@orangecheck/agent-cli 0.2.3 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +11 -4
  2. package/dist/cli.js +86 -64
  3. package/dist/cli.js.map +1 -1
  4. package/package.json +2 -2
package/README.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # @orangecheck/agent-cli
2
2
 
3
- Command-line tool for [OC Agent](https://github.com/orangecheck/oc-agent-protocol). Verify, inspect, canonicalize, and reason about delegation / action / revocation envelopes from your shell. Exits 0 on success, 1 on any error. Every command supports `--json` for script-friendly output.
3
+ Command-line tool for [OC Agent](https://github.com/orangecheck/oc-agent-protocol). Verify, inspect, canonicalize, and reason about delegation / action / revocation envelopes from your shell. Exits 0 on success, 1 on any error. `verify`, `inspect`, `scope` and `subscope` support `--json` for script-friendly output.
4
4
 
5
5
  ## Install
6
6
 
@@ -14,20 +14,27 @@ npx @orangecheck/agent-cli verify delegation.json
14
14
 
15
15
  ### `oc-agent verify <file>`
16
16
 
17
- Verify an envelope. Accepts a single envelope, or an array `[delegation, action|revocation]` for full authority verification. Runs the §SPEC 8 algorithm including BIP-322 signature check.
17
+ Verify an envelope. Takes a file holding a single envelope, or an array `[delegation, action]` or `[delegation, revocation]`. Runs the §SPEC 8 algorithm including BIP-322 signature check.
18
18
 
19
19
  ```bash
20
20
  oc-agent verify delegation.json
21
21
  # → OK · delegation verified
22
22
  # id: 36d79600…
23
23
 
24
- oc-agent verify '[delegation.json-contents, action.json-contents]'
24
+ oc-agent verify pair.json # [delegation, action]
25
25
  # → OK · action + delegation verified
26
+ # checked at 2026-10-21T12:00:00.000Z
26
27
  ```
27
28
 
29
+ An action is checked live, as of now (SPEC §8): the delegation in force now and `signed_at` within 120 seconds of your clock, or `E_STALE`. To audit a past action as of its own `signed_at`, add `--as-of-signed-at`; the output says that time is the agent's claim unless a verified anchor fixes it.
30
+
31
+ The CLI has no relay access. Pass the revocations you fetched (`{ kinds: [30085], "#t": [<delegation id>] }`) as a JSON array with `--revocations`; without it, the output says revocation was not checked.
32
+
28
33
  Flags:
34
+ - `--revocations <file>` — the revocations fetched for the delegation, as a JSON array
35
+ - `--as-of-signed-at` — audit a past action as of its own `signed_at`
29
36
  - `--skip-sig` — skip BIP-322 signature verification (useful for test vectors with placeholder sigs)
30
- - `--skip-temporal` — skip `issued_at` / `expires_at` checks (for inspecting historical envelopes)
37
+ - `--skip-temporal` — skip `issued_at` / `expires_at` checks on a delegation alone (for inspecting historical envelopes)
31
38
  - `--json` — emit machine-readable JSON
32
39
 
33
40
  Exits `1` with an error code on rejection:
package/dist/cli.js CHANGED
@@ -1,77 +1,87 @@
1
1
  #!/usr/bin/env node
2
2
  import { readFile } from 'fs/promises';
3
- import { verifyAction, verifyRevocation, verifyDelegation, parseScope, validateScope, canonicalizeScope, REGISTERED_SCOPES, isSubScope, computeDelegationId, computeActionId, computeRevocationId, delegationCanonicalMessage, actionCanonicalMessage, revocationCanonicalMessage } from '@orangecheck/agent-core';
3
+ import { createRequire } from 'module';
4
+ import { verifyActionAsOfSignedAt, verifyAction, verifyRevocation, verifyDelegation, parseScope, validateScope, canonicalizeScope, REGISTERED_SCOPES, isSubScope, computeDelegationId, computeActionId, computeRevocationId, delegationCanonicalMessage, actionCanonicalMessage, revocationCanonicalMessage } from '@orangecheck/agent-core';
4
5
  import { verifySignature } from '@orangecheck/bip322';
5
6
  import { Command } from 'commander';
6
7
 
7
8
  var program = new Command();
8
- program.name("oc-agent").description("command-line verifier for OC Agent envelopes").version("0.1.0");
9
+ program.name("oc-agent").description("command-line verifier for OC Agent envelopes").version(createRequire(import.meta.url)("../package.json").version);
9
10
  program.command("verify").description(
10
11
  "verify an envelope (delegation / action / revocation). accepts a single envelope, or an array [delegation, action|revocation] for full authority verification."
11
- ).argument("<file>", 'path to the envelope JSON file, or "-" for stdin').option("--json", "machine-readable JSON output", false).option("--skip-sig", "skip BIP-322 signature verification", false).option("--skip-temporal", "skip issued_at / expires_at checks", false).action(async (file, opts) => {
12
- const parsed = JSON.parse(await read(file));
13
- const verifyBip322 = opts.skipSig ? void 0 : async (msg, sig, addr) => {
14
- return verifySignature(addr, msg, sig);
15
- };
16
- if (Array.isArray(parsed) && parsed.length === 2) {
17
- const [d, a] = parsed;
18
- if (a.kind === "agent-action") {
19
- const r = await verifyAction({
20
- action: a,
21
- delegation: d,
12
+ ).argument("<file>", 'path to the envelope JSON file, or "-" for stdin').option("--json", "machine-readable JSON output", false).option("--skip-sig", "skip BIP-322 signature verification", false).option("--skip-temporal", "skip issued_at / expires_at checks", false).option(
13
+ "--revocations <file>",
14
+ "a JSON array of the revocations fetched for the delegation; without it, revocation is not checked"
15
+ ).option(
16
+ "--as-of-signed-at",
17
+ "audit a past action as of its own signed_at instead of now; that time is the agent's claim unless anchored",
18
+ false
19
+ ).action(
20
+ async (file, opts) => {
21
+ const parsed = JSON.parse(await read(file));
22
+ const revocations = opts.revocations ? JSON.parse(await read(opts.revocations)) : void 0;
23
+ const revocationInput = revocations ? { revocations } : { skipRevocationCheck: true };
24
+ const verifyBip322 = opts.skipSig ? void 0 : async (msg, sig, addr) => {
25
+ return verifySignature(addr, msg, sig);
26
+ };
27
+ if (Array.isArray(parsed) && parsed.length === 2) {
28
+ const [d, a] = parsed;
29
+ if (a.kind === "agent-action") {
30
+ const input = {
31
+ action: a,
32
+ delegation: d,
33
+ verifyBip322,
34
+ skipSignatureVerification: opts.skipSig,
35
+ ...revocationInput
36
+ };
37
+ const r = opts.asOfSignedAt ? await verifyActionAsOfSignedAt(input) : await verifyAction(input);
38
+ if (!r.ok && r.code === "E_STALE") {
39
+ die(opts.json, r.code, `${r.message}. To audit a past action, add --as-of-signed-at.`);
40
+ }
41
+ report(r, opts.json, "action + delegation", !opts.skipSig, !!revocations, r.ok ? r.asOf : void 0);
42
+ return;
43
+ }
44
+ if (a.kind === "agent-revocation") {
45
+ const r = await verifyRevocation({
46
+ envelope: a,
47
+ delegation: d,
48
+ verifyBip322,
49
+ skipSignatureVerification: opts.skipSig
50
+ });
51
+ report(r, opts.json, "revocation + delegation", !opts.skipSig, true);
52
+ return;
53
+ }
54
+ die(opts.json, "UNKNOWN_PAIR", `unknown second envelope kind: ${a.kind}`);
55
+ }
56
+ const env = parsed;
57
+ if (env.kind === "agent-delegation") {
58
+ const r = await verifyDelegation({
59
+ envelope: env,
22
60
  verifyBip322,
23
61
  skipSignatureVerification: opts.skipSig,
24
- // This CLI reads envelopes from files and stdin and has no
25
- // relay access by design, so it genuinely cannot query the
26
- // kind-30085 feed. agent-core 2.0.0 makes that a statement
27
- // rather than an omission — and report() discloses it, so
28
- // "OK" never silently means "possibly revoked".
