@orangecheck/agent-anthropic 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OrangeCheck
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,97 @@
+# @orangecheck/agent-anthropic
+
+Wrap [Anthropic Tool Use](https://docs.anthropic.com/en/docs/build-with-claude/tool-use) (Claude `tool_use` blocks) with [OC Agent](https://github.com/orangecheck/oc-agent-protocol) scope enforcement and emit a signed `agent-action` envelope per tool execution.
+
+## Why
+
+Claude's tool-use API exposes a list of tools and produces structured `tool_use` content blocks. The MCP wire format has no native notion of "who authorized this invocation" beyond the transport layer's authentication. For anything consequential — sending email, moving sats, committing code — the handler running underneath should be able to verify:
+
+1. **Which principal stands behind this agent.** A Bitcoin address, not an opaque API key.
+2. **What scope authorizes this specific tool call.** A declarative string like `anthropic:tool(name=invoice.create)`.
+3. **That the agent hasn't exceeded its grant.** Automatic via OC Agent's sub-scope algorithm.
+4. **That the invocation happened before any revocation.** Optional OC Stamp anchoring.
+
+`@orangecheck/agent-anthropic` canonicalizes the `(id, name, input)` tuple, hashes it, and stamps the hash as an `agent-action`. Your handler — or any downstream auditor — sees a verifiable authority artifact alongside the call itself.
+
+## Status
+
+**v0.0.1 · in design.** API shape is stable; the package is published to give integrators something to build against. Production wiring (per-event streaming-API integration with `@anthropic-ai/sdk` v0.45+) lands when the first design partner names the integration. Until then this module is the canonical, transport-agnostic core; you call it from your existing Anthropic-SDK glue.
+
+## Install
+
+```bash
+npm i @orangecheck/agent-anthropic
+# peer deps:
+npm i @orangecheck/agent-core @orangecheck/agent-signer
+```
+
+## Quickstart
+
+```ts
+import { invokeWithStamp } from '@orangecheck/agent-anthropic';
+
+// You already have a SignerRef and a DelegationEnvelope from
+// @orangecheck/agent-signer. The delegation grants something like
+//   anthropic:tool(name=invoice.create)
+
+const { result, action } = await invokeWithStamp({
+    agent,
+    delegation,
+    toolUse: {
+        id:    'toolu_01abc...',
+        name:  'invoice.create',
+        input: { customer: 'acme', amount: 14.20 },
+    },
+    call: async (t) => myInvoiceCreateImpl(t.input),
+});
+
+// `result` goes back to Claude as the tool_result content block.
+// `action` is the signed envelope; ship it alongside the result, publish
+// to Nostr kind 30084, anchor through the OC Stamp pipeline, etc.
+```
+
+## What gets stamped
+
+The stamp's `content.hash` is a SHA-256 of the RFC-8785-canonicalized JSON:
+
+```json
+{
+  "id":    "<tool_use_id>",
+  "input": <canonical-json of toolUse.input>,
+  "name":  "<tool name>"
+}
+```
+
+This shape is minimal by design — a verifier reconstructs it from the three fields without knowing anything Anthropic-SDK-specific.
+
+The action's `scope_exercised` defaults to `anthropic:tool(name=<tool>)`, which is the tightest scope that exactly identifies the call. Callers who want a narrower scope can pass `scopeExercised` explicitly; `stampToolUse` pre-flights sub-scope containment against the delegation.
+
+## API
+
+### `canonicalizeToolUse(toolUse) -> Uint8Array`
+
+RFC 8785 JSON canonicalization of `{id, name, input}`. Byte-identical across implementations.
+
+### `toolUseHash(toolUse) -> "sha256:<64-hex>"`
+
+SHA-256 of the canonical bytes, prefixed for the envelope's `content.hash`.
+
+### `stampToolUse(input) -> Promise<ActionEnvelope>`
+
+Produces a signed `agent-action` without executing the tool. Useful for pre-authorization flows or batch stamping.
+
+### `invokeWithStamp(input) -> Promise<{ result, action }>`
+
+Stamp first, then execute the tool. Returns both.
+
+## License
+
+MIT.
+
+## Related
+
+- [oc-agent-protocol](https://github.com/orangecheck/oc-agent-protocol) — normative wire format.
+- [@orangecheck/agent-core](https://www.npmjs.com/package/@orangecheck/agent-core) — verifier library.
+- [@orangecheck/agent-mcp](https://www.npmjs.com/package/@orangecheck/agent-mcp) — same pattern, for MCP.
+- [@orangecheck/agent-openai](https://www.npmjs.com/package/@orangecheck/agent-openai) — same pattern, for OpenAI Responses + Chat Completions.
+- [console.ochk.io/integrations/anthropic](https://console.ochk.io/integrations/anthropic) — the managed-tier story this slots into.

