@orangecheck/agent-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 OrangeCheck
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,134 @@
+# @orangecheck/agent-cli
+
+Command-line tool for [OC Agent](https://github.com/orangecheck/oc-agent-protocol). Verify, inspect, canonicalize, and reason about delegation / action / revocation envelopes from your shell. Exits 0 on success, 1 on any error. Every command supports `--json` for script-friendly output.
+
+## Install
+
+```bash
+npm i -g @orangecheck/agent-cli
+# or run once, no install:
+npx @orangecheck/agent-cli verify delegation.json
+```
+
+## Commands
+
+### `oc-agent verify <file>`
+
+Verify an envelope. Accepts a single envelope, or an array `[delegation, action|revocation]` for full authority verification. Runs the §SPEC 8 algorithm including BIP-322 signature check.
+
+```bash
+oc-agent verify delegation.json
+# → OK · delegation verified
+#     id: 36d79600…
+
+oc-agent verify '[delegation.json-contents, action.json-contents]'
+# → OK · action + delegation verified
+```
+
+Flags:
+- `--skip-sig` — skip BIP-322 signature verification (useful for test vectors with placeholder sigs)
+- `--skip-temporal` — skip `issued_at` / `expires_at` checks (for inspecting historical envelopes)
+- `--json` — emit machine-readable JSON
+
+Exits `1` with an error code on rejection:
+```
+oc-agent verify tampered.json
+# → REJECTED · E_BAD_ID
+#     reconstructed id (…) does not match envelope.id (…)
+```
+
+### `oc-agent inspect <file>`
+
+Pretty-print an envelope with key fields and the recomputed id. Works on any kind (delegation / action / revocation).
+
+```bash
+oc-agent inspect delegation.json
+# → kind:    agent-delegation
+#   id:      36d79…
+#   id(recomputed): 36d79… ✓
+#   principal: bc1qalice…
+#   agent:     bc1qagent…
+#   scopes:
+#     - ln:send(max_sats<=1000,node=03abc)
+```
+
+### `oc-agent canonical <file>`
+
+Print the canonical message the envelope commits to (what a signer actually signed via BIP-322). Useful for debugging id mismatches — just diff two runs.
+
+```bash
+oc-agent canonical delegation.json
+# → oc-agent:delegation:v1
+#   principal: bc1qalice…
+#   agent: bc1qagent…
+#   scopes: lock:seal(recipient=bc1qbob)
+#   bond_sats: 0
+#   bond_attestation: none
+#   issued_at: 2026-04-22T12:00:00Z
+#   expires_at: 2026-04-29T12:00:00Z
+#   nonce: 0123…cdef
+```
+
+### `oc-agent scope <string>`
+
+Parse a scope string and print its canonical form plus the registered-key check.
+
+```bash
+oc-agent scope 'ln:send(node=03abc,max_sats<=1000)'
+# → ok
+#   canonical: ln:send(max_sats<=1000,node=03abc)
+#   product:   ln
+#   verb:      send
+#   registered: yes
+#   constraints:
+#     - node = 03abc
+#     - max_sats <= 1000
+```
+
+Flags:
+- `--permissive` — accept unregistered products, verbs, and constraint keys
+- `--json` — machine-readable output
+
+### `oc-agent subscope <granted> <exercised>`
+
+Check whether `exercised` is a sub-scope of `granted` per [SPEC §7.4](https://github.com/orangecheck/oc-agent-protocol/blob/main/SPEC.md#74-sub-scope-relation). Exits 0 (admitted) or 1 (rejected).
+
+```bash
+oc-agent subscope 'ln:send(max_sats<=1000)' 'ln:send(max_sats=500,node=03abc)'
+# → admitted
+
+oc-agent subscope 'stamp:sign(mime=text/markdown)' 'stamp:sign(mime=application/pdf)'
+# → rejected (E_SCOPE_DENIED)
+# (exit 1)
+```
+
+Great for CI: gate a PR merge on an exercised scope matching a granted grant.
+
+## Use with stdin
+
+Every file-taking command accepts `-` to read from stdin:
+
+```bash
+curl -s https://agent.example.com/delegations/abc.json | oc-agent verify -
+```
+
+## Composing with other tools
+
+```bash
+# Pretty-print every delegation under ~/delegations/
+find ~/delegations -name '*.json' -exec oc-agent inspect {} \;
+
+# Fail the pipeline on any rejected envelope
+for f in *.delegation.json; do
+    oc-agent verify "$f" --json || { echo "bad: $f"; exit 1; }
+done
+
+# Batch scope check from a CSV
+while IFS=, read -r granted exercised; do
+    oc-agent subscope "$granted" "$exercised" --json
+done < pairs.csv
+```
+
+## License
+
+MIT. See [LICENSE](./LICENSE).

package/dist/cli.js

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+import { readFile } from 'fs/promises';
+import { verifyAction, verifyRevocation, verifyDelegation, parseScope, validateScope, canonicalizeScope, REGISTERED_SCOPES, isSubScope, computeDelegationId, computeActionId, computeRevocationId, delegationCanonicalMessage, actionCanonicalMessage, revocationCanonicalMessage } from '@orangecheck/agent-core';
+import { Verifier } from 'bip322-js';
+import { Command } from 'commander';
+
+var program = new Command();
+program.name("oc-agent").description("command-line verifier for OC Agent envelopes").version("0.1.0");
+program.command("verify").description(
+  "verify an envelope (delegation / action / revocation). accepts a single envelope, or an array [delegation, action|revocation] for full authority verification."
+).argument("<file>", 'path to the envelope JSON file, or "-" for stdin').option("--json", "machine-readable JSON output", false).option("--skip-sig", "skip BIP-322 signature verification", false).option("--skip-temporal", "skip issued_at / expires_at checks", false).action(async (file, opts) => {
+  const parsed = JSON.parse(await read(file));
+  const verifyBip322 = opts.skipSig ? void 0 : async (msg, sig, addr) => {
+    try {
+      return Verifier.verifySignature(addr, msg, sig);
+    } catch {
+      return false;
+    }
+  };
+  if (Array.isArray(parsed) && parsed.length === 2) {
+    const [d, a] = parsed;
+    if (a.kind === "agent-action") {
+      const r = await verifyAction({
+        action: a,
+        delegation: d,
+        verifyBip322,
+        skipSignatureVerification: opts.skipSig
+      });
+      report(r, opts.json, "action + delegation");
+      return;
+    }
+    if (a.kind === "agent-revocation") {
+      const r = await verifyRevocation({
+        envelope: a,
+        delegation: d,
+        verifyBip322,
+        skipSignatureVerification: opts.skipSig
+      });
+      report(r, opts.json, "revocation + delegation");
+      return;
+    }
+    die(opts.json, "UNKNOWN_PAIR", `unknown second envelope kind: ${a.kind}`);
+  }
+  const env = parsed;
+  if (env.kind === "agent-delegation") {
+    const r = await verifyDelegation({
+      envelope: env,
+      verifyBip322,
+      skipSignatureVerification: opts.skipSig,
+      skipTemporalCheck: opts.skipTemporal
+    });
+    report(r, opts.json, "delegation");
+    return;
+  }
+  if (env.kind === "agent-action") {
+    die(
+      opts.json,
+      "NEED_DELEGATION",
+      "an action envelope needs the cited delegation. pass an array: [delegation, action]."
+    );
+  }
+  if (env.kind === "agent-revocation") {
+    die(
+      opts.json,
+      "NEED_DELEGATION",
+      "a revocation envelope needs the cited delegation. pass an array: [delegation, revocation]."
+    );
+  }
+  die(opts.json, "UNKNOWN_KIND", `unknown envelope kind: ${env.kind}`);
+});
+program.command("inspect").description("pretty-print an envelope with key fields and a recomputed id.").argument("<file>", 'path to the envelope JSON file, or "-" for stdin').option("--json", "machine-readable JSON output", false).action(async (file, opts) => {
+  const env = JSON.parse(await read(file));
+  const recomputed = recomputeId(env);
+  if (opts.json) {
+    console.log(JSON.stringify({ envelope: env, recomputed_id: recomputed }, null, 2));
+    return;
+  }
+  console.log(`kind:    ${env.kind}`);
+  console.log(`v:       ${env.v}`);
+  console.log(`id:      ${env.id}`);
+  console.log(`id(recomputed): ${recomputed} ${recomputed === env.id ? "\u2713" : "\u2717"}`);
+  if (env.kind === "agent-delegation") {
+    console.log(`principal: ${env.principal.address}`);
+    console.log(`agent:     ${env.agent.address}`);
+    console.log(`issued:    ${env.issued_at}`);
+    console.log(`expires:   ${env.expires_at}`);
+    if (env.bond) {
+      console.log(`bond:      ${env.bond.sats.toLocaleString()} sats \xB7 attestation=${env.bond.attestation_id}`);
+    } else {
+      console.log(`bond:      none`);
+    }
+    console.log(`scopes:`);
+    for (const s of env.scopes) console.log(`  - ${s}`);
+  } else if (env.kind === "agent-action") {
+    console.log(`agent:           ${env.signer.address}`);
+    console.log(`signed_at:       ${env.signed_at}`);
+    console.log(`delegation_id:   ${env.delegation_id}`);
+    console.log(`scope_exercised: ${env.scope_exercised}`);
+    console.log(`content.hash:    ${env.content.hash}`);
+    console.log(`content.length:  ${env.content.length}`);
+    console.log(`content.mime:    ${env.content.mime}`);
+    console.log(`ots:             ${env.ots?.status ?? "none"}`);
+  } else if (env.kind === "agent-revocation") {
+    console.log(`signer:        ${env.signer.address}`);
