@lemmaoracle/agent 0.0.23

package/README.md

@@ -0,0 +1,190 @@
+# @lemmaoracle/agent
+
+Agent Identity + Authority Credential schema for Lemma — implemented as a Rust WASM module with ZK identity-proof circuit.
+
+## Schema: `agent-identity-authority-v1`
+
+Represents a verifiable credential with these field groups:
+
+- **Identity**: `agentId`, `subjectId`, `controllerId`, `orgId`
+- **Authority**: `roles`, `scopes`, `permissions`
+- **Financial**: `spendLimit`, `currency`, `paymentPolicy`
+- **Lifecycle**: `issuedAt`, `expiresAt`, `revoked`, `revocationRef`
+- **Provenance**: `issuerId`, `sourceSystem`, `generatorId`, `chainContext`
+
+## Build
+
+```bash
+cd packages/agent
+pnpm build              # Build WASM via wasm-pack
+pnpm type-check         # Type-check registration scripts
+pnpm test               # Run Rust tests
+pnpm register           # Register schema with Lemma
+pnpm register:circuit   # Register circuit with Lemma
+```
+
+## Registration
+
+First build the WASM, then register with Lemma:
+
+```bash
+LEMMA_API_KEY=<key> PINATA_API_KEY=<key> PINATA_SECRET_API_KEY=<secret> pnpm register
+```
+
+## Usage with Lemma SDK
+
+The WASM schema is loaded and executed by the Lemma SDK's `define()` function, which:
+1. Downloads the WASM blob (from IPFS or HTTPS)
+2. Instantiates the wasm-bindgen JS shim
+3. Calls `normalize(input)` to canonicalize credential data
+4. Calls `validate(input)` for structural validation
+
+```typescript
+import { create, schemas } from "@lemmaoracle/sdk";
+
+const client = create({ apiBase: "...", apiKey: "..." });
+
+// Register the schema
+await schemas.register(client, {
+  id: "agent-identity-authority-v1",
+  description: "Agent Identity + Authority Credential",
+  normalize: {
+    artifact: { type: "ipfs", wasm: "ipfs://...", js: "ipfs://..." },
+    hash: "0x...",
+    abi: {
+      raw: { identity: "object", authority: "object", ... },
+      norm: { "identity.agentId": "string", ... },
+    },
+  },
+  metadata: { type: "agent-identity-authority", version: "1.0.0", ... },
+});
+```
+
+## Example Credential Payload
+
+```json
+{
+  "schema": "agent-identity-authority-v1",
+  "identity": {
+    "agentId": "did:example:agent-42",
+    "subjectId": "0x1234567890ABCDEF1234567890ABCDEF12345678",
+    "controllerId": "did:example:controller-1",
+    "orgId": "org:lemma-labs"
+  },
+  "authority": {
+    "roles": [
+      { "name": "operator" },
+      { "name": "validator" }
+    ],
+    "scopes": [
+      { "name": "read:data" },
+      { "name": "write:data" }
+    ],
+    "permissions": [
+      { "resource": "api", "action": "invoke" },
+      { "resource": "ledger", "action": "query" }
+    ]
+  },
+  "financial": {
+    "spendLimit": 10000,
+    "currency": "USD",
+    "paymentPolicy": "pre-authorized"
+  },
+  "lifecycle": {
+    "issuedAt": 1714000000,
+    "expiresAt": 1745536000,
+    "revoked": false,
+    "revocationRef": "rev-list:123"
+  },
+  "provenance": {
