@orangecheck/agent-core 1.2.0 → 2.1.0

package/dist/index.mjs

@@ -223,10 +223,15 @@ function rangeSubset(ex, g) {
   if (!exRange || !gRange) return false;
   return gRange.lo <= exRange.lo && exRange.hi <= gRange.hi;
 }
+function parseDecimalInteger(value) {
+  if (!/^-?\d+$/.test(value)) return null;
+  const n = Number(value);
+  return Number.isSafeInteger(n) ? n : null;
+}
 function opToRange(c) {
   if (c.value === void 0) return null;
-  const n = Number(c.value);
-  if (!Number.isFinite(n)) return null;
+  const n = parseDecimalInteger(c.value);
+  if (n === null) return null;
   switch (c.op) {
     case "=":
       return { lo: n, hi: n };
@@ -496,6 +501,25 @@ async function verifyDelegation(input) {
     const ok = await input.verifyBip322(env.id, env.sig.value, env.principal.address);
     if (!ok) return err("E_BAD_SIG", "BIP-322 signature did not verify");
   }
+  if (!input.skipRevocationCheck && !input.revocations) {
+    return err(
+      "E_MALFORMED",
+      "verifyDelegation requires `revocations` (fetch kind-30085 by #delegation) or an explicit skipRevocationCheck:true to state that revocation is not being checked"
+    );
+  }
+  if (input.revocations) {
+    for (const rev of input.revocations) {
+      if (rev.delegation_id !== env.id) continue;
+      const rr = await verifyRevocation({
+        envelope: rev,
+        delegation: env,
+        verifyBip322: input.verifyBip322,
+        skipSignatureVerification: input.skipSignatureVerification
+      });
+      if (!rr.ok) continue;
+      return err("E_REVOKED", `delegation ${env.id} was revoked by ${rev.id}`);
+    }
+  }
   if (!input.skipTemporalCheck) {
     const now = input.now ?? /* @__PURE__ */ new Date();
     const issued = new Date(env.issued_at);
@@ -530,6 +554,12 @@ async function verifyAction(input) {
     scopeMode: input.scopeMode,
     skipTemporalCheck: true,
     // action window check dominates
+    // Revocation is evaluated ONCE, below, across every link in the chain
+    // (root + subdelegations) against the action's effective time — a
+    // per-link check here would use the wrong clock and would also
+    // double-report. Forward the caller's decision so this inner call does
+    // not trip the fail-closed guard.
+    skipRevocationCheck: true,
     ...input.decryptScopesWith ? { decryptScopesWith: input.decryptScopesWith } : {}
   });
   if (!dr.ok) return dr;
@@ -599,6 +629,12 @@ async function verifyAction(input) {
     return err("E_BAD_SCOPE_GRAMMAR", msg);
   }
   if (!accepted) return err("E_SCOPE_DENIED", `scope_exercised (${exercised}) not a sub-scope of any granted scope`);
+  if (!input.skipRevocationCheck && !input.revocations) {
+    return err(
+      "E_MALFORMED",
+      "verifyAction requires `revocations` (fetch kind-30085 by #delegation for every link in the chain) or an explicit skipRevocationCheck:true"
+    );
+  }
   if (input.revocations && input.revocations.length > 0) {
     const allLinks = [rootHydrated, ...hydratedChain];
     for (const link of allLinks) {