+    console.log(`delegation_id: ${env.delegation_id}`);
+    console.log(`reason:        ${env.reason || "(none)"}`);
+    console.log(`signed_at:     ${env.signed_at}`);
+    console.log(`ots:           ${env.ots?.status ?? "none"}`);
+  }
+});
+program.command("canonical").description("print the canonical message that an envelope commits to.").argument("<file>", 'path to the envelope JSON file, or "-" for stdin').action(async (file) => {
+  const env = JSON.parse(await read(file));
+  process.stdout.write(canonicalMessageFor(env));
+});
+program.command("scope").description("parse a scope string and print its canonical form + registered-key check.").argument("<scope>", 'the scope string, e.g. "ln:send(max_sats<=1000)"').option("--json", "machine-readable JSON output", false).option("--permissive", "accept unregistered products / verbs / keys", false).action((scope, opts) => {
+  try {
+    const parsed = parseScope(scope);
+    validateScope(parsed, { mode: opts.permissive ? "permissive" : "strict" });
+    const canonical = canonicalizeScope(parsed);
+    const registered = !!REGISTERED_SCOPES[`${parsed.product}:${parsed.verb}`];
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: true, canonical, parsed, registered }, null, 2));
+    } else {
+      console.log(`ok`);
+      console.log(`canonical: ${canonical}`);
+      console.log(`product:   ${parsed.product}`);
+      console.log(`verb:      ${parsed.verb}`);
+      console.log(`registered: ${registered ? "yes" : "NO (strict mode would reject)"}`);
+      if (parsed.constraints.length > 0) {
+        console.log(`constraints:`);
+        for (const c of parsed.constraints) {
+          console.log(`  - ${c.key} ${c.op} ${c.value ?? "(wildcard)"}`);
+        }
+      }
+    }
+  } catch (e) {
+    die(opts.json, "E_BAD_SCOPE_GRAMMAR", e.message);
+  }
+});
+program.command("subscope").description("check whether exercised scope is a sub-scope of granted.").argument("<granted>", "the granted scope string").argument("<exercised>", "the exercised scope string").option("--json", "machine-readable JSON output", false).action((granted, exercised, opts) => {
+  try {
+    const g = parseScope(granted);
+    const e = parseScope(exercised);
+    const admitted = isSubScope(e, g);
+    if (opts.json) {
+      console.log(JSON.stringify({ admitted }));
+    } else {
+      console.log(admitted ? "admitted" : "rejected (E_SCOPE_DENIED)");
+    }
+    if (!admitted) process.exit(1);
+  } catch (err) {
+    die(opts.json, "E_BAD_SCOPE_GRAMMAR", err.message);
+  }
+});
+async function read(path) {
+  if (path === "-") {
+    let acc = "";
+    for await (const chunk of process.stdin) acc += chunk;
+    return acc;
+  }
+  return readFile(path, "utf8");
+}
+function recomputeId(env) {
+  if (env.kind === "agent-delegation") {
+    return computeDelegationId({
+      principal: env.principal.address,
+      agent: env.agent.address,
+      scopes: env.scopes,
+      bond_sats: env.bond?.sats ?? 0,
+      bond_attestation: env.bond?.attestation_id ?? "none",
+      issued_at: env.issued_at,
+      expires_at: env.expires_at,
+      nonce: env.nonce
+    });
+  }
+  if (env.kind === "agent-action") {
+    return computeActionId({
+      address: env.signer.address,
+      content_hash: env.content.hash,
+      content_length: env.content.length,
+      content_mime: env.content.mime,
+      signed_at: env.signed_at,
+      delegation_id: env.delegation_id,
+      scope_exercised: env.scope_exercised
+    });
+  }
+  return computeRevocationId({
+    address: env.signer.address,
+    delegation_id: env.delegation_id,
+    reason: env.reason,
+    signed_at: env.signed_at
+  });
+}
+function canonicalMessageFor(env) {
+  if (env.kind === "agent-delegation") {
+    return delegationCanonicalMessage({
+      principal: env.principal.address,
+      agent: env.agent.address,
+      scopes: env.scopes,
+      bond_sats: env.bond?.sats ?? 0,
+      bond_attestation: env.bond?.attestation_id ?? "none",
+      issued_at: env.issued_at,
+      expires_at: env.expires_at,
+      nonce: env.nonce
+    });
+  }
+  if (env.kind === "agent-action") {
+    return actionCanonicalMessage({
+      address: env.signer.address,
+      content_hash: env.content.hash,
+      content_length: env.content.length,
+      content_mime: env.content.mime,
+      signed_at: env.signed_at,
+      delegation_id: env.delegation_id,
+      scope_exercised: env.scope_exercised
+    });
+  }
+  return revocationCanonicalMessage({
+    address: env.signer.address,
+    delegation_id: env.delegation_id,
+    reason: env.reason,
+    signed_at: env.signed_at
+  });
+}
+function report(result, asJson, what) {
+  if (result.ok) {
+    if (asJson) {
