@orangecheck/agent-mcp 0.2.0 → 0.4.0

package/README.md

@@ -1,5 +1,9 @@
 # @orangecheck/agent-mcp
 
+> **Full reference:** [docs.ochk.io/sdk/agent-mcp](https://docs.ochk.io/sdk/agent-mcp) — auto-generated from the TypeScript source on every release.
+> Hand-written prose below is the high-level overview; the docs site is the source of truth for every export, type, and signature.
+
+
 Wrap [Model Context Protocol](https://modelcontextprotocol.io/) tool invocations in [OC Agent](https://github.com/orangecheck/oc-agent-protocol) envelopes. Every call produces a signed, scope-constrained, verifiable `agent-action` stamp.
 
 ## Why

package/dist/index.d.mts

@@ -1,7 +1,5 @@
 import { DelegationEnvelope } from '@orangecheck/agent-core';
 import { SignerRef, ActionEnvelope } from '@orangecheck/agent-signer';
-import { ConsoleClient, PostActionResult } from '@orangecheck/agent-console-client';
-export { ConsoleClient, PostActionResult, postActionToConsole } from '@orangecheck/agent-console-client';
 
 interface McpInvocation {
     server: string;
@@ -28,12 +26,4 @@ interface InvokeWithStampResult<T> {
 }
 declare function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>>;
 
-interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
-    console?: ConsoleClient;
-}
-interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
-    posted: PostActionResult | null;
-}
-declare function invokeWithStampAndPost<T>(input: InvokeWithStampAndPostInput<T>): Promise<InvokeWithStampAndPostResult<T>>;
-
-export { type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type McpInvocation, type StampInvocationInput, canonicalizeInvocation, invocationHash, invocationId, invokeWithStamp, invokeWithStampAndPost, stampInvocation };
+export { type InvokeWithStampInput, type InvokeWithStampResult, type McpInvocation, type StampInvocationInput, canonicalizeInvocation, invocationHash, invocationId, invokeWithStamp, stampInvocation };

package/dist/index.d.ts

@@ -1,7 +1,5 @@
 import { DelegationEnvelope } from '@orangecheck/agent-core';
 import { SignerRef, ActionEnvelope } from '@orangecheck/agent-signer';
-import { ConsoleClient, PostActionResult } from '@orangecheck/agent-console-client';
-export { ConsoleClient, PostActionResult, postActionToConsole } from '@orangecheck/agent-console-client';
 
 interface McpInvocation {
     server: string;
@@ -28,12 +26,4 @@ interface InvokeWithStampResult<T> {
 }
 declare function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>>;
 
-interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
-    console?: ConsoleClient;
-}
-interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
-    posted: PostActionResult | null;
-}
-declare function invokeWithStampAndPost<T>(input: InvokeWithStampAndPostInput<T>): Promise<InvokeWithStampAndPostResult<T>>;
-
-export { type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type McpInvocation, type StampInvocationInput, canonicalizeInvocation, invocationHash, invocationId, invokeWithStamp, invokeWithStampAndPost, stampInvocation };
+export { type InvokeWithStampInput, type InvokeWithStampResult, type McpInvocation, type StampInvocationInput, canonicalizeInvocation, invocationHash, invocationId, invokeWithStamp, stampInvocation };

package/dist/index.js

@@ -3,7 +3,6 @@
 var sha256 = require('@noble/hashes/sha256');
 var agentCore = require('@orangecheck/agent-core');
 var agentSigner = require('@orangecheck/agent-signer');
-var agentConsoleClient = require('@orangecheck/agent-console-client');
 
 // src/index.ts
 function canonicalizeInvocation(inv) {
@@ -31,13 +30,7 @@ function invocationId(agentAddress, signedAt, delegationId, scopeExercised, inv)
 }
 async function stampInvocation(input) {
   const scopeExercised = input.scopeExercised ?? `mcp:invoke(server=${input.invocation.server.trim()},tool=${input.invocation.tool})`;
-  const granted = input.delegation.scopes.map(agentCore.parseScope);
-  const exercisedParsed = agentCore.parseScope(scopeExercised);
-  if (!granted.some((g) => agentCore.isSubScope(exercisedParsed, g))) {
-    throw new Error(
-      `stampInvocation: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
-    );
-  }
+  agentCore.assertScopeGranted(input.delegation, scopeExercised, "stampInvocation");
   const bytes = canonicalizeInvocation(input.invocation);
   return agentSigner.signAsAgent({
     agent: input.agent,
@@ -53,28 +46,11 @@ async function invokeWithStamp(input) {
   const result = await input.call(input.invocation);
   return { result, action };
 }
-async function invokeWithStampAndPost(input) {
-  const { result, action } = await invokeWithStamp(input);
-  let posted = null;
-  if (input.console) {
-    try {
-      posted = await agentConsoleClient.postActionToConsole(action, input.console);
-    } catch (err) {
-      console.error("[oc-agent-mcp] postActionToConsole failed:", err);
-    }
-  }
-  return { result, action, posted };
-}
 
-Object.defineProperty(exports, "postActionToConsole", {
-  enumerable: true,
-  get: function () { return agentConsoleