npm - @orangecheck/agent-langgraph - Versions diffs - 0.3.0 → 1.0.0 - Mend

@orangecheck/agent-langgraph 0.3.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/README.md CHANGED Viewed

@@ -94,4 +94,3 @@ MIT.
 - [oc-agent-protocol](https://github.com/orangecheck/oc-agent-protocol) — normative wire format.
 - [@orangecheck/agent-core](https://www.npmjs.com/package/@orangecheck/agent-core) — verifier library.
 - [@orangecheck/agent-mcp](https://www.npmjs.com/package/@orangecheck/agent-mcp) / [-anthropic](https://www.npmjs.com/package/@orangecheck/agent-anthropic) / [-openai](https://www.npmjs.com/package/@orangecheck/agent-openai) / [-vercel](https://www.npmjs.com/package/@orangecheck/agent-vercel) — sibling adapters, all stateless.
-- [fleet.ochk.io/integrations/langgraph](https://fleet.ochk.io/integrations/langgraph) — managed-tier story.

package/dist/index.d.mts CHANGED Viewed

@@ -30,25 +30,11 @@ interface OcToolNodeWrapped<TArgs extends Record<string, unknown>, TResult> {
     execute: (args: TArgs, ctx: AgentContext & {
         callId: string;
         graphState: Record<string, unknown>;
-        fleet?: FleetClient;
     }) => Promise<{
         result: TResult;
         action: ActionEnvelope;
-        posted: PostActionResult | null;
     }>;
 }
 declare function ocToolNode<TArgs extends Record<string, unknown>, TResult>(input: OcToolNodeInput<TArgs, TResult>): OcToolNodeWrapped<TArgs, TResult>;
-interface FleetClient {
-    baseUrl?: string;
-    apiToken: string;
-    projectId: string;
-    fetch?: typeof fetch;
-}
-interface PostActionResult {
-    id: string;
-    project_id: string;
-    delegation_id: string;
-}
-declare function postActionToFleet(action: ActionEnvelope, client: FleetClient): Promise<PostActionResult>;
-export { type AgentContext, type FleetClient, type LangGraphToolCall, type OcToolNodeInput, type OcToolNodeWrapped, type PostActionResult, type StampToolCallInput, canonicalizeToolCall, graphStateHash, ocToolNode, postActionToFleet, stampToolCall, toolCallActionId, toolCallHash };
+export { type AgentContext, type LangGraphToolCall, type OcToolNodeInput, type OcToolNodeWrapped, type StampToolCallInput, canonicalizeToolCall, graphStateHash, ocToolNode, stampToolCall, toolCallActionId, toolCallHash };

package/dist/index.d.ts CHANGED Viewed

@@ -30,25 +30,11 @@ interface OcToolNodeWrapped<TArgs extends Record<string, unknown>, TResult> {
     execute: (args: TArgs, ctx: AgentContext & {
         callId: string;
         graphState: Record<string, unknown>;
-        fleet?: FleetClient;
     }) => Promise<{
         result: TResult;
         action: ActionEnvelope;
-        posted: PostActionResult | null;
     }>;
 }
 declare function ocToolNode<TArgs extends Record<string, unknown>, TResult>(input: OcToolNodeInput<TArgs, TResult>): OcToolNodeWrapped<TArgs, TResult>;
-interface FleetClient {
-    baseUrl?: string;
-    apiToken: string;
-    projectId: string;
-    fetch?: typeof fetch;
-}
-interface PostActionResult {
-    id: string;
-    project_id: string;
-    delegation_id: string;
-}
-declare function postActionToFleet(action: ActionEnvelope, client: FleetClient): Promise<PostActionResult>;
-export { type AgentContext, type FleetClient, type LangGraphToolCall, type OcToolNodeInput, type OcToolNodeWrapped, type PostActionResult, type StampToolCallInput, canonicalizeToolCall, graphStateHash, ocToolNode, postActionToFleet, stampToolCall, toolCallActionId, toolCallHash };
+export { type AgentContext, type LangGraphToolCall, type OcToolNodeInput, type OcToolNodeWrapped, type StampToolCallInput, canonicalizeToolCall, graphStateHash, ocToolNode, stampToolCall, toolCallActionId, toolCallHash };

package/dist/index.js CHANGED Viewed

@@ -62,58 +62,14 @@ function ocToolNode(input) {
         call
       });
       const result = await input.execute(args);
-      let posted = null;
-      if (ctx.fleet) {
-        try {
-          posted = await postActionToFleet(action, ctx.fleet);
-        } catch (err) {
-          console.error("[oc-agent-langgraph] postActionToFleet failed:", err);
-        }
-      }
-      return { result, action, posted };
+      return { result, action };
     }
   };
 }
-async function postActionToFleet(action, client) {
-  const baseUrl = client.baseUrl ?? "https://fleet.ochk.io";
-  const f = client.fetch ?? fetch;
-  const body = {
-    project_id: client.projectId,
-    delegation_id: action.delegation_id,
-    agent_address: action.signer.address,
-    scope_exercised: action.scope_exercised,
-    content_hash: action.content.hash,
-    content_length: action.content.length,
-    content_mime: action.content.mime,
-    signed_at: action.signed_at,
-    signature: action.sig.value,
-    id: action.id
-  };
-  const r = await f(`${baseUrl}/api/actions`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${client.apiToken}`
-    },
-    body: JSON.stringify(body)
-  });
-  if (!r.ok) {
-    let reason = `http_${r.status}`;
-    try {
-      const j2 = await r.json();
-      if (j2.reason) reason = j2.reason;
-    } catch {
-    }
-    throw new Error(`postActionToFleet failed: ${reason}`);
-  }
-  const j = await r.json();
-  return j.action;
-}
 exports.canonicalizeToolCall = canonicalizeToolCall;
 exports.graphStateHash = graphStateHash;
 exports.ocToolNode = ocToolNode;
-exports.postActionToFleet = postActionToFleet;
 exports.stampToolCall = stampToolCall;
 exports.toolCallActionId = toolCallActionId;
 exports.toolCallHash = toolCallHash;

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","assertScopeGranted","signAsAgent","j"],"mappings":";;;;;;;AA0CO,SAAS,eAAe,KAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,SAAA,GAAYC,mBAAA,CAAUC,aAAA,CAAO,IAAI,WAAA,GAAc,MAAA,CAAO,GAAA,GAAM,IAAI,CAAC,CAAC,CAAA;AAC7E;AA4BO,SAAS,qBAAqB,CAAA,EAAkC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE,MAAA;AAAA,IACX,kBAAkB,CAAA,CAAE,cAAA;AAAA,IACpB,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAMF,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,aAAa,CAAA,EAA8B;AACvD,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,oBAAA,CAAqB,CAAC,CAAC,CAAC,CAAA;AAChE;AAEO,SAAS,gBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,aAAa,CAAC,CAAA;AAAA,IAC5B,cAAA,EAAgB,oBAAA,CAAqB,CAAC,CAAA,CAAE,UAAA;AAAA,IACxC,YAAA,EAAc,mDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAkBA,eAAsB,cAAc,KAAA,EAAoD;AACpF,EAAA,MAAM,iBACF,KAAA,CAAM,cAAA,IAAkB,CAAA,oBAAA,EAAuB,KAAA,CAAM,KAAK,IAAI,CAAA,CAAA,CAAA;AAElE,EAAAC,4BAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,eAAe,CAAA;AAEpE,