29
- skipRevocationCheck: true
62
+ skipTemporalCheck: opts.skipTemporal,
63
+ ...revocationInput
30
64
  });
31
- report(r, opts.json, "action + delegation", !opts.skipSig);
65
+ report(r, opts.json, "delegation", !opts.skipSig, !!revocations);
32
66
  return;
33
67
  }
34
- if (a.kind === "agent-revocation") {
35
- const r = await verifyRevocation({
36
- envelope: a,
37
- delegation: d,
38
- verifyBip322,
39
- skipSignatureVerification: opts.skipSig
40
- });
41
- report(r, opts.json, "revocation + delegation", !opts.skipSig);
42
- return;
68
+ if (env.kind === "agent-action") {
69
+ die(
70
+ opts.json,
71
+ "NEED_DELEGATION",
72
+ "an action envelope needs the cited delegation. pass an array: [delegation, action]."
73
+ );
43
74
  }
44
- die(opts.json, "UNKNOWN_PAIR", `unknown second envelope kind: ${a.kind}`);
45
- }
46
- const env = parsed;
47
- if (env.kind === "agent-delegation") {
48
- const r = await verifyDelegation({
49
- envelope: env,
50
- verifyBip322,
51
- skipSignatureVerification: opts.skipSig,
52
- skipTemporalCheck: opts.skipTemporal,
53
- skipRevocationCheck: true
54
- // offline verifier — see the note above
55
- });
56
- report(r, opts.json, "delegation", !opts.skipSig);
57
- return;
58
- }
59
- if (env.kind === "agent-action") {
60
- die(
61
- opts.json,
62
- "NEED_DELEGATION",
63
- "an action envelope needs the cited delegation. pass an array: [delegation, action]."
64
- );
65
- }
66
- if (env.kind === "agent-revocation") {
67
- die(
68
- opts.json,
69
- "NEED_DELEGATION",
70
- "a revocation envelope needs the cited delegation. pass an array: [delegation, revocation]."
71
- );
75
+ if (env.kind === "agent-revocation") {
76
+ die(
77
+ opts.json,
78
+ "NEED_DELEGATION",
79
+ "a revocation envelope needs the cited delegation. pass an array: [delegation, revocation]."
80
+ );
81
+ }
82
+ die(opts.json, "UNKNOWN_KIND", `unknown envelope kind: ${env.kind}`);
72
83
  }
73
- die(opts.json, "UNKNOWN_KIND", `unknown envelope kind: ${env.kind}`);
74
- });
84
+ );
75
85
  program.command("inspect").description("pretty-print an envelope with key fields and a recomputed id.").argument("<file>", 'path to the envelope JSON file, or "-" for stdin').option("--json", "machine-readable JSON output", false).action(async (file, opts) => {
76
86
  const env = JSON.parse(await read(file));
77
87
  const recomputed = recomputeId(env);
@@ -240,9 +250,19 @@ function canonicalMessageFor(env) {
240
250
  signed_at: env.signed_at
241
251
  });
242
252
  }
243
- function report(result, asJson, what, signatureChecked) {
253
+ function report(result, asJson, what, signatureChecked, revocationChecked, asOf) {
244
254
  if (result.ok) {
245
- const revNote = "revocation not checked (offline) \u2014 query kind-30085 by #delegation";
255
+ const notes = [];
256
+ if (!revocationChecked) {
257
+ notes.push(
258
+ 'revocation not checked (offline) \u2014 query kind 30085 with "#t": [delegation id] and pass --revocations'
259
+ );
260
+ }
261
+ if (asOf?.basis === "signed_at") {
262
+ notes.push(
263
+ asOf.anchored ? `checked as of signed_at ${asOf.signedAt}, fixed by a verified anchor` : `checked as of signed_at ${asOf.signedAt}, which is the agent's own claim (no verified anchor)`
264
+ );
265
+ }
246
266
  if (asJson) {
247
267
  console.log(
248
268
  JSON.stringify({
@@ -250,8 +270,9 @@ function report(result, asJson, what, signatureChecked) {
250
270
  verified: what,
251
271
  id: result.id,
252
272
  signature_checked: signatureChecked,
253
- revocation_checked: false,
254
- note: revNote
273
+ revocation_checked: revocationChecked,
274
+ ...asOf ? { as_of: asOf } : {},
275
+ notes
255
276
  })
256
277
  );
257
278
  } else {
@@ -259,7 +280,8 @@ function report(result, asJson, what, signatureChecked) {
259
280
  signatureChecked ? `OK \xB7 ${what} verified` : `OK \xB7 ${what} well-formed \u2014 signature NOT checked (--skip-sig)`
260
281
  );
261
282
  console.log(` id: ${result.id}`);
262
- console.log(` ! ${revNote}`);
283
+ if (asOf?.basis === "now") console.log(` checked at ${asOf.now}`);
284
+ for (const n of notes) console.log(` ! ${n}`);
263
285
  }
264
286
  return;
265
287
  }
package/dist/cli.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AAiCA,IAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,OAAA,CACK,KAAK,UAAU,CAAA,CACf,YAAY,8CAA8C,CAAA,CAC1D,QAAQ,OAAO,CAAA;AAMpB,OAAA,CACK,OAAA,CAAQ,QAAQ,CAAA,CAChB,WAAA;AAAA,EACG;AACJ,CAAA,CACC,QAAA,CAAS,UAAU,kDAAkD,CAAA,CACrE,OAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,YAAA,EAAc,uCAAuC,KAAK,CAAA,CACjE,OAAO,iBAAA,EAAmB,oCAAA,EAAsC,KAAK,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,EAAc,IAAA,KAAqE;AAC9F,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAE1C,EAAA,MAAM,eAAe,IAAA,CAAK,OAAA,GACpB,SACA,OAAO,GAAA,EAAa,KAAa,IAAA,KAAiB;AAC9C,IAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AAAA,EACzC,CAAA;AAEN,EAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,IAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC9C,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACf,IAAA,IAAI,CAAA,CAAE,SAAS,cAAA,EAAgB;AAC3B,MAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa;AAAA,QACzB,MAAA,EAAQ,CAAA;AAAA,QACR,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMhC,mBAAA,EAAqB;AAAA,OACxB,CAAA;AACD,MAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAuB,CAAC,KAAK,OAAO,CAAA;AACzD,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,CAAA,CAAE,SAAS,kBAAA,EAAoB;AAC/B,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,QAC7B,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK;AAAA,OACnC,CAAA;AACD,MAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,yBAAA,EAA2B,CAAC,KAAK,OAAO,CAAA;AAC7D,MAAA;AAAA,IACJ;AACA,IAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,8BAAA,EAAkC,CAAA,CAAkB,IAAI,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA;AACZ,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,MAC7B,QAAA,EAAU,GAAA;AAAA,MACV,YAAA;AAAA,MACA,2BAA2B,IAAA,CAAK,OAAA;AAAA,MAChC,mBAAmB,IAAA,CAAK,YAAA;AAAA,MACxB,mBAAA,EAAqB;AAAA;AAAA,KACxB,CAAA;AACD,IAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,CAAC,KAAK,OAAO,CAAA;AAChD,IAAA;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,GAAA;AAAA,MACI,IAAA,CAAK,IAAA;AAAA,MACL,iBAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,uBAAA,EAA2B,GAAA,CAAoB,IAAI,CAAA,CAAE,CAAA;AACxF,CAAC,CAAA;AAML,OAAA,CACK,QAAQ,SAAS,CAAA,CACjB,YAAY,+DAA+D,CAAA,CAC3E,SAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,OAAO,MAAc,IAAA,KAA4B;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,MAAM,UAAA,GAAa,YAAY,GAAG,CAAA;AAClC,EAAA,IAAI,KAAK,IAAA,EAAM;AACX,IAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,GAAA,EAAK,aAAA,EAAe,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AACjF,IAAA;AAAA,EACJ;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,CAAC,CAAA,CAAE,CAAA;AAC/B,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,EAAE,CAAA,CAAE,CAAA;AAChC,EAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAU,CAAA,CAAA,EAAI,eAAe,GAAA,CAAI,EAAA,GAAK,QAAA,GAAM,QAAG,CAAA,CAAE,CAAA;AAChF,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAC1C,IAAA,IAAI,IAAI,IAAA,EAAM;AACV,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,cAAA,EAAgB,CAAA,uBAAA,EAAuB,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAAA,IAC5G,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,CAAiB,CAAA;AAAA,IACjC;AAKA,IAAA,IAAI,IAAI,MAAA,EAAQ;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA,OAAA,CAAS,CAAA;AACrB,MAAA,KAAA,MAAW,KAAK,GAAA,CAAI,MAAA,UAAgB,GAAA,CAAI,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,IACtD,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,yEAAA,CAAsE,CAAA;AAAA,IACtF;AAAA,EACJ,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB;AACpC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC/C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACnD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,eAAe,CAAA,CAAE,CAAA;AACrD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,IAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/D,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,kBAAA,EAAoB;AACxC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,IAAU,QAAQ,CAAA,CAAE,CAAA;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,WAAW,CAAA,CACnB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,KAAiB;AAC5B,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,mBAAA,CAAoB,GAAG,CAAC,CAAA;AACjD,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,OAAO,CAAA,CACf,WAAA,CAAY,2EAA2E,CAAA,CACvF,QAAA,CAAS,SAAA,EAAW,kDAAkD,CAAA,CACtE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,cAAA,EAAgB,6CAAA,EAA+C,KAAK,CAAA,CAC3E,MAAA,CAAO,CAAC,KAAA,EAAe,IAAA,KAAiD;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,IAAA,aAAA,CAAc,QAAQ,EAAE,IAAA,EAAM,KAAK,UAAA,GAAa,YAAA,GAAe,UAAU,CAAA;AACzE,IAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAC1C,IAAA,MAAM,UAAA,GAAa,CAAC,CAAC,iBAAA,CAAkB,CAAA,EAAG,OAAO,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACzE,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,IACpF,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,CAAI,CAAA;AAChB,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,CAAA;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC1C,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACvC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,YAAA,EAAe,UAAA,GAAa,KAAA,GAAQ,+BAA+B,CAAA,CAAE,CAAA;AACjF,MAAA,IAAI,MAAA,CAAO,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC/B,QAAA,OAAA,CAAQ,IAAI,CAAA,YAAA,CAAc,CAAA;AAC1B,QAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,UAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,KAAA,IAAS,YAAY,CAAA,CAAE,CAAA;AAAA,QACjE;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,SAAS,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,CAAA,CAAY,OAAO,CAAA;AAAA,EAC9D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,WAAA,EAAa,0BAA0B,CAAA,CAChD,QAAA,CAAS,eAAe,4BAA4B,CAAA,CACpD,MAAA,CAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,CAAC,OAAA,EAAiB,SAAA,EAAmB,IAAA,KAA4B;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,CAAA,GAAI,WAAW,OAAO,CAAA;AAC5B,IAAA,MAAM,CAAA,GAAI,WAAW,SAAS,CAAA;AAC9B,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AAChC,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,CAAC,CAAA;AAAA,IAC5C,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,GAAW,UAAA,GAAa,2BAA2B,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,CAAC,QAAA,EAAU,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,GAAA,CAAc,OAAO,CAAA;AAAA,EAChE;AACJ,CAAC,CAAA;AAML,eAAe,KAAK,IAAA,EAA+B;AAC/C,EAAA,IAAI,SAAS,GAAA,EAAK;AACd,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,WAAA,MAAiB,KAAA,IAAS,OAAA,CAAQ,KAAA,EAAO,GAAA,IAAO,KAAA;AAChD,IAAA,OAAO,GAAA;AAAA,EACX;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,MAAM,CAAA;AAChC;AAEA,SAAS,YAAY,GAAA,EAA0B;AAC3C,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,mBAAA,CAAoB;AAAA,MACvB,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,eAAA,CAAgB;AAAA,MACnB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,mBAAA,CAAoB;AAAA,IACvB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,oBAAoB,GAAA,EAA0B;AACnD,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,0BAAA,CAA2B;AAAA,MAC9B,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,sBAAA,CAAuB;AAAA,MAC1B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,0BAAA,CAA2B;AAAA,IAC9B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,MAAA,CACL,MAAA,EACA,MAAA,EACA,IAAA,EACA,gBAAA,EACI;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AAIX,IAAA,MAAM,OAAA,GAAU,yEAAA;AAChB,IAAA,IAAI,MAAA,EAAQ;AACR,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,KAAK,SAAA,CAAU;AAAA,UACX,EAAA,EAAI,IAAA;AAAA,UACJ,QAAA,EAAU,IAAA;AAAA,UACV,IAAI,MAAA,CAAO,EAAA;AAAA,UACX,iBAAA,EAAmB,gBAAA;AAAA,UACnB,kBAAA,EAAoB,KAAA;AAAA,UACpB,IAAA,EAAM;AAAA,SACT;AAAA,OACL;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,gBAAA,GACM,CAAA,QAAA,EAAQ,IAAI,CAAA,SAAA,CAAA,GACZ,WAAQ,IAAI,CAAA,sDAAA;AAAA,OACtB;AACA,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,MAAA,EAAS,MAAA,CAAO,EAAE,CAAA,CAAE,CAAA;AAChC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IAChC;AACA,IAAA;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AAC3C;AAEA,SAAS,GAAA,CAAI,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAwB;AAChE,EAAA,IAAI,MAAA,EAAQ;AACR,IAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,SAAA,CAAU,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,CAAC,CAAA;AAAA,EAC9D,CAAA,MAAO;AACH,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,cAAA,EAAc,IAAI,CAAA,CAAE,CAAA;AAClC,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAAA,EAChC;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,OAAA,CAAQ,UAAA,EAAW,CAAE,KAAA,CAAM,CAAC,GAAA,KAAe;AACvC,EAAA,OAAA,CAAQ,KAAA,CAAM,IAAI,OAAO,CAAA;AACzB,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"cli.js","sourcesContent":["// oc-agent — command-line tool for OC Agent v1 envelopes.\n//\n// Verify, inspect, canonicalize, and check scope containment against the\n// same @orangecheck/agent-core the reference web client uses. Exits 0 on\n// success, 1 on any verification/parse error; every command supports --json\n// for script-friendly output.\n\nimport { readFile } from 'node:fs/promises';\n\nimport {\n actionCanonicalMessage,\n canonicalizeScope,\n computeActionId,\n computeDelegationId,\n computeRevocationId,\n delegationCanonicalMessage,\n isSubScope,\n parseScope,\n REGISTERED_SCOPES,\n revocationCanonicalMessage,\n validateScope,\n verifyAction,\n verifyDelegation,\n verifyRevocation,\n type ActionEnvelope,\n type DelegationEnvelope,\n type RevocationEnvelope,\n} from '@orangecheck/agent-core';\nimport { verifySignature } from '@orangecheck/bip322';\nimport { Command } from 'commander';\n\ntype AnyEnvelope = DelegationEnvelope | ActionEnvelope | RevocationEnvelope;\n\nconst program = new Command();\n\nprogram\n .name('oc-agent')\n .description('command-line verifier for OC Agent envelopes')\n .version('0.1.0');\n\n// ─────────────────────────────────────────────────────────────────────────────\n// verify\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('verify')\n .description(\n 'verify an envelope (delegation / action / revocation). accepts a single envelope, or an array [delegation, action|revocation] for full authority verification.'