+    "issuerId": "did:example:issuer-org",
+    "sourceSystem": "lemma-admin",
+    "generatorId": "gen:v1.0",
+    "chainContext": {
+      "chainId": 8453,
+      "network": "base"
+    }
+  }
+}
+```
+
+## Example Normalized Output
+
+The `normalize` function canonicalizes all fields:
+
+```json
+{
+  "schema": "agent-identity-authority-v1",
+  "identity": {
+    "agentId": "did:example:agent-42",
+    "subjectId": "0x1234567890abcdef1234567890abcdef12345678",
+    "controllerId": "did:example:controller-1",
+    "orgId": "org:lemma-labs"
+  },
+  "authority": {
+    "roles": "operator,validator",
+    "scopes": "read:data,write:data",
+    "permissions": "api:invoke,ledger:query"
+  },
+  "financial": {
+    "spendLimit": "10000",
+    "currency": "USD",
+    "paymentPolicy": "pre-authorized"
+  },
+  "lifecycle": {
+    "issuedAt": "2024-04-25T01:46:40.000Z",
+    "expiresAt": "2025-04-25T01:46:40.000Z",
+    "revoked": "false",
+    "revocationRef": "rev-list:123"
+  },
+  "provenance": {
+    "issuerId": "did:example:issuer-org",
+    "sourceSystem": "lemma-admin",
+    "generatorId": "gen:v1.0",
+    "chainId": "8453",
+    "network": "base"
+  }
+}
+```
+
+## ZK Circuit: `agent-identity-v1`
+
+The `circuits/` directory contains the `agent-identity-v1` Groth16 circuit that proves an agent credential was issued by a trusted authority and is currently valid.
+
+**Circuit signals:**
+
+| Signal | Visibility | Description |
+| :--- | :--- | :--- |
+| `identityHash` | private | Poseidon hash of normalized identity fields |
+| `authorityHash` | private | Poseidon hash of normalized authority fields |
+| `financialHash` | private | Poseidon hash of normalized financial fields |
+| `lifecycleHash` | private | Poseidon hash of normalized lifecycle fields |
+| `provenanceHash` | private | Poseidon hash of normalized provenance fields |
+| `salt` | private | Binding randomness |
+| `issuerSecretKey` | private | Issuer's secret key for MAC verification |
+| `mac` | private | Issuer's MAC over the credentialCommitment |
+| `issuedAt` | private | Credential issuance timestamp |
+| `expiresAt` | private | Credential expiration (0 = none) |
+| `revoked` | private | Revocation flag (must be 0) |
+| `credentialCommitment` | **public** | Poseidon commitment binding all credential fields |
+| `issuerPublicKey` | **public** | Issuer's public key |
+| `nowSec` | **public** | Current unix timestamp |
+
+**Constraints:**
+1. `credentialCommitment = Poseidon6(identityHash, authorityHash, financialHash, lifecycleHash, provenanceHash, salt)`
+2. `issuerPublicKey = Poseidon1(issuerSecretKey)` — key derivation
+3. `mac = Poseidon2(credentialCommitment, issuerSecretKey)` — issuer signature
+4. `issuedAt <= nowSec` — credential has been issued
+5. `revoked === 0` — not revoked
+6. If `expiresAt != 0`: `nowSec < expiresAt` — not expired
+
+Build the circuit:
+
+```bash
+cd packages/agent/circuits
+npm run build
+```
+
+## License
+
+MIT