EAAA,MAAM,KAAA,GAAQ,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA;AAC7C,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,YAAA,CAAa,MAAM,IAAI,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACpE,IAAA,EAAM,mDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AA2DO,SAAS,WACZ,KAAA,EACiC;AACjC,EAAA,OAAO;AAAA,IACH,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,OAAA,EAAS,OAAO,IAAA,EAAM,GAAA,KAAQ;AAC1B,MAAA,MAAM,IAAA,GAA0B;AAAA,QAC5B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,IAAA;AAAA,QACA,cAAA,EAAgB,cAAA,CAAe,GAAA,CAAI,UAAU;AAAA,OACjD;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc;AAAA,QAC/B,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB;AAAA,OACH,CAAA;AACD,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AACvC,MAAA,IAAI,MAAA,GAAkC,IAAA;AACtC,MAAA,IAAI,IAAI,KAAA,EAAO;AACX,QAAA,IAAI;AACA,UAAA,MAAA,GAAS,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAA,CAAI,KAAK,CAAA;AAAA,QACtD,SAAS,GAAA,EAAK;AAEV,UAAA,OAAA,CAAQ,KAAA,CAAM,kDAAkD,GAAG,CAAA;AAAA,QACvE;AAAA,MACJ;AACA,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAO;AAAA,IACpC;AAAA,GACJ;AACJ;AAuBA,eAAsB,iBAAA,CAClB,QACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,IAAW,uBAAA;AAClC,EAAA,MAAM,CAAA,GAAI,OAAO,KAAA,IAAS,KAAA;AAC1B,EAAA,MAAM,IAAA,GAAO;AAAA,IACT,YAAY,MAAA,CAAO,SAAA;AAAA,IACnB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,aAAA,EAAe,OAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,iBAAiB,MAAA,CAAO,eAAA;AAAA,IACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,cAAA,EAAgB,OAAO,OAAA,CAAQ,MAAA;AAAA,IAC/B,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAA,EAAW,OAAO,GAAA,CAAI,KAAA;AAAA,IACtB,IAAI,MAAA,CAAO;AAAA,GACf;AACA,EAAA,MAAM,CAAA,GAAI,MAAM,CAAA,CAAE,CAAA,EAAG,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,IACxC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,GAC5B,CAAA;AACD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI;AACP,IAAA,IAAI,MAAA,GAAS,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAA;AAC7B,IAAA,IAAI;AACA,MAAA,MAAMC,EAAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,MAAA,IAAIA,EAAAA,CAAE,MAAA,EAAQ,MAAA,GAASA,EAAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,EAAA,OAAO,CAAA,CAAE,MAAA;AACb","file":"index.js","sourcesContent":["// @orangecheck/agent-langgraph — wrap LangGraph tool-node executions in\n// OC Agent action envelopes.\n//\n// LangGraph's distinguishing feature is graph state: stateful agents\n// composed of typed nodes that share a persisted state object. The\n// compliance-relevant question becomes \"at what graph state did this\n// agent take this action?\" — and the answer must be cryptographically\n// bound to the action receipt.\n//\n// This adapter therefore canonicalizes (verb, args, callId, graph_state_hash)\n// — one extra field over the agent-mcp / agent-anthropic / agent-openai /\n// agent-vercel canonicalization. Two verifiers re-deriving the action from\n// a persisted graph snapshot compute the same envelope id only when the\n// snapshot's state-hash matches; tampered or out-of-order replay fails.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n assertScopeGranted,\n canonicalize,\n computeActionId,\n hexEncode,\n type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n signAsAgent,\n type ActionEnvelope,\n type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Graph state hashing\n// ─────────────────────────────────────────────────────────────────────────────\n\n/*\n Compute a stable hash of a LangGraph state object. Use canonical JSON\n * (RFC 8785) so reordered keys / repeated serializations produce the same\n * hash. Returns `sha256:<64-hex>`.\n \n Most LangGraph deployments persist the state object via a checkpointer\n * (in-memory, postgres, redis, etc.). The state-hash here is over the\n * checkpointer's serialized state at the moment the tool node fires.\n /\nexport function graphStateHash(state: Record<string, unknown>): string {\n const str = canonicalize(state as unknown as Parameters<typeof canonicalize>[0]);\n return 'sha256:' + hexEncode(sha256(new TextEncoder().encode(str + '\\n')));\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Tool-call canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface LangGraphToolCall {\n /* Stable id assigned by your graph runtime for this tool invocation. /\n callId: string;\n /* Tool verb — typically the node name. /\n verb: string;\n /* JSON-serializable arguments to the tool node. /\n args: Record<string, unknown>;\n /* sha256:<64-hex> of the graph state at the moment of execution. /\n graphStateHash: string;\n}\n\n/\n Produce the canonical bytes for a LangGraph tool call.\n \n Shape (RFC 8785 canonical JSON, then trailing LF):\n * {\n * \"args\": <canonical JSON of args>,\n * \"call_id\": <callId>,\n * \"graph_state_hash\": <state hash>,\n * \"verb\": <verb>\n * }\n /\nexport function canonicalizeToolCall(c: LangGraphToolCall): Uint8Array {\n const canon = {\n args: c.args,\n call_id: c.callId,\n graph_state_hash: c.graphStateHash,\n verb: c.verb,\n };\n const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolCallHash(c: LangGraphToolCall): string {\n return 'sha256:' + hexEncode(sha256(canonicalizeToolCall(c)));\n}\n\nexport function toolCallActionId(\n agentAddress: string,\n signedAt: string,\n delegationId: string,\n scopeExercised: string,\n c: LangGraphToolCall\n): string {\n return computeActionId({\n address: agentAddress,\n content_hash: toolCallHash(c),\n content_length: canonicalizeToolCall(c).byteLength,\n content_mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n signed_at: signedAt,\n delegation_id: delegationId,\n scope_exercised: scopeExercised,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping primitive\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AgentContext {\n agent: SignerRef;\n delegation: DelegationEnvelope;\n}\n\nexport interface StampToolCallInput extends AgentContext {\n call: LangGraphToolCall;\n /* Defaults to `langgraph:tool(verb=<verb>)` — the tightest admissible sub-scope. /\n scopeExercised?: string;\n signedAt?: Date;\n}\n\nexport async function stampToolCall(input: StampToolCallInput): Promise<ActionEnvelope> {\n const scopeExercised =\n input.scopeExercised ?? `langgraph:tool(verb=${input.call.verb})`;\n\n assertScopeGranted(input.delegation, scopeExercised, 'stampToolCall');\n\n const bytes = canonicalizeToolCall(input.call);\n return signAsAgent({\n agent: input.agent,\n delegation: input.delegation as never,\n content: { hash: toolCallHash(input.call), length: bytes.byteLength },\n mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n scopeExercised,\n signedAt: input.signedAt,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// ocToolNode — convenience wrapper\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OcToolNodeInput<TArgs extends Record<string, unknown>, TResult> {\n /* OC Agent verb under which this tool is exercised. /\n verb: string;\n /* Your real handler. Receives the same args your LangGraph tool node receives. /\n execute: (args: TArgs) => Promise<TResult>;\n}\n\nexport interface OcToolNodeWrapped<TArgs extends Record<string, unknown>, TResult> {\n verb: string;\n /\n The execute fn your LangGraph node calls. Receives args + a context\n * object with the agent ref, delegation, callId, current graph state,\n * and an optional `fleet` field that triggers fire-and-forget POST\n * to fleet.ochk.io/api/actions after the underlying execute returns.\n /\n execute: (\n args: TArgs,\n ctx: AgentContext & {\n callId: string;\n graphState: Record<string, unknown>;\n fleet?: FleetClient;\n }\n ) => Promise<{\n result: TResult;\n action: ActionEnvelope;\n posted: PostActionResult \| null;\n }>;\n}\n\n/\n Wrap a LangGraph tool-node execute path so it produces an OC Agent\n * action envelope per call. The wrapper computes the graph_state_hash\n * inline from the supplied state object, so the verifier replaying the\n * graph against a persisted snapshot gets the same hash deterministically.\n \n Typical shape:\n \n const createInvoice = ocToolNode({\n * verb: 'invoice.create',\n * execute: async (args) => myInvoiceCreateImpl(args),\n * });\n \n const graph = new StateGraph(MyState)\n * .addNode('createInvoice', async (state) => {\n * const args = pickToolArgs(state);\n * const callId = state.lastToolCallId;\n * const { result, action } = await createInvoice.execute(args, {\n * agent, delegation, callId, graphState: state,\n * });\n * await audit.append(action);\n * return mergeResultIntoState(state, result);\n * });\n /\nexport function ocToolNode<TArgs extends Record<string, unknown>, TResult>(\n input: OcToolNodeInput<TArgs, TResult>\n): OcToolNodeWrapped<TArgs, TResult> {\n return {\n verb: input.verb,\n execute: async (args, ctx) => {\n const call: LangGraphToolCall = {\n callId: ctx.callId,\n verb: input.verb,\n args,\n graphStateHash: graphStateHash(ctx.graphState),\n };\n const action = await stampToolCall({\n agent: ctx.agent,\n delegation: ctx.delegation,\n call,\n });\n const result = await input.execute(args);\n let posted: PostActionResult \| null = null;\n if (ctx.fleet) {\n try {\n posted = await postActionToFleet(action, ctx.fleet);\n } catch (err) {\n // eslint-disable-next-line no-console\n console.error('[oc-agent-langgraph] postActionToFleet failed:', err);\n }\n }\n return { result, action, posted };\n },\n };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Fleet integration: POST stamped actions to fleet.ochk.io/api/actions\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface FleetClient {\n /* Defaults to https://fleet.ochk.io. /\n baseUrl?: string;\n /* Bearer token from /settings § 03 (`ock_<hex>`). /\n apiToken: string;\n /* Project the action belongs to (proj_). /\n projectId: string;\n /** Optional fetch override for runtimes that need it. */\n fetch?: typeof fetch;\n}\n\nexport interface PostActionResult {\n id: string;\n project_id: string;\n delegation_id: string;\n}\n\nexport async function postActionToFleet(\n action: ActionEnvelope,\n client: FleetClient\n): Promise<PostActionResult> {\n const baseUrl = client.baseUrl ?? 'https://fleet.ochk.io';\n const f = client.fetch ?? fetch;\n const body = {\n project_id: client.projectId,\n delegation_id: action.delegation_id,\n agent_address: action.signer.address,\n scope_exercised: action.scope_exercised,\n content_hash: action.content.hash,\n content_length: action.content.length,\n content_mime: action.content.mime,\n signed_at: action.signed_at,\n signature: action.sig.value,\n id: action.id,\n };\n const r = await f(`${baseUrl}/api/actions`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${client.apiToken}`,\n },\n body: JSON.stringify(body),\n });\n if (!r.ok) {\n let reason = `http_${r.status}`;\n try {\n const j = (await r.json()) as { reason?: string };\n if (j.reason) reason = j.reason;\n } catch {\n // body wasn't json\n }\n throw new Error(`postActionToFleet failed: ${reason}`);\n }\n const j = (await r.json()) as { ok: true; action: PostActionResult };\n return j.action;\n}\n"]}
1	+ {"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","assertScopeGranted","signAsAgent"],"mappings":";;;;;;;AA0CO,SAAS,eAAe,KAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,SAAA,GAAYC,mBAAA,CAAUC,aAAA,CAAO,IAAI,WAAA,GAAc,MAAA,CAAO,GAAA,GAAM,IAAI,CAAC,CAAC,CAAA;AAC7E;AA4BO,SAAS,qBAAqB,CAAA,EAAkC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE,MAAA;AAAA,IACX,kBAAkB,CAAA,CAAE,cAAA;AAAA,IACpB,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAMF,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,aAAa,CAAA,EAA8B;AACvD,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,oBAAA,CAAqB,CAAC,CAAC,CAAC,CAAA;AAChE;AAEO,SAAS,gBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,aAAa,CAAC,CAAA;AAAA,IAC5B,cAAA,EAAgB,oBAAA,CAAqB,CAAC,CAAA,CAAE,UAAA;AAAA,IACxC,YAAA,EAAc,mDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAkBA,eAAsB,cAAc,KAAA,EAAoD;AACpF,EAAA,MAAM,iBACF,KAAA,CAAM,cAAA,IAAkB,CAAA,oBAAA,EAAuB,KAAA,CAAM,KAAK,IAAI,CAAA,CAAA,CAAA;AAElE,EAAAC,4BAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,eAAe,CAAA;AAEpE,EAAA,MAAM,KAAA,GAAQ,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA;AAC7C,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,YAAA,CAAa,MAAM,IAAI,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACpE,IAAA,EAAM,mDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAwDO,SAAS,WACZ,KAAA,EACiC;AACjC,EAAA,OAAO;AAAA,IACH,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,OAAA,EAAS,OAAO,IAAA,EAAM,GAAA,KAAQ;AAC1B,MAAA,MAAM,IAAA,GAA0B;AAAA,QAC5B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,IAAA;AAAA,QACA,cAAA,EAAgB,cAAA,CAAe,GAAA,CAAI,UAAU;AAAA,OACjD;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc;AAAA,QAC/B,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB;AAAA,OACH,CAAA;AACD,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AACvC,MAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,IAC5B;AAAA,GACJ;AACJ","file":"index.js","sourcesContent":["// @orangecheck/agent-langgraph — wrap LangGraph tool-node executions in\n// OC Agent action envelopes.\n//\n// LangGraph's distinguishing feature is graph state: stateful agents\n// composed of typed nodes that share a persisted state object. The\n// compliance-relevant question becomes \"at what graph state did this\n// agent take this action?\" — and the answer must be cryptographically\n// bound to the action receipt.\n//\n// This adapter therefore canonicalizes (verb, args, callId, graph_state_hash)\n// — one extra field over the agent-mcp / agent-anthropic / agent-openai /\n// agent-vercel canonicalization. Two verifiers re-deriving the action from\n// a persisted graph snapshot compute the same envelope id only when the\n// snapshot's state-hash matches; tampered or out-of-order replay fails.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n assertScopeGranted,\n canonicalize,\n computeActionId,\n hexEncode,\n type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n signAsAgent,\n type ActionEnvelope,\n type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Graph state hashing\n// ─────────────────────────────────────────────────────────────────────────────\n\n/*\n Compute a stable hash of a LangGraph state object. Use canonical JSON\n * (RFC 8785) so reordered keys / repeated serializations produce the same\n * hash. Returns `sha256:<64-hex>`.\n \n Most LangGraph deployments persist the state object via a checkpointer\n * (in-memory, postgres, redis, etc.). The state-hash here is over the\n * checkpointer's serialized state at the moment the tool node fires.\n /\nexport function graphStateHash(state: Record<string, unknown>): string {\n const str = canonicalize(state as unknown as Parameters<typeof canonicalize>[0]);\n return 'sha256:' + hexEncode(sha256(new TextEncoder().encode(str + '\\n')));\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Tool-call canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface LangGraphToolCall {\n /* Stable id assigned by your graph runtime for this tool invocation. /\n callId: string;\n /* Tool verb — typically the node name. /\n verb: string;\n /* JSON-serializable arguments to the tool node. /\n args: Record<string, unknown>;\n /* sha256:<64-hex> of the graph state at the moment of execution. /\n graphStateHash: string;\n}\n\n/\n Produce the canonical bytes for a LangGraph tool call.\n \n Shape (RFC 8785 canonical JSON, then trailing LF):\n * {\n * \"args\": <canonical JSON of args>,\n * \"call_id\": <callId>,\n * \"graph_state_hash\": <state hash>,\n * \"verb\": <verb>\n * }\n /\nexport function canonicalizeToolCall(c: LangGraphToolCall): Uint8Array {\n const canon = {\n args: c.args,\n call_id: c.callId,\n graph_state_hash: c.graphStateHash,\n verb: c.verb,\n };\n const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolCallHash(c: LangGraphToolCall): string {\n return 'sha256:' + hexEncode(sha256(canonicalizeToolCall(c)));\n}\n\nexport function toolCallActionId(\n agentAddress: string,\n signedAt: string,\n delegationId: string,\n scopeExercised: string,\n c: LangGraphToolCall\n): string {\n return computeActionId({\n address: agentAddress,\n content_hash: toolCallHash(c),\n content_length: canonicalizeToolCall(c).byteLength,\n content_mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n signed_at: signedAt,\n delegation_id: delegationId,\n scope_exercised: scopeExercised,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping primitive\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AgentContext {\n agent: SignerRef;\n delegation: DelegationEnvelope;\n}\n\nexport interface StampToolCallInput extends AgentContext {\n call: LangGraphToolCall;\n /* Defaults to `langgraph:tool(verb=<verb>)` — the tightest admissible sub-scope. /\n scopeExercised?: string;\n signedAt?: Date;\n}\n\nexport async function stampToolCall(input: StampToolCallInput): Promise<ActionEnvelope> {\n const scopeExercised =\n input.scopeExercised ?? `langgraph:tool(verb=${input.call.verb})`;\n\n assertScopeGranted(input.delegation, scopeExercised, 'stampToolCall');\n\n const bytes = canonicalizeToolCall(input.call);\n return signAsAgent({\n agent: input.agent,\n delegation: input.delegation as never,\n content: { hash: toolCallHash(input.call), length: bytes.byteLength },\n mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n scopeExercised,\n signedAt: input.signedAt,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// ocToolNode — convenience wrapper\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OcToolNodeInput<TArgs extends Record<string, unknown>, TResult> {\n /* OC Agent verb under which this tool is exercised. /\n verb: string;\n /* Your real handler. Receives the same args your LangGraph tool node receives. /\n execute: (args: TArgs) => Promise<TResult>;\n}\n\nexport interface OcToolNodeWrapped<TArgs extends Record<string, unknown>, TResult> {\n verb: string;\n /\n The execute fn your LangGraph node calls. Receives args + a context\n * object with the agent ref, delegation, callId, current graph state,\n * and the current graph state.\n /\n execute: (\n args: TArgs,\n ctx: AgentContext & {\n callId: string;\n graphState: Record<string, unknown>;\n }\n ) => Promise<{\n result: TResult;\n action: ActionEnvelope;\n }>;\n}\n\n/\n Wrap a LangGraph tool-node execute path so it produces an OC Agent\n * action envelope per call. The wrapper computes the graph_state_hash\n * inline from the supplied state object, so the verifier replaying the\n * graph against a persisted snapshot gets the same hash deterministically.\n \n Typical shape:\n \n const createInvoice = ocToolNode({\n * verb: 'invoice.create',\n * execute: async (args) => myInvoiceCreateImpl(args),\n * });\n \n const graph = new StateGraph(MyState)\n * .addNode('createInvoice', async (state) => {\n * const args = pickToolArgs(state);\n * const callId = state.lastToolCallId;\n * const { result, action } = await createInvoice.execute(args, {\n * agent, delegation, callId, graphState: state,\n * });\n * await audit.append(action);\n * return mergeResultIntoState(state, result);\n * });\n */\nexport function ocToolNode<TArgs extends Record<string, unknown>, TResult>(\n input: OcToolNodeInput<TArgs, TResult>\n): OcToolNodeWrapped<TArgs, TResult> {\n return {\n verb: input.verb,\n execute: async (args, ctx) => {\n const call: LangGraphToolCall = {\n callId: ctx.callId,\n verb: input.verb,\n args,\n graphStateHash: graphStateHash(ctx.graphState),\n };\n const action = await stampToolCall({\n agent: ctx.agent,\n delegation: ctx.delegation,\n call,\n });\n const result = await input.execute(args);\n return { result, action };\n },\n };\n}\n"]}