\n )\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .option('--skip-sig', 'skip BIP-322 signature verification', false)\n .option('--skip-temporal', 'skip issued_at / expires_at checks', false)\n .action(async (file: string, opts: { json: boolean; skipSig: boolean; skipTemporal: boolean }) => {\n const parsed = JSON.parse(await read(file));\n\n const verifyBip322 = opts.skipSig\n ? undefined\n : async (msg: string, sig: string, addr: string) => {\n return verifySignature(addr, msg, sig);\n };\n\n if (Array.isArray(parsed) && parsed.length === 2) {\n const [d, a] = parsed as [DelegationEnvelope, ActionEnvelope | RevocationEnvelope];\n if (a.kind === 'agent-action') {\n const r = await verifyAction({\n action: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n // This CLI reads envelopes from files and stdin and has no\n // relay access by design, so it genuinely cannot query the\n // kind-30085 feed. agent-core 2.0.0 makes that a statement\n // rather than an omission — and report() discloses it, so\n // \"OK\" never silently means \"possibly revoked\".\n skipRevocationCheck: true,\n });\n report(r, opts.json, 'action + delegation', !opts.skipSig);\n return;\n }\n if (a.kind === 'agent-revocation') {\n const r = await verifyRevocation({\n envelope: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n });\n report(r, opts.json, 'revocation + delegation', !opts.skipSig);\n return;\n }\n die(opts.json, 'UNKNOWN_PAIR', `unknown second envelope kind: ${(a as AnyEnvelope).kind}`);\n }\n\n const env = parsed as AnyEnvelope;\n if (env.kind === 'agent-delegation') {\n const r = await verifyDelegation({\n envelope: env,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n skipTemporalCheck: opts.skipTemporal,\n skipRevocationCheck: true, // offline verifier — see the note above\n });\n report(r, opts.json, 'delegation', !opts.skipSig);\n return;\n }\n if (env.kind === 'agent-action') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'an action envelope needs the cited delegation. pass an array: [delegation, action].'\n );\n }\n if (env.kind === 'agent-revocation') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'a revocation envelope needs the cited delegation. pass an array: [delegation, revocation].'\n );\n }\n die(opts.json, 'UNKNOWN_KIND', `unknown envelope kind: ${(env as AnyEnvelope).kind}`);\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// inspect\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('inspect')\n .description('pretty-print an envelope with key fields and a recomputed id.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .action(async (file: string, opts: { json: boolean }) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n const recomputed = recomputeId(env);\n if (opts.json) {\n console.log(JSON.stringify({ envelope: env, recomputed_id: recomputed }, null, 2));\n return;\n }\n console.log(`kind: ${env.kind}`);\n console.log(`v: ${env.v}`);\n console.log(`id: ${env.id}`);\n console.log(`id(recomputed): ${recomputed} ${recomputed === env.id ? '✓' : '✗'}`);\n if (env.kind === 'agent-delegation') {\n console.log(`principal: ${env.principal.address}`);\n console.log(`agent: ${env.agent.address}`);\n console.log(`issued: ${env.issued_at}`);\n console.log(`expires: ${env.expires_at}`);\n if (env.bond) {\n console.log(`bond: ${env.bond.sats.toLocaleString()} sats · attestation=${env.bond.attestation_id}`);\n } else {\n console.log(`bond: none`);\n }\n // v1.2 private mode seals the grant into `scopes_encrypted` and\n // omits `scopes`, so an absent list is not an empty grant — it is a\n // grant this reader cannot see. Printing \"scopes:\" with nothing\n // under it would read as \"no permissions\", the opposite of true.\n if (env.scopes) {\n console.log(`scopes:`);\n for (const s of env.scopes) console.log(` - ${s}`);\n } else {\n console.log(`scopes: sealed (v1.2 private mode) — needs a recipient device key`);\n }\n } else if (env.kind === 'agent-action') {\n console.log(`agent: ${env.signer.address}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`scope_exercised: ${env.scope_exercised}`);\n console.log(`content.hash: ${env.content.hash}`);\n console.log(`content.length: ${env.content.length}`);\n console.log(`content.mime: ${env.content.mime}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n } else if (env.kind === 'agent-revocation') {\n console.log(`signer: ${env.signer.address}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`reason: ${env.reason || '(none)'}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// canonical\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('canonical')\n .description('print the canonical message that an envelope commits to.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .action(async (file: string) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n process.stdout.write(canonicalMessageFor(env));\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// scope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('scope')\n .description('parse a scope string and print its canonical form + registered-key check.')\n .argument('<scope>', 'the scope string, e.g. \"ln:send(max_sats<=1000)\"')\n .option('--json', 'machine-readable JSON output', false)\n .option('--permissive', 'accept unregistered products / verbs / keys', false)\n .action((scope: string, opts: { json: boolean; permissive: boolean }) => {\n try {\n const parsed = parseScope(scope);\n validateScope(parsed, { mode: opts.permissive ? 'permissive' : 'strict' });\n const canonical = canonicalizeScope(parsed);\n const registered = !!REGISTERED_SCOPES[`${parsed.product}:${parsed.verb}`];\n if (opts.json) {\n console.log(JSON.stringify({ ok: true, canonical, parsed, registered }, null, 2));\n } else {\n console.log(`ok`);\n console.log(`canonical: ${canonical}`);\n console.log(`product: ${parsed.product}`);\n console.log(`verb: ${parsed.verb}`);\n console.log(`registered: ${registered ? 'yes' : 'NO (strict mode would reject)'}`);\n if (parsed.constraints.length > 0) {\n console.log(`constraints:`);\n for (const c of parsed.constraints) {\n console.log(` - ${c.key} ${c.op} ${c.value ?? '(wildcard)'}`);\n }\n }\n }\n } catch (e) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (e as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// subscope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('subscope')\n .description('check whether exercised scope is a sub-scope of granted.')\n .argument('<granted>', 'the granted scope string')\n .argument('<exercised>', 'the exercised scope string')\n .option('--json', 'machine-readable JSON output', false)\n .action((granted: string, exercised: string, opts: { json: boolean }) => {\n try {\n const g = parseScope(granted);\n const e = parseScope(exercised);\n const admitted = isSubScope(e, g);\n if (opts.json) {\n console.log(JSON.stringify({ admitted }));\n } else {\n console.log(admitted ? 'admitted' : 'rejected (E_SCOPE_DENIED)');\n }\n if (!admitted) process.exit(1);\n } catch (err) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (err as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nasync function read(path: string): Promise<string> {\n if (path === '-') {\n let acc = '';\n for await (const chunk of process.stdin) acc += chunk;\n return acc;\n }\n return readFile(path, 'utf8');\n}\n\nfunction recomputeId(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot recompute a delegation id for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted and must be decrypted with a recipient device key first',\n );\n }\n return computeDelegationId({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return computeActionId({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return computeRevocationId({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\nfunction canonicalMessageFor(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot rebuild the canonical message for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted',\n );\n }\n return delegationCanonicalMessage({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return actionCanonicalMessage({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return revocationCanonicalMessage({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\nfunction report(\n result: { ok: true; id: string } | { ok: false; code: string; message: string },\n asJson: boolean,\n what: string,\n signatureChecked: boolean\n): void {\n if (result.ok) {\n // Revocation is NOT part of this verdict: the CLI has no relay. Saying\n // so is the difference between \"this envelope is authentic\" and \"this\n // grant is still in force\", which are not the same claim.\n const revNote = 'revocation not checked (offline) — query kind-30085 by #delegation';\n if (asJson) {\n console.log(\n JSON.stringify({\n ok: true,\n verified: what,\n id: result.id,\n signature_checked: signatureChecked,\n revocation_checked: false,\n note: revNote,\n }),\n );\n } else {\n console.log(\n signatureChecked\n ? `OK · ${what} verified`\n : `OK · ${what} well-formed — signature NOT checked (--skip-sig)`,\n );\n console.log(` id: ${result.id}`);\n console.log(` ! ${revNote}`);\n }\n return;\n }\n die(asJson, result.code, result.message);\n}\n\nfunction die(asJson: boolean, code: string, message: string): never {\n if (asJson) {\n console.error(JSON.stringify({ ok: false, code, message }));\n } else {\n console.error(`REJECTED · ${code}`);\n console.error(` ${message}`);\n }\n process.exit(1);\n}\n\nprogram.parseAsync().catch((err: Error) => {\n console.error(err.message);\n process.exit(1);\n});\n"]}
1
+ {"version":3,"sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;;AAmCA,IAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,OAAA,CACK,IAAA,CAAK,UAAU,CAAA,CACf,WAAA,CAAY,8CAA8C,CAAA,CAC1D,OAAA,CAAS,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA,CAAE,iBAAiB,EAA0B,OAAO,CAAA;AAM/F,OAAA,CACK,OAAA,CAAQ,QAAQ,CAAA,CAChB,WAAA;AAAA,EACG;AACJ,CAAA,CACC,SAAS,QAAA,EAAU,kDAAkD,EACrE,MAAA,CAAO,QAAA,EAAU,gCAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,YAAA,EAAc,uCAAuC,KAAK,CAAA,CACjE,OAAO,iBAAA,EAAmB,oCAAA,EAAsC,KAAK,CAAA,CACrE,MAAA;AAAA,EACG,sBAAA;AAAA,EACA;AACJ,CAAA,CACC,MAAA;AAAA,EACG,mBAAA;AAAA,EACA,4GAAA;AAAA,EACA;AACJ,CAAA,CACC,MAAA;AAAA,EACG,OACI,MACA,IAAA,KAOC;AACL,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC1C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,GAClB,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAA,CAAK,WAAW,CAAC,CAAA,GACxC,MAAA;AAIN,IAAA,MAAM,kBAAkB,WAAA,GAAc,EAAE,aAAY,GAAI,EAAE,qBAAqB,IAAA,EAAK;AAEpF,IAAA,MAAM,eAAe,IAAA,CAAK,OAAA,GACpB,SACA,OAAO,GAAA,EAAa,KAAa,IAAA,KAAiB;AAC9C,MAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AAAA,IACzC,CAAA;AAEN,IAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,IAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC9C,MAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,MAAA;AACf,MAAA,IAAI,CAAA,CAAE,SAAS,cAAA,EAAgB;AAC3B,QAAA,MAAM,KAAA,GAAQ;AAAA,UACV,MAAA,EAAQ,CAAA;AAAA,UACR,UAAA,EAAY,CAAA;AAAA,UACZ,YAAA;AAAA,UACA,2BAA2B,IAAA,CAAK,OAAA;AAAA,UAChC,GAAG;AAAA,SACP;AAGA,QAAA,MAAM,CAAA,GAAI,KAAK,YAAA,GACT,MAAM,yBAAyB,KAAK,CAAA,GACpC,MAAM,YAAA,CAAa,KAAK,CAAA;AAC9B,QAAA,IAAI,CAAC,CAAA,CAAE,EAAA,IAAM,CAAA,CAAE,SAAS,SAAA,EAAW;AAC/B,UAAA,GAAA,CAAI,KAAK,IAAA,EAAM,CAAA,CAAE,MAAM,CAAA,EAAG,CAAA,CAAE,OAAO,CAAA,gDAAA,CAAkD,CAAA;AAAA,QACzF;AACA,QAAA,MAAA,CAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAuB,CAAC,IAAA,CAAK,OAAA,EAAS,CAAC,CAAC,WAAA,EAAa,CAAA,CAAE,EAAA,GAAK,CAAA,CAAE,OAAO,MAAS,CAAA;AACnG,QAAA;AAAA,MACJ;AACA,MAAA,IAAI,CAAA,CAAE,SAAS,kBAAA,EAAoB;AAC/B,QAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,UAC7B,QAAA,EAAU,CAAA;AAAA,UACV,UAAA,EAAY,CAAA;AAAA,UACZ,YAAA;AAAA,UACA,2BAA2B,IAAA,CAAK;AAAA,SACnC,CAAA;AACD,QAAA,MAAA,CAAO,GAAG,IAAA,CAAK,IAAA,EAAM,2BAA2B,CAAC,IAAA,CAAK,SAAS,IAAI,CAAA;AACnE,QAAA;AAAA,MACJ;AACA,MAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,8BAAA,EAAkC,CAAA,CAAkB,IAAI,CAAA,CAAE,CAAA;AAAA,IAC7F;AAEA,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB;AAAA,QAC7B,QAAA,EAAU,GAAA;AAAA,QACV,YAAA;AAAA,QACA,2BAA2B,IAAA,CAAK,OAAA;AAAA,QAChC,mBAAmB,IAAA,CAAK,YAAA;AAAA,QACxB,GAAG;AAAA,OACN,CAAA;AACD,MAAA,MAAA,CAAO,CAAA,EAAG,KAAK,IAAA,EAAM,YAAA,EAAc,CAAC,IAAA,CAAK,OAAA,EAAS,CAAC,CAAC,WAAW,CAAA;AAC/D,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,MAAA,GAAA;AAAA,QACI,IAAA,CAAK,IAAA;AAAA,QACL,iBAAA;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,MAAA,GAAA;AAAA,QACI,IAAA,CAAK,IAAA;AAAA,QACL,iBAAA;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,GAAA,CAAI,KAAK,IAAA,EAAM,cAAA,EAAgB,CAAA,uBAAA,EAA2B,GAAA,CAAoB,IAAI,CAAA,CAAE,CAAA;AAAA,EACpF;AACJ,CAAA;AAMJ,OAAA,CACK,QAAQ,SAAS,CAAA,CACjB,YAAY,+DAA+D,CAAA,CAC3E,SAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,OAAO,MAAc,IAAA,KAA4B;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,MAAM,UAAA,GAAa,YAAY,GAAG,CAAA;AAClC,EAAA,IAAI,KAAK,IAAA,EAAM;AACX,IAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,GAAA,EAAK,aAAA,EAAe,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AACjF,IAAA;AAAA,EACJ;AACA,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,IAAI,CAAA,CAAE,CAAA;AAClC,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,CAAC,CAAA,CAAE,CAAA;AAC/B,EAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,SAAA,EAAY,GAAA,CAAI,EAAE,CAAA,CAAE,CAAA;AAChC,EAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAU,CAAA,CAAA,EAAI,eAAe,GAAA,CAAI,EAAA,GAAK,QAAA,GAAM,QAAG,CAAA,CAAE,CAAA;AAChF,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAA,CAAU,OAAO,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAC1C,IAAA,IAAI,IAAI,IAAA,EAAM;AACV,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,cAAA,EAAgB,CAAA,uBAAA,EAAuB,GAAA,CAAI,IAAA,CAAK,cAAc,CAAA,CAAE,CAAA;AAAA,IAC5G,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,CAAiB,CAAA;AAAA,IACjC;AAKA,IAAA,IAAI,IAAI,MAAA,EAAQ;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA,OAAA,CAAS,CAAA;AACrB,MAAA,KAAA,MAAW,KAAK,GAAA,CAAI,MAAA,UAAgB,GAAA,CAAI,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,IACtD,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,yEAAA,CAAsE,CAAA;AAAA,IACtF;AAAA,EACJ,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,EAAgB;AACpC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC/C,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACnD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,eAAe,CAAA,CAAE,CAAA;AACrD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AACpD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,IAAI,CAAA,iBAAA,EAAoB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC/D,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,kBAAA,EAAoB;AACxC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAClD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,aAAa,CAAA,CAAE,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,MAAA,IAAU,QAAQ,CAAA,CAAE,CAAA;AACtD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,SAAS,CAAA,CAAE,CAAA;AAC7C,IAAA,OAAA,CAAQ,IAAI,CAAA,eAAA,EAAkB,GAAA,CAAI,GAAA,EAAK,MAAA,IAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,WAAW,CAAA,CACnB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,QAAA,EAAU,kDAAkD,CAAA,CACrE,MAAA,CAAO,OAAO,IAAA,KAAiB;AAC5B,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AACvC,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,mBAAA,CAAoB,GAAG,CAAC,CAAA;AACjD,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,OAAO,CAAA,CACf,WAAA,CAAY,2EAA2E,CAAA,CACvF,QAAA,CAAS,SAAA,EAAW,kDAAkD,CAAA,CACtE,MAAA,CAAO,UAAU,8BAAA,EAAgC,KAAK,CAAA,CACtD,MAAA,CAAO,cAAA,EAAgB,6CAAA,EAA+C,KAAK,CAAA,CAC3E,MAAA,CAAO,CAAC,KAAA,EAAe,IAAA,KAAiD;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,IAAA,aAAA,CAAc,QAAQ,EAAE,IAAA,EAAM,KAAK,UAAA,GAAa,YAAA,GAAe,UAAU,CAAA;AACzE,IAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAC1C,IAAA,MAAM,UAAA,GAAa,CAAC,CAAC,iBAAA,CAAkB,CAAA,EAAG,OAAO,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACzE,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,EAAA,EAAI,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,UAAA,EAAW,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,IACpF,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,IAAI,CAAA,EAAA,CAAI,CAAA;AAChB,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,CAAA;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC1C,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,MAAA,CAAO,IAAI,CAAA,CAAE,CAAA;AACvC,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,YAAA,EAAe,UAAA,GAAa,KAAA,GAAQ,+BAA+B,CAAA,CAAE,CAAA;AACjF,MAAA,IAAI,MAAA,CAAO,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC/B,QAAA,OAAA,CAAQ,IAAI,CAAA,YAAA,CAAc,CAAA;AAC1B,QAAA,KAAA,MAAW,CAAA,IAAK,OAAO,WAAA,EAAa;AAChC,UAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,EAAE,CAAA,CAAA,EAAI,CAAA,CAAE,KAAA,IAAS,YAAY,CAAA,CAAE,CAAA;AAAA,QACjE;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,SAAS,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,CAAA,CAAY,OAAO,CAAA;AAAA,EAC9D;AACJ,CAAC,CAAA;AAML,OAAA,CACK,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,0DAA0D,CAAA,CACtE,QAAA,CAAS,WAAA,EAAa,0BAA0B,CAAA,CAChD,QAAA,CAAS,eAAe,4BAA4B,CAAA,CACpD,MAAA,CAAO,QAAA,EAAU,8BAAA,EAAgC,KAAK,EACtD,MAAA,CAAO,CAAC,OAAA,EAAiB,SAAA,EAAmB,IAAA,KAA4B;AACrE,EAAA,IAAI;AACA,IAAA,MAAM,CAAA,GAAI,WAAW,OAAO,CAAA;AAC5B,IAAA,MAAM,CAAA,GAAI,WAAW,SAAS,CAAA;AAC9B,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AAChC,IAAA,IAAI,KAAK,IAAA,EAAM;AACX,MAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,CAAC,CAAA;AAAA,IAC5C,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,GAAW,UAAA,GAAa,2BAA2B,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,CAAC,QAAA,EAAU,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,qBAAA,EAAwB,GAAA,CAAc,OAAO,CAAA;AAAA,EAChE;AACJ,CAAC,CAAA;AAML,eAAe,KAAK,IAAA,EAA+B;AAC/C,EAAA,IAAI,SAAS,GAAA,EAAK;AACd,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,WAAA,MAAiB,KAAA,IAAS,OAAA,CAAQ,KAAA,EAAO,GAAA,IAAO,KAAA;AAChD,IAAA,OAAO,GAAA;AAAA,EACX;AACA,EAAA,OAAO,QAAA,CAAS,MAAM,MAAM,CAAA;AAChC;AAEA,SAAS,YAAY,GAAA,EAA0B;AAC3C,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,mBAAA,CAAoB;AAAA,MACvB,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,eAAA,CAAgB;AAAA,MACnB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,mBAAA,CAAoB;AAAA,IACvB,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAEA,SAAS,oBAAoB,GAAA,EAA0B;AACnD,EAAA,IAAI,GAAA,CAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OAEJ;AAAA,IACJ;AACA,IAAA,OAAO,0BAAA,CAA2B;AAAA,MAC9B,SAAA,EAAW,IAAI,SAAA,CAAU,OAAA;AAAA,MACzB,KAAA,EAAO,IAAI,KAAA,CAAM,OAAA;AAAA,MACjB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,SAAA,EAAW,GAAA,CAAI,IAAA,EAAM,IAAA,IAAQ,CAAA;AAAA,MAC7B,gBAAA,EAAkB,GAAA,CAAI,IAAA,EAAM,cAAA,IAAkB,MAAA;AAAA,MAC9C,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,cAAA,EAAgB;AAC7B,IAAA,OAAO,sBAAA,CAAuB;AAAA,MAC1B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,MACpB,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,cAAA,EAAgB,IAAI,OAAA,CAAQ,MAAA;AAAA,MAC5B,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,WAAW,GAAA,CAAI,SAAA;AAAA,MACf,eAAe,GAAA,CAAI,aAAA;AAAA,MACnB,iBAAiB,GAAA,CAAI;AAAA,KACxB,CAAA;AAAA,EACL;AACA,EAAA,OAAO,0BAAA,CAA2B;AAAA,IAC9B,OAAA,EAAS,IAAI,MAAA,CAAO,OAAA;AAAA,IACpB,eAAe,GAAA,CAAI,aAAA;AAAA,IACnB,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,WAAW,GAAA,CAAI;AAAA,GAClB,CAAA;AACL;AAIA,SAAS,OACL,MAAA,EACA,MAAA,EACA,IAAA,EACA,gBAAA,EACA,mBACA,IAAA,EACI;AACJ,EAAA,IAAI,OAAO,EAAA,EAAI;AAIX,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACpB,MAAA,KAAA,CAAM,IAAA;AAAA,QACF;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,IAAI,IAAA,EAAM,UAAU,WAAA,EAAa;AAC7B,MAAA,KAAA,CAAM,IAAA;AAAA,QACF,IAAA,CAAK,WACC,CAAA,wBAAA,EAA2B,IAAA,CAAK,QAAQ,CAAA,4BAAA,CAAA,GACxC,CAAA,wBAAA,EAA2B,KAAK,QAAQ,CAAA,qDAAA;AAAA,OAClD;AAAA,IACJ;AACA,IAAA,IAAI,MAAA,EAAQ;AACR,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,KAAK,SAAA,CAAU;AAAA,UACX,EAAA,EAAI,IAAA;AAAA,UACJ,QAAA,EAAU,IAAA;AAAA,UACV,IAAI,MAAA,CAAO,EAAA;AAAA,UACX,iBAAA,EAAmB,gBAAA;AAAA,UACnB,kBAAA,EAAoB,iBAAA;AAAA,UACpB,GAAI,IAAA,GAAO,EAAE,KAAA,EAAO,IAAA,KAAS,EAAC;AAAA,UAC9B;AAAA,SACH;AAAA,OACL;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,OAAA,CAAQ,GAAA;AAAA,QACJ,gBAAA,GACM,CAAA,QAAA,EAAQ,IAAI,CAAA,SAAA,CAAA,GACZ,WAAQ,IAAI,CAAA,sDAAA;AAAA,OACtB;AACA,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,MAAA,EAAS,MAAA,CAAO,EAAE,CAAA,CAAE,CAAA;AAChC,MAAA,IAAI,IAAA,EAAM,UAAU,KAAA,EAAO,OAAA,CAAQ,IAAI,CAAA,aAAA,EAAgB,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACjE,MAAA,KAAA,MAAW,KAAK,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA;AAAA,IACjD;AACA,IAAA;AAAA,EACJ;AACA,EAAA,GAAA,CAAI,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AAC3C;AAEA,SAAS,GAAA,CAAI,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAwB;AAChE,EAAA,IAAI,MAAA,EAAQ;AACR,IAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,SAAA,CAAU,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,CAAC,CAAA;AAAA,EAC9D,CAAA,MAAO;AACH,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,cAAA,EAAc,IAAI,CAAA,CAAE,CAAA;AAClC,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAAA,EAChC;AACA,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB;AAEA,OAAA,CAAQ,UAAA,EAAW,CAAE,KAAA,CAAM,CAAC,GAAA,KAAe;AACvC,EAAA,OAAA,CAAQ,KAAA,CAAM,IAAI,OAAO,CAAA;AACzB,EAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAClB,CAAC,CAAA","file":"cli.js","sourcesContent":["// oc-agent — command-line tool for OC Agent v1 envelopes.