package/dist/commit.d.ts

@@ -0,0 +1,17 @@
+import type { LemmaClient } from "@lemmaoracle/spec";
+import type { AgentCredential, CommitOutput, NormalizedAgentCredential, SectionedCommitResult } from "./types.js";
+/**
+ * Compute the sectioned Poseidon commitment for a normalized credential.
+ *
+ * Pure function: groups fields into 5 sections, hashes each section via
+ * `toScalar(JSON.stringify(sectionObj))`, then computes the root as
+ * `poseidon([identityHash, authorityHash, financialHash, lifecycleHash,
+ * provenanceHash, saltScalar])`.
+ */
+export declare const computeCredentialCommitment: (normalized: NormalizedAgentCredential, salt?: string) => SectionedCommitResult;
+/**
+ * Normalize a credential via SDK `normalize`, then compute the sectioned
+ * Poseidon commitment matching `agent-identity.circom`.
+ */
+export declare const commit: (client: LemmaClient, credential: AgentCredential) => Promise<CommitOutput<NormalizedAgentCredential>>;
+//# sourceMappingURL=commit.d.ts.map

package/dist/commit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit.d.ts","sourceRoot":"","sources":["../src/commit.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EACZ,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AA+BpB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GACtC,YAAY,yBAAyB,EACrC,OAAO,MAAM,KACZ,qBAkCF,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,MAAM,GACjB,QAAQ,WAAW,EACnB,YAAY,eAAe,KAC1B,OAAO,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAejD,CAAC"}

package/dist/commit.js

@@ -0,0 +1,84 @@
+/**
+ * Sectioned Poseidon commitment for agent-identity.circom.
+ *
+ * Groups normalized fields into 5 sections (identity, authority, financial,
+ * lifecycle, provenance), computes each section hash as
+ * `toScalar(JSON.stringify(sectionObj))`, and computes the root as
+ * `poseidon([identityHash, authorityHash, financialHash, lifecycleHash,
+ * provenanceHash, saltScalar])`.
+ */
+import { randomBytes } from "node:crypto";
+import * as R from "ramda";
+import { poseidon6 } from "poseidon-lite";
+import { toScalar } from "@lemmaoracle/sdk";
+const SECTION_KEYS = [
+    "identityHash",
+    "authorityHash",
+    "financialHash",
+    "lifecycleHash",
+    "provenanceHash",
+];
+/** Extract a section object for hashing from the normalized credential. */
+const extractSection = (normalized, sectionKey) => {
+    const sectionMap = {
+        identityHash: normalized.identity,
+        authorityHash: normalized.authority,
+        financialHash: normalized.financial,
+        lifecycleHash: normalized.lifecycle,
+        provenanceHash: normalized.provenance,
+    };
+    return sectionMap[sectionKey] ?? {};
+};
+// ── computeCredentialCommitment ─────────────────────────────────────────
+/**
+ * Compute the sectioned Poseidon commitment for a normalized credential.
+ *
+ * Pure function: groups fields into 5 sections, hashes each section via
+ * `toScalar(JSON.stringify(sectionObj))`, then computes the root as
+ * `poseidon([identityHash, authorityHash, financialHash, lifecycleHash,
+ * provenanceHash, saltScalar])`.
+ */
+export const computeCredentialCommitment = (normalized, salt) => {
+    const saltHex = salt ?? randomBytes(32).toString("hex");
+    const saltScalar = BigInt(`0x${saltHex}`);
+    const sectionHashes = R.reduce((acc, key) => {
+        const sectionObj = extractSection(normalized, key);
+        const hash = toScalar(JSON.stringify(sectionObj));
+        return { ...acc, [key]: hash.toString() };
+    }, {}, SECTION_KEYS);
+    const identityHash = BigInt(sectionHashes.identityHash ?? "0");
+    const authorityHash = BigInt(sectionHashes.authorityHash ?? "0");
+    const financialHash = BigInt(sectionHashes.financialHash ?? "0");
+    const lifecycleHash = BigInt(sectionHashes.lifecycleHash ?? "0");
+    const provenanceHash = BigInt(sectionHashes.provenanceHash ?? "0");
+    const root = poseidon6([
+        identityHash,
+        authorityHash,
+        financialHash,
+        lifecycleHash,
+        provenanceHash,
+        saltScalar,
+    ]);
+    return {
+        root: root.toString(),
+        sectionHashes: sectionHashes,
+        salt: `0x${saltHex}`,
+    };
+};
+// ── commit ──────────────────────────────────────────────────────────────
+/**
+ * Normalize a credential via SDK `normalize`, then compute the sectioned
+ * Poseidon commitment matching `agent-identity.circom`.
+ */
+export const commit = async (client, credential) => {
+    const { normalize } = await import("@lemmaoracle/sdk");
+    const normalized = await normalize(client, { schema: credential.schema, payload: credential });
+    const commitment = computeCredentialCommitment(normalized);
+    return {
+        normalized,
+        root: commitment.root,
+        sectionHashes: commitment.sectionHashes,
+        salt: commitment.salt,
+    };
+};
+//# sourceMappingURL=commit.js.map