package/dist/index.d.mts

@@ -0,0 +1,48 @@
+import { DelegationEnvelope } from '@orangecheck/agent-core';
+import { SignerRef, ActionEnvelope } from '@orangecheck/agent-signer';
+
+interface AnthropicToolUse {
+    id: string;
+    name: string;
+    input: Record<string, unknown>;
+}
+declare function canonicalizeToolUse(t: AnthropicToolUse): Uint8Array;
+declare function toolUseHash(t: AnthropicToolUse): string;
+declare function toolUseId(agentAddress: string, signedAt: string, delegationId: string, scopeExercised: string, t: AnthropicToolUse): string;
+interface StampToolUseInput {
+    agent: SignerRef;
+    delegation: DelegationEnvelope;
+    toolUse: AnthropicToolUse;
+    scopeExercised?: string;
+    signedAt?: Date;
+}
+declare function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope>;
+interface InvokeWithStampInput<T> extends StampToolUseInput {
+    call: (toolUse: AnthropicToolUse) => Promise<T>;
+}
+interface InvokeWithStampResult<T> {
+    result: T;
+    action: ActionEnvelope;
+}
+declare function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>>;
+interface ConsoleClient {
+    baseUrl?: string;
+    apiToken: string;
+    projectId: string;
+    fetch?: typeof fetch;
+}
+interface PostActionResult {
+    id: string;
+    project_id: string;
+    delegation_id: string;
+}
+declare function postActionToConsole(action: ActionEnvelope, client: ConsoleClient): Promise<PostActionResult>;
+interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
+    console?: ConsoleClient;
+}
+interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
+    posted: PostActionResult | null;
+}
+declare function invokeWithStampAndPost<T>(input: InvokeWithStampAndPostInput<T>): Promise<InvokeWithStampAndPostResult<T>>;
+
+export { type AnthropicToolUse, type ConsoleClient, type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type PostActionResult, type StampToolUseInput, canonicalizeToolUse, invokeWithStamp, invokeWithStampAndPost, postActionToConsole, stampToolUse, toolUseHash, toolUseId };

package/dist/index.d.ts

@@ -0,0 +1,48 @@
+import { DelegationEnvelope } from '@orangecheck/agent-core';
+import { SignerRef, ActionEnvelope } from '@orangecheck/agent-signer';
+
+interface AnthropicToolUse {
+    id: string;
+    name: string;
+    input: Record<string, unknown>;
+}
+declare function canonicalizeToolUse(t: AnthropicToolUse): Uint8Array;
+declare function toolUseHash(t: AnthropicToolUse): string;
+declare function toolUseId(agentAddress: string, signedAt: string, delegationId: string, scopeExercised: string, t: AnthropicToolUse): string;
+interface StampToolUseInput {
+    agent: SignerRef;
+    delegation: DelegationEnvelope;
+    toolUse: AnthropicToolUse;
+    scopeExercised?: string;
+    signedAt?: Date;
+}
+declare function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope>;
+interface InvokeWithStampInput<T> extends StampToolUseInput {
+    call: (toolUse: AnthropicToolUse) => Promise<T>;
+}
+interface InvokeWithStampResult<T> {
+    result: T;
+    action: ActionEnvelope;
+}
+declare function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>>;
+interface ConsoleClient {
+    baseUrl?: string;
+    apiToken: string;
+    projectId: string;
+    fetch?: typeof fetch;
+}
+interface PostActionResult {
+    id: string;
+    project_id: string;
+    delegation_id: string;
+}
+declare function postActionToConsole(action: ActionEnvelope, client: ConsoleClient): Promise<PostActionResult>;
+interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
+    console?: ConsoleClient;
+}
+interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
+    posted: PostActionResult | null;
+}
+declare function invokeWithStampAndPost<T>(input: InvokeWithStampAndPostInput<T>): Promise<InvokeWithStampAndPostResult<T>>;
+
+export { type AnthropicToolUse, type ConsoleClient, type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type PostActionResult, type StampToolUseInput, canonicalizeToolUse, invokeWithStamp, invokeWithStampAndPost, postActionToConsole, stampToolUse, toolUseHash, toolUseId };

package/dist/index.js

@@ -0,0 +1,111 @@
+'use strict';
+
+var sha256 = require('@noble/hashes/sha256');
+var agentCore = require('@orangecheck/agent-core');
+var agentSigner = require('@orangecheck/agent-signer');
+
+// src/index.ts
+function canonicalizeToolUse(t) {
+  const canon = {
+    id: t.id,
+    input: t.input,
+    name: t.name
+  };
+  const str = agentCore.canonicalize(canon);
+  return new TextEncoder().encode(str + "\n");
+}
+function toolUseHash(t) {
+  return "sha256:" + agentCore.hexEncode(sha256.sha256(canonicalizeToolUse(t)));
+}
+function toolUseId(agentAddress, signedAt, delegationId, scopeExercised, t) {
+  return agentCore.computeActionId({
+    address: agentAddress,
+    content_hash: toolUseHash(t),
+    content_length: canonicalizeToolUse(t).byteLength,
+    content_mime: "application/vnd.oc-agent.anthropic-tool-use+json",
+    signed_at: signedAt,
+    delegation_id: delegationId,
+    scope_exercised: scopeExercised
+  });
+}
+async function stampToolUse(input) {
+  const scopeExercised = input.scopeExercised ?? `anthropic:tool(name=${input.toolUse.name})`;
+  const granted = (input.delegation.scopes ?? []).map(agentCore.parseScope);
+  const exercisedParsed = agentCore.parseScope(scopeExercised);
+  if (!granted.some((g) => agentCore.isSubScope(exercisedParsed, g))) {
+    throw new Error(
+      `stampToolUse: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
+    );
+  }
+  const bytes = canonicalizeToolUse(input.toolUse);
+  return agentSigner.signAsAgent({
+    agent: input.agent,
+    delegation: input.delegation,
+    content: { hash: toolUseHash(input.toolUse), length: bytes.byteLength },
+    mime: "application/vnd.oc-agent.anthropic-tool-use+json",
+    scopeExercised,
+    signedAt: input.signedAt
+  });
+}
+async function invokeWithStamp(input) {
+  const action = await stampToolUse(input);
+  const result = await input.call(input.toolUse);
+  return { result, action };
+}
+async function postActionToConsole(action, client) {
+  const baseUrl = client.baseUrl ?? "https://console.ochk.io";
+  const f = client.fetch ?? fetch;
+  const body = {
+    project_id: client.projectId,
+    delegation_id: action.delegation_id,
+    agent_address: action.signer.address,
+    scope_exercised: action.scope_exercised,
+    content_hash: action.content.hash,
+    content_length: action.content.length,
+    content_mime: action.content.mime,
+    signed_at: action.signed_at,
+    signature: action.sig.value,
+    id: action.id
+  };
+  const r = await f(`${baseUrl}/api/actions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${client.apiToken}`
+    },
+    body: JSON.stringify(body)
+  });
+  if (!r.ok) {
+    let reason = `http_${r.status}`;
+    try {
+      const j2 = await r.json();
+      if (j2.reason) reason = j2.reason;
+    } catch {
+    }
