@orangecheck/agent-core 2.7.0 → 2.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangecheck/agent-core",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "OC Agent canonical messages, envelope formats (delegation/action/revocation), scope grammar, and verification. See https://github.com/orangecheck/oc-agent-protocol.",
   "keywords": [
     "bitcoin",

package/src/federation.test.ts

@@ -245,7 +245,7 @@ d('federation delegation revocation check', () => {
         };
     }
 
-    it('honours an agent self-revocation only when holders include the agent', async () => {
+    it('honours the agent’s own revocation whatever holders says', async () => {
         const dv = await load('v19-federation-delegation-3of5-valid.json');
         const del = dv.expected.envelope as FederationDelegationEnvelope;
         const principalOnly = { ...del, revocation: { holders: ['principal' as const], ref: null } };
@@ -253,12 +253,12 @@ d('federation delegation revocation check', () => {
             ...del,
             revocation: { holders: ['principal' as const, 'agent' as const], ref: null },
         };
-        const ignored = await verifyFederationDelegation({
+        const revokedToo = await verifyFederationDelegation({
             envelope: principalOnly,
             revocations: [agentRevocation(principalOnly)],
             ...base,
         });
-        expect(ignored.ok).toBe(true);
+        expect(revokedToo.ok === false && revokedToo.code).toBe('E_REVOKED');
         const revoked = await verifyFederationDelegation({
             envelope: withAgent,
             revocations: [agentRevocation(withAgent)],

package/src/federation.ts

@@ -230,7 +230,7 @@ export interface VerifyFederationDelegationInput extends VerifyFederationBase {
     envelope: FederationDelegationEnvelope;
     /**
      * Revocations to check (kind-30085 by `#t` with the delegation id, SPEC §9.4): federation revocations,
-     * and agent self-revocations when `revocation.holders` includes "agent".
+     * and the agent's own revocations.
      * Required unless `skipRevocationCheck` states that revocation is not checked.
      */
     revocations?: Array<FederationRevocationEnvelope | RevocationEnvelope>;
@@ -316,9 +316,8 @@ export async function verifyFederationDelegation(
 }
 
 /**
- * FEDERATION.md §4: the federation (M-of-N) may always revoke; the agent may
- * self-revoke with its own BIP-322 signature when `revocation.holders`
- * includes "agent".
+ * FEDERATION.md §4: the federation (M-of-N) may always revoke, and so may the
+ * agent with its own BIP-322 signature, whatever `revocation.holders` says.
  */
 async function verifyRevocationOf(
     d: FederationDelegationEnvelope,
@@ -334,10 +333,6 @@ async function verifyRevocationOf(
         });
     }
     const v1 = rev as RevocationEnvelope;
-    const holders = d.revocation?.holders ?? ['principal'];
-    if (!Array.isArray(holders) || !holders.includes('agent')) {
-        return fail('E_REVOKER_UNAUTHORIZED', 'only the federation may revoke this delegation');
-    }
     if (v1.kind !== 'agent-revocation' || v1.signer?.address !== d.agent.address) {
         return fail('E_REVOKER_UNAUTHORIZED', 'a single-address revocation must be signed by the agent');
     }

package/src/revocation-authority.test.ts

@@ -117,22 +117,24 @@ describe('revocation authority always includes the principal', () => {
         });
     }
 
-    it('the agent may revoke only when holders lists it', async () => {
-        const open = delegation(['principal', 'agent']);
-        const closed = delegation(['principal']);
-        const okR = await verifyRevocation({
-            envelope: revocation(open, AGENT, '2026-04-23T00:00:00Z'),
-            delegation: open,
-            skipSignatureVerification: true,
-        });
-        expect(okR.ok).toBe(true);
-        const noR = await verifyRevocation({
-            envelope: revocation(closed, AGENT, '2026-04-23T00:00:00Z'),
-            delegation: closed,
-            skipSignatureVerification: true,
+    // A copy of the delegation presented with holders ["principal"] has the same
+    // id and signature as one with the agent listed, so it must not undo the
+    // agent's own revocation (SPEC §9.5).
+    for (const holders of [['principal', 'agent'], ['principal'], [], undefined]) {
+        it(`the agent's revocation is honoured with holders=${JSON.stringify(holders)}`, async () => {
+            const d = delegation(holders);
+            const rev = revocation(d, AGENT, '2026-04-23T00:00:00Z');
+            const rr = await verifyRevocation({ envelope: rev, delegation: d, skipSignatureVerification: true });
+            expect(rr.ok).toBe(true);
+            const dr = await verifyDelegation({
+                envelope: d,
+                revocations: [rev],
+                skipSignatureVerification: true,
+                now: AT,
+            });
+            expect(dr.ok === false && dr.code).toBe('E_REVOKED');
         });
-        expect(noR.ok === false && noR.code).toBe('E_REVOKER_UNAUTHORIZED');
-    });
+    }
 
     it('a third party is never an authorised revoker', async () => {
         const d = delegation(['principal', 'agent']);

package/src/verify.ts

@@ -717,13 +717,14 @@ export async function verifyRevocation(input: VerifyRevocationInput): Promise<Ve
         return err('E_DELEGATION_MISMATCH', `revocation.delegation_id (${env.delegation_id}) != delegation.id (${d.id})`);
     }
 
-    // The principal may always revoke (SPEC §9.5). `revocation.holders` is not
-    // covered by the delegation signature, so it may only add the agent.
-    const holders = d.revocation?.holders ?? ['principal'];
-    const holderAddrs = new Set<string>([d.principal.address]);
-    if (Array.isArray(holders) && holders.includes('agent')) holderAddrs.add(d.agent.address);
-    if (!holderAddrs.has(env.signer.address)) {
-        return err('E_REVOKER_UNAUTHORIZED', `revocation signer ${env.signer.address} not in delegation holders`);
+    // The principal and the agent may always revoke (SPEC §9.5). Revoking only
+    // removes authority, and `revocation.holders` is outside the delegation's
+    // signature, so no copy of it decides who may.
+    if (env.signer.address !== d.principal.address && env.signer.address !== d.agent.address) {
+        return err(
+            'E_REVOKER_UNAUTHORIZED',
+            `revocation signer ${env.signer.address} is neither the principal nor the agent`
+        );
     }
 
     const canonInput = {