+      console.log(JSON.stringify({ ok: true, verified: what, id: result.id }));
+    } else {
+      console.log(`OK \xB7 ${what} verified`);
+      console.log(`  id: ${result.id}`);
+    }
+    return;
+  }
+  die(asJson, result.code, result.message);
+}
+function die(asJson, code, message) {
+  if (asJson) {
+    console.error(JSON.stringify({ ok: false, code, message }));
+  } else {
+    console.error(`REJECTED \xB7 ${code}`);
+    console.error(`  ${message}`);
+  }
+  process.exit(1);
+}
+program.parseAsync().catch((err) => {
+  console.error(err.message);
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AAiCA,IAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,OAAA,CACK,KAAK,UAAU,CAAA,CACf,YAAY,8CAA8C,CAAA,CAC1D,QAAQ,OAAO,CAAA;AAMpB,OAAA,CACK,OAAA,CAAQ,QAAQ,CAAA,CAChB,WAAA;AAAA,EACG;AACJ,CAAA,CACC,QAAA,CAAS,UAAU,kDAAkD,CAAA,CACrE,OAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,YAAA,EAAc,uCAAuC,KAAK,CAAA,CACjE,OAAO,iBAAA,EAAmB,oCAAA,EAAsC,KAAK,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,EAAc,IAAA,KAAqE;AAC9F,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAE1C,EAAA,MAAM,eAAe,IAAA,CAAK,OAAA,GACpB,SACA,OAAO,GAAA,EAAa,KAAa,IAAA,KAAiB;AAC9C,IAAA,IAAI;AACA,MAAA,OAAO,QAAA,CAAS,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AAAA,IAClD,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,KAAA;AAAA,IACX;AAAA,EACJ,CAAA;AAEN,EAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,IAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC9C,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACf,IAAA,IAAI,CAAA,CAAE,SAAS,cAAA,EAAgB;AAC3B,MAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa;AAAA,QACzB,MAAA,EAAQ,CAAA;AAAA,QACR,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK;AAAA,OACnC,CAAA;AACD,MAAA,MAAA,CAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,qBAAqB,CAAA;AAC1C,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,CAAA,CAAE,SAAS,kBAAA,EAAoB;AAC/B,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,QAC7B,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK;AAAA,OACnC,CAAA;AACD,MAAA,MAAA,CAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAC9C,MAAA;AAAA,IACJ;AACA,IAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,8BAAA,EAAkC,CAAA,CAAkB,IAAI,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,MAC7B,QAAA,EAAU,GAAA;AAAA,MACV,YAAA;AAAA,MACA,2BAA2B,IAAA,CAAK,OAAA;AAAA,MAChC,mBAAmB,IAAA,CAAK;AAAA,KAC3B,CAAA;AACD,IAAA,MAAA,CAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,YAAY,CAAA;AACjC,IAAA;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,uBAAA,EAA2B,GAAA,CAAoB,IAAI,CAAA,CAAE,CAAA;AACxF,CAAC,CAAA;AAML,OAAA,CACK,QAAQ,SAAS,CAAA,CACjB,YAAY,+DAA+D,CAAA,CAC3E,SAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,OAAO,MAAc,IAAA,KAA4B;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,MAAM,UAAA,GAAa,YAAY,GAAG,CAAA;AAClC,EAAA,IAAI,KAAK,IAAA,EAAM;AACX,IAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,GAAA,EAAK,aAAA,EAAe,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AACjF,IAAA;AAAA,EACJ;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,CAAC,CAAA,CAAE,CAAA;AAC/B,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,EAAE,CAAA,CAAE,CAAA;AAChC,EAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAU,CAAA,CAAA,EAAI,eAAe,GAAA,CAAI,EAAA,GAAK,QAAA,GAAM,QAAG,CAAA,CAAE,CAAA;AAChF,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAC1C,IAAA,IAAI,IAAI,IAAA,EAAM;AACV,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,cAAA,EAAgB,CAAA,uBAAA,EAAuB,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAAA,IAC5G,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,CAAiB,CAAA;AAAA,IACjC;AACA,IAAA,OAAA,CAAQ,IAAI,CAAA,OAAA,CAAS,CAAA;AACrB,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,MAAA,UAAgB,GAAA,CAAI,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,EACtD,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB;AACpC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC/C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACnD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,eAAe,CAAA,CAAE,CAAA;AACrD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,IAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/D,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,kBAAA,EAAoB;AACxC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,IAAU,QAAQ,CAAA,CAAE,CAAA;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,WAAW,CAAA,CACnB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,KAAiB;AAC5B,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,mBAAA,CAAoB,GAAG,CAAC,CAAA;AACjD,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,OAAO,CAAA,CACf,WAAA,CAAY,2EAA2E,CAAA,CACvF,QAAA,CAAS,SAAA,EAAW,kDAAkD,CAAA,CACtE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,cAAA,EAAgB,6CAAA,EAA+C,KAAK,CAAA,CAC3E,MAAA,CAAO,CAAC,KAAA,EAAe,IAAA,KAAiD;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,IAAA,aAAA,CAAc,QAAQ,EAAE,IAAA,EAAM,KAAK,UAAA,GAAa,YAAA,GAAe,UAAU,CAAA;AACzE,IAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAC1C,IAAA,MAAM,UAAA,GAAa,CAAC,CAAC,iBAAA,CAAkB,CAAA,EAAG,OAAO,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACzE,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,IACpF,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,CAAI,CAAA;AAChB,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,CAAA;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC1C,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACvC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,YAAA,EAAe,UAAA,GAAa,KAAA,GAAQ,+BAA+B,CAAA,CAAE,CAAA;AACjF,MAAA,IAAI,MAAA,CAAO,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC/B,QAAA,OAAA,CAAQ,IAAI,CAAA,YAAA,CAAc,CAAA;AAC1B,QAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,UAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,KAAA,IAAS,YAAY,CAAA,CAAE,CAAA;AAAA,QACjE;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,SAAS,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,CAAA,CAAY,OAAO,CAAA;AAAA,EAC9D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,WAAA,EAAa,0BAA0B,CAAA,CAChD,QAAA,CAAS,eAAe,4BAA4B,CAAA,CACpD,MAAA,CAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,CAAC,OAAA,EAAiB,SAAA,EAAmB,IAAA,KAA4B;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,CAAA,GAAI,WAAW,OAAO,CAAA;AAC5B,IAAA,MAAM,CAAA,GAAI,WAAW,SAAS,CAAA;AAC9B,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AAChC,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,CAAC,CAAA;AAAA,IAC5C,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,GAAW,UAAA,GAAa,2BAA2B,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,CAAC,QAAA,EAAU,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,GAAA,CAAc,OAAO,CAAA;AAAA,EAChE;AACJ,CAAC,CAAA;AAML,eAAe,KAAK,IAAA,EAA+B;AAC/C,EAAA,IAAI,SAAS,GAAA,EAAK;AACd,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,WAAA,MAAiB,KAAA,IAAS,OAAA,CAAQ,KAAA,EAAO,GAAA,IAAO,KAAA;AAChD,IAAA,OAAO,GAAA;AAAA,EACX;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,MAAM,CAAA;AAChC;AAEA,SAAS,YAAY,GAAA,EAA0B;AAC3C,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,OAAO,mBAAA,CAAoB;AAAA,MACvB,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,eAAA,CAAgB;AAAA,MACnB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,mBAAA,CAAoB;AAAA,IACvB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,oBAAoB,GAAA,EAA0B;AACnD,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,OAAO,0BAAA,CAA2B;AAAA,MAC9B,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,sBAAA,CAAuB;AAAA,MAC1B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,0BAAA,CAA2B;AAAA,IAC9B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,MAAA,CACL,MAAA,EACA,MAAA,EACA,IAAA,EACI;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AACX,IAAA,IAAI,MAAA,EAAQ;AACR,MAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,EAAA,EAAI,MAAA,CAAO,EAAA,EAAI,CAAC,CAAA;AAAA,IAC3E,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,QAAA,EAAQ,IAAI,CAAA,SAAA,CAAW,CAAA;AACnC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,MAAA,EAAS,MAAA,CAAO,EAAE,CAAA,CAAE,CAAA;AAAA,IACpC;AACA,IAAA;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AAC3C;AAEA,SAAS,GAAA,CAAI,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAwB;AAChE,EAAA,IAAI,MAAA,EAAQ;AACR,IAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,SAAA,CAAU,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,CAAC,CAAA;AAAA,EAC9D,CAAA,MAAO;AACH,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,cAAA,EAAc,IAAI,CAAA,CAAE,CAAA;AAClC,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAAA,EAChC;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,OAAA,CAAQ,UAAA,EAAW,CAAE,KAAA,CAAM,CAAC,GAAA,KAAe;AACvC,EAAA,OAAA,CAAQ,KAAA,CAAM,IAAI,OAAO,CAAA;AACzB,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"cli.js","sourcesContent":["// oc-agent — command-line tool for OC Agent v1 envelopes.\n//\n// Verify, inspect, canonicalize, and check scope containment against the\n// same @orangecheck/agent-core the reference web client uses. Exits 0 on\n// success, 1 on any verification/parse error; every command supports --json\n// for script-friendly output.