjC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;iBACrC;aACF;SACF;QACD,OAAO,EAAE,EAAE;KACZ;CACO,CAAC;AAEX;wGACwG;AACxG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAS,EACT,IAAoD;IAEpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,iBAAiB;QAC/B,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAY,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAsB,EACtB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,kBAAkB,CAAC;QAC9B,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,yBAAyB;QACvC,IAAI,EAAE;YACJ;gBACE,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC;SACF;KACF,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC"}

package/dist/presentation-release.d.ts

@@ -0,0 +1,94 @@
+import type { Address, Delegation, Hex } from './types.js';
+import { type EnforcerAddresses, type MandateDecision, type SubsetHandlers } from './mandate.js';
+import type { MethodAuthorizationChecks } from './method-authorization.js';
+/** ES256 over a MESSAGE (hash inside), raw r||s low-S — key-custody's `JwsSignerPort`, structurally. `context` is the bound
+ *  evidence this release minted for the signature (a key-service key refuses without it; a local key ignores it). */
+export interface DeviceSignerLike {
+    sign(message: Uint8Array, context?: {
+        evidenceToken: string;
+        audience: string;
+    }): Promise<Uint8Array>;
+}
+/** WHAT THE RELEASE JUDGED, as facts a key service can hold the signature to (faithkms ADR-0012): the digest the key will
+ *  sign, the venue (the audience the challenge is bound to), the predicate program, and the actor the release acted for. */
+export interface BoundEvidenceFactsV1 {
+    digest: Hex;
+    venue: string;
+    predicateDigest: Hex;
+    subject: Address;
+}
+/** The claims a key service reads off the evidence statement — its wire names. */
+export declare const boundEvidenceClaims: (f: BoundEvidenceFactsV1) => {
+    digest: Hex;
+    venue: string;
+    predicate_digest: Hex;
+};
+/** Mints the evidence statement for ONE judged signature — the release calls it after `allow`, never before. */
+export type BoundEvidencePort = (facts: BoundEvidenceFactsV1) => Promise<{
+    evidenceToken: string;
+    audience: string;
+}>;
+/** A `BoundEvidencePort` over key-custody's `createEs256EvidenceMinter` (structurally: anything that `mint(subject, claims)`). */
+export declare const boundEvidenceFrom: (minter: {
+    mint(subject: string, claims: Record<string, string>): Promise<string>;
+}) => BoundEvidencePort;
+/** THE REASON a presentation mandate is bound to: the statement the person agreed her agent may prove. One intent per
+ *  (audience, predicate program, issuer facet); every challenge under it is the same reason, which is what makes the
+ *  wire standing within its window rather than a signature per nonce. */
+export interface PresentationIntentV1 {
+    type: 'PresentationIntentV1';
+    audience: string;
+    predicateDigest: Hex;
+    issuerKeyId: string;
+}
+export declare const presentationIntent: (i: {
+    audience: string;
+    predicateDigest: Hex;
+    issuerKeyId: string;
+}) => PresentationIntentV1;
+/** An audience-bound challenge: `<scheme>:<audience>:<nonce>`. The audience is everything between the first and the
+ *  last colon, so a URL audience with its own colon survives; the nonce never contains one. */
+export declare function parseAudienceBoundChallenge(message: Uint8Array): {
+    scheme: string;
+    audience: string;
+    nonce: string;
+} | null;
+export type PresentationRefusalCode = 'mandate-denied' | 'challenge-unbound' | 'audience-mismatch' | 'approval-required';
+export declare class PresentationReleaseRefused extends Error {
+    readonly code: PresentationRefusalCode;
+    readonly decision?: MandateDecision | undefined;
+    constructor(code: PresentationRefusalCode, message: string, decision?: MandateDecision | undefined);
+}
+export interface PresentationReleaseInput {
+    /** The mandate presented for THIS statement — a child derived from her standing wire (`deriveFromStanding`). */
+    mandate: Delegation;
+    /** The party asking: must be the mandate's delegate (the runtime's key). */
+    actor: Address;
+    enforcers: EnforcerAddresses;
+    checks: MethodAuthorizationChecks;
+    /** Injected clock, read per signature. */
+    now: () => number;
+    /** The custodied device key. */
+    signer: DeviceSignerLike;
+    /** The release's attestation of what it judged, handed to the key with each signature (required by a key-service key). */
+    evidence?: BoundEvidencePort;
+    handlers?: SubsetHandlers;
+    /** Every decision, allow or deny, with its evidence — the receipt's raw material. */
+    onDecision?: (d: {
+        step: PresentationStepV1;
+        decision: MandateDecision;
+    }) => void;
+}
+export interface PresentationStepV1 {
+    audience: string;
+    predicateDigest: Hex;
+    issuerKeyId: string;
+}
+export interface PresentationRelease {
+    /** Sign `message` for `step`, or refuse. `message` MUST be an audience-bound challenge whose audience is the step's. */
+    sign(step: PresentationStepV1, message: Uint8Array): Promise<Uint8Array>;
+    /** The judgement without the signature — for a dry run or a surface that previews what a wire allows. */
+    judge(step: PresentationStepV1): Promise<MandateDecision>;
+}
+export declare function createPresentationRelease(input: PresentationReleaseInput): PresentationRelease;
+//# sourceMappingURL=presentation-release.d.ts.map

package/dist/presentation-release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation-release.d.ts","sourceRoot":"","sources":["../src/presentation-release.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAwB,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACvH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAG3E;qHACqH;AACrH,MAAM,WAAW,gBAAgB;IAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE;AAE3I;4HAC4H;AAC5H,MAAM,WAAW,oBAAoB;IAAG,MAAM,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AAC5G,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,MAAO,oBAAoB,KAAG;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,GAAG,CAAA;CACM,CAAC;AACxH,gHAAgH;AAChH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACtH,kIAAkI;AAClI,eAAO,MAAM,iBAAiB,WAAY;IAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,KAAG,iBACI,CAAC;AAE5H;;yEAEyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,GAAG,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AACD,eAAO,MAAM,kBAAkB,MAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,KAAG,oBACuC,CAAC;AAEhJ;+FAC+F;AAC/F,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,UAAU,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM3H;AAED,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AACzH,qBAAa,0BAA2B,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,uBAAuB;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe;gBAAnF,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,eAAe,YAAA;CAIzG;AAED,MAAM,WAAW,wBAAwB;IACvC,gHAAgH;IAChH,OAAO,EAAE,UAAU,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,gCAAgC;IAChC,MAAM,EAAE,gBAAgB,CAAC;IACzB,0HAA0H;IAC1H,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,qFAAqF;IACrF,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,KAAK,IAAI,CAAC;CACnF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,GAAG,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,wHAAwH;IACxH,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,yGAAyG;IACzG,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC3D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAqC9F"}