\n//\n// Verify, inspect, canonicalize, and check scope containment against the\n// same @orangecheck/agent-core the reference web client uses. Exits 0 on\n// success, 1 on any verification/parse error; verify, inspect, scope and\n// subscope support --json for script-friendly output.\n\nimport { readFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\n\nimport {\n actionCanonicalMessage,\n canonicalizeScope,\n computeActionId,\n computeDelegationId,\n computeRevocationId,\n delegationCanonicalMessage,\n isSubScope,\n parseScope,\n REGISTERED_SCOPES,\n revocationCanonicalMessage,\n validateScope,\n verifyAction,\n verifyActionAsOfSignedAt,\n verifyDelegation,\n verifyRevocation,\n type ActionEnvelope,\n type DelegationEnvelope,\n type RevocationEnvelope,\n} from '@orangecheck/agent-core';\nimport { verifySignature } from '@orangecheck/bip322';\nimport { Command } from 'commander';\n\ntype AnyEnvelope = DelegationEnvelope | ActionEnvelope | RevocationEnvelope;\n\nconst program = new Command();\n\nprogram\n .name('oc-agent')\n .description('command-line verifier for OC Agent envelopes')\n .version((createRequire(import.meta.url)('../package.json') as { version: string }).version);\n\n// ─────────────────────────────────────────────────────────────────────────────\n// verify\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('verify')\n .description(\n 'verify an envelope (delegation / action / revocation). accepts a single envelope, or an array [delegation, action|revocation] for full authority verification.'\n )\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .option('--skip-sig', 'skip BIP-322 signature verification', false)\n .option('--skip-temporal', 'skip issued_at / expires_at checks', false)\n .option(\n '--revocations <file>',\n 'a JSON array of the revocations fetched for the delegation; without it, revocation is not checked'\n )\n .option(\n '--as-of-signed-at',\n \"audit a past action as of its own signed_at instead of now; that time is the agent's claim unless anchored\",\n false\n )\n .action(\n async (\n file: string,\n opts: {\n json: boolean;\n skipSig: boolean;\n skipTemporal: boolean;\n revocations?: string;\n asOfSignedAt: boolean;\n }\n ) => {\n const parsed = JSON.parse(await read(file));\n const revocations = opts.revocations\n ? (JSON.parse(await read(opts.revocations)) as RevocationEnvelope[])\n : undefined;\n // This CLI has no relay access by design, so it cannot query the\n // kind-30085 feed itself: the caller passes what they fetched, or the\n // verdict says revocation was not checked.\n const revocationInput = revocations ? { revocations } : { skipRevocationCheck: true };\n\n const verifyBip322 = opts.skipSig\n ? undefined\n : async (msg: string, sig: string, addr: string) => {\n return verifySignature(addr, msg, sig);\n };\n\n if (Array.isArray(parsed) && parsed.length === 2) {\n const [d, a] = parsed as [DelegationEnvelope, ActionEnvelope | RevocationEnvelope];\n if (a.kind === 'agent-action') {\n const input = {\n action: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n ...revocationInput,\n };\n // Live by default: the delegation must be in force now and the\n // action recent. An audit of a past action asks for it by name.\n const r = opts.asOfSignedAt\n ? await verifyActionAsOfSignedAt(input)\n : await verifyAction(input);\n if (!r.ok && r.code === 'E_STALE') {\n die(opts.json, r.code, `${r.message}. To audit a past action, add --as-of-signed-at.`);\n }\n report(r, opts.json, 'action + delegation', !opts.skipSig, !!revocations, r.ok ? r.asOf : undefined);\n return;\n }\n if (a.kind === 'agent-revocation') {\n const r = await verifyRevocation({\n envelope: a,\n delegation: d,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n });\n report(r, opts.json, 'revocation + delegation', !opts.skipSig, true);\n return;\n }\n die(opts.json, 'UNKNOWN_PAIR', `unknown second envelope kind: ${(a as AnyEnvelope).kind}`);\n }\n\n const env = parsed as AnyEnvelope;\n if (env.kind === 'agent-delegation') {\n const r = await verifyDelegation({\n envelope: env,\n verifyBip322,\n skipSignatureVerification: opts.skipSig,\n skipTemporalCheck: opts.skipTemporal,\n ...revocationInput,\n });\n report(r, opts.json, 'delegation', !opts.skipSig, !!revocations);\n return;\n }\n if (env.kind === 'agent-action') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'an action envelope needs the cited delegation. pass an array: [delegation, action].'\n );\n }\n if (env.kind === 'agent-revocation') {\n die(\n opts.json,\n 'NEED_DELEGATION',\n 'a revocation envelope needs the cited delegation. pass an array: [delegation, revocation].'\n );\n }\n die(opts.json, 'UNKNOWN_KIND', `unknown envelope kind: ${(env as AnyEnvelope).kind}`);\n }\n );\n\n// ─────────────────────────────────────────────────────────────────────────────\n// inspect\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('inspect')\n .description('pretty-print an envelope with key fields and a recomputed id.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .option('--json', 'machine-readable JSON output', false)\n .action(async (file: string, opts: { json: boolean }) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n const recomputed = recomputeId(env);\n if (opts.json) {\n console.log(JSON.stringify({ envelope: env, recomputed_id: recomputed }, null, 2));\n return;\n }\n console.log(`kind: ${env.kind}`);\n console.log(`v: ${env.v}`);\n console.log(`id: ${env.id}`);\n console.log(`id(recomputed): ${recomputed} ${recomputed === env.id ? '✓' : '✗'}`);\n if (env.kind === 'agent-delegation') {\n console.log(`principal: ${env.principal.address}`);\n console.log(`agent: ${env.agent.address}`);\n console.log(`issued: ${env.issued_at}`);\n console.log(`expires: ${env.expires_at}`);\n if (env.bond) {\n console.log(`bond: ${env.bond.sats.toLocaleString()} sats · attestation=${env.bond.attestation_id}`);\n } else {\n console.log(`bond: none`);\n }\n // v1.2 private mode seals the grant into `scopes_encrypted` and\n // omits `scopes`, so an absent list is not an empty grant — it is a\n // grant this reader cannot see. Printing \"scopes:\" with nothing\n // under it would read as \"no permissions\", the opposite of true.\n if (env.scopes) {\n console.log(`scopes:`);\n for (const s of env.scopes) console.log(` - ${s}`);\n } else {\n console.log(`scopes: sealed (v1.2 private mode) — needs a recipient device key`);\n }\n } else if (env.kind === 'agent-action') {\n console.log(`agent: ${env.signer.address}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`scope_exercised: ${env.scope_exercised}`);\n console.log(`content.hash: ${env.content.hash}`);\n console.log(`content.length: ${env.content.length}`);\n console.log(`content.mime: ${env.content.mime}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n } else if (env.kind === 'agent-revocation') {\n console.log(`signer: ${env.signer.address}`);\n console.log(`delegation_id: ${env.delegation_id}`);\n console.log(`reason: ${env.reason || '(none)'}`);\n console.log(`signed_at: ${env.signed_at}`);\n console.log(`ots: ${env.ots?.status ?? 