@orangecheck/agent-cli 0.2.2 → 0.2.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/cli.js +3 -7
  2. package/dist/cli.js.map +1 -1
  3. package/package.json +2 -2
package/dist/cli.js CHANGED
@@ -1,7 +1,7 @@
1
1
  #!/usr/bin/env node
2
2
  import { readFile } from 'fs/promises';
3
3
  import { verifyAction, verifyRevocation, verifyDelegation, parseScope, validateScope, canonicalizeScope, REGISTERED_SCOPES, isSubScope, computeDelegationId, computeActionId, computeRevocationId, delegationCanonicalMessage, actionCanonicalMessage, revocationCanonicalMessage } from '@orangecheck/agent-core';
4
- import { Verifier } from 'bip322-js';
4
+ import { verifySignature } from '@orangecheck/bip322';
5
5
  import { Command } from 'commander';
6
6
 
7
7
  var program = new Command();
@@ -11,11 +11,7 @@ program.command("verify").description(
11
11
  ).argument("<file>", 'path to the envelope JSON file, or "-" for stdin').option("--json", "machine-readable JSON output", false).option("--skip-sig", "skip BIP-322 signature verification", false).option("--skip-temporal", "skip issued_at / expires_at checks", false).action(async (file, opts) => {
12
12
  const parsed = JSON.parse(await read(file));
13
13
  const verifyBip322 = opts.skipSig ? void 0 : async (msg, sig, addr) => {
14
- try {
15
- return Verifier.verifySignature(addr, msg, sig);
16
- } catch {
17
- return false;
18
- }
14
+ return verifySignature(addr, msg, sig);
19
15
  };
20
16
  if (Array.isArray(parsed) && parsed.length === 2) {
21
17
  const [d, a] = parsed;
@@ -246,7 +242,7 @@ function canonicalMessageFor(env) {
246
242
  }
247
243
  function report(result, asJson, what, signatureChecked) {
248
244
  if (result.ok) {
249
- const revNote = "revocation not checked (offline) \u2014 query kind-30085 by #delegation";
245
+ const revNote = 'revocation not checked (offline) \u2014 query kind 30085 with "#t": [delegation id]';
250
246
  if (asJson) {
251
247
  console.log(
252
248
  JSON.stringify({
package/dist/cli.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AAiCA,IAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,OAAA,CACK,KAAK,UAAU,CAAA,CACf,YAAY,8CAA8C,CAAA,CAC1D,QAAQ,OAAO,CAAA;AAMpB,OAAA,CACK,OAAA,CAAQ,QAAQ,CAAA,CAChB,WAAA;AAAA,EACG;AACJ,CAAA,CACC,QAAA,CAAS,UAAU,kDAAkD,CAAA,CACrE,OAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,YAAA,EAAc,uCAAuC,KAAK,CAAA,CACjE,OAAO,iBAAA,EAAmB,oCAAA,EAAsC,KAAK,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,EAAc,IAAA,KAAqE;AAC9F,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAE1C,EAAA,MAAM,eAAe,IAAA,CAAK,OAAA,GACpB,SACA,OAAO,GAAA,EAAa,KAAa,IAAA,KAAiB;AAC9C,IAAA,IAAI;AACA,MAAA,OAAO,QAAA,CAAS,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AAAA,IAClD,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,KAAA;AAAA,IACX;AAAA,EACJ,CAAA;AAEN,EAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,IAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC9C,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACf,IAAA,IAAI,CAAA,CAAE,SAAS,cAAA,EAAgB;AAC3B,MAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa;AAAA,QACzB,MAAA,EAAQ,CAAA;AAAA,QACR,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMhC,mBAAA,EAAqB;AAAA,OACxB,CAAA;AACD,MAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAuB,CAAC,KAAK,OAAO,CAAA;AACzD,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,CAAA,CAAE,SAAS,kBAAA,EAAoB;AAC/B,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,QAC7B,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK;AAAA,OACnC,CAAA;AACD,MAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,yBAAA,EAA2B,CAAC,KAAK,OAAO,CAAA;AAC7D,MAAA;AAAA,IACJ;AACA,IAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,8BAAA,EAAkC,CAAA,CAAkB,IAAI,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,MAC7B,QAAA,EAAU,GAAA;AAAA,MACV,YAAA;AAAA,MACA,2BAA2B,IAAA,CAAK,OAAA;AAAA,MAChC,mBAAmB,IAAA,CAAK,YAAA;AAAA,MACxB,mBAAA,EAAqB;AAAA;AAAA,KACxB,CAAA;AACD,IAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,CAAC,KAAK,OAAO,CAAA;AAChD,IAAA;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,uBAAA,EAA2B,GAAA,CAAoB,IAAI,CAAA,CAAE,CAAA;AACxF,CAAC,CAAA;AAML,OAAA,CACK,QAAQ,SAAS,CAAA,CACjB,YAAY,+DAA+D,CAAA,CAC3E,SAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,OAAO,MAAc,IAAA,KAA4B;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,MAAM,UAAA,GAAa,YAAY,GAAG,CAAA;AAClC,EAAA,IAAI,KAAK,IAAA,EAAM;AACX,IAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,GAAA,EAAK,aAAA,EAAe,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AACjF,IAAA;AAAA,EACJ;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,CAAC,CAAA,CAAE,CAAA;AAC/B,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,EAAE,CAAA,CAAE,CAAA;AAChC,EAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAU,CAAA,CAAA,EAAI,eAAe,GAAA,CAAI,EAAA,GAAK,QAAA,GAAM,QAAG,CAAA,CAAE,CAAA;AAChF,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAC1C,IAAA,IAAI,IAAI,IAAA,EAAM;AACV,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,cAAA,EAAgB,CAAA,uBAAA,EAAuB,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAAA,IAC5G,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,CAAiB,CAAA;AAAA,IACjC;AAKA,IAAA,IAAI,IAAI,MAAA,EAAQ;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA,OAAA,CAAS,CAAA;AACrB,