@orangecheck/agent-core 1.1.0 → 1.2.0

package/dist/index.d.mts

@@ -165,4 +165,14 @@ declare function hasPrivateScopes<T extends {
     scopes_encrypted: ScopesEncryptedEnvelope;
 };
 
-export { ActionEnvelope, ActorRef, AgentError, AgentErrorCode, ChainLink, DEFAULT_MAX_CHAIN_DEPTH, DelegationBond, DelegationEnvelope, DelegationRevocationRef, type FederationDelegationEnvelope, type FederationDescriptor, type FederationGuardian, type FederationPrincipal, type FederationRevocationEnvelope, type FederationSignature, type FederationVerifyResult, RevocationEnvelope, ScopesEncryptedEnvelope, type SealScopesInput, SubdelegationEnvelope, type UnsealScopesInput, type UnsealedScopes, ValidationOptions, type VerifyActionInput, VerifyActionResult, type VerifyBase, type VerifyDelegationInput, VerifyDelegationResult, type VerifyFederationBase, type VerifyFederationDelegationInput, type VerifyFederationRevocationInput, type VerifyRevocationInput, VerifyRevocationResult, type VerifySubdelegationInput, VerifySubdelegationResult, computeFederationDescriptorId, decodeScopesPayload, encodeScopesPayload, federationDescriptorCanonicalMessage, hasPrivateScopes, sealScopes, unsealScopes, verifyAction, verifyDelegation, verifyFederationDelegation, verifyFederationRevocation, verifyRevocation, verifySubdelegation };
+interface ScopeBearingDelegation {
+    scopes?: string[];
+    scopes_encrypted?: ScopesEncryptedEnvelope;
+}
+declare class ScopeNotGrantedError extends Error {
+    readonly reason: 'not_subscope' | 'scopes_encrypted' | 'no_scopes';
+    constructor(reason: ScopeNotGrantedError['reason'], message: string);
+}
+declare function assertScopeGranted(delegation: ScopeBearingDelegation, scopeExercised: string, fnName: string): void;
+
+export { ActionEnvelope, ActorRef, AgentError, AgentErrorCode, ChainLink, DEFAULT_MAX_CHAIN_DEPTH, DelegationBond, DelegationEnvelope, DelegationRevocationRef, type FederationDelegationEnvelope, type FederationDescriptor, type FederationGuardian, type FederationPrincipal, type FederationRevocationEnvelope, type FederationSignature, type FederationVerifyResult, RevocationEnvelope, type ScopeBearingDelegation, ScopeNotGrantedError, ScopesEncryptedEnvelope, type SealScopesInput, SubdelegationEnvelope, type UnsealScopesInput, type UnsealedScopes, ValidationOptions, type VerifyActionInput, VerifyActionResult, type VerifyBase, type VerifyDelegationInput, VerifyDelegationResult, type VerifyFederationBase, type VerifyFederationDelegationInput, type VerifyFederationRevocationInput, type VerifyRevocationInput, VerifyRevocationResult, type VerifySubdelegationInput, VerifySubdelegationResult, assertScopeGranted, computeFederationDescriptorId, decodeScopesPayload, encodeScopesPayload, federationDescriptorCanonicalMessage, hasPrivateScopes, sealScopes, unsealScopes, verifyAction, verifyDelegation, verifyFederationDelegation, verifyFederationRevocation, verifyRevocation, verifySubdelegation };

package/dist/index.d.ts

@@ -165,4 +165,14 @@ declare function hasPrivateScopes<T extends {
     scopes_encrypted: ScopesEncryptedEnvelope;
 };
 
