@orangecheck/agent-core 2.6.0 → 2.7.1

package/dist/index.mjs

@@ -410,6 +410,7 @@ function hasPrivateScopes(envelope) {
 
 // src/verify.ts
 var DEFAULT_MAX_CHAIN_DEPTH = 5;
+var DEFAULT_MAX_SKEW_MS = 12e4;
 var AgentError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -544,6 +545,12 @@ async function verifyDelegation(input) {
   };
 }
 async function verifyAction(input) {
+  return verifyActionAt(input, input.now ?? /* @__PURE__ */ new Date());
+}
+async function verifyActionAsOfSignedAt(input) {
+  return verifyActionAt(input, null);
+}
+async function verifyActionAt(input, now) {
   const a = input.action;
   const d = input.delegation;
   const chain = input.subdelegationChain ?? [];
@@ -621,6 +628,17 @@ async function verifyAction(input) {
   if (signed < issued || signed >= expires) {
     return err("E_OUT_OF_WINDOW", `action.signed_at ${a.signed_at} is outside leaf window [${leaf.issued_at}, ${leaf.expires_at})`);
   }
+  if (now) {
+    const t = now.getTime();
+    for (const link of [rootHydrated, ...hydratedChain]) {
+      if (t < new Date(link.issued_at).getTime()) {
+        return err("E_NOT_YET_VALID", `${link.id} is not valid until ${link.issued_at}`);
+      }
+      if (t >= new Date(link.expires_at).getTime()) {
+        return err("E_EXPIRED", `${link.id} expired at ${link.expires_at}`);
+      }
+    }
+  }
   if (!leaf.scopes) {
     return err("E_SCOPES_NEITHER_PROVIDED", "leaf has no plaintext scopes after hydration");
   }
@@ -669,9 +687,21 @@ async function verifyAction(input) {
         if (revocationPrecedes(rev, revAnchor, a, actionAnchor)) {
           return err("E_REVOKED", `chain link ${link.id} was revoked by ${rev.id} before action was signed`);
         }
+        if (now && (revAnchor !== null || new Date(rev.signed_at).getTime() <= now.getTime())) {
+          return err("E_REVOKED", `chain link ${link.id} was revoked by ${rev.id}`);
+        }
       }
     }
   }
+  if (now) {
+    const maxSkew = input.maxSkewMs ?? DEFAULT_MAX_SKEW_MS;
+    if (Math.abs(now.getTime() - signed) > maxSkew) {
+      return err(
+        "E_STALE",
+        `action.signed_at ${a.signed_at} is more than ${maxSkew} ms from the time of verification ${now.toISOString()}`
+      );
+    }
+  }
   if (input.content) {
     const actualHash = "sha256:" + hexEncode(sha256(input.content));
     if (actualHash !== a.content.hash) {
@@ -699,7 +729,20 @@ async function verifyAction(input) {
     delegation: rootHydrated,
     chain: hydratedChain,
     scopeExercised: exercised,
-    anchor
+    anchor,
+    asOf: now ? { basis: "now", now: now.toISOString() } : { basis: "signed_at", signedAt: a.signed_at, anchored: actionAnchor !== null }
+  };
+}
+function createReplayGuard(maxSkewMs = DEFAULT_MAX_SKEW_MS) {
+  const keepUntil = /* @__PURE__ */ new Map();
+  return {
+    firstUse(action, now = /* @__PURE__ */ new Date()) {
+      const t = now.getTime();
+      for (const [id, until] of keepUntil) if (until <= t) keepUntil.delete(id);
+      if (keepUntil.has(action.id)) return false;
+      keepUntil.set(action.id, new Date(action.signed_at).getTime() + maxSkewMs);
+      return true;
+    }
   };
 }
 async function hydrateSubdelegationScopes(sub, input) {
@@ -757,11 +800,11 @@ async function verifyRevocation(input) {
   if (env.delegation_id !== d.id) {
     return err("E_DELEGATION_MISMATCH", `revocation.delegation_id (${env.delegation_id}) != delegation.id (${d.id})`);
   }
-  const holders = d.revocation?.holders ?? ["principal"];
-  const holderAddrs = /* @__PURE__ */ new Set([d.principal.address]);
-  if (Array.isArray(holders) && holders.includes("agent")) holderAddrs.add(d.agent.address);
-  if (!holderAddrs.has(env.signer.address)) {
-    return err("E_REVOKER_UNAUTHORIZED", `revocation signer ${env.signer.address} not in delegation holders`);
+  if (env.signer.address !== d.principal.address && env.signer.address !== d.agent.address) {
+    return err(
+      "E_REVOKER_UNAUTHORIZED",
+      `revocation signer ${env.signer.address} is neither the principal nor the agent`
+    );
   }
   const canonInput = {
     address: env.signer.address,
@@ -1144,10 +1187,6 @@ async function verifyRevocationOf(d, rev, input) {
     });
   }
   const v1 = rev;
-  const holders = d.revocation?.holders ?? ["principal"];
-  if (!Array.isArray(holders) || !holders.includes("agent")) {
-    return fail("E_REVOKER_UNAUTHORIZED", "only the federation may revoke this delegation");
-  }
   if (v1.kind !== "agent-revocation" || v1.signer?.address !== d.agent.address) {
     return fail("E_REVOKER_UNAUTHORIZED", "a single-address revocation must be signed by the agent");
   }
@@ -1239,6 +1278,6 @@ function assertScopeGranted(delegation, scopeExercised, fnName) {
   }
 }
 