MAAA,KAAA,MAAW,KAAK,GAAA,CAAI,MAAA,UAAgB,GAAA,CAAI,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,IACtD,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,yEAAA,CAAsE,CAAA;AAAA,IACtF;AAAA,EACJ,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB;AACpC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC/C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACnD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,eAAe,CAAA,CAAE,CAAA;AACrD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,IAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/D,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,kBAAA,EAAoB;AACxC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,IAAU,QAAQ,CAAA,CAAE,CAAA;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,WAAW,CAAA,CACnB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,KAAiB;AAC5B,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,mBAAA,CAAoB,GAAG,CAAC,CAAA;AACjD,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,OAAO,CAAA,CACf,WAAA,CAAY,2EAA2E,CAAA,CACvF,QAAA,CAAS,SAAA,EAAW,kDAAkD,CAAA,CACtE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,cAAA,EAAgB,6CAAA,EAA+C,KAAK,CAAA,CAC3E,MAAA,CAAO,CAAC,KAAA,EAAe,IAAA,KAAiD;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,IAAA,aAAA,CAAc,QAAQ,EAAE,IAAA,EAAM,KAAK,UAAA,GAAa,YAAA,GAAe,UAAU,CAAA;AACzE,IAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAC1C,IAAA,MAAM,UAAA,GAAa,CAAC,CAAC,iBAAA,CAAkB,CAAA,EAAG,OAAO,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACzE,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,IACpF,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,CAAI,CAAA;AAChB,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,CAAA;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC1C,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACvC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,YAAA,EAAe,UAAA,GAAa,KAAA,GAAQ,+BAA+B,CAAA,CAAE,CAAA;AACjF,MAAA,IAAI,MAAA,CAAO,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC/B,QAAA,OAAA,CAAQ,IAAI,CAAA,YAAA,CAAc,CAAA;AAC1B,QAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,UAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,KAAA,IAAS,YAAY,CAAA,CAAE,CAAA;AAAA,QACjE;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,SAAS,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,CAAA,CAAY,OAAO,CAAA;AAAA,EAC9D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,WAAA,EAAa,0BAA0B,CAAA,CAChD,QAAA,CAAS,eAAe,4BAA4B,CAAA,CACpD,MAAA,CAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,CAAC,OAAA,EAAiB,SAAA,EAAmB,IAAA,KAA4B;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,CAAA,GAAI,WAAW,OAAO,CAAA;AAC5B,IAAA,MAAM,CAAA,GAAI,WAAW,SAAS,CAAA;AAC9B,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AAChC,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,CAAC,CAAA;AAAA,IAC5C,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,GAAW,UAAA,GAAa,2BAA2B,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,CAAC,QAAA,EAAU,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,GAAA,CAAc,OAAO,CAAA;AAAA,EAChE;AACJ,CAAC,CAAA;AAML,eAAe,KAAK,IAAA,EAA+B;AAC/C,EAAA,IAAI,SAAS,GAAA,EAAK;AACd,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,WAAA,MAAiB,KAAA,IAAS,OAAA,CAAQ,KAAA,EAAO,GAAA,IAAO,KAAA;AAChD,IAAA,OAAO,GAAA;AAAA,EACX;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,MAAM,CAAA;AAChC;AAEA,SAAS,YAAY,GAAA,EAA0B;AAC3C,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,mBAAA,CAAoB;AAAA,MACvB,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,eAAA,CAAgB;AAAA,MACnB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,mBAAA,CAAoB;AAAA,IACvB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,oBAAoB,GAAA,EAA0B;AACnD,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,0BAAA,CAA2B;AAAA,MAC9B,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,sBAAA,CAAuB;AAAA,MAC1B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,0BAAA,CAA2B;AAAA,IAC9B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,MAAA,CACL,MAAA,EACA,MAAA,EACA,IAAA,EACA,gBAAA,EACI;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AAIX,IAAA,MAAM,OAAA,GAAU,yEAAA;AAChB,IAAA,IAAI,MAAA,EAAQ;AACR,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,KAAK,SAAA,CAAU;AAAA,UACX,EAAA,EAAI,IAAA;AAAA,UACJ,QAAA,EAAU,IAAA;AAAA,UACV,IAAI,MAAA,CAAO,EAAA;AAAA,UACX,iBAAA,EAAmB,gBAAA;AAAA,UACnB,kBAAA,EAAoB,KAAA;AAAA,UACpB,IAAA,EAAM;AAAA,SACT;AAAA,OACL;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,gBAAA,GACM,CAAA,QAAA,EAAQ,IAAI,CAAA,SAAA,CAAA,GACZ,WAAQ,IAAI,CAAA,sDAAA;AAAA,OACtB;AACA,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,MAAA,EAAS,MAAA,CAAO,EAAE,CAAA,CAAE,CAAA;AAChC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IAChC;AACA,IAAA;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AAC3C;AAEA,SAAS,GAAA,CAAI,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAwB;AAChE,EAAA,IAAI,MAAA,EAAQ;AACR,IAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,SAAA,CAAU,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,CAAC,CAAA;AAAA,EAC9D,CAAA,MAAO;AACH,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,cAAA,EAAc,IAAI,CAAA,CAAE,CAAA;AAClC,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAAA,EAChC;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,OAAA,CAAQ,UAAA,EAAW,CAAE,KAAA,CAAM,CAAC,GAAA,KAAe;AACvC,EAAA,OAAA,CAAQ,KAAA,CAAM,IAAI,OAAO,CAAA;AACzB,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"cli.js","sourcesContent":["// oc-agent — command-line tool for OC Agent v1 envelopes.