'none'}`);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// canonical\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('canonical')\n .description('print the canonical message that an envelope commits to.')\n .argument('<file>', 'path to the envelope JSON file, or \"-\" for stdin')\n .action(async (file: string) => {\n const env = JSON.parse(await read(file)) as AnyEnvelope;\n process.stdout.write(canonicalMessageFor(env));\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// scope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('scope')\n .description('parse a scope string and print its canonical form + registered-key check.')\n .argument('<scope>', 'the scope string, e.g. \"ln:send(max_sats<=1000)\"')\n .option('--json', 'machine-readable JSON output', false)\n .option('--permissive', 'accept unregistered products / verbs / keys', false)\n .action((scope: string, opts: { json: boolean; permissive: boolean }) => {\n try {\n const parsed = parseScope(scope);\n validateScope(parsed, { mode: opts.permissive ? 'permissive' : 'strict' });\n const canonical = canonicalizeScope(parsed);\n const registered = !!REGISTERED_SCOPES[`${parsed.product}:${parsed.verb}`];\n if (opts.json) {\n console.log(JSON.stringify({ ok: true, canonical, parsed, registered }, null, 2));\n } else {\n console.log(`ok`);\n console.log(`canonical: ${canonical}`);\n console.log(`product: ${parsed.product}`);\n console.log(`verb: ${parsed.verb}`);\n console.log(`registered: ${registered ? 'yes' : 'NO (strict mode would reject)'}`);\n if (parsed.constraints.length > 0) {\n console.log(`constraints:`);\n for (const c of parsed.constraints) {\n console.log(` - ${c.key} ${c.op} ${c.value ?? '(wildcard)'}`);\n }\n }\n }\n } catch (e) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (e as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// subscope\n// ─────────────────────────────────────────────────────────────────────────────\n\nprogram\n .command('subscope')\n .description('check whether exercised scope is a sub-scope of granted.')\n .argument('<granted>', 'the granted scope string')\n .argument('<exercised>', 'the exercised scope string')\n .option('--json', 'machine-readable JSON output', false)\n .action((granted: string, exercised: string, opts: { json: boolean }) => {\n try {\n const g = parseScope(granted);\n const e = parseScope(exercised);\n const admitted = isSubScope(e, g);\n if (opts.json) {\n console.log(JSON.stringify({ admitted }));\n } else {\n console.log(admitted ? 'admitted' : 'rejected (E_SCOPE_DENIED)');\n }\n if (!admitted) process.exit(1);\n } catch (err) {\n die(opts.json, 'E_BAD_SCOPE_GRAMMAR', (err as Error).message);\n }\n });\n\n// ─────────────────────────────────────────────────────────────────────────────\n// helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nasync function read(path: string): Promise<string> {\n if (path === '-') {\n let acc = '';\n for await (const chunk of process.stdin) acc += chunk;\n return acc;\n }\n return readFile(path, 'utf8');\n}\n\nfunction recomputeId(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot recompute a delegation id for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted and must be decrypted with a recipient device key first',\n );\n }\n return computeDelegationId({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return computeActionId({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return computeRevocationId({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\nfunction canonicalMessageFor(env: AnyEnvelope): string {\n if (env.kind === 'agent-delegation') {\n if (!env.scopes) {\n throw new Error(\n 'cannot rebuild the canonical message for a v1.2 private delegation: scopes are ' +\n 'sealed in scopes_encrypted',\n );\n }\n return delegationCanonicalMessage({\n principal: env.principal.address,\n agent: env.agent.address,\n scopes: env.scopes,\n bond_sats: env.bond?.sats ?? 0,\n bond_attestation: env.bond?.attestation_id ?? 'none',\n issued_at: env.issued_at,\n expires_at: env.expires_at,\n nonce: env.nonce,\n });\n }\n if (env.kind === 'agent-action') {\n return actionCanonicalMessage({\n address: env.signer.address,\n content_hash: env.content.hash,\n content_length: env.content.length,\n content_mime: env.content.mime,\n signed_at: env.signed_at,\n delegation_id: env.delegation_id,\n scope_exercised: env.scope_exercised,\n });\n }\n return revocationCanonicalMessage({\n address: env.signer.address,\n delegation_id: env.delegation_id,\n reason: env.reason,\n signed_at: env.signed_at,\n });\n}\n\ntype AsOf = { basis: 'now'; now: string } | { basis: 'signed_at'; signedAt: string; anchored: boolean };\n\nfunction report(\n result: { ok: true; id: string } | { ok: false; code: string; message: string },\n asJson: boolean,\n what: string,\n signatureChecked: boolean,\n revocationChecked: boolean,\n asOf?: AsOf\n): void {\n if (result.ok) {\n // Unless the caller passed what they fetched, revocation is NOT part\n // of this verdict: the CLI has no relay. \"This envelope is authentic\"\n // and \"this grant is still in force\" are not the same claim.\n const notes: string[] = [];\n if (!revocationChecked) {\n notes.push(\n 'revocation not checked (offline) — query kind 30085 with \"#t\": [delegation id] and pass --revocations'\n );\n }\n if (asOf?.basis === 'signed_at') {\n notes.push(\n asOf.anchored\n ? `checked as of signed_at ${asOf.signedAt}, fixed by a verified anchor`\n : `checked as of signed_at ${asOf.signedAt}, which is the agent's own claim (no verified anchor)`\n );\n }\n if (asJson) {\n console.log(\n JSON.stringify({\n ok: true,\n verified: what,\n id: result.id,\n signature_checked: signatureChecked,\n revocation_checked: revocationChecked,\n ...(asOf ? { as_of: asOf } : {}),\n notes,\n }),\n );\n } else {\n console.log(\n signatureChecked\n ? `OK · ${what} verified`\n : `OK · ${what} well-formed — signature NOT checked (--skip-sig)`,\n );\n console.log(` id: ${result.id}`);\n if (asOf?.basis === 'now') console.log(` checked at ${asOf.now}`);\n for (const n of notes) console.log(` ! ${n}`);\n }\n return;\n }\n die(asJson, result.code, result.message);\n}\n\nfunction die(asJson: boolean, code: string, message: string): never {\n if (asJson) {\n console.error(JSON.stringify({ ok: false, code, message }));\n } else {\n console.error(`REJECTED · ${code}`);\n console.error(` ${message}`);\n }\n process.exit(1);\n}\n\nprogram.parseAsync().catch((err: Error) => {\n console.error(err.message);\n process.exit(1);\n});\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@orangecheck/agent-cli",
3
- "version": "0.2.3",
3
+ "version": "0.3.0",
4
4
  "description": "Command-line tool for OC Agent — verify, inspect, and canonicalize delegation / action / revocation envelopes from your shell.",
5
5
  "keywords": [
6
6
  "oc-agent",
@@ -42,7 +42,7 @@
42
42
  },
43
43
  "dependencies": {
44
44
  "@noble/hashes": "^1.5.0",
45
- "@orangecheck/agent-core": "^2.1.0",
45
+ "@orangecheck/agent-core": "^2.7.0",
46
46
  "@orangecheck/bip322": "^1.0.0",
47
47
  "commander": "^12.1.0"
48
48
  },