-export { ActionEnvelope, ActorRef, AgentError, AgentErrorCode, ChainLink, DEFAULT_MAX_CHAIN_DEPTH, DelegationBond, DelegationEnvelope, DelegationRevocationRef, type FederationDelegationEnvelope, type FederationDescriptor, type FederationGuardian, type FederationPrincipal, type FederationRevocationEnvelope, type FederationSignature, type FederationVerifyResult, RevocationEnvelope, ScopesEncryptedEnvelope, type SealScopesInput, SubdelegationEnvelope, type UnsealScopesInput, type UnsealedScopes, ValidationOptions, type VerifyActionInput, VerifyActionResult, type VerifyBase, type VerifyDelegationInput, VerifyDelegationResult, type VerifyFederationBase, type VerifyFederationDelegationInput, type VerifyFederationRevocationInput, type VerifyRevocationInput, VerifyRevocationResult, type VerifySubdelegationInput, VerifySubdelegationResult, computeFederationDescriptorId, decodeScopesPayload, encodeScopesPayload, federationDescriptorCanonicalMessage, hasPrivateScopes, sealScopes, unsealScopes, verifyAction, verifyDelegation, verifyFederationDelegation, verifyFederationRevocation, verifyRevocation, verifySubdelegation };
+interface ScopeBearingDelegation {
+    scopes?: string[];
+    scopes_encrypted?: ScopesEncryptedEnvelope;
+}
+declare class ScopeNotGrantedError extends Error {
+    readonly reason: 'not_subscope' | 'scopes_encrypted' | 'no_scopes';
+    constructor(reason: ScopeNotGrantedError['reason'], message: string);
+}
+declare function assertScopeGranted(delegation: ScopeBearingDelegation, scopeExercised: string, fnName: string): void;
+
+export { ActionEnvelope, ActorRef, AgentError, AgentErrorCode, ChainLink, DEFAULT_MAX_CHAIN_DEPTH, DelegationBond, DelegationEnvelope, DelegationRevocationRef, type FederationDelegationEnvelope, type FederationDescriptor, type FederationGuardian, type FederationPrincipal, type FederationRevocationEnvelope, type FederationSignature, type FederationVerifyResult, RevocationEnvelope, type ScopeBearingDelegation, ScopeNotGrantedError, ScopesEncryptedEnvelope, type SealScopesInput, SubdelegationEnvelope, type UnsealScopesInput, type UnsealedScopes, ValidationOptions, type VerifyActionInput, VerifyActionResult, type VerifyBase, type VerifyDelegationInput, VerifyDelegationResult, type VerifyFederationBase, type VerifyFederationDelegationInput, type VerifyFederationRevocationInput, type VerifyRevocationInput, VerifyRevocationResult, type VerifySubdelegationInput, VerifySubdelegationResult, assertScopeGranted, computeFederationDescriptorId, decodeScopesPayload, encodeScopesPayload, federationDescriptorCanonicalMessage, hasPrivateScopes, sealScopes, unsealScopes, verifyAction, verifyDelegation, verifyFederationDelegation, verifyFederationRevocation, verifyRevocation, verifySubdelegation };

package/dist/index.js

@@ -1102,6 +1102,37 @@ function fail(code, message) {
   return { ok: false, code, message };
 }
 
+// src/assert-scope.ts
+var ScopeNotGrantedError = class extends Error {
+  constructor(reason, message) {
+    super(message);
+    this.name = "ScopeNotGrantedError";
+    this.reason = reason;
+  }
+};
+function assertScopeGranted(delegation, scopeExercised, fnName) {
+  if (hasPrivateScopes(delegation)) {
+    throw new ScopeNotGrantedError(
+      "scopes_encrypted",
+      `${fnName}: this delegation uses v1.2 private scopes \u2014 \`scopes_encrypted\` is set and \`scopes\` is absent, so the granted set cannot be read here. Decrypt it with decryptPrivateScopes() using a matching device key and pass the recovered scopes as \`delegation.scopes\`. Refusing to stamp \`${scopeExercised}\` against an unreadable grant.`
+    );
+  }
+  const scopes = delegation.scopes;
+  if (scopes === void 0 || scopes.length === 0) {
+    throw new ScopeNotGrantedError(
+      "no_scopes",
+      `${fnName}: delegation grants no scopes, so \`${scopeExercised}\` cannot be exercised. An absent or empty \`scopes\` means nothing is granted, never everything.`
+    );
+  }
+  const exercised = parseScope(scopeExercised);
+  if (!scopes.map(parseScope).some((g) => isSubScope(exercised, g))) {
+    throw new ScopeNotGrantedError(
+      "not_subscope",
+      `${fnName}: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope (${scopes.join(", ")})`
+    );
+  }
+}
+
 Object.defineProperty(exports, "canonicalize", {
   enumerable: true,
   get: function () { return canonical.canonicalize; }
@@ -1114,9 +1145,11 @@ exports.AgentError = AgentError;
 exports.DEFAULT_MAX_CHAIN_DEPTH = DEFAULT_MAX_CHAIN_DEPTH;
 exports.ENVELOPE_VERSION = ENVELOPE_VERSION;
 exports.REGISTERED_SCOPES = REGISTERED_SCOPES;
+exports.ScopeNotGrantedError = ScopeNotGrantedError;
 exports.ScopeParseError = ScopeParseError;
 exports.actionCanonicalBytes = actionCanonicalBytes;
 exports.actionCanonicalMessage = actionCanonicalMessage;
+exports.assertScopeGranted = assertScopeGranted;
 exports.canonicalActionBytes = canonicalActionBytes;
 exports.canonicalDelegationBytes = canonicalDelegationBytes;
 exports.canonicalRevocationBytes = canonicalRevocationBytes;