\n//\n// Verify, inspect, canonicalize, and check scope containment against the\n// same @orangecheck/agent-core the reference web client uses. Exits 0 on\n// success, 1 on any verification/parse error; every command supports --json\n// for script-friendly output.\n\nimport { readFile } from 'node:fs/promises';\n\nimport {\n actionCanonicalMessage,\n canonicalizeScope,\n computeActionId,\n computeDelegationId,\n computeRevocationId,\n delegationCanonicalMessage,\n isSubScope,\n parseScope,\n REGISTERED_SCOPES,\n revocationCanonicalMessage,\n validateScope,\n verifyAction,\n verifyDelegation,\n verifyRevocation,\n type ActionEnvelope,\n type DelegationEnvelope,\n type RevocationEnvelope,\n} from '@orangecheck/agent-core';\nimport { Verifier } from 'bip322-js';\nimport { Command } from 'commander';\n\ntype AnyEnvelope = DelegationEnvelope | ActionEnvelope | RevocationEnvelope;\n\nconst program = new Command();\n\nprogram\n .name('oc-agent')\n .description('command-line verifier for OC Agent envelopes')\n .version('0.1.0');\n\n// ─────────────────────────────────────────────────────────────────────────────\n// verify\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('verify')\n .description(\n 'verify an envelope (delegation / action / revocation). accepts a single envelope, or an array [delegation, action|revocation] for full authority verification.'\n )\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .option('--skip-sig', 'skip BIP-322 signature verification', false)\n .option('--skip-temporal', 'skip issued_at / expires_at checks', false)\n .action(async (file: string, opts: { json: boolean; skipSig: boolean; skipTemporal: boolean }) => {\n const parsed = JSON.parse(await read(file));\n\n const verifyBip322 = opts.skipSig\n ? undefined\n : async (msg: string, sig: string, addr: string) => {\n try {\n return Verifier.verifySignature(addr, msg, sig);\n } catch {\n return false;\n }\n };\n\n if (Array.isArray(parsed) && parsed.length === 2) {\n const [d, a] = parsed as [DelegationEnvelope, ActionEnvelope | RevocationEnvelope];\n if (a.kind === 'agent-action') {\n const r = await verifyAction({\n action: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n // This CLI reads envelopes from files and stdin and has no\n // relay access by design, so it genuinely cannot query the\n // kind-30085 feed. agent-core 2.0.0 makes that a statement\n // rather than an omission — and report() discloses it, so\n // \"OK\" never silently means \"possibly revoked\".\n skipRevocationCheck: true,\n });\n report(r, opts.json, 'action + delegation', !opts.skipSig);\n return;\n }\n if (a.kind === 'agent-revocation') {\n const r = await verifyRevocation({\n envelope: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n });\n report(r, opts.json, 'revocation + delegation', !opts.skipSig);\n return;\n }\n die(opts.json, 'UNKNOWN_PAIR', `unknown second envelope kind: ${(a as AnyEnvelope).kind}`);\n }\n\n const env = parsed as AnyEnvelope;\n if (env.kind === 'agent-delegation') {\n const r = await verifyDelegation({\n envelope: env,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n skipTemporalCheck: opts.skipTemporal,\n skipRevocationCheck: true, // offline verifier — see the note above\n });\n report(r, opts.json, 'delegation', !opts.skipSig);\n return;\n }\n if (env.kind === 'agent-action') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'an action envelope needs the cited delegation. pass an array: [delegation, action].'\n );\n }\n if (env.kind === 'agent-revocation') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'a revocation envelope needs the cited delegation. pass an array: [delegation, revocation].'\n );\n }\n die(opts.json, 'UNKNOWN_KIND', `unknown envelope kind: ${(env as AnyEnvelope).kind}`);\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// inspect\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('inspect')\n .description('pretty-print an envelope with key fields and a recomputed id.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .action(async (file: string, opts: { json: boolean }) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n const recomputed = recomputeId(env);\n if (opts.json) {\n console.log(JSON.stringify({ envelope: env, recomputed_id: recomputed }, null, 2));\n return;\n }\n console.log(`kind: ${env.kind}`);\n console.log(`v: ${env.v}`);\n console.log(`id: ${env.id}`);\n console.log(`id(recomputed): ${recomputed} ${recomputed === env.id ? '✓' : '✗'}`);\n if (env.kind === 'agent-delegation') {\n console.log(`principal: ${env.principal.address}`);\n console.log(`agent: ${env.agent.address}`);\n console.log(`issued: ${env.issued_at}`);\n console.log(`expires: ${env.expires_at}`);\n if (env.bond) {\n console.log(`bond: ${env.bond.sats.toLocaleString()} sats · attestation=${env.bond.attestation_id}`);\n } else {\n console.log(`bond: none`);\n }\n // v1.2 private mode seals the grant into `scopes_encrypted` and\n // omits `scopes`, so an absent list is not an empty grant — it is a\n // grant this reader cannot see. Printing \"scopes:\" with nothing\n // under it would read as \"no permissions\", the opposite of true.