package/dist/index.mjs CHANGED Viewed

@@ -60,54 +60,11 @@ function ocToolNode(input) {
         call
       });
       const result = await input.execute(args);
-      let posted = null;
-      if (ctx.fleet) {
-        try {
-          posted = await postActionToFleet(action, ctx.fleet);
-        } catch (err) {
-          console.error("[oc-agent-langgraph] postActionToFleet failed:", err);
-        }
-      }
-      return { result, action, posted };
+      return { result, action };
     }
   };
 }
-async function postActionToFleet(action, client) {
-  const baseUrl = client.baseUrl ?? "https://fleet.ochk.io";
-  const f = client.fetch ?? fetch;
-  const body = {
-    project_id: client.projectId,
-    delegation_id: action.delegation_id,
-    agent_address: action.signer.address,
-    scope_exercised: action.scope_exercised,
-    content_hash: action.content.hash,
-    content_length: action.content.length,
-    content_mime: action.content.mime,
-    signed_at: action.signed_at,
-    signature: action.sig.value,
-    id: action.id
-  };
-  const r = await f(`${baseUrl}/api/actions`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${client.apiToken}`
-    },
-    body: JSON.stringify(body)
-  });
-  if (!r.ok) {
-    let reason = `http_${r.status}`;
-    try {
-      const j2 = await r.json();
-      if (j2.reason) reason = j2.reason;
-    } catch {
-    }
-    throw new Error(`postActionToFleet failed: ${reason}`);
-  }
-  const j = await r.json();
-  return j.action;
-}
-export { canonicalizeToolCall, graphStateHash, ocToolNode, postActionToFleet, stampToolCall, toolCallActionId, toolCallHash };
+export { canonicalizeToolCall, graphStateHash, ocToolNode, stampToolCall, toolCallActionId, toolCallHash };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts"],"names":["j"],"mappings":";;;;;AA0CO,SAAS,eAAe,KAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,SAAA,GAAY,SAAA,CAAU,MAAA,CAAO,IAAI,WAAA,GAAc,MAAA,CAAO,GAAA,GAAM,IAAI,CAAC,CAAC,CAAA;AAC7E;AA4BO,SAAS,qBAAqB,CAAA,EAAkC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE,MAAA;AAAA,IACX,kBAAkB,CAAA,CAAE,cAAA;AAAA,IACpB,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,aAAa,CAAA,EAA8B;AACvD,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,oBAAA,CAAqB,CAAC,CAAC,CAAC,CAAA;AAChE;AAEO,SAAS,gBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,aAAa,CAAC,CAAA;AAAA,IAC5B,cAAA,EAAgB,oBAAA,CAAqB,CAAC,CAAA,CAAE,UAAA;AAAA,IACxC,YAAA,EAAc,mDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAkBA,eAAsB,cAAc,KAAA,EAAoD;AACpF,EAAA,MAAM,iBACF,KAAA,CAAM,cAAA,IAAkB,CAAA,oBAAA,EAAuB,KAAA,CAAM,KAAK,IAAI,CAAA,CAAA,CAAA;AAElE,EAAA,kBAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,eAAe,CAAA;AAEpE,EAAA,MAAM,KAAA,GAAQ,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA;AAC7C,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,YAAA,CAAa,MAAM,IAAI,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACpE,IAAA,EAAM,mDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AA2DO,SAAS,WACZ,KAAA,EACiC;AACjC,EAAA,OAAO;AAAA,IACH,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,OAAA,EAAS,OAAO,IAAA,EAAM,GAAA,KAAQ;AAC1B,MAAA,MAAM,IAAA,GAA0B;AAAA,QAC5B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,IAAA;AAAA,QACA,cAAA,EAAgB,cAAA,CAAe,GAAA,CAAI,UAAU;AAAA,OACjD;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc;AAAA,QAC/B,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB;AAAA,OACH,CAAA;AACD,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AACvC,MAAA,IAAI,MAAA,GAAkC,IAAA;AACtC,MAAA,IAAI,IAAI,KAAA,EAAO;AACX,QAAA,IAAI;AACA,UAAA,MAAA,GAAS,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAA,CAAI,KAAK,CAAA;AAAA,QACtD,SAAS,GAAA,EAAK;AAEV,UAAA,OAAA,CAAQ,KAAA,CAAM,kDAAkD,GAAG,CAAA;AAAA,QACvE;AAAA,MACJ;AACA,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAO;AAAA,IACpC;AAAA,GACJ;AACJ;AAuBA,eAAsB,iBAAA,CAClB,QACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,IAAW,uBAAA;AAClC,EAAA,MAAM,CAAA,GAAI,OAAO,KAAA,IAAS,KAAA;AAC1B,EAAA,MAAM,IAAA,GAAO;AAAA,IACT,YAAY,MAAA,CAAO,SAAA;AAAA,IACnB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,aAAA,EAAe,OAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,iBAAiB,MAAA,CAAO,eAAA;AAAA,IACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,cAAA,EAAgB,OAAO,OAAA,CAAQ,MAAA;AAAA,IAC/B,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAA,EAAW,OAAO,GAAA,CAAI,KAAA;AAAA,IACtB,IAAI,MAAA,CAAO;AAAA,GACf;AACA,EAAA,MAAM,CAAA,GAAI,MAAM,CAAA,CAAE,CAAA,EAAG,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,IACxC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,GAC5B,CAAA;AACD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI;AACP,IAAA,IAAI,MAAA,GAAS,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAA;AAC7B,IAAA,IAAI;AACA,MAAA,MAAMA,EAAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,MAAA,IAAIA,EAAAA,CAAE,MAAA,EAAQ,MAAA,GAASA,EAAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,EAAA,OAAO,CAAA,CAAE,MAAA;AACb","file":"index.mjs","sourcesContent":["// @orangecheck/agent-langgraph — wrap LangGraph tool-node executions in\n// OC Agent action envelopes.\n//\n// LangGraph's distinguishing feature is graph state: stateful agents\n// composed of typed nodes that share a persisted state object. The\n// compliance-relevant question becomes \"at what graph state did this\n// agent take this action?\" — and the answer must be cryptographically\n// bound to the action receipt.\n//\n// This adapter therefore canonicalizes (verb, args, callId, graph_state_hash)\n// — one extra field over the agent-mcp / agent-anthropic / agent-openai /\n// agent-vercel canonicalization. Two verifiers re-deriving the action from\n// a persisted graph snapshot compute the same envelope id only when the\n// snapshot's state-hash matches; tampered or out-of-order replay fails.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n assertScopeGranted,\n canonicalize,\n computeActionId,\n hexEncode,\n type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n signAsAgent,\n type ActionEnvelope,\n type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Graph state hashing\n// ─────────────────────────────────────────────────────────────────────────────\n\n/*\n Compute a stable hash of a LangGraph state object. Use canonical JSON\n * (RFC 8785) so reordered keys / repeated serializations produce the same\n * hash. Returns `sha256:<64-hex>`.\n \n Most LangGraph deployments persist the state object via a checkpointer\n * (in-memory, postgres, redis, etc.). The state-hash here is over the\n * checkpointer's serialized state at the moment the tool node fires.