package/dist/commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit.js","sourceRoot":"","sources":["../src/commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAa5C,MAAM,YAAY,GAA8B;IAC9C,cAAc;IACd,eAAe;IACf,eAAe;IACf,eAAe;IACf,gBAAgB;CACjB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,cAAc,GAAG,CACrB,UAAqC,EACrC,UAAsB,EACG,EAAE;IAC3B,MAAM,UAAU,GAA0D;QACxE,YAAY,EAAE,UAAU,CAAC,QAA8C;QACvE,aAAa,EAAE,UAAU,CAAC,SAA+C;QACzE,aAAa,EAAE,UAAU,CAAC,SAA+C;QACzE,aAAa,EAAE,UAAU,CAAC,SAA+C;QACzE,cAAc,EAAE,UAAU,CAAC,UAAgD;KAC5E,CAAC;IACF,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC,CAAC;AAEF,2EAA2E;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,UAAqC,EACrC,IAAa,EACU,EAAE;IACzB,MAAM,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAC5B,CAAC,GAA2B,EAAE,GAAe,EAAE,EAAE;QAC/C,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QAClD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC,EACD,EAA4B,EAC5B,YAAY,CACb,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;IAEnE,MAAM,IAAI,GAAG,SAAS,CAAC;QACrB,YAAY;QACZ,aAAa;QACb,aAAa;QACb,aAAa;QACb,cAAc;QACd,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,aAAa,EAAE,aAAiD;QAChE,IAAI,EAAE,KAAK,OAAO,EAAE;KACrB,CAAC;AACJ,CAAC,CAAC;AAEF,2EAA2E;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,MAAmB,EACnB,UAA2B,EACuB,EAAE;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,SAAS,CAChC,MAAM,EACN,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CACnD,CAAC;IAEF,MAAM,UAAU,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAE3D,OAAO;QACL,UAAU;QACV,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,IAAI,EAAE,UAAU,CAAC,IAAI;KACtB,CAAC;AACJ,CAAC,CAAC"}

package/dist/credential.d.ts

@@ -0,0 +1,13 @@
+import type { AgentCredentialInput, CredentialOptions, ValidationResult } from "./types.js";
+/**
+ * Build a validated AgentCredential from partial input.
+ *
+ * Defaults:
+ * - `schema` from `options.schemaId ?? "agent-identity-authority-v1"`
+ * - `issuedAt` from `Math.floor(Date.now() / 1000)`
+ * - `currency` from `"USD"`
+ * - Empty arrays for scopes/permissions
+ * - Empty strings for optional provenance fields
+ */
+export declare const credential: (input: AgentCredentialInput, options?: CredentialOptions) => ValidationResult;
+//# sourceMappingURL=credential.d.ts.map

package/dist/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,GACrB,OAAO,oBAAoB,EAC3B,UAAU,iBAAiB,KAC1B,gBAwCF,CAAC"}

package/dist/credential.js

@@ -0,0 +1,59 @@
+/**
+ * Credential factory — builds a validated AgentCredential from partial input.
+ *
+ * Fills defaults to produce output that, when normalized, yields deterministic
+ * results matching WASM normalization behavior.
+ */
+import * as R from "ramda";
+import { validate } from "./validate.js";
+const DEFAULT_SCHEMA_ID = "agent-identity-authority-v1";
+/**
+ * Build a validated AgentCredential from partial input.
+ *
+ * Defaults:
+ * - `schema` from `options.schemaId ?? "agent-identity-authority-v1"`
+ * - `issuedAt` from `Math.floor(Date.now() / 1000)`
+ * - `currency` from `"USD"`
+ * - Empty arrays for scopes/permissions
+ * - Empty strings for optional provenance fields
+ */
+export const credential = (input, options) => {
+    const schemaId = options?.schemaId ?? DEFAULT_SCHEMA_ID;
+    const issuedAt = input.issuedAt ?? Math.floor(Date.now() / 1000);
+    const credentialObj = {
+        schema: schemaId,
+        identity: {
+            agentId: input.agentId,
+            subjectId: input.subjectId,
+            controllerId: input.controllerId ?? "",
+            orgId: input.orgId ?? "",
+        },
+        authority: {
+            roles: R.map((name) => ({ name }), input.roles),
+            scopes: R.map((name) => ({ name }), input.scopes ?? []),
+            permissions: input.permissions ?? [],
+        },
+        financial: {
+            spendLimit: input.spendLimit,
+            currency: input.currency ?? "USD",
+            paymentPolicy: input.paymentPolicy ?? "",
+        },
+        lifecycle: {
+            issuedAt,
+            expiresAt: input.expiresAt,
+            revoked: input.revoked,
+            revocationRef: input.revocationRef ?? "",
+        },
+        provenance: {
+            issuerId: input.issuerId,
+            sourceSystem: input.sourceSystem ?? "",
+            generatorId: input.generatorId ?? "",
+            chainContext: {
+                chainId: input.chainId,
+                network: input.network ?? "",
+            },
+        },
+    };
+    return validate(credentialObj, options);
+};
+//# sourceMappingURL=credential.js.map