+    throw new Error(`postActionToConsole failed: ${reason}`);
+  }
+  const j = await r.json();
+  return j.action;
+}
+async function invokeWithStampAndPost(input) {
+  const { result, action } = await invokeWithStamp(input);
+  let posted = null;
+  if (input.console) {
+    try {
+      posted = await postActionToConsole(action, input.console);
+    } catch (err) {
+      console.error("[oc-agent-anthropic] postActionToConsole failed:", err);
+    }
+  }
+  return { result, action, posted };
+}
+
+exports.canonicalizeToolUse = canonicalizeToolUse;
+exports.invokeWithStamp = invokeWithStamp;
+exports.invokeWithStampAndPost = invokeWithStampAndPost;
+exports.postActionToConsole = postActionToConsole;
+exports.stampToolUse = stampToolUse;
+exports.toolUseHash = toolUseHash;
+exports.toolUseId = toolUseId;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","parseScope","isSubScope","signAsAgent","j"],"mappings":";;;;;;;AAgDO,SAAS,oBAAoB,CAAA,EAAiC;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,YAAY,CAAA,EAA6B;AACrD,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,mBAAA,CAAoB,CAAC,CAAC,CAAC,CAAA;AAC/D;AAEO,SAAS,SAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,YAAY,CAAC,CAAA;AAAA,IAC3B,cAAA,EAAgB,mBAAA,CAAoB,CAAC,CAAA,CAAE,UAAA;AAAA,IACvC,YAAA,EAAc,kDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAmBA,eAAsB,aAAa,KAAA,EAAmD;AAClF,EAAA,MAAM,iBACF,KAAA,CAAM,cAAA,IAAkB,CAAA,oBAAA,EAAuB,KAAA,CAAM,QAAQ,IAAI,CAAA,CAAA,CAAA;AAErE,EAAA,MAAM,WAAW,KAAA,CAAM,UAAA,CAAW,UAAU,EAAC,EAAG,IAAIC,oBAAU,CAAA;AAC9D,EAAA,MAAM,eAAA,GAAkBA,qBAAW,cAAc,CAAA;AACjD,EAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,CAAC,MAAMC,oBAAA,CAAW,eAAA,EAAiB,CAAC,CAAC,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,kCAAkC,cAAc,CAAA,yCAAA;AAAA,KACpD;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,KAAA,CAAM,OAAO,CAAA;AAC/C,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,CAAY,MAAM,OAAO,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACtE,IAAA,EAAM,kDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAsBA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,KAAK,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,OAAO,CAAA;AAC7C,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B;AAoCA,eAAsB,mBAAA,CAClB,QACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,IAAW,yBAAA;AAClC,EAAA,MAAM,CAAA,GAAI,OAAO,KAAA,IAAS,KAAA;AAC1B,EAAA,MAAM,IAAA,GAAO;AAAA,IACT,YAAY,MAAA,CAAO,SAAA;AAAA,IACnB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,aAAA,EAAe,OAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,iBAAiB,MAAA,CAAO,eAAA;AAAA,IACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,cAAA,EAAgB,OAAO,OAAA,CAAQ,MAAA;AAAA,IAC/B,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAA,EAAW,OAAO,GAAA,CAAI,KAAA;AAAA,IACtB,IAAI,MAAA,CAAO;AAAA,GACf;AACA,EAAA,MAAM,CAAA,GAAI,MAAM,CAAA,CAAE,CAAA,EAAG,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,IACxC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,GAC5B,CAAA;AACD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI;AACP,IAAA,IAAI,MAAA,GAAS,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAA;AAC7B,IAAA,IAAI;AACA,MAAA,MAAMC,EAAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,MAAA,IAAIA,EAAAA,CAAE,MAAA,EAAQ,MAAA,GAASA,EAAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,MAAM,CAAA,CAAE,CAAA;AAAA,EAC3D;AACA,EAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,EAAA,OAAO,CAAA,CAAE,MAAA;AACb;AAsBA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAM,gBAAgB,KAAK,CAAA;AACtD,EAAA,IAAI,MAAA,GAAkC,IAAA;AACtC,EAAA,IAAI,MAAM,OAAA,EAAS;AACf,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAM,mBAAA,CAAoB,MAAA,EAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,IAC5D,SAAS,GAAA,EAAK;AAKV,MAAA,OAAA,CAAQ,KAAA,CAAM,oDAAoD,GAAG,CAAA;AAAA,IACzE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAO;AACpC","file":"index.js","sourcesContent":["// @orangecheck/agent-anthropic — wrap Anthropic Tool Use invocations in\n// OC Agent action envelopes.\n//\n// Anthropic's Messages API surfaces tool calls as `tool_use` content\n// blocks: { type: 'tool_use', id, name, input }. This module canonicalizes\n// each tool_use, hashes it, and produces an agent-action envelope binding\n// the BIP-322-authenticated agent to the (tool_name, input) tuple — at a\n// scope of `anthropic:tool(name=<tool>)`.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    isSubScope,\n    parseScope,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an Anthropic tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AnthropicToolUse {\n    /** The `id` Anthropic assigns to this tool_use block (passed back as tool_use_id on result). */\n    id: string;\n    /** The tool name registered in your `tools` array on messages.create. */\n    name: string;\n    /** The model's structured input for this tool — JSON-serializable. */\n    input: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an Anthropic tool_use. The bytes are what\n * the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n *   {\n *     \"id\":    <tool_use_id>,\n *     \"input\": <canonical JSON of input>,\n *     \"name\":  <tool name>\n *   }\n */\nexport function canonicalizeToolUse(t: AnthropicToolUse): Uint8Array {\n    const canon = {\n        id: t.id,\n        input: t.input,\n        name: t.name,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolUseHash(t: AnthropicToolUse): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeToolUse(t)));\n}\n\nexport function toolUseId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    t: AnthropicToolUse\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: toolUseHash(t),\n        content_length: canonicalizeToolUse(t).byteLength,\n        content_mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampToolUseInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    toolUse: AnthropicToolUse;\n    /** Defaults to `anthropic:tool(name=<tool>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\n/**\n * Stamp an Anthropic tool_use without executing it. Useful for pre-\n * authorization flows or batch stamping.\n */\nexport async function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope> {\n    const scopeExercised =\n        input.scopeExercised ?? `anthropic:tool(name=${input.toolUse.name})`;\n\n    const granted = (input.delegation.scopes ?? []).map(parseScope);\n    const exercisedParsed = parseScope(scopeExercised);\n    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {\n        throw new Error(\n            `stampToolUse: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`\n        );\n    }\n\n    const bytes = canonicalizeToolUse(input.toolUse);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation as never,\n        content: { hash: toolUseHash(input.toolUse), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampToolUseInput {\n    /** Your handler that actually runs the tool. Returns whatever the tool returns. */\n    call: (toolUse: AnthropicToolUse) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n}\n\n/**\n * Stamp the tool_use first, then execute the handler. The stamped envelope\n * is returned alongside the result so the caller can ship them together —\n * e.g. as a side-channel to an audit log, or as the `_oc_agent` metadata on\n * the tool_result content block back to Claude.