\n /\nexport function graphStateHash(state: Record<string, unknown>): string {\n const str = canonicalize(state as unknown as Parameters<typeof canonicalize>[0]);\n return 'sha256:' + hexEncode(sha256(new TextEncoder().encode(str + '\\n')));\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Tool-call canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface LangGraphToolCall {\n /* Stable id assigned by your graph runtime for this tool invocation. /\n callId: string;\n /* Tool verb — typically the node name. /\n verb: string;\n /* JSON-serializable arguments to the tool node. /\n args: Record<string, unknown>;\n /* sha256:<64-hex> of the graph state at the moment of execution. /\n graphStateHash: string;\n}\n\n/\n Produce the canonical bytes for a LangGraph tool call.\n \n Shape (RFC 8785 canonical JSON, then trailing LF):\n * {\n * \"args\": <canonical JSON of args>,\n * \"call_id\": <callId>,\n * \"graph_state_hash\": <state hash>,\n * \"verb\": <verb>\n * }\n /\nexport function canonicalizeToolCall(c: LangGraphToolCall): Uint8Array {\n const canon = {\n args: c.args,\n call_id: c.callId,\n graph_state_hash: c.graphStateHash,\n verb: c.verb,\n };\n const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolCallHash(c: LangGraphToolCall): string {\n return 'sha256:' + hexEncode(sha256(canonicalizeToolCall(c)));\n}\n\nexport function toolCallActionId(\n agentAddress: string,\n signedAt: string,\n delegationId: string,\n scopeExercised: string,\n c: LangGraphToolCall\n): string {\n return computeActionId({\n address: agentAddress,\n content_hash: toolCallHash(c),\n content_length: canonicalizeToolCall(c).byteLength,\n content_mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n signed_at: signedAt,\n delegation_id: delegationId,\n scope_exercised: scopeExercised,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping primitive\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AgentContext {\n agent: SignerRef;\n delegation: DelegationEnvelope;\n}\n\nexport interface StampToolCallInput extends AgentContext {\n call: LangGraphToolCall;\n /* Defaults to `langgraph:tool(verb=<verb>)` — the tightest admissible sub-scope. /\n scopeExercised?: string;\n signedAt?: Date;\n}\n\nexport async function stampToolCall(input: StampToolCallInput): Promise<ActionEnvelope> {\n const scopeExercised =\n input.scopeExercised ?? `langgraph:tool(verb=${input.call.verb})`;\n\n assertScopeGranted(input.delegation, scopeExercised, 'stampToolCall');\n\n const bytes = canonicalizeToolCall(input.call);\n return signAsAgent({\n agent: input.agent,\n delegation: input.delegation as never,\n content: { hash: toolCallHash(input.call), length: bytes.byteLength },\n mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n scopeExercised,\n signedAt: input.signedAt,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// ocToolNode — convenience wrapper\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OcToolNodeInput<TArgs extends Record<string, unknown>, TResult> {\n /* OC Agent verb under which this tool is exercised. /\n verb: string;\n /* Your real handler. Receives the same args your LangGraph tool node receives. /\n execute: (args: TArgs) => Promise<TResult>;\n}\n\nexport interface OcToolNodeWrapped<TArgs extends Record<string, unknown>, TResult> {\n verb: string;\n /\n The execute fn your LangGraph node calls. Receives args + a context\n * object with the agent ref, delegation, callId, current graph state,\n * and an optional `fleet` field that triggers fire-and-forget POST\n * to fleet.ochk.io/api/actions after the underlying execute returns.\n /\n execute: (\n args: TArgs,\n ctx: AgentContext & {\n callId: string;\n graphState: Record<string, unknown>;\n fleet?: FleetClient;\n }\n ) => Promise<{\n result: TResult;\n action: ActionEnvelope;\n posted: PostActionResult \| null;\n }>;\n}\n\n/\n Wrap a LangGraph tool-node execute path so it produces an OC Agent\n * action envelope per call. The wrapper computes the graph_state_hash\n * inline from the supplied state object, so the verifier replaying the\n * graph against a persisted snapshot gets the same hash deterministically.\n \n Typical shape:\n \n const createInvoice = ocToolNode({\n * verb: 'invoice.create',\n * execute: async (args) => myInvoiceCreateImpl(args),\n * });\n \n const graph = new StateGraph(MyState)\n * .addNode('createInvoice', async (state) => {\n * const args = pickToolArgs(state);\n * const callId = state.lastToolCallId;\n * const { result, action } = await createInvoice.execute(args, {\n * agent, delegation, callId, graphState: state,\n * });\n * await audit.append(action);\n * return mergeResultIntoState(state, result);\n * });\n /\nexport function ocToolNode<TArgs extends Record<string, unknown>, TResult>(\n input: OcToolNodeInput<TArgs, TResult>\n): OcToolNodeWrapped<TArgs, TResult> {\n return {\n verb: input.verb,\n execute: async (args, ctx) => {\n const call: LangGraphToolCall = {\n callId: ctx.callId,\n verb: input.verb,\n args,\n graphStateHash: graphStateHash(ctx.graphState),\n };\n const action = await stampToolCall({\n agent: ctx.agent,\n delegation: ctx.delegation,\n call,\n });\n const result = await input.execute(args);\n let posted: PostActionResult \| null = null;\n if (ctx.fleet) {\n try {\n posted = await postActionToFleet(action, ctx.fleet);\n } catch (err) {\n // eslint-disable-next-line no-console\n console.error('[oc-agent-langgraph] postActionToFleet failed:', err);\n }\n }\n return { result, action, posted };\n },\n };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Fleet integration: POST stamped actions to fleet.ochk.io/api/actions\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface FleetClient {\n /* Defaults to https://fleet.ochk.io. /\n baseUrl?: string;\n /* Bearer token from /settings § 03 (`ock_<hex>`). /\n apiToken: string;\n /* Project the action belongs to (proj_). /\n projectId: string;\n /** Optional fetch override for runtimes that need it. */\n fetch?: typeof fetch;\n}\n\nexport interface PostActionResult {\n id: string;\n project_id: string;\n delegation_id: string;\n}\n\nexport async function postActionToFleet(\n action: ActionEnvelope,\n client: FleetClient\n): Promise<PostActionResult> {\n const baseUrl = client.baseUrl ?? 'https://fleet.ochk.io';\n const f = client.fetch ?? fetch;\n const body = {\n project_id: client.projectId,\n delegation_id: action.delegation_id,\n agent_address: action.signer.address,\n scope_exercised: action.scope_exercised,\n content_hash: action.content.hash,\n content_length: action.content.length,\n content_mime: action.content.mime,\n signed_at: action.signed_at,\n signature: action.sig.value,\n id: action.id,\n };\n const r = await f(`${baseUrl}/api/actions`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${client.apiToken}`,\n },\n body: JSON.stringify(body),\n });\n if (!r.ok) {\n let reason = `http_${r.status}`;\n try {\n const j = (await r.json()) as { reason?: string };\n if (j.reason) reason = j.reason;\n } catch {\n // body wasn't json\n }\n throw new Error(`postActionToFleet failed: ${reason}`);\n }\n const j = (await r.json()) as { ok: true; action: PostActionResult };\n return j.action;\n}\n"]}