\n if (env.scopes) {\n console.log(`scopes:`);\n for (const s of env.scopes) console.log(` - ${s}`);\n } else {\n console.log(`scopes: sealed (v1.2 private mode) — needs a recipient device key`);\n }\n } else if (env.kind === 'agent-action') {\n console.log(`agent: ${env.signer.address}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`scope_exercised: ${env.scope_exercised}`);\n console.log(`content.hash: ${env.content.hash}`);\n console.log(`content.length: ${env.content.length}`);\n console.log(`content.mime: ${env.content.mime}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n } else if (env.kind === 'agent-revocation') {\n console.log(`signer: ${env.signer.address}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`reason: ${env.reason || '(none)'}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// canonical\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('canonical')\n .description('print the canonical message that an envelope commits to.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .action(async (file: string) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n process.stdout.write(canonicalMessageFor(env));\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// scope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('scope')\n .description('parse a scope string and print its canonical form + registered-key check.')\n .argument('<scope>', 'the scope string, e.g. \"ln:send(max_sats<=1000)\"')\n .option('--json', 'machine-readable JSON output', false)\n .option('--permissive', 'accept unregistered products / verbs / keys', false)\n .action((scope: string, opts: { json: boolean; permissive: boolean }) => {\n try {\n const parsed = parseScope(scope);\n validateScope(parsed, { mode: opts.permissive ? 'permissive' : 'strict' });\n const canonical = canonicalizeScope(parsed);\n const registered = !!REGISTERED_SCOPES[`${parsed.product}:${parsed.verb}`];\n if (opts.json) {\n console.log(JSON.stringify({ ok: true, canonical, parsed, registered }, null, 2));\n } else {\n console.log(`ok`);\n console.log(`canonical: ${canonical}`);\n console.log(`product: ${parsed.product}`);\n console.log(`verb: ${parsed.verb}`);\n console.log(`registered: ${registered ? 'yes' : 'NO (strict mode would reject)'}`);\n if (parsed.constraints.length > 0) {\n console.log(`constraints:`);\n for (const c of parsed.constraints) {\n console.log(` - ${c.key} ${c.op} ${c.value ?? '(wildcard)'}`);\n }\n }\n }\n } catch (e) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (e as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// subscope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('subscope')\n .description('check whether exercised scope is a sub-scope of granted.')\n .argument('<granted>', 'the granted scope string')\n .argument('<exercised>', 'the exercised scope string')\n .option('--json', 'machine-readable JSON output', false)\n .action((granted: string, exercised: string, opts: { json: boolean }) => {\n try {\n const g = parseScope(granted);\n const e = parseScope(exercised);\n const admitted = isSubScope(e, g);\n if (opts.json) {\n console.log(JSON.stringify({ admitted }));\n } else {\n console.log(admitted ? 'admitted' : 'rejected (E_SCOPE_DENIED)');\n }\n if (!admitted) process.exit(1);\n } catch (err) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (err as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nasync function read(path: string): Promise<string> {\n if (path === '-') {\n let acc = '';\n for await (const chunk of process.stdin) acc += chunk;\n return acc;\n }\n return readFile(path, 'utf8');\n}\n\nfunction recomputeId(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot recompute a delegation id for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted and must be decrypted with a recipient device key first',\n );\n }\n return computeDelegationId({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return computeActionId({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return computeRevocationId({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\nfunction canonicalMessageFor(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot rebuild the canonical message for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted',\n );\n }\n return delegationCanonicalMessage({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return actionCanonicalMessage({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return revocationCanonicalMessage({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\nfunction report(\n result: { ok: true; id: string } | { ok: false; code: string; message: string },\n asJson: boolean,\n what: string,\n signatureChecked: boolean\n): void {\n if (result.ok) {\n // Revocation is NOT part of this verdict: the CLI has no relay. Saying\n // so is the difference between \"this envelope is authentic\" and \"this\n // grant is still in force\", which are not the same claim.\n const revNote = 'revocation not checked (offline) — query kind-30085 by #delegation';\n if (asJson) {\n console.log(\n JSON.stringify({\n ok: true,\n verified: what,\n id: result.id,\n signature_checked: signatureChecked,\n revocation_checked: false,\n note: revNote,\n }),\n );\n } else {\n console.log(\n signatureChecked\n ? `OK · ${what} verified`\n : `OK · ${what} well-formed — signature NOT checked (--skip-sig)`,\n );\n console.log(` id: ${result.id}`);\n console.log(` ! ${revNote}`);\n }\n return;\n }\n die(asJson, result.code, result.message);\n}\n\nfunction die(asJson: boolean, code: string, message: string): never {\n if (asJson) {\n console.error(JSON.stringify({ ok: false, code, message }));\n } else {\n console.error(`REJECTED · ${code}`);\n console.error(` ${message}`);\n }\n process.exit(1);\n}\n\nprogram.parseAsync().catch((err: Error) => {\n console.error(err.message);\n process.exit(1);\n});\n"]}
1
+ {"version":3,"sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AAiCA,IAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,OAAA,CACK,KAAK,UAAU,CAAA,CACf,YAAY,8CAA8C,CAAA,CAC1D,QAAQ,OAAO,CAAA;AAMpB,OAAA,CACK,OAAA,CAAQ,QAAQ,CAAA,CAChB,WAAA;AAAA,EACG;AACJ,CAAA,CACC,QAAA,CAAS,UAAU,kDAAkD,CAAA,CACrE,OAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,YAAA,EAAc,uCAAuC,KAAK,CAAA,CACjE,OAAO,iBAAA,EAAmB,oCAAA,EAAsC,KAAK,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,EAAc,IAAA,KAAqE;AAC9F,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAE1C,EAAA,MAAM,eAAe,IAAA,CAAK,OAAA,GACpB,SACA,OAAO,GAAA,EAAa,KAAa,IAAA,KAAiB;AAC9C,IAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AAAA,EACzC,CAAA;AAEN,EAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,IAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC9C,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACf,IAAA,IAAI,CAAA,CAAE,SAAS,cAAA,EAAgB;AAC3B,MAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa;AAAA,QACzB,MAAA,EAAQ,CAAA;AAAA,QACR,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMhC,mBAAA,EAAqB;AAAA,OACxB,CAAA;AACD,MAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAuB,CAAC,KAAK,OAAO,CAAA;AACzD,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,CAAA,CAAE,SAAS,kBAAA,EAAoB;AAC/B,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,QAC7B,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK;AAAA,OACnC,CAAA;AACD,MAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,yBAAA,EAA2B,CAAC,KAAK,OAAO,CAAA;AAC7D,MAAA;AAAA,IACJ;AACA,IAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,8BAAA,EAAkC,CAAA,CAAkB,IAAI,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,MAC7B,QAAA,EAAU,GAAA;AAAA,MACV,YAAA;AAAA,MACA,2BAA2B,IAAA,CAAK,OAAA;AAAA,MAChC,mBAAmB,IAAA,CAAK,YAAA;AAAA,MACxB,mBAAA,EAAqB;AAAA;AAAA,KACxB,CAAA;AACD,IAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,CAAC,KAAK,OAAO,CAAA;AAChD,IAAA;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,uBAAA,EAA2B,GAAA,CAAoB,IAAI,CAAA,CAAE,CAAA;AACxF,CAAC,CAAA;AAML,OAAA,CACK,QAAQ,SAAS,CAAA,CACjB,YAAY,+DAA+D,CAAA,CAC3E,SAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,OAAO,MAAc,IAAA,KAA4B;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,MAAM,UAAA,GAAa,YAAY,GAAG,CAAA;AAClC,EAAA,IAAI,KAAK,IAAA,EAAM;AACX,IAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,GAAA,EAAK,aAAA,EAAe,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AACjF,IAAA;AAAA,EACJ;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,CAAC,CAAA,CAAE,CAAA;AAC/B,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,EAAE,CAAA,CAAE,CAAA;AAChC,EAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAU,CAAA,CAAA,EAAI,eAAe,GAAA,CAAI,EAAA,GAAK,QAAA,GAAM,QAAG,CAAA,CAAE,CAAA;AAChF,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAC1C,IAAA,IAAI,IAAI,IAAA,EAAM;AACV,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,cAAA,EAAgB,CAAA,uBAAA,EAAuB,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAAA,IAC5G,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,CAAiB,CAAA;AAAA,IACjC;AAKA,IAAA,IAAI,IAAI,MAAA,EAAQ;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA,OAAA,CAAS,CAAA;AACrB,MAAA,KAAA,MAAW,KAAK,GAAA,CAAI,MAAA,UAAgB,GAAA,CAAI,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,IACtD,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,yEAAA,CAAsE,CAAA;AAAA,IACtF;AAAA,EACJ,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB;AACpC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC/C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACnD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,eAAe,CAAA,CAAE,CAAA;AACrD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,IAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/D,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,kBAAA,EAAoB;AACxC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,IAAU,QAAQ,CAAA,CAAE,CAAA;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,WAAW,CAAA,CACnB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,KAAiB;AAC5B,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,mBAAA,CAAoB,GAAG,CAAC,CAAA;AACjD,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,OAAO,CAAA,CACf,WAAA,CAAY,2EAA2E,CAAA,CACvF,QAAA,CAAS,SAAA,EAAW,kDAAkD,CAAA,CACtE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,cAAA,EAAgB,6CAAA,EAA+C,KAAK,CAAA,CAC3E,MAAA,CAAO,CAAC,KAAA,EAAe,IAAA,KAAiD;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,IAAA,aAAA,CAAc,QAAQ,EAAE,IAAA,EAAM,KAAK,UAAA,GAAa,YAAA,GAAe,UAAU