\n\nimport { readFile } from 'node:fs/promises';\n\nimport {\n    actionCanonicalMessage,\n    canonicalizeScope,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    delegationCanonicalMessage,\n    isSubScope,\n    parseScope,\n    REGISTERED_SCOPES,\n    revocationCanonicalMessage,\n    validateScope,\n    verifyAction,\n    verifyDelegation,\n    verifyRevocation,\n    type ActionEnvelope,\n    type DelegationEnvelope,\n    type RevocationEnvelope,\n} from '@orangecheck/agent-core';\nimport { Verifier } from 'bip322-js';\nimport { Command } from 'commander';\n\ntype AnyEnvelope = DelegationEnvelope | ActionEnvelope | RevocationEnvelope;\n\nconst program = new Command();\n\nprogram\n    .name('oc-agent')\n    .description('command-line verifier for OC Agent envelopes')\n    .version('0.1.0');\n\n// ─────────────────────────────────────────────────────────────────────────────\n// verify\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n    .command('verify')\n    .description(\n        'verify an envelope (delegation / action / revocation). accepts a single envelope, or an array [delegation, action|revocation] for full authority verification.'\n    )\n    .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n    .option('--json', 'machine-readable JSON output', false)\n    .option('--skip-sig', 'skip BIP-322 signature verification', false)\n    .option('--skip-temporal', 'skip issued_at / expires_at checks', false)\n    .action(async (file: string, opts: { json: boolean; skipSig: boolean; skipTemporal: boolean }) => {\n        const parsed = JSON.parse(await read(file));\n\n        const verifyBip322 = opts.skipSig\n            ? undefined\n            : async (msg: string, sig: string, addr: string) => {\n                  try {\n                      return Verifier.verifySignature(addr, msg, sig);\n                  } catch {\n                      return false;\n                  }\n              };\n\n        if (Array.isArray(parsed) && parsed.length === 2) {\n            const [d, a] = parsed as [DelegationEnvelope, ActionEnvelope | RevocationEnvelope];\n            if (a.kind === 'agent-action') {\n                const r = await verifyAction({\n                    action: a,\n                    delegation: d,\n                    verifyBip322,\n                    skipSignatureVerification: opts.skipSig,\n                });\n                report(r, opts.json, 'action + delegation');\n                return;\n            }\n            if (a.kind === 'agent-revocation') {\n                const r = await verifyRevocation({\n                    envelope: a,\n                    delegation: d,\n                    verifyBip322,\n                    skipSignatureVerification: opts.skipSig,\n                });\n                report(r, opts.json, 'revocation + delegation');\n                return;\n            }\n            die(opts.json, 'UNKNOWN_PAIR', `unknown second envelope kind: ${(a as AnyEnvelope).kind}`);\n        }\n\n        const env = parsed as AnyEnvelope;\n        if (env.kind === 'agent-delegation') {\n            const r = await verifyDelegation({\n                envelope: env,\n                verifyBip322,\n                skipSignatureVerification: opts.skipSig,\n                skipTemporalCheck: opts.skipTemporal,\n            });\n            report(r, opts.json, 'delegation');\n            return;\n        }\n        if (env.kind === 'agent-action') {\n            die(\n                opts.json,\n                'NEED_DELEGATION',\n                'an action envelope needs the cited delegation. pass an array: [delegation, action].'\n            );\n        }\n        if (env.kind === 'agent-revocation') {\n            die(\n                opts.json,\n                'NEED_DELEGATION',\n                'a revocation envelope needs the cited delegation. pass an array: [delegation, revocation].'\n            );\n        }\n        die(opts.json, 'UNKNOWN_KIND', `unknown envelope kind: ${(env as AnyEnvelope).kind}`);\n    });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// inspect\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n    .command('inspect')\n    .description('pretty-print an envelope with key fields and a recomputed id.')\n    .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n    .option('--json', 'machine-readable JSON output', false)\n    .action(async (file: string, opts: { json: boolean }) => {\n        const env = JSON.parse(await read(file)) as AnyEnvelope;\n        const recomputed = recomputeId(env);\n        if (opts.json) {\n            console.log(JSON.stringify({ envelope: env, recomputed_id: recomputed }, null, 2));\n            return;\n        }\n        console.log(`kind:    ${env.kind}`);\n        console.log(`v:       ${env.v}`);\n        console.log(`id:      ${env.id}`);\n        console.log(`id(recomputed): ${recomputed} ${recomputed === env.id ? '✓' : '✗'}`);\n        if (env.kind === 'agent-delegation') {\n            console.log(`principal: ${env.principal.address}`);\n            console.log(`agent:     ${env.agent.address}`);\n            console.log(`issued:    ${env.issued_at}`);\n            