\n */\nexport async function invokeWithStamp<T>(\n    input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n    const action = await stampToolUse(input);\n    const result = await input.call(input.toolUse);\n    return { result, action };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Console integration: POST stamped actions to console.ochk.io/api/actions\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface ConsoleClient {\n    /** Defaults to https://console.ochk.io. */\n    baseUrl?: string;\n    /** Bearer token from /settings § 03 (`ock_<hex>`). */\n    apiToken: string;\n    /** Project the action belongs to (proj_*). */\n    projectId: string;\n    /** Optional fetch override for runtimes that need it (Node 18 LTS w/o global fetch, etc). */\n    fetch?: typeof fetch;\n}\n\nexport interface PostActionResult {\n    id: string;\n    project_id: string;\n    delegation_id: string;\n}\n\n/**\n * POST a stamped action envelope to console.ochk.io's /api/actions\n * registry. The console:\n *   - re-derives the action id from canonical inputs and rejects on\n *     mismatch (tamper defense)\n *   - validates that the agent address matches the parent delegation's\n *     agent (forgery defense)\n *   - persists, fans out to Nostr (kind 30084), submits to OC Stamp,\n *     and triggers any subscribed webhooks (action.registered)\n *\n * Returns the registered action's id + project_id + delegation_id.\n * Throws on non-2xx with the server's reason string.\n */\nexport async function postActionToConsole(\n    action: ActionEnvelope,\n    client: ConsoleClient\n): Promise<PostActionResult> {\n    const baseUrl = client.baseUrl ?? 'https://console.ochk.io';\n    const f = client.fetch ?? fetch;\n    const body = {\n        project_id: client.projectId,\n        delegation_id: action.delegation_id,\n        agent_address: action.signer.address,\n        scope_exercised: action.scope_exercised,\n        content_hash: action.content.hash,\n        content_length: action.content.length,\n        content_mime: action.content.mime,\n        signed_at: action.signed_at,\n        signature: action.sig.value,\n        id: action.id,\n    };\n    const r = await f(`${baseUrl}/api/actions`, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: `Bearer ${client.apiToken}`,\n        },\n        body: JSON.stringify(body),\n    });\n    if (!r.ok) {\n        let reason = `http_${r.status}`;\n        try {\n            const j = (await r.json()) as { reason?: string };\n            if (j.reason) reason = j.reason;\n        } catch {\n            // body wasn't json; keep the http_<n> reason\n        }\n        throw new Error(`postActionToConsole failed: ${reason}`);\n    }\n    const j = (await r.json()) as { ok: true; action: PostActionResult };\n    return j.action;\n}\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Console credentials. If absent, behaves like invokeWithStamp (no posting). */\n    console?: ConsoleClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when console is configured AND the POST succeeded. null otherwise. */\n    posted: PostActionResult | null;\n}\n\n/**\n * Convenience: stamp the tool_use, execute the handler, AND post the\n * stamped envelope to console. Three roundtrips → one call. If `console`\n * is omitted, this is identical to invokeWithStamp + posted=null.\n *\n * The post happens AFTER the call so a failing post doesn't prevent the\n * tool from running. If you need pre-authorization (the post must\n * succeed before the call runs), use stampToolUse + postActionToConsole\n * + your call() in that order.\n */\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action } = await invokeWithStamp(input);\n    let posted: PostActionResult | null = null;\n    if (input.console) {\n        try {\n            posted = await postActionToConsole(action, input.console);\n        } catch (err) {\n            // Best-effort post — surfacing the error here would force\n            // every caller to handle \"tool ran fine but post failed\",\n            // which is rarely what they want. Log and continue.\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-anthropic] postActionToConsole failed:', err);\n        }\n    }\n    return { result, action, posted };\n}\n"]}

package/dist/index.mjs

@@ -0,0 +1,103 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { canonicalize, hexEncode, computeActionId, parseScope, isSubScope } from '@orangecheck/agent-core';
+import { signAsAgent } from '@orangecheck/agent-signer';
+
+// src/index.ts
+function canonicalizeToolUse(t) {
+  const canon = {
+    id: t.id,
+    input: t.input,
+    name: t.name
+  };
+  const str = canonicalize(canon);
+  return new TextEncoder().encode(str + "\n");
+}
+function toolUseHash(t) {
+  return "sha256:" + hexEncode(sha256(canonicalizeToolUse(t)));
+}
+function toolUseId(agentAddress, signedAt, delegationId, scopeExercised, t) {
+  return computeActionId({
+    address: agentAddress,
+    content_hash: toolUseHash(t),
+    content_length: canonicalizeToolUse(t).byteLength,
+    content_mime: "application/vnd.oc-agent.anthropic-tool-use+json",
+    signed_at: signedAt,
+    delegation_id: delegationId,
+    scope_exercised: scopeExercised
+  });
+}
+async function stampToolUse(input) {
+  const scopeExercised = input.scopeExercised ?? `anthropic:tool(name=${input.toolUse.name})`;
+  const granted = (input.delegation.scopes ?? []).map(parseScope);
+  const exercisedParsed = parseScope(scopeExercised);
+  if (!granted.some((g) => isSubScope(exercisedParsed, g))) {
+    throw new Error(
+      `stampToolUse: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
+    );
+  }
+  const bytes = canonicalizeToolUse(input.toolUse);
+  return signAsAgent({
+    agent: input.agent,
+    delegation: input.delegation,
+    content: { hash: toolUseHash(input.toolUse), length: bytes.byteLength },
+    mime: "application/vnd.oc-agent.anthropic-tool-use+json",
+    scopeExercised,
+    signedAt: input.signedAt
+  });
+}
+async function invokeWithStamp(input) {
+  const action = await stampToolUse(input);
+  const result = await input.call(input.toolUse);
+  return { result, action };
+}
+async function postActionToConsole(action, client) {
+  const baseUrl = client.baseUrl ?? "https://console.ochk.io";
+  const f = client.fetch ?? fetch;
+  const body = {
+    project_id: client.projectId,
+    delegation_id: action.delegation_id,
+    agent_address: action.signer.address,
+    scope_exercised: action.scope_exercised,
+    content_hash: action.content.hash,
+    content_length: action.content.length,