,CAAA;AACzE,IAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAC1C,IAAA,MAAM,UAAA,GAAa,CAAC,CAAC,iBAAA,CAAkB,CAAA,EAAG,OAAO,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACzE,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,IACpF,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,CAAI,CAAA;AAChB,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,CAAA;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC1C,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACvC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,YAAA,EAAe,UAAA,GAAa,KAAA,GAAQ,+BAA+B,CAAA,CAAE,CAAA;AACjF,MAAA,IAAI,MAAA,CAAO,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC/B,QAAA,OAAA,CAAQ,IAAI,CAAA,YAAA,CAAc,CAAA;AAC1B,QAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,UAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,KAAA,IAAS,YAAY,CAAA,CAAE,CAAA;AAAA,QACjE;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,SAAS,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,CAAA,CAAY,OAAO,CAAA;AAAA,EAC9D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,WAAA,EAAa,0BAA0B,CAAA,CAChD,QAAA,CAAS,eAAe,4BAA4B,CAAA,CACpD,MAAA,CAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,CAAC,OAAA,EAAiB,SAAA,EAAmB,IAAA,KAA4B;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,CAAA,GAAI,WAAW,OAAO,CAAA;AAC5B,IAAA,MAAM,CAAA,GAAI,WAAW,SAAS,CAAA;AAC9B,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AAChC,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,CAAC,CAAA;AAAA,IAC5C,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,GAAW,UAAA,GAAa,2BAA2B,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,CAAC,QAAA,EAAU,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,GAAA,CAAc,OAAO,CAAA;AAAA,EAChE;AACJ,CAAC,CAAA;AAML,eAAe,KAAK,IAAA,EAA+B;AAC/C,EAAA,IAAI,SAAS,GAAA,EAAK;AACd,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,WAAA,MAAiB,KAAA,IAAS,OAAA,CAAQ,KAAA,EAAO,GAAA,IAAO,KAAA;AAChD,IAAA,OAAO,GAAA;AAAA,EACX;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,MAAM,CAAA;AAChC;AAEA,SAAS,YAAY,GAAA,EAA0B;AAC3C,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,mBAAA,CAAoB;AAAA,MACvB,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,eAAA,CAAgB;AAAA,MACnB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,mBAAA,CAAoB;AAAA,IACvB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,oBAAoB,GAAA,EAA0B;AACnD,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,0BAAA,CAA2B;AAAA,MAC9B,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,sBAAA,CAAuB;AAAA,MAC1B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,0BAAA,CAA2B;AAAA,IAC9B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,MAAA,CACL,MAAA,EACA,MAAA,EACA,IAAA,EACA,gBAAA,EACI;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AAIX,IAAA,MAAM,OAAA,GAAU,qFAAA;AAChB,IAAA,IAAI,MAAA,EAAQ;AACR,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,KAAK,SAAA,CAAU;AAAA,UACX,EAAA,EAAI,IAAA;AAAA,UACJ,QAAA,EAAU,IAAA;AAAA,UACV,IAAI,MAAA,CAAO,EAAA;AAAA,UACX,iBAAA,EAAmB,gBAAA;AAAA,UACnB,kBAAA,EAAoB,KAAA;AAAA,UACpB,IAAA,EAAM;AAAA,SACT;AAAA,OACL;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,gBAAA,GACM,CAAA,QAAA,EAAQ,IAAI,CAAA,SAAA,CAAA,GACZ,WAAQ,IAAI,CAAA,sDAAA;AAAA,OACtB;AACA,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,MAAA,EAAS,MAAA,CAAO,EAAE,CAAA,CAAE,CAAA;AAChC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IAChC;AACA,IAAA;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AAC3C;AAEA,SAAS,GAAA,CAAI,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAwB;AAChE,EAAA,IAAI,MAAA,EAAQ;AACR,IAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,SAAA,CAAU,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,CAAC,CAAA;AAAA,EAC9D,CAAA,MAAO;AACH,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,cAAA,EAAc,IAAI,CAAA,CAAE,CAAA;AAClC,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAAA,EAChC;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,OAAA,CAAQ,UAAA,EAAW,CAAE,KAAA,CAAM,CAAC,GAAA,KAAe;AACvC,EAAA,OAAA,CAAQ,KAAA,CAAM,IAAI,OAAO,CAAA;AACzB,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"cli.js","sourcesContent":["// oc-agent — command-line tool for OC Agent v1 envelopes.\n//\n// Verify, inspect, canonicalize, and check scope containment against the\n// same @orangecheck/agent-core the reference web client uses. Exits 0 on\n// success, 1 on any verification/parse error; every command supports --json\n// for script-friendly output.\n\nimport { readFile } from 'node:fs/promises';\n\nimport {\n actionCanonicalMessage,\n canonicalizeScope,\n computeActionId,\n computeDelegationId,\n computeRevocationId,\n delegationCanonicalMessage,\n isSubScope,\n parseScope,\n REGISTERED_SCOPES,\n revocationCanonicalMessage,\n validateScope,\n verifyAction,\n verifyDelegation,\n verifyRevocation,\n type ActionEnvelope,\n type DelegationEnvelope,\n type RevocationEnvelope,\n} from '@orangecheck/agent-core';\nimport { verifySignature } from '@orangecheck/bip322';\nimport { Command } from 'commander';\n\ntype AnyEnvelope = DelegationEnvelope | ActionEnvelope | RevocationEnvelope;\n\nconst program = new Command();\n\nprogram\n .name('oc-agent')\n .description('command-line verifier for OC Agent envelopes')\n .version('0.1.0');\n\n// ─────────────────────────────────────────────────────────────────────────────\n// verify\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('verify')\n .description(\n 'verify an envelope (delegation / action / revocation). accepts a single envelope, or an array [delegation, action|revocation] for full authority verification.'