console.log(`expires:   ${env.expires_at}`);\n            if (env.bond) {\n                console.log(`bond:      ${env.bond.sats.toLocaleString()} sats · attestation=${env.bond.attestation_id}`);\n            } else {\n                console.log(`bond:      none`);\n            }\n            console.log(`scopes:`);\n            for (const s of env.scopes) console.log(`  - ${s}`);\n        } else if (env.kind === 'agent-action') {\n            console.log(`agent:           ${env.signer.address}`);\n            console.log(`signed_at:       ${env.signed_at}`);\n            console.log(`delegation_id:   ${env.delegation_id}`);\n            console.log(`scope_exercised: ${env.scope_exercised}`);\n            console.log(`content.hash:    ${env.content.hash}`);\n            console.log(`content.length:  ${env.content.length}`);\n            console.log(`content.mime:    ${env.content.mime}`);\n            console.log(`ots:             ${env.ots?.status ?? 'none'}`);\n        } else if (env.kind === 'agent-revocation') {\n            console.log(`signer:        ${env.signer.address}`);\n            console.log(`delegation_id: ${env.delegation_id}`);\n            console.log(`reason:        ${env.reason || '(none)'}`);\n            console.log(`signed_at:     ${env.signed_at}`);\n            console.log(`ots:           ${env.ots?.status ?? 'none'}`);\n        }\n    });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// canonical\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n    .command('canonical')\n    .description('print the canonical message that an envelope commits to.')\n    .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n    .action(async (file: string) => {\n        const env = JSON.parse(await read(file)) as AnyEnvelope;\n        process.stdout.write(canonicalMessageFor(env));\n    });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// scope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n    .command('scope')\n    .description('parse a scope string and print its canonical form + registered-key check.')\n    .argument('<scope>', 'the scope string, e.g. \"ln:send(max_sats<=1000)\"')\n    .option('--json', 'machine-readable JSON output', false)\n    .option('--permissive', 'accept unregistered products / verbs / keys', false)\n    .action((scope: string, opts: { json: boolean; permissive: boolean }) => {\n        try {\n            const parsed = parseScope(scope);\n            validateScope(parsed, { mode: opts.permissive ? 'permissive' : 'strict' });\n            const canonical = canonicalizeScope(parsed);\n            const registered = !!REGISTERED_SCOPES[`${parsed.product}:${parsed.verb}`];\n            if (opts.json) {\n                console.log(JSON.stringify({ ok: true, canonical, parsed, registered }, null, 2));\n            } else {\n                console.log(`ok`);\n                console.log(`canonical: ${canonical}`);\n                console.log(`product:   ${parsed.product}`);\n                console.log(`verb:      ${parsed.verb}`);\n                console.log(`registered: ${registered ? 'yes' : 'NO (strict mode would reject)'}`);\n                if (parsed.constraints.length > 0) {\n                    console.log(`constraints:`);\n                    for (const c of parsed.constraints) {\n                        console.log(`  - ${c.key} ${c.op} ${c.value ?? '(wildcard)'}`);\n                    }\n                }\n            }\n        } catch (e) {\n            die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (e as Error).message);\n        }\n    });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// subscope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n    .command('subscope')\n    .description('check whether exercised scope is a sub-scope of granted.')\n    .argument('<granted>', 'the granted scope string')\n    .argument('<exercised>', 'the exercised scope string')\n    .option('--json', 'machine-readable JSON output', false)\n    .action((granted: string, exercised: string, opts: { json: boolean }) => {\n        try {\n            const g = parseScope(granted);\n            const e = parseScope(exercised);\n            const admitted = isSubScope(e, g);\n            if (opts.json) {\n                console.log(JSON.stringify({ admitted }));\n            } else {\n                console.log(admitted ? 