+    content_mime: action.content.mime,
+    signed_at: action.signed_at,
+    signature: action.sig.value,
+    id: action.id
+  };
+  const r = await f(`${baseUrl}/api/actions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${client.apiToken}`
+    },
+    body: JSON.stringify(body)
+  });
+  if (!r.ok) {
+    let reason = `http_${r.status}`;
+    try {
+      const j2 = await r.json();
+      if (j2.reason) reason = j2.reason;
+    } catch {
+    }
+    throw new Error(`postActionToConsole failed: ${reason}`);
+  }
+  const j = await r.json();
+  return j.action;
+}
+async function invokeWithStampAndPost(input) {
+  const { result, action } = await invokeWithStamp(input);
+  let posted = null;
+  if (input.console) {
+    try {
+      posted = await postActionToConsole(action, input.console);
+    } catch (err) {
+      console.error("[oc-agent-anthropic] postActionToConsole failed:", err);
+    }
+  }
+  return { result, action, posted };
+}
+
+export { canonicalizeToolUse, invokeWithStamp, invokeWithStampAndPost, postActionToConsole, stampToolUse, toolUseHash, toolUseId };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["j"],"mappings":";;;;;AAgDO,SAAS,oBAAoB,CAAA,EAAiC;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,YAAY,CAAA,EAA6B;AACrD,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,mBAAA,CAAoB,CAAC,CAAC,CAAC,CAAA;AAC/D;AAEO,SAAS,SAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,YAAY,CAAC,CAAA;AAAA,IAC3B,cAAA,EAAgB,mBAAA,CAAoB,CAAC,CAAA,CAAE,UAAA;AAAA,IACvC,YAAA,EAAc,kDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAmBA,eAAsB,aAAa,KAAA,EAAmD;AAClF,EAAA,MAAM,iBACF,KAAA,CAAM,cAAA,IAAkB,CAAA,oBAAA,EAAuB,KAAA,CAAM,QAAQ,IAAI,CAAA,CAAA,CAAA;AAErE,EAAA,MAAM,WAAW,KAAA,CAAM,UAAA,CAAW,UAAU,EAAC,EAAG,IAAI,UAAU,CAAA;AAC9D,EAAA,MAAM,eAAA,GAAkB,WAAW,cAAc,CAAA;AACjD,EAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,CAAC,MAAM,UAAA,CAAW,eAAA,EAAiB,CAAC,CAAC,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,kCAAkC,cAAc,CAAA,yCAAA;AAAA,KACpD;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,KAAA,CAAM,OAAO,CAAA;AAC/C,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,WAAA,CAAY,MAAM,OAAO,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACtE,IAAA,EAAM,kDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAsBA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,KAAK,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,OAAO,CAAA;AAC7C,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B;AAoCA,eAAsB,mBAAA,CAClB,QACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,IAAW,yBAAA;AAClC,EAAA,MAAM,CAAA,GAAI,OAAO,KAAA,IAAS,KAAA;AAC1B,EAAA,MAAM,IAAA,GAAO;AAAA,IACT,YAAY,MAAA,CAAO,SAAA;AAAA,IACnB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,aAAA,EAAe,OAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,iBAAiB,MAAA,CAAO,eAAA;AAAA,IACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,cAAA,EAAgB,OAAO,OAAA,CAAQ,MAAA;AAAA,IAC/B,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAA,EAAW,OAAO,GAAA,CAAI,KAAA;AAAA,IACtB,IAAI,MAAA,CAAO;AAAA,GACf;AACA,EAAA,MAAM,CAAA,GAAI,MAAM,CAAA,CAAE,CAAA,EAAG,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,IACxC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,GAC5B,CAAA;AACD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI;AACP,IAAA,IAAI,MAAA,GAAS,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAA;AAC7B,IAAA,IAAI;AACA,MAAA,MAAMA,EAAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,MAAA,IAAIA,EAAAA,CAAE,MAAA,EAAQ,MAAA,GAASA,EAAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,MAAM,CAAA,CAAE,CAAA;AAAA,EAC3D;AACA,EAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,EAAA,OAAO,CAAA,CAAE,MAAA;AACb;AAsBA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAM,gBAAgB,KAAK,CAAA;AACtD,EAAA,IAAI,MAAA,GAAkC,IAAA;AACtC,EAAA,IAAI,MAAM,OAAA,EAAS;AACf,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAM,mBAAA,CAAoB,MAAA,EAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,IAC5D,SAAS,GAAA,EAAK;AAKV,MAAA,OAAA,CAAQ,KAAA,CAAM,oDAAoD,GAAG,CAAA;AAAA,IACzE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAO;AACpC","file":"index.mjs","sourcesContent":["// @orangecheck/agent-anthropic — wrap Anthropic Tool Use invocations in\n// OC Agent action envelopes.\n//\n// Anthropic's Messages API surfaces tool calls as `tool_use` content\n// blocks: { type: 'tool_use', id, name, input }. This module canonicalizes\n// each tool_use, hashes it, and produces an agent-action envelope binding\n// the BIP-322-authenticated agent to the (tool_name, input) tuple — at a\n// scope of `anthropic:tool(name=<tool>)`.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    isSubScope,\n    parseScope,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an Anthropic tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AnthropicToolUse {\n    /** The `id` Anthropic assigns to this tool_use block (passed back as tool_use_id on result). */\n    id: string;\n    /** The tool name registered in your `tools` array on messages.create. */\n    name: string;\n    /** The model's structured input for this tool — JSON-serializable. */\n    input: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an Anthropic tool_use. The bytes are what\n * the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n *   {\n *     \"id\":    <tool_use_id>,\n *     \"input\": <canonical JSON of input>,\n *     \"name\":  <tool name>\n *   }\n */\nexport function canonicalizeToolUse(t: AnthropicToolUse): Uint8Array {\n    const canon = {\n        id: t.id,\n        input: t.input,\n        name: t.name,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolUseHash(t: AnthropicToolUse): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeToolUse(t)));\n}\n\nexport function toolUseId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    t: AnthropicToolUse\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: toolUseHash(t),\n        content_length: canonicalizeToolUse(t).byteLength,\n        content_mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped tool_use\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampToolUseInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    toolUse: AnthropicToolUse;\n    /** Defaults to `anthropic:tool(name=<tool>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\n/**\n * Stamp an Anthropic tool_use without executing it. Useful for pre-\n * authorization flows or batch stamping.