\n )\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .option('--skip-sig', 'skip BIP-322 signature verification', false)\n .option('--skip-temporal', 'skip issued_at / expires_at checks', false)\n .action(async (file: string, opts: { json: boolean; skipSig: boolean; skipTemporal: boolean }) => {\n const parsed = JSON.parse(await read(file));\n\n const verifyBip322 = opts.skipSig\n ? undefined\n : async (msg: string, sig: string, addr: string) => {\n return verifySignature(addr, msg, sig);\n };\n\n if (Array.isArray(parsed) && parsed.length === 2) {\n const [d, a] = parsed as [DelegationEnvelope, ActionEnvelope | RevocationEnvelope];\n if (a.kind === 'agent-action') {\n const r = await verifyAction({\n action: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n // This CLI reads envelopes from files and stdin and has no\n // relay access by design, so it genuinely cannot query the\n // kind-30085 feed. agent-core 2.0.0 makes that a statement\n // rather than an omission — and report() discloses it, so\n // \"OK\" never silently means \"possibly revoked\".\n skipRevocationCheck: true,\n });\n report(r, opts.json, 'action + delegation', !opts.skipSig);\n return;\n }\n if (a.kind === 'agent-revocation') {\n const r = await verifyRevocation({\n envelope: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n });\n report(r, opts.json, 'revocation + delegation', !opts.skipSig);\n return;\n }\n die(opts.json, 'UNKNOWN_PAIR', `unknown second envelope kind: ${(a as AnyEnvelope).kind}`);\n }\n\n const env = parsed as AnyEnvelope;\n if (env.kind === 'agent-delegation') {\n const r = await verifyDelegation({\n envelope: env,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n skipTemporalCheck: opts.skipTemporal,\n skipRevocationCheck: true, // offline verifier — see the note above\n });\n report(r, opts.json, 'delegation', !opts.skipSig);\n return;\n }\n if (env.kind === 'agent-action') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'an action envelope needs the cited delegation. pass an array: [delegation, action].'\n );\n }\n if (env.kind === 'agent-revocation') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'a revocation envelope needs the cited delegation. pass an array: [delegation, revocation].'\n );\n }\n die(opts.json, 'UNKNOWN_KIND', `unknown envelope kind: ${(env as AnyEnvelope).kind}`);\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// inspect\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('inspect')\n .description('pretty-print an envelope with key fields and a recomputed id.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .action(async (file: string, opts: { json: boolean }) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n const recomputed = recomputeId(env);\n if (opts.json) {\n console.log(JSON.stringify({ envelope: env, recomputed_id: recomputed }, null, 2));\n return;\n }\n console.log(`kind: ${env.kind}`);\n console.log(`v: ${env.v}`);\n console.log(`id: ${env.id}`);\n console.log(`id(recomputed): ${recomputed} ${recomputed === env.id ? '✓' : '✗'}`);\n if (env.kind === 'agent-delegation') {\n console.log(`principal: ${env.principal.address}`);\n console.log(`agent: ${env.agent.address}`);\n console.log(`issued: ${env.issued_at}`);\n console.log(`expires: ${env.expires_at}`);\n if (env.bond) {\n console.log(`bond: ${env.bond.sats.toLocaleString()} sats · attestation=${env.bond.attestation_id}`);\n } else {\n console.log(`bond: none`);\n }\n // v1.2 private mode seals the grant into `scopes_encrypted` and\n // omits `scopes`, so an absent list is not an empty grant — it is a\n // grant this reader cannot see. Printing \"scopes:\" with nothing\n // under it would read as \"no permissions\", the opposite of true.\n if (env.scopes) {\n console.log(`scopes:`);\n for (const s of env.scopes) console.log(` - ${s}`);\n } else {\n console.log(`scopes: sealed (v1.2 private mode) — needs a recipient device key`);\n }\n } else if (env.kind === 'agent-action') {\n console.log(`agent: ${env.signer.address}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`scope_exercised: ${env.scope_exercised}`);\n console.log(`content.hash: ${env.content.hash}`);\n console.log(`content.length: ${env.content.length}`);\n console.log(`content.mime: ${env.content.mime}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n } else if (env.kind === 'agent-revocation') {\n console.log(`signer: ${env.signer.address}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`reason: ${env.reason || '(none)'}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// canonical\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('canonical')\n .description('print the canonical message that an envelope commits to.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .action(async (file: string) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n process.stdout.write(canonicalMessageFor(env));\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// scope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('scope')\n .description('parse a scope string and print its canonical form + registered-key check.')