@orangecheck/agent-core 1.2.0 → 2.0.0

package/dist/index.mjs

@@ -496,6 +496,25 @@ async function verifyDelegation(input) {
     const ok = await input.verifyBip322(env.id, env.sig.value, env.principal.address);
     if (!ok) return err("E_BAD_SIG", "BIP-322 signature did not verify");
   }
+  if (!input.skipRevocationCheck && !input.revocations) {
+    return err(
+      "E_MALFORMED",
+      "verifyDelegation requires `revocations` (fetch kind-30085 by #delegation) or an explicit skipRevocationCheck:true to state that revocation is not being checked"
+    );
+  }
+  if (input.revocations) {
+    for (const rev of input.revocations) {
+      if (rev.delegation_id !== env.id) continue;
+      const rr = await verifyRevocation({
+        envelope: rev,
+        delegation: env,
+        verifyBip322: input.verifyBip322,
+        skipSignatureVerification: input.skipSignatureVerification
+      });
+      if (!rr.ok) continue;
+      return err("E_REVOKED", `delegation ${env.id} was revoked by ${rev.id}`);
+    }
+  }
   if (!input.skipTemporalCheck) {
     const now = input.now ?? /* @__PURE__ */ new Date();
     const issued = new Date(env.issued_at);
@@ -530,6 +549,12 @@ async function verifyAction(input) {
     scopeMode: input.scopeMode,
     skipTemporalCheck: true,
     // action window check dominates
+    // Revocation is evaluated ONCE, below, across every link in the chain
+    // (root + subdelegations) against the action's effective time — a
+    // per-link check here would use the wrong clock and would also
+    // double-report. Forward the caller's decision so this inner call does
+    // not trip the fail-closed guard.
+    skipRevocationCheck: true,
     ...input.decryptScopesWith ? { decryptScopesWith: input.decryptScopesWith } : {}
   });
   if (!dr.ok) return dr;
@@ -599,6 +624,12 @@ async function verifyAction(input) {
     return err("E_BAD_SCOPE_GRAMMAR", msg);
   }
   if (!accepted) return err("E_SCOPE_DENIED", `scope_exercised (${exercised}) not a sub-scope of any granted scope`);
+  if (!input.skipRevocationCheck && !input.revocations) {
+    return err(
+      "E_MALFORMED",
+      "verifyAction requires `revocations` (fetch kind-30085 by #delegation for every link in the chain) or an explicit skipRevocationCheck:true"
+    );
+  }
   if (input.revocations && input.revocations.length > 0) {
     const allLinks = [rootHydrated, ...hydratedChain];
     for (const link of allLinks) {