package/dist/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAO3B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAA2B,EAC3B,OAA2B,EACT,EAAE;IACpB,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAoB;QACrC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE;YACR,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;SACzB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;YACvD,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;SACrC;QACD,SAAS,EAAE;YACT,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;YACjC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;SACzC;QACD,SAAS,EAAE;YACT,QAAQ;YACR,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;SACzC;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YACpC,YAAY,EAAE;gBACZ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;aAC7B;SACF;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @lemmaoracle/agent — Public API surface.
+ *
+ * Agent Identity & Authority Credential types, validation, and commitment.
+ */
+export type { AgentIdentity, AgentAuthority, AgentFinancial, AgentLifecycle, AgentProvenance, ChainContext, Role, Scope, Permission, AgentCredential, AgentCredentialInput, NormalizedIdentity, NormalizedAuthority, NormalizedFinancial, NormalizedLifecycle, NormalizedProvenance, NormalizedAgentCredential, ValidationError, ValidationErrorKind, ValidationResult, CredentialOptions, SectionedCommitResult, CommitOutput, } from "./types.js";
+export { credential } from "./credential.js";
+export { validate, validateRequiredFields, validateSpendLimit, validateCurrency, validateTimestamps, validateProvenance } from "./validate.js";
+export { computeCredentialCommitment, commit } from "./commit.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,EACZ,IAAI,EACJ,KAAK,EACL,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/I,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+/**
+ * @lemmaoracle/agent — Public API surface.
+ *
+ * Agent Identity & Authority Credential types, validation, and commitment.
+ */
+// Functions
+export { credential } from "./credential.js";
+export { validate, validateRequiredFields, validateSpendLimit, validateCurrency, validateTimestamps, validateProvenance } from "./validate.js";
+export { computeCredentialCommitment, commit } from "./commit.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA6BH,YAAY;AACZ,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/I,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,213 @@
+/**
+ * @lemmaoracle/agent — Type definitions for Agent Identity & Authority Credentials.
+ *
+ * Schema ID: agent-identity-authority-v1
+ * Source: https://github.com/lemmaoracle/lemma
+ */
+/** @see agent-identity-authority-v1 → identity */
+export type AgentIdentity = Readonly<{
+    /** @see identity.agentId — unique agent identifier */
+    agentId: string;
+    /** @see identity.subjectId — subject the agent acts on behalf of */
+    subjectId: string;
+    /** @see identity.controllerId — optional controller of the agent */
+    controllerId?: string;
+    /** @see identity.orgId — optional organisation the agent belongs to */
+    orgId?: string;
+}>;
+/** @see agent-identity-authority-v1 → authority.roles[] */
+export type Role = Readonly<{
+    name: string;
+}>;
+/** @see agent-identity-authority-v1 → authority.scopes[] */
+export type Scope = Readonly<{
+    name: string;
+}>;
+/** @see agent-identity-authority-v1 → authority.permissions[] */
+export type Permission = Readonly<{
+    resource: string;
+    action: string;
+}>;
+/** @see agent-identity-authority-v1 → authority */
+export type AgentAuthority = Readonly<{
+    /** @see authority.roles — at least one role required */
+    roles: ReadonlyArray<Role>;
+    /** @see authority.scopes */
+    scopes: ReadonlyArray<Scope>;
+    /** @see authority.permissions */
+    permissions: ReadonlyArray<Permission>;
+}>;
+/** @see agent-identity-authority-v1 → financial */