'admitted' : 'rejected (E_SCOPE_DENIED)');\n            }\n            if (!admitted) process.exit(1);\n        } catch (err) {\n            die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (err as Error).message);\n        }\n    });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nasync function read(path: string): Promise<string> {\n    if (path === '-') {\n        let acc = '';\n        for await (const chunk of process.stdin) acc += chunk;\n        return acc;\n    }\n    return readFile(path, 'utf8');\n}\n\nfunction recomputeId(env: AnyEnvelope): string {\n    if (env.kind === 'agent-delegation') {\n        return computeDelegationId({\n            principal: env.principal.address,\n            agent: env.agent.address,\n            scopes: env.scopes,\n            bond_sats: env.bond?.sats ?? 0,\n            bond_attestation: env.bond?.attestation_id ?? 'none',\n            issued_at: env.issued_at,\n            expires_at: env.expires_at,\n            nonce: env.nonce,\n        });\n    }\n    if (env.kind === 'agent-action') {\n        return computeActionId({\n            address: env.signer.address,\n            content_hash: env.content.hash,\n            content_length: env.content.length,\n            content_mime: env.content.mime,\n            signed_at: env.signed_at,\n            delegation_id: env.delegation_id,\n            scope_exercised: env.scope_exercised,\n        });\n    }\n    return computeRevocationId({\n        address: env.signer.address,\n        delegation_id: env.delegation_id,\n        reason: env.reason,\n        signed_at: env.signed_at,\n    });\n}\n\nfunction canonicalMessageFor(env: AnyEnvelope): string {\n    if (env.kind === 'agent-delegation') {\n        return delegationCanonicalMessage({\n            principal: env.principal.address,\n            agent: env.agent.address,\n            scopes: env.scopes,\n            bond_sats: env.bond?.sats ?? 0,\n            bond_attestation: env.bond?.attestation_id ?? 'none',\n            issued_at: env.issued_at,\n            expires_at: env.expires_at,\n            nonce: env.nonce,\n        });\n    }\n    if (env.kind === 'agent-action') {\n        return actionCanonicalMessage({\n            address: env.signer.address,\n            content_hash: env.content.hash,\n            content_length: env.content.length,\n            content_mime: env.content.mime,\n            signed_at: env.signed_at,\n            delegation_id: env.delegation_id,\n            scope_exercised: env.scope_exercised,\n        });\n    }\n    return revocationCanonicalMessage({\n        address: env.signer.address,\n        delegation_id: env.delegation_id,\n        reason: env.reason,\n        signed_at: env.signed_at,\n    });\n}\n\nfunction report(\n    result: { ok: true; id: string } | { ok: false; code: string; message: string },\n    asJson: boolean,\n    what: string\n): void {\n    if (result.ok) {\n        if (asJson) {\n            console.log(JSON.stringify({ ok: true, verified: what, id: result.id }));\n        } else {\n            console.log(`OK · ${what} verified`);\n            console.log(`  id: ${result.id}`);\n        }\n        return;\n    }\n    die(asJson, result.code, result.message);\n}\n\nfunction die(asJson: boolean, code: string, message: string): never {\n    if (asJson) {\n        console.error(JSON.stringify({ ok: false, code, message }));\n    } else {\n        console.error(`REJECTED · ${code}`);\n        console.error(`  ${message}`);\n    }\n    process.exit(1);\n}\n\nprogram.parseAsync().catch((err: Error) => {\n    console.error(err.message);\n    process.exit(1);\n});\n"]}

package/package.json

@@ -0,0 +1,54 @@
+{
+    "name": "@orangecheck/agent-cli",
+    "version": "0.1.0",
+    "description": "Command-line tool for OC Agent — verify, inspect, and canonicalize delegation / action / revocation envelopes from your shell.",
+    "keywords": [
+        "oc-agent",
+        "orangecheck",
+        "bitcoin",
+        "delegation",
+        "authority",
+        "bip322",
+        "cli",
+        "nostr"
+    ],
+    "author": "OrangeCheck",
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/orangecheck/oc-packages.git",
+        "directory": "agent-cli"
+    },
+    "homepage": "https://agent.ochk.io",
+    "bugs": {
+        "url": "https://github.com/orangecheck/oc-agent-protocol/issues"
+    },
+    "type": "module",
+    "bin": {
+        "oc-agent": "./dist/cli.js"
+    },
+    "main": "./dist/cli.js",
+    "files": [
+        "dist",
+        "README.md",
+        "LICENSE"
+    ],
+    "scripts": {
+        "build": "tsup",
+        "dev": "tsup --watch",
+        "type-check": "tsc --noEmit",
+        "clean": "rm -rf dist",
+        "prepublishOnly": "npm run clean && npm run build"
+    },
+    "dependencies": {
+        "@noble/hashes": "^1.5.0",
+        "@orangecheck/agent-core": "^0.1.0",
+        "bip322-js": "^3.0.0",
+        "commander": "^12.1.0"
+    },
+    "devDependencies": {
+        "@types/node": "^22.10.2",
+        "tsup": "^8.3.5",
+        "typescript": "^5.7.2"
+    }
+}