\n */\nexport async function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope> {\n    const scopeExercised =\n        input.scopeExercised ?? `anthropic:tool(name=${input.toolUse.name})`;\n\n    const granted = (input.delegation.scopes ?? []).map(parseScope);\n    const exercisedParsed = parseScope(scopeExercised);\n    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {\n        throw new Error(\n            `stampToolUse: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`\n        );\n    }\n\n    const bytes = canonicalizeToolUse(input.toolUse);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation as never,\n        content: { hash: toolUseHash(input.toolUse), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.anthropic-tool-use+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampToolUseInput {\n    /** Your handler that actually runs the tool. Returns whatever the tool returns. */\n    call: (toolUse: AnthropicToolUse) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n}\n\n/**\n * Stamp the tool_use first, then execute the handler. The stamped envelope\n * is returned alongside the result so the caller can ship them together —\n * e.g. as a side-channel to an audit log, or as the `_oc_agent` metadata on\n * the tool_result content block back to Claude.\n */\nexport async function invokeWithStamp<T>(\n    input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n    const action = await stampToolUse(input);\n    const result = await input.call(input.toolUse);\n    return { result, action };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Console integration: POST stamped actions to console.ochk.io/api/actions\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface ConsoleClient {\n    /** Defaults to https://console.ochk.io. */\n    baseUrl?: string;\n    /** Bearer token from /settings § 03 (`ock_<hex>`). */\n    apiToken: string;\n    /** Project the action belongs to (proj_*). */\n    projectId: string;\n    /** Optional fetch override for runtimes that need it (Node 18 LTS w/o global fetch, etc). */\n    fetch?: typeof fetch;\n}\n\nexport interface PostActionResult {\n    id: string;\n    project_id: string;\n    delegation_id: string;\n}\n\n/**\n * POST a stamped action envelope to console.ochk.io's /api/actions\n * registry. The console:\n *   - re-derives the action id from canonical inputs and rejects on\n *     mismatch (tamper defense)\n *   - validates that the agent address matches the parent delegation's\n *     agent (forgery defense)\n *   - persists, fans out to Nostr (kind 30084), submits to OC Stamp,\n *     and triggers any subscribed webhooks (action.registered)\n *\n * Returns the registered action's id + project_id + delegation_id.\n * Throws on non-2xx with the server's reason string.\n */\nexport async function postActionToConsole(\n    action: ActionEnvelope,\n    client: ConsoleClient\n): Promise<PostActionResult> {\n    const baseUrl = client.baseUrl ?? 'https://console.ochk.io';\n    const f = client.fetch ?? fetch;\n    const body = {\n        project_id: client.projectId,\n        delegation_id: action.delegation_id,\n        agent_address: action.signer.address,\n        scope_exercised: action.scope_exercised,\n        content_hash: action.content.hash,\n        content_length: action.content.length,\n        content_mime: action.content.mime,\n        signed_at: action.signed_at,\n        signature: action.sig.value,\n        id: action.id,\n    };\n    const r = await f(`${baseUrl}/api/actions`, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: `Bearer ${client.apiToken}`,\n        },\n        body: JSON.stringify(body),\n    });\n    if (!r.ok) {\n        let reason = `http_${r.status}`;\n        try {\n            const j = (await r.json()) as { reason?: string };\n            if (j.reason) reason = j.reason;\n        } catch {\n            // body wasn't json; keep the http_<n> reason\n        }\n        throw new Error(`postActionToConsole failed: ${reason}`);\n    }\n    const j = (await r.json()) as { ok: true; action: PostActionResult };\n    return j.action;\n}\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Console credentials. If absent, behaves like invokeWithStamp (no posting). */\n    console?: ConsoleClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when console is configured AND the POST succeeded. null otherwise. */\n    posted: PostActionResult | null;\n}\n\n/**\n * Convenience: stamp the tool_use, execute the handler, AND post the\n * stamped envelope to console. Three roundtrips → one call. If `console`\n * is omitted, this is identical to invokeWithStamp + posted=null.\n *\n * The post happens AFTER the call so a failing post doesn't prevent the\n * tool from running. If you need pre-authorization (the post must\n * succeed before the call runs), use stampToolUse + postActionToConsole\n * + your call() in that order.\n */\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action } = await invokeWithStamp(input);\n    let posted: PostActionResult | null = null;\n    if (input.console) {\n        try {\n            posted = await postActionToConsole(action, input.console);\n        } catch (err) {\n            // Best-effort post — surfacing the error here would force\n            // every caller to handle \"tool ran fine but post failed\",\n            // which is rarely what they want. Log and continue.\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-anthropic] postActionToConsole failed:', err);\n        }\n    }\n    return { result, action, posted };\n}\n"]}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@orangecheck/agent-anthropic",
+  "version": "0.1.0",
+  "description": "Wrap Anthropic Tool Use (Claude tool_use blocks) with OC Agent scope enforcement and emit a signed agent-action envelope per tool execution.",
+  "keywords": [
+    "bitcoin",
+    "agent",
+    "authority",
+    "anthropic",
+    "claude",
+    "tool-use",
+    "bip322",
+    "oc-agent",
+    "orangecheck"
+  ],
+  "author": "OrangeCheck",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/orangecheck/oc-packages.git",
+    "directory": "agent-anthropic"
+  },
+  "homepage": "https://github.com/orangecheck/oc-agent-protocol",
+  "bugs": {
+    "url": "https://github.com/orangecheck/oc-agent-protocol/issues"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.5.0",
+    "@orangecheck/agent-core": "^0.3.0",
+    "@orangecheck/agent-signer": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^3.2.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/index.test.ts

@@ -0,0 +1,159 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import {
+    canonicalizeToolUse,
+    postActionToConsole,
+    toolUseHash,
+} from './index.js';
+import type { ActionEnvelope } from '@orangecheck/agent-signer';
+
+describe('canonicalizeToolUse', () => {
+    it('produces byte-identical output for identical inputs (key reorder)', () => {
+        const a = canonicalizeToolUse({
+            id: 'toolu_01abc',
+            name: 'invoice.create',
+            input: { customer: 'acme', amount: 14.2 },
+        });
+        const b = canonicalizeToolUse({
+            id: 'toolu_01abc',
+            input: { amount: 14.2, customer: 'acme' }, // keys reordered
+            name: 'invoice.create',
+        });
+        expect(a).toEqual(b);
+    });
+
+    it('produces different hashes for different argument values', () => {
+        const h1 = toolUseHash({
+            id: 'toolu_01abc',