+export type AgentFinancial = Readonly<{
+    /** @see financial.spendLimit — u64, max 1 000 000 000 000 */
+    spendLimit?: number;
+    /** @see financial.currency — 3-letter uppercase ISO 4217 */
+    currency?: string;
+    /** @see financial.paymentPolicy */
+    paymentPolicy?: string;
+}>;
+/** @see agent-identity-authority-v1 → lifecycle */
+export type AgentLifecycle = Readonly<{
+    /** @see lifecycle.issuedAt — epoch seconds, u64 */
+    issuedAt: number;
+    /** @see lifecycle.expiresAt — epoch seconds, u64, must be > issuedAt */
+    expiresAt?: number;
+    /** @see lifecycle.revoked */
+    revoked?: boolean;
+    /** @see lifecycle.revocationRef */
+    revocationRef?: string;
+}>;
+/** @see agent-identity-authority-v1 → provenance.chainContext */
+export type ChainContext = Readonly<{
+    /** @see provenance.chainContext.chainId — u64 */
+    chainId?: number;
+    /** @see provenance.chainContext.network */
+    network?: string;
+}>;
+/** @see agent-identity-authority-v1 → provenance */
+export type AgentProvenance = Readonly<{
+    /** @see provenance.issuerId — required */
+    issuerId: string;
+    /** @see provenance.sourceSystem */
+    sourceSystem?: string;
+    /** @see provenance.generatorId */
+    generatorId?: string;
+    /** @see provenance.chainContext */
+    chainContext?: ChainContext;
+}>;
+/**
+ * Canonical Agent Credential type aligned to `agent-identity-authority-v1` schema ABI.
+ *
+ * All fields from `abi.raw` and `abi.norm` with JSDoc referencing schema ID
+ * and source repository at https://github.com/lemmaoracle/lemma.
+ *
+ * @see agent-identity-authority-v1
+ */
+export type AgentCredential = Readonly<{
+    /** Schema identifier, e.g. "agent-identity-authority-v1" */
+    schema: string;
+    /** @see identity */
+    identity: AgentIdentity;
+    /** @see authority */
+    authority: AgentAuthority;
+    /** @see financial — optional section */
+    financial?: AgentFinancial;
+    /** @see lifecycle */
+    lifecycle: AgentLifecycle;
+    /** @see provenance */
+    provenance: AgentProvenance;
+}>;
+/**
+ * Partial input for the `credential()` factory.
+ * Only `agentId`, `subjectId`, `roles`, and `issuerId` are required;
+ * all other fields default automatically.
+ */
+export type AgentCredentialInput = Readonly<{
+    agentId: string;
+    subjectId: string;
+    roles: ReadonlyArray<string>;
+    issuerId: string;
+    controllerId?: string;
+    orgId?: string;
+    scopes?: ReadonlyArray<string>;
+    permissions?: ReadonlyArray<Permission>;
+    spendLimit?: number;
+    currency?: string;
+    paymentPolicy?: string;
+    issuedAt?: number;
+    expiresAt?: number;
+    revoked?: boolean;
+    revocationRef?: string;
+    sourceSystem?: string;
+    generatorId?: string;
+    chainId?: number;
+    network?: string;
+}>;
+/** @see NormalizedAgentCredential.identity */
+export type NormalizedIdentity = Readonly<{
+    agentId: string;
+    subjectId: string;
+    controllerId: string;
+    orgId: string;
+}>;
+/** @see NormalizedAgentCredential.authority */
+export type NormalizedAuthority = Readonly<{
+    roles: string;
+    scopes: string;
+    permissions: string;
+}>;
+/** @see NormalizedAgentCredential.financial */
+export type NormalizedFinancial = Readonly<{
+    spendLimit: string;
+    currency: string;
+    paymentPolicy: string;
+}>;
+/** @see NormalizedAgentCredential.lifecycle */
+export type NormalizedLifecycle = Readonly<{
+    issuedAt: string;
+    expiresAt: string;
+    revoked: string;
+    revocationRef: string;
+}>;
+/** @see NormalizedAgentCredential.provenance */
+export type NormalizedProvenance = Readonly<{
+    issuerId: string;
+    sourceSystem: string;
+    generatorId: string;
+    chainId: string;
+    network: string;
+}>;
+/**
+ * Normalized Agent Credential matching the WASM's `NormalizedAgentCredential`
+ * output structure.