\n .argument('<scope>', 'the scope string, e.g. \"ln:send(max_sats<=1000)\"')\n .option('--json', 'machine-readable JSON output', false)\n .option('--permissive', 'accept unregistered products / verbs / keys', false)\n .action((scope: string, opts: { json: boolean; permissive: boolean }) => {\n try {\n const parsed = parseScope(scope);\n validateScope(parsed, { mode: opts.permissive ? 'permissive' : 'strict' });\n const canonical = canonicalizeScope(parsed);\n const registered = !!REGISTERED_SCOPES[`${parsed.product}:${parsed.verb}`];\n if (opts.json) {\n console.log(JSON.stringify({ ok: true, canonical, parsed, registered }, null, 2));\n } else {\n console.log(`ok`);\n console.log(`canonical: ${canonical}`);\n console.log(`product: ${parsed.product}`);\n console.log(`verb: ${parsed.verb}`);\n console.log(`registered: ${registered ? 'yes' : 'NO (strict mode would reject)'}`);\n if (parsed.constraints.length > 0) {\n console.log(`constraints:`);\n for (const c of parsed.constraints) {\n console.log(` - ${c.key} ${c.op} ${c.value ?? '(wildcard)'}`);\n }\n }\n }\n } catch (e) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (e as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// subscope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('subscope')\n .description('check whether exercised scope is a sub-scope of granted.')\n .argument('<granted>', 'the granted scope string')\n .argument('<exercised>', 'the exercised scope string')\n .option('--json', 'machine-readable JSON output', false)\n .action((granted: string, exercised: string, opts: { json: boolean }) => {\n try {\n const g = parseScope(granted);\n const e = parseScope(exercised);\n const admitted = isSubScope(e, g);\n if (opts.json) {\n console.log(JSON.stringify({ admitted }));\n } else {\n console.log(admitted ? 'admitted' : 'rejected (E_SCOPE_DENIED)');\n }\n if (!admitted) process.exit(1);\n } catch (err) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (err as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nasync function read(path: string): Promise<string> {\n if (path === '-') {\n let acc = '';\n for await (const chunk of process.stdin) acc += chunk;\n return acc;\n }\n return readFile(path, 'utf8');\n}\n\nfunction recomputeId(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot recompute a delegation id for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted and must be decrypted with a recipient device key first',\n );\n }\n return computeDelegationId({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return computeActionId({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return computeRevocationId({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\nfunction canonicalMessageFor(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot rebuild the canonical message for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted',\n );\n }\n return delegationCanonicalMessage({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return actionCanonicalMessage({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return revocationCanonicalMessage({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\nfunction report(\n result: { ok: true; id: string } | { ok: false; code: string; message: string },\n asJson: boolean,\n what: string,\n signatureChecked: boolean\n): void {\n if (result.ok) {\n // Revocation is NOT part of this verdict: the CLI has no relay. Saying\n // so is the difference between \"this envelope is authentic\" and \"this\n // grant is still in force\", which are not the same claim.\n const revNote = 'revocation not checked (offline) — query kind 30085 with \"#t\": [delegation id]';\n if (asJson) {\n console.log(\n JSON.stringify({\n ok: true,\n verified: what,\n id: result.id,\n signature_checked: signatureChecked,\n revocation_checked: false,\n note: revNote,\n }),\n );\n } else {\n console.log(\n signatureChecked\n ? `OK · ${what} verified`\n : `OK · ${what} well-formed — signature NOT checked (--skip-sig)`,\n );\n console.log(` id: ${result.id}`);\n console.log(` ! ${revNote}`);\n }\n return;\n }\n die(asJson, result.code, result.message);\n}\n\nfunction die(asJson: boolean, code: string, message: string): never {\n if (asJson) {\n console.error(JSON.stringify({ ok: false, code, message }));\n } else {\n console.error(`REJECTED · ${code}`);\n console.error(` ${message}`);\n }\n process.exit(1);\n}\n\nprogram.parseAsync().catch((err: Error) => {\n console.error(err.message);\n process.exit(1);\n});\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@orangecheck/agent-cli",
3
- "version": "0.2.2",
3
+ "version": "0.2.4",
4
4
  "description": "Command-line tool for OC Agent — verify, inspect, and canonicalize delegation / action / revocation envelopes from your shell.",
5
5
  "keywords": [
6
6
  "oc-agent",
@@ -43,7 +43,7 @@
43
43
  "dependencies": {
44
44
  "@noble/hashes": "^1.5.0",
45
45
  "@orangecheck/agent-core": "^2.1.0",
46
- "bip322-js": "^3.0.0",
46
+ "@orangecheck/bip322": "^1.0.0",
47
47
  "commander": "^12.1.0"
48
48
  },
49
49
  "devDependencies": {