+            name: 'invoice.create',
+            input: { amount: 14.2 },
+        });
+        const h2 = toolUseHash({
+            id: 'toolu_01abc',
+            name: 'invoice.create',
+            input: { amount: 28.0 },
+        });
+        expect(h1).not.toBe(h2);
+    });
+
+    it('changes when the tool name changes', () => {
+        const h1 = toolUseHash({ id: 't1', name: 'a', input: {} });
+        const h2 = toolUseHash({ id: 't1', name: 'b', input: {} });
+        expect(h1).not.toBe(h2);
+    });
+
+    it('changes when the tool_use id changes', () => {
+        const h1 = toolUseHash({ id: 't1', name: 'a', input: {} });
+        const h2 = toolUseHash({ id: 't2', name: 'a', input: {} });
+        expect(h1).not.toBe(h2);
+    });
+});
+
+describe('postActionToConsole', () => {
+    const fakeAction: ActionEnvelope = {
+        v: 1,
+        kind: 'agent-action',
+        id: 'a'.repeat(64),
+        signer: { address: 'bc1qbot00000000000000000000000000000000000a', alg: 'bip322' },
+        delegation_id: 'd'.repeat(64),
+        scope_exercised: 'anthropic:tool(name=invoice.create)',
+        content: {
+            hash: 'sha256:' + 'b'.repeat(64),
+            length: 1024,
+            mime: 'application/vnd.oc-agent.anthropic-tool-use+json',
+        },
+        signed_at: '2026-04-30T12:00:00Z',
+        ots: null,
+        sig: { alg: 'bip322', pubkey: 'bc1qbot00000000000000000000000000000000000a', value: 'CCCC' },
+    };
+
+    it('POSTs to /api/actions with Bearer auth + the action body fields', async () => {
+        const fakeFetch = vi.fn(async (url: string | URL, init?: RequestInit) => {
+            expect(String(url)).toBe('https://console.example/api/actions');
+            const headers = init!.headers as Record<string, string>;
+            expect(headers.Authorization).toBe('Bearer ock_xxxx');
+            expect(headers['Content-Type']).toBe('application/json');
+            const body = JSON.parse(init!.body as string);
+            expect(body.id).toBe(fakeAction.id);
+            expect(body.delegation_id).toBe(fakeAction.delegation_id);
+            expect(body.agent_address).toBe(fakeAction.signer.address);
+            expect(body.scope_exercised).toBe(fakeAction.scope_exercised);
+            expect(body.content_hash).toBe(fakeAction.content.hash);
+            expect(body.signature).toBe(fakeAction.sig.value);
+            expect(body.project_id).toBe('proj_test');
+            return new Response(
+                JSON.stringify({
+                    ok: true,
+                    action: {
+                        id: fakeAction.id,
+                        project_id: 'proj_test',
+                        delegation_id: fakeAction.delegation_id,
+                    },
+                }),
+                { status: 201, headers: { 'Content-Type': 'application/json' } }
+            );
+        });
+        const result = await postActionToConsole(fakeAction, {
+            apiToken: 'ock_xxxx',
+            projectId: 'proj_test',
+            baseUrl: 'https://console.example',
+            fetch: fakeFetch as unknown as typeof fetch,
+        });
+        expect(result.id).toBe(fakeAction.id);
+        expect(result.project_id).toBe('proj_test');
+        expect(fakeFetch).toHaveBeenCalledOnce();
+    });
+
+    it('throws with the server reason on non-2xx', async () => {
+        const fakeFetch = vi.fn(async () =>
+            new Response(JSON.stringify({ ok: false, reason: 'agent_must_match_delegation' }), {
+                status: 403,
+                headers: { 'Content-Type': 'application/json' },
+            })
+        );
+        await expect(
+            postActionToConsole(fakeAction, {
+                apiToken: 'ock_xxxx',
+                projectId: 'proj_test',
+                baseUrl: 'https://console.example',
+                fetch: fakeFetch as unknown as typeof fetch,
+            })
+        ).rejects.toThrow(/agent_must_match_delegation/);
+    });
+
+    it('falls back to http_<status> when the body is not JSON', async () => {
+        const fakeFetch = vi.fn(async () =>
+            new Response('upstream error', { status: 502, headers: { 'Content-Type': 'text/plain' } })
+        );
+        await expect(
+            postActionToConsole(fakeAction, {
+                apiToken: 'ock_xxxx',
+                projectId: 'proj_test',
+                baseUrl: 'https://console.example',
+                fetch: fakeFetch as unknown as typeof fetch,
+            })
+        ).rejects.toThrow(/http_502/);
+    });
+
+    it('defaults to https://console.ochk.io when baseUrl is omitted', async () => {
+        const fakeFetch = vi.fn(async (url: string | URL) => {
+            expect(String(url)).toBe('https://console.ochk.io/api/actions');
+            return new Response(
+                JSON.stringify({
+                    ok: true,
+                    action: {
+                        id: fakeAction.id,
+                        project_id: 'proj_test',
+                        delegation_id: fakeAction.delegation_id,
+                    },
+                }),
+                { status: 201, headers: { 'Content-Type': 'application/json' } }
+            );
+        });
+        await postActionToConsole(fakeAction, {
+            apiToken: 'ock_xxxx',
+            projectId: 'proj_test',
+            fetch: fakeFetch as unknown as typeof fetch,
+        });
+    });
+});

package/src/index.ts

@@ -0,0 +1,260 @@
+// @orangecheck/agent-anthropic — wrap Anthropic Tool Use invocations in
+// OC Agent action envelopes.
+//
+// Anthropic's Messages API surfaces tool calls as `tool_use` content
+// blocks: { type: 'tool_use', id, name, input }. This module canonicalizes
+// each tool_use, hashes it, and produces an agent-action envelope binding
+// the BIP-322-authenticated agent to the (tool_name, input) tuple — at a
+// scope of `anthropic:tool(name=<tool>)`.
+
+import { sha256 } from '@noble/hashes/sha256';
+import {
+    canonicalize,
+    computeActionId,
+    hexEncode,
+    isSubScope,
+    parseScope,
+    type DelegationEnvelope,
+} from '@orangecheck/agent-core';
+import {
+    signAsAgent,
+    type ActionEnvelope,
+    type SignerRef,
+} from '@orangecheck/agent-signer';
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Canonicalization of an Anthropic tool_use
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface AnthropicToolUse {
+    /** The `id` Anthropic assigns to this tool_use block (passed back as tool_use_id on result). */
+    id: string;
+    /** The tool name registered in your `tools` array on messages.create. */
+    name: string;
+    /** The model's structured input for this tool — JSON-serializable. */
+    input: Record<string, unknown>;
+}
+
+/**
+ * Produce the canonical bytes for an Anthropic tool_use. The bytes are what
+ * the agent-action envelope's `content.hash` is a SHA-256 of.
