@orangecheck/agent-core 2.1.0 → 2.2.0

package/README.md

@@ -95,7 +95,9 @@ if (!result.ok) throw new Error(result.code + ': ' + result.message);
 
 - `verifyDelegation({ envelope, verifyBip322, now?, skipTemporalCheck?, scopeMode? })`
 - `verifyAction({ action, delegation, revocations?, verifyBip322, verifyOtsAnchor?, content?, resolveAnchorBlockHeight?, scopeMode? })`
-- `verifyRevocation({ envelope, delegation, verifyBip322 })`
+- `verifyRevocation({ envelope, delegation, verifyBip322 })` — the principal may always revoke; `revocation.holders` can only add the agent
+- `verifyOtsAnchor(proofB64, blockHeight, blockHash, envelopeId)` — an anchor orders an action against a revocation only when this returns true
+- `verifyFederationRevocation({ envelope, delegation, verifyBip322 })`
 
 Each returns a discriminated union:
 

package/dist/index.d.mts

@@ -34,7 +34,7 @@ interface VerifyActionInput extends VerifyBase {
     subdelegationChain?: SubdelegationEnvelope[];
     maxChainDepth?: number;
     content?: Uint8Array;
-    verifyOtsAnchor?: (proofB64: string, blockHeight: number, blockHash: string) => Promise<boolean>;
+    verifyOtsAnchor?: (proofB64: string, blockHeight: number, blockHash: string, envelopeId: string) => Promise<boolean>;
     resolveAnchorBlockHeight?: (env: ActionEnvelope | RevocationEnvelope) => number | null;
     decryptScopesWith?: {
         device_id: string;
@@ -131,6 +131,7 @@ interface VerifyFederationDelegationInput extends VerifyFederationBase {
 declare function verifyFederationDelegation(input: VerifyFederationDelegationInput): Promise<FederationVerifyResult>;
 interface VerifyFederationRevocationInput extends VerifyFederationBase {
     envelope: FederationRevocationEnvelope;
+    delegation: FederationDelegationEnvelope;
 }
 declare function verifyFederationRevocation(input: VerifyFederationRevocationInput): Promise<FederationVerifyResult>;
 

package/dist/index.d.ts

@@ -34,7 +34,7 @@ interface VerifyActionInput extends VerifyBase {
     subdelegationChain?: SubdelegationEnvelope[];
     maxChainDepth?: number;
     content?: Uint8Array;
-    verifyOtsAnchor?: (proofB64: string, blockHeight: number, blockHash: string) => Promise<boolean>;
+    verifyOtsAnchor?: (proofB64: string, blockHeight: number, blockHash: string, envelopeId: string) => Promise<boolean>;
     resolveAnchorBlockHeight?: (env: ActionEnvelope | RevocationEnvelope) => number | null;
     decryptScopesWith?: {
         device_id: string;
@@ -131,6 +131,7 @@ interface VerifyFederationDelegationInput extends VerifyFederationBase {
 declare function verifyFederationDelegation(input: VerifyFederationDelegationInput): Promise<FederationVerifyResult>;
 interface VerifyFederationRevocationInput extends VerifyFederationBase {
     envelope: FederationRevocationEnvelope;
+    delegation: FederationDelegationEnvelope;
 }
 declare function verifyFederationRevocation(input: VerifyFederationRevocationInput): Promise<FederationVerifyResult>;
 