-export { AgentError, DEFAULT_MAX_CHAIN_DEPTH, ENVELOPE_VERSION, REGISTERED_SCOPES, ScopeNotGrantedError, ScopeParseError, actionCanonicalBytes, actionCanonicalMessage, assertScopeGranted, canonicalActionBytes, canonicalDelegationBytes, canonicalRevocationBytes, canonicalizeAction, canonicalizeDelegation, canonicalizeRevocation, canonicalizeScope, canonicalizeScopeString, canonicalizeScopes, computeActionId, computeDelegationId, computeFederationDescriptorId, computeRevocationId, computeSubdelegationId, decodeScopesPayload, delegationCanonicalBytes, delegationCanonicalMessage, encodeScopesPayload, federationDescriptorCanonicalMessage, hasPrivateScopes, isSubScope, parseAndCanonicalizeScopes, parseScope, revocationCanonicalBytes, revocationCanonicalMessage, sealScopes, sha256Hex, subdelegationCanonicalBytes, subdelegationCanonicalMessage, unsealScopes, validateScope, verifyAction, verifyDelegation, verifyFederationDelegation, verifyFederationRevocation, verifyRevocation, verifySubdelegation };
+export { AgentError, DEFAULT_MAX_CHAIN_DEPTH, DEFAULT_MAX_SKEW_MS, ENVELOPE_VERSION, REGISTERED_SCOPES, ScopeNotGrantedError, ScopeParseError, actionCanonicalBytes, actionCanonicalMessage, assertScopeGranted, canonicalActionBytes, canonicalDelegationBytes, canonicalRevocationBytes, canonicalizeAction, canonicalizeDelegation, canonicalizeRevocation, canonicalizeScope, canonicalizeScopeString, canonicalizeScopes, computeActionId, computeDelegationId, computeFederationDescriptorId, computeRevocationId, computeSubdelegationId, createReplayGuard, decodeScopesPayload, delegationCanonicalBytes, delegationCanonicalMessage, encodeScopesPayload, federationDescriptorCanonicalMessage, hasPrivateScopes, isSubScope, parseAndCanonicalizeScopes, parseScope, revocationCanonicalBytes, revocationCanonicalMessage, sealScopes, sha256Hex, subdelegationCanonicalBytes, subdelegationCanonicalMessage, unsealScopes, validateScope, verifyAction, verifyActionAsOfSignedAt, verifyDelegation, verifyFederationDelegation, verifyFederationRevocation, verifyRevocation, verifySubdelegation };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map