+ *
+ * Shape (RFC 8785 canonical JSON, then trailing LF):
+ *   {
+ *     "id":    <tool_use_id>,
+ *     "input": <canonical JSON of input>,
+ *     "name":  <tool name>
+ *   }
+ */
+export function canonicalizeToolUse(t: AnthropicToolUse): Uint8Array {
+    const canon = {
+        id: t.id,
+        input: t.input,
+        name: t.name,
+    };
+    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);
+    return new TextEncoder().encode(str + '\n');
+}
+
+export function toolUseHash(t: AnthropicToolUse): string {
+    return 'sha256:' + hexEncode(sha256(canonicalizeToolUse(t)));
+}
+
+export function toolUseId(
+    agentAddress: string,
+    signedAt: string,
+    delegationId: string,
+    scopeExercised: string,
+    t: AnthropicToolUse
+): string {
+    return computeActionId({
+        address: agentAddress,
+        content_hash: toolUseHash(t),
+        content_length: canonicalizeToolUse(t).byteLength,
+        content_mime: 'application/vnd.oc-agent.anthropic-tool-use+json',
+        signed_at: signedAt,
+        delegation_id: delegationId,
+        scope_exercised: scopeExercised,
+    });
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Stamped tool_use
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface StampToolUseInput {
+    agent: SignerRef;
+    delegation: DelegationEnvelope;
+    toolUse: AnthropicToolUse;
+    /** Defaults to `anthropic:tool(name=<tool>)` — the tightest admissible sub-scope. */
+    scopeExercised?: string;
+    signedAt?: Date;
+}
+
+/**
+ * Stamp an Anthropic tool_use without executing it. Useful for pre-
+ * authorization flows or batch stamping.
+ */
+export async function stampToolUse(input: StampToolUseInput): Promise<ActionEnvelope> {
+    const scopeExercised =
+        input.scopeExercised ?? `anthropic:tool(name=${input.toolUse.name})`;
+
+    const granted = (input.delegation.scopes ?? []).map(parseScope);
+    const exercisedParsed = parseScope(scopeExercised);
+    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {
+        throw new Error(
+            `stampToolUse: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
+        );
+    }
+
+    const bytes = canonicalizeToolUse(input.toolUse);
+    return signAsAgent({
+        agent: input.agent,
+        delegation: input.delegation as never,
+        content: { hash: toolUseHash(input.toolUse), length: bytes.byteLength },
+        mime: 'application/vnd.oc-agent.anthropic-tool-use+json',
+        scopeExercised,
+        signedAt: input.signedAt,
+    });
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// invokeWithStamp — call the tool AND produce the stamp around it
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface InvokeWithStampInput<T> extends StampToolUseInput {
+    /** Your handler that actually runs the tool. Returns whatever the tool returns. */
+    call: (toolUse: AnthropicToolUse) => Promise<T>;
+}
+
+export interface InvokeWithStampResult<T> {
+    result: T;
+    action: ActionEnvelope;
+}
+
+/**
+ * Stamp the tool_use first, then execute the handler. The stamped envelope
+ * is returned alongside the result so the caller can ship them together —
+ * e.g. as a side-channel to an audit log, or as the `_oc_agent` metadata on
+ * the tool_result content block back to Claude.
+ */
+export async function invokeWithStamp<T>(
+    input: InvokeWithStampInput<T>
+): Promise<InvokeWithStampResult<T>> {
+    const action = await stampToolUse(input);
+    const result = await input.call(input.toolUse);
+    return { result, action };
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Console integration: POST stamped actions to console.ochk.io/api/actions
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface ConsoleClient {
+    /** Defaults to https://console.ochk.io. */
+    baseUrl?: string;
+    /** Bearer token from /settings § 03 (`ock_<hex>`). */
+    apiToken: string;
+    /** Project the action belongs to (proj_*). */
+    projectId: string;
+    /** Optional fetch override for runtimes that need it (Node 18 LTS w/o global fetch, etc). */
+    fetch?: typeof fetch;
+}
+
+export interface PostActionResult {
+    id: string;
+    project_id: string;
+    delegation_id: string;
+}
+
+/**
+ * POST a stamped action envelope to console.ochk.io's /api/actions
+ * registry. The console:
+ *   - re-derives the action id from canonical inputs and rejects on
+ *     mismatch (tamper defense)
+ *   - validates that the agent address matches the parent delegation's
+ *     agent (forgery defense)
+ *   - persists, fans out to Nostr (kind 30084), submits to OC Stamp,
+ *     and triggers any subscribed webhooks (action.registered)
+ *
+ * Returns the registered action's id + project_id + delegation_id.
+ * Throws on non-2xx with the server's reason string.
+ */
+export async function postActionToConsole(
+    action: ActionEnvelope,
+    client: ConsoleClient
+): Promise<PostActionResult> {
+    const baseUrl = client.baseUrl ?? 'https://console.ochk.io';
+    const f = client.fetch ?? fetch;
+    const body = {
+        project_id: client.projectId,
+        delegation_id: action.delegation_id,
+        agent_address: action.signer.address,
+        scope_exercised: action.scope_exercised,
+        content_hash: action.content.hash,
+        content_length: action.content.length,
+        content_mime: action.content.mime,
+        signed_at: action.signed_at,
+        signature: action.sig.value,
+        id: action.id,
+    };
+    const r = await f(`${baseUrl}/api/actions`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${client.apiToken}`,
+        },
+        body: JSON.stringify(body),
+    });
+    if (!r.ok) {
+        let reason = `http_${r.status}`;
+        try {
+            const j = (await r.json()) as { reason?: string };
+            if (j.reason) reason = j.reason;
+        } catch {
+            // body wasn't json; keep the http_<n> reason
+        }
+        throw new Error(`postActionToConsole failed: ${reason}`);
+    }
+    const j = (await r.json()) as { ok: true; action: PostActionResult };
+    return j.action;
+}
+
+export interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
+    /** Console credentials. If absent, behaves like invokeWithStamp (no posting). */
+    console?: ConsoleClient;
+}
+
+export interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
+    /** Set when console is configured AND the POST succeeded. null otherwise. */
+    posted: PostActionResult | null;
+}
+
+/**
+ * Convenience: stamp the tool_use, execute the handler, AND post the
+ * stamped envelope to console. Three roundtrips → one call. If `console`
+ * is omitted, this is identical to invokeWithStamp + posted=null.
+ *
+ * The post happens AFTER the call so a failing post doesn't prevent the
+ * tool from running. If you need pre-authorization (the post must
+ * succeed before the call runs), use stampToolUse + postActionToConsole
+ * + your call() in that order.
+ */
+export async function invokeWithStampAndPost<T>(
+    input: InvokeWithStampAndPostInput<T>
+): Promise<InvokeWithStampAndPostResult<T>> {
+    const { result, action } = await invokeWithStamp(input);
+    let posted: PostActionResult | null = null;
+    if (input.console) {
+        try {
+            posted = await postActionToConsole(action, input.console);
+        } catch (err) {
+            // Best-effort post — surfacing the error here would force
+            // every caller to handle "tool ran fine but post failed",
+            // which is rarely what they want. Log and continue.
+            // eslint-disable-next-line no-console
+            console.error('[oc-agent-anthropic] postActionToConsole failed:', err);
+        }
+    }
+    return { result, action, posted };
+}