1	+ {"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;AA0CO,SAAS,eAAe,KAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,SAAA,GAAY,SAAA,CAAU,MAAA,CAAO,IAAI,WAAA,GAAc,MAAA,CAAO,GAAA,GAAM,IAAI,CAAC,CAAC,CAAA;AAC7E;AA4BO,SAAS,qBAAqB,CAAA,EAAkC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE,MAAA;AAAA,IACX,kBAAkB,CAAA,CAAE,cAAA;AAAA,IACpB,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,aAAa,CAAA,EAA8B;AACvD,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,oBAAA,CAAqB,CAAC,CAAC,CAAC,CAAA;AAChE;AAEO,SAAS,gBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,aAAa,CAAC,CAAA;AAAA,IAC5B,cAAA,EAAgB,oBAAA,CAAqB,CAAC,CAAA,CAAE,UAAA;AAAA,IACxC,YAAA,EAAc,mDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAkBA,eAAsB,cAAc,KAAA,EAAoD;AACpF,EAAA,MAAM,iBACF,KAAA,CAAM,cAAA,IAAkB,CAAA,oBAAA,EAAuB,KAAA,CAAM,KAAK,IAAI,CAAA,CAAA,CAAA;AAElE,EAAA,kBAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,eAAe,CAAA;AAEpE,EAAA,MAAM,KAAA,GAAQ,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA;AAC7C,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,YAAA,CAAa,MAAM,IAAI,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IACpE,IAAA,EAAM,mDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAwDO,SAAS,WACZ,KAAA,EACiC;AACjC,EAAA,OAAO;AAAA,IACH,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,OAAA,EAAS,OAAO,IAAA,EAAM,GAAA,KAAQ;AAC1B,MAAA,MAAM,IAAA,GAA0B;AAAA,QAC5B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,IAAA;AAAA,QACA,cAAA,EAAgB,cAAA,CAAe,GAAA,CAAI,UAAU;AAAA,OACjD;AACA,MAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc;AAAA,QAC/B,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB;AAAA,OACH,CAAA;AACD,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AACvC,MAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAAA,IAC5B;AAAA,GACJ;AACJ","file":"index.mjs","sourcesContent":["// @orangecheck/agent-langgraph — wrap LangGraph tool-node executions in\n// OC Agent action envelopes.\n//\n// LangGraph's distinguishing feature is graph state: stateful agents\n// composed of typed nodes that share a persisted state object. The\n// compliance-relevant question becomes \"at what graph state did this\n// agent take this action?\" — and the answer must be cryptographically\n// bound to the action receipt.\n//\n// This adapter therefore canonicalizes (verb, args, callId, graph_state_hash)\n// — one extra field over the agent-mcp / agent-anthropic / agent-openai /\n// agent-vercel canonicalization. Two verifiers re-deriving the action from\n// a persisted graph snapshot compute the same envelope id only when the\n// snapshot's state-hash matches; tampered or out-of-order replay fails.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n assertScopeGranted,\n canonicalize,\n computeActionId,\n hexEncode,\n type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n signAsAgent,\n type ActionEnvelope,\n type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Graph state hashing\n// ─────────────────────────────────────────────────────────────────────────────\n\n/*\n Compute a stable hash of a LangGraph state object. Use canonical JSON\n * (RFC 8785) so reordered keys / repeated serializations produce the same\n * hash. Returns `sha256:<64-hex>`.\n \n Most LangGraph deployments persist the state object via a checkpointer\n * (in-memory, postgres, redis, etc.). The state-hash here is over the\n * checkpointer's serialized state at the moment the tool node fires.\n /\nexport function graphStateHash(state: Record<string, unknown>): string {\n const str = canonicalize(state as unknown as Parameters<typeof canonicalize>[0]);\n return 'sha256:' + hexEncode(sha256(new TextEncoder().encode(str + '\\n')));\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Tool-call canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface LangGraphToolCall {\n /* Stable id assigned by your graph runtime for this tool invocation. /\n callId: string;\n /* Tool verb — typically the node name. /\n verb: string;\n /* JSON-serializable arguments to the tool node. /\n args: Record<string, unknown>;\n /* sha256:<64-hex> of the graph state at the moment of execution. /\n graphStateHash: string;\n}\n\n/\n Produce the canonical bytes for a LangGraph tool call.\n \n Shape (RFC 8785 canonical JSON, then trailing LF):\n * {\n * \"args\": <canonical JSON of args>,\n * \"call_id\": <callId>,\n * \"graph_state_hash\": <state hash>,\n * \"verb\": <verb>\n * }\n /\nexport function canonicalizeToolCall(c: LangGraphToolCall): Uint8Array {\n const canon = {\n args: c.args,\n call_id: c.callId,\n graph_state_hash: c.graphStateHash,\n verb: c.verb,\n };\n const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n return new TextEncoder().encode(str + '\\n');\n}\n\nexport function toolCallHash(c: LangGraphToolCall): string {\n return 'sha256:' + hexEncode(sha256(canonicalizeToolCall(c)));\n}\n\nexport function toolCallActionId(\n agentAddress: string,\n signedAt: string,\n delegationId: string,\n scopeExercised: string,\n c: LangGraphToolCall\n): string {\n return computeActionId({\n address: agentAddress,\n content_hash: toolCallHash(c),\n content_length: canonicalizeToolCall(c).byteLength,\n content_mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n signed_at: signedAt,\n delegation_id: delegationId,\n scope_exercised: scopeExercised,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping primitive\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AgentContext {\n agent: SignerRef;\n delegation: DelegationEnvelope;\n}\n\nexport interface StampToolCallInput extends AgentContext {\n call: LangGraphToolCall;\n /* Defaults to `langgraph:tool(verb=<verb>)` — the tightest admissible sub-scope. /\n scopeExercised?: string;\n signedAt?: Date;\n}\n\nexport async function stampToolCall(input: StampToolCallInput): Promise<ActionEnvelope> {\n const scopeExercised =\n input.scopeExercised ?? `langgraph:tool(verb=${input.call.verb})`;\n\n assertScopeGranted(input.delegation, scopeExercised, 'stampToolCall');\n\n const bytes = canonicalizeToolCall(input.call);\n return signAsAgent({\n agent: input.agent,\n delegation: input.delegation as never,\n content: { hash: toolCallHash(input.call), length: bytes.byteLength },\n mime: 'application/vnd.oc-agent.langgraph-tool-call+json',\n scopeExercised,\n signedAt: input.signedAt,\n });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// ocToolNode — convenience wrapper\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OcToolNodeInput<TArgs extends Record<string, unknown>, TResult> {\n /* OC Agent verb under which this tool is exercised. /\n verb: string;\n /* Your real handler. Receives the same args your LangGraph tool node receives. /\n execute: (args: TArgs) => Promise<TResult>;\n}\n\nexport interface OcToolNodeWrapped<TArgs extends Record<string, unknown>, TResult> {\n verb: string;\n /\n The execute fn your LangGraph node calls. Receives args + a context\n * object with the agent ref, delegation, callId, current graph state,\n * and the current graph state.\n /\n execute: (\n args: TArgs,\n ctx: AgentContext & {\n callId: string;\n graphState: Record<string, unknown>;\n }\n ) => Promise<{\n result: TResult;\n action: ActionEnvelope;\n }>;\n}\n\n/\n Wrap a LangGraph tool-node execute path so it produces an OC Agent\n * action envelope per call. The wrapper computes the graph_state_hash\n * inline from the supplied state object, so the verifier replaying the\n * graph against a persisted snapshot gets the same hash deterministically.\n \n Typical shape:\n \n const createInvoice = ocToolNode({\n * verb: 'invoice.create',\n * execute: async (args) => myInvoiceCreateImpl(args),\n * });\n \n const graph = new StateGraph(MyState)\n * .addNode('createInvoice', async (state) => {\n * const args = pickToolArgs(state);\n * const callId = state.lastToolCallId;\n * const { result, action } = await createInvoice.execute(args, {\n * agent, delegation, callId, graphState: state,\n * });\n * await audit.append(action);\n * return mergeResultIntoState(state, result);\n * });\n */\nexport function ocToolNode<TArgs extends Record<string, unknown>, TResult>(\n input: OcToolNodeInput<TArgs, TResult>\n): OcToolNodeWrapped<TArgs, TResult> {\n return {\n verb: input.verb,\n execute: async (args, ctx) => {\n const call: LangGraphToolCall = {\n callId: ctx.callId,\n verb: input.verb,\n args,\n graphStateHash: graphStateHash(ctx.graphState),\n };\n const action = await stampToolCall({\n agent: ctx.agent,\n delegation: ctx.delegation,\n call,\n });\n const result = await input.execute(args);\n return { result, action };\n },\n };\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@orangecheck/agent-langgraph",
-  "version": "0.3.0",
+  "version": "1.0.0",
   "description": "Wrap LangGraph tool nodes with OC Agent scope enforcement and emit a signed agent-action envelope per execution. Binds the action to the graph-state hash so verifiers replay the audit against the persisted graph snapshot.",
   "keywords": [
     "bitcoin",

package/src/index.ts CHANGED Viewed

@@ -153,20 +153,17 @@ export interface OcToolNodeWrapped<TArgs extends Record<string, unknown>, TResul
     /**
      * The execute fn your LangGraph node calls. Receives args + a context
      * object with the agent ref, delegation, callId, current graph state,
-     * and an optional `fleet` field that triggers fire-and-forget POST
-     * to fleet.ochk.io/api/actions after the underlying execute returns.
+     * and the current graph state.
      */
     execute: (
         args: TArgs,
         ctx: AgentContext & {
             callId: string;
             graphState: Record<string, unknown>;
-            fleet?: FleetClient;
         }
     ) => Promise<{
         result: TResult;
         action: ActionEnvelope;
-        posted: PostActionResult | null;
     }>;
 }
@@ -212,77 +209,7 @@ export function ocToolNode<TArgs extends Record<string, unknown>, TResult>(
                 call,
             });
             const result = await input.execute(args);
-            let posted: PostActionResult | null = null;
-            if (ctx.fleet) {
-                try {
-                    posted = await postActionToFleet(action, ctx.fleet);
-                } catch (err) {
-                    // eslint-disable-next-line no-console
-                    console.error('[oc-agent-langgraph] postActionToFleet failed:', err);
-                }
-            }
-            return { result, action, posted };
+            return { result, action };
         },
     };
 }
-// ─────────────────────────────────────────────────────────────────────────────
-// Fleet integration: POST stamped actions to fleet.ochk.io/api/actions
-// ─────────────────────────────────────────────────────────────────────────────
-export interface FleetClient {
-    /** Defaults to https://fleet.ochk.io. */
-    baseUrl?: string;
-    /** Bearer token from /settings § 03 (`ock_<hex>`). */
-    apiToken: string;
-    /** Project the action belongs to (proj_*). */
-    projectId: string;
-    /** Optional fetch override for runtimes that need it. */
-    fetch?: typeof fetch;
-}
-export interface PostActionResult {
-    id: string;
-    project_id: string;
-    delegation_id: string;
-}
-export async function postActionToFleet(
-    action: ActionEnvelope,
-    client: FleetClient
-): Promise<PostActionResult> {
-    const baseUrl = client.baseUrl ?? 'https://fleet.ochk.io';
-    const f = client.fetch ?? fetch;
-    const body = {
-        project_id: client.projectId,
-        delegation_id: action.delegation_id,
-        agent_address: action.signer.address,
-        scope_exercised: action.scope_exercised,
-        content_hash: action.content.hash,
-        content_length: action.content.length,
-        content_mime: action.content.mime,
-        signed_at: action.signed_at,
-        signature: action.sig.value,
-        id: action.id,
-    };
-    const r = await f(`${baseUrl}/api/actions`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${client.apiToken}`,
-        },
-        body: JSON.stringify(body),
-    });
-    if (!r.ok) {
-        let reason = `http_${r.status}`;
-        try {
-            const j = (await r.json()) as { reason?: string };
-            if (j.reason) reason = j.reason;
-        } catch {
-            // body wasn't json
-        }
-        throw new Error(`postActionToFleet failed: ${reason}`);
-    }
-    const j = (await r.json()) as { ok: true; action: PostActionResult };
-    return j.action;
-}