+ *
+ * @see agent-identity-authority-v1 → abi.norm
+ */
+export type NormalizedAgentCredential = Readonly<{
+    schema: string;
+    identity: NormalizedIdentity;
+    authority: NormalizedAuthority;
+    financial: NormalizedFinancial;
+    lifecycle: NormalizedLifecycle;
+    provenance: NormalizedProvenance;
+}>;
+/** Error kinds matching the WASM's ValidationError enum. */
+export type ValidationErrorKind = "EmptyAgentId" | "EmptySubjectId" | "EmptyRoles" | "SpendLimitExceeded" | "InvalidCurrency" | "InvalidTimestamp" | "EmptyIssuerId" | "InvalidSchema";
+/** Tagged union for validation errors. */
+export type ValidationError = Readonly<{
+    kind: ValidationErrorKind;
+    message: string;
+}>;
+/**
+ * Discriminated union for validation results.
+ * - `{ valid: true, credential }` on success
+ * - `{ valid: false, errors }` on failure
+ */
+export type ValidationResult = Readonly<{
+    valid: true;
+    credential: AgentCredential;
+}> | Readonly<{
+    valid: false;
+    errors: ReadonlyArray<ValidationError>;
+}>;
+/** Optional configuration for `credential()` and `validate()`. */
+export type CredentialOptions = Readonly<{
+    schemaId?: string;
+}>;
+/** Result of computing a sectioned Poseidon commitment. */
+export type SectionedCommitResult = Readonly<{
+    /** Top-level Poseidon commitment (= credentialCommitment in agent-identity.circom) */
+    root: string;
+    /** Per-section hashes keyed by section name */
+    sectionHashes: Readonly<Record<string, string>>;
+    /** Binding salt */
+    salt: string;
+}>;
+/** Full output of `commit()` including normalized data. */
+export type CommitOutput<Norm = NormalizedAgentCredential> = Readonly<{
+    normalized: Norm;
+    root: string;
+    sectionHashes: Readonly<Record<string, string>>;
+    salt: string;
+}>;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,kDAAkD;AAClD,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAIH,2DAA2D;AAC3D,MAAM,MAAM,IAAI,GAAG,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH,4DAA4D;AAC5D,MAAM,MAAM,KAAK,GAAG,QAAQ,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,mDAAmD;AACnD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACpC,wDAAwD;IACxD,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,4BAA4B;IAC5B,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,iCAAiC;IACjC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACxC,CAAC,CAAC;AAIH,mDAAmD;AACnD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACpC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAIH,mDAAmD;AACnD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IACpC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAIH,iEAAiE;AACjE,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,QAAQ,EAAE,aAAa,CAAC;IACxB,qBAAqB;IACrB,SAAS,EAAE,cAAc,CAAC;IAC1B,wCAAwC;IACxC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,qBAAqB;IACrB,SAAS,EAAE,cAAc,CAAC;IAC1B,sBAAsB;IACtB,UAAU,EAAE,eAAe,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAIH,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,UAAU,EAAE,oBAAoB,CAAC;CAClC,CAAC,CAAC;AAIH,4DAA4D;AAC5D,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,eAAe,GACf,eAAe,CAAC;AAEpB,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB,QAAQ,CAAC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,CAAC,GACtD,QAAQ,CAAC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;CAAE,CAAC,CAAC;AAIvE,kEAAkE;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAIH,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,MAAM,YAAY,CAAC,IAAI,GAAG,yBAAyB,IAAI,QAAQ,CAAC;IACpE,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC"}

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * @lemmaoracle/agent — Type definitions for Agent Identity & Authority Credentials.
+ *
+ * Schema ID: agent-identity-authority-v1
+ * Source: https://github.com/lemmaoracle/lemma
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}