package/dist/index.js

@@ -636,6 +636,12 @@ async function verifyAction(input) {
       "verifyAction requires `revocations` (fetch kind-30085 by #delegation for every link in the chain) or an explicit skipRevocationCheck:true"
     );
   }
+  let actionAnchor;
+  try {
+    actionAnchor = await verifiedAnchorHeight(a, input);
+  } catch (e) {
+    return err("E_MALFORMED", `anchor verifier threw: ${e.message}`);
+  }
   if (input.revocations && input.revocations.length > 0) {
     const allLinks = [rootHydrated, ...hydratedChain];
     for (const link of allLinks) {
@@ -648,9 +654,13 @@ async function verifyAction(input) {
           skipSignatureVerification: input.skipSignatureVerification
         });
         if (!rr.ok) continue;
-        const effective = effectiveRevocationTime(rev, input.resolveAnchorBlockHeight);
-        const actionTime = actionEffectiveTime(a, input.resolveAnchorBlockHeight);
-        if (compareTimes(effective, actionTime) <= 0) {
+        let revAnchor;
+        try {
+          revAnchor = await verifiedAnchorHeight(rev, input);
+        } catch (e) {
+          return err("E_MALFORMED", `anchor verifier threw: ${e.message}`);
+        }
+        if (revocationPrecedes(rev, revAnchor, a, actionAnchor)) {
           return err("E_REVOKED", `chain link ${link.id} was revoked by ${rev.id} before action was signed`);
         }
       }
@@ -673,14 +683,7 @@ async function verifyAction(input) {
     if (h === null || hash === null) {
       return err("E_MALFORMED", "confirmed OTS proof missing block_height or block_hash");
     }
-    let verified = false;
-    if (input.verifyOtsAnchor) {
-      try {
-        verified = await input.verifyOtsAnchor(a.ots.proof, h, hash);
-      } catch (e) {
-        return err("E_MALFORMED", `anchor verifier threw: ${e.message}`);
-      }
-    }
+    const verified = actionAnchor !== null;
     anchor = { status: "confirmed", blockHeight: h, blockHash: hash, verified };
   }
   return {
@@ -750,9 +753,8 @@ async function verifyRevocation(input) {
     return err("E_DELEGATION_MISMATCH", `revocation.delegation_id (${env.delegation_id}) != delegation.id (${d.id})`);
   }
   const holders = d.revocation?.holders ?? ["principal"];
-  const holderAddrs = /* @__PURE__ */ new Set();
-  if (holders.includes("principal")) holderAddrs.add(d.principal.address);
-  if (holders.includes("agent")) holderAddrs.add(d.agent.address);
+  const holderAddrs = /* @__PURE__ */ new Set([d.principal.address]);
+  if (Array.isArray(holders) && holders.includes("agent")) holderAddrs.add(d.agent.address);
   if (!holderAddrs.has(env.signer.address)) {
     return err("E_REVOKER_UNAUTHORIZED", `revocation signer ${env.signer.address} not in delegation holders`);
   }
@@ -952,25 +954,17 @@ async function verifySubdelegation(input) {
   }
   return r;
 }
-function actionEffectiveTime(a, resolve) {
-  if (a.ots?.status === "confirmed") {
-    const h = resolve ? resolve(a) : a.ots.block_height;
-    if (h !== null && h !== void 0) return { kind: "anchor", blockHeight: h };
-  }
-  return { kind: "signed", ms: new Date(a.signed_at).getTime() };
+async function verifiedAnchorHeight(env, input) {
+  if (env.ots?.status !== "confirmed" || !input.verifyOtsAnchor) return null;
+  const h = input.resolveAnchorBlockHeight ? input.resolveAnchorBlockHeight(env) : env.ots.block_height;
+  const hash = env.ots.block_hash;
+  if (h === null || h === void 0 || !Number.isInteger(h) || !hash) return null;
+  return await input.verifyOtsAnchor(env.ots.proof, h, hash, env.id) ? h : null;
 }
-function effectiveRevocationTime(r, resolve) {
-  if (r.ots?.status === "confirmed") {
-    const h = resolve ? resolve(r) : r.ots.block_height;
-    if (h !== null && h !== void 0) return { kind: "anchor", blockHeight: h };
-  }
-  return { kind: "signed", ms: new Date(r.signed_at).getTime() };
-}
-function compareTimes(a, b) {
-  if (a.kind === "anchor" && b.kind === "anchor") return a.blockHeight - b.blockHeight;
-  if (a.kind === "anchor") return -1;
-  if (b.kind === "anchor") return 1;
-  return a.ms - b.ms;
+function revocationPrecedes(rev, revAnchor, action, actionAnchor) {
+  if (revAnchor !== null && actionAnchor !== null) return revAnchor <= actionAnchor;
+  if (actionAnchor === null && rev.ots?.status === "confirmed") return true;
+  return new Date(rev.signed_at).getTime() <= new Date(action.signed_at).getTime();
 }
 function err(code, message) {
   return { ok: false, code, message };
@@ -1120,6 +1114,17 @@ async function verifyFederationRevocation(input) {
     return fail("E_MALFORMED", "reason must be a string \u2264128 bytes");
   }
   if (!ISO_UTC.test(env.signed_at)) return fail("E_MALFORMED", "signed_at must be ISO 8601 UTC");
+  const d = input.delegation;
+  if (!d || !HEX64.test(d.id ?? "")) return fail("E_MALFORMED", "the revoked delegation is required");
+  if (env.delegation_id !== d.id) {
+    return fail("E_DELEGATION_MISMATCH", `revocation.delegation_id (${env.delegation_id}) != delegation.id (${d.id})`);
+  }
+  if (d.principal?.alg !== "federation" || env.signer?.descriptor_id !== d.principal.descriptor_id) {
+    return fail(
+      "E_REVOKER_UNAUTHORIZED",
+      `revoking federation (${env.signer?.descriptor_id}) is not the delegation's principal`
+    );
+  }
   const canonInput = {
     address: `federation:${env.signer?.descriptor_id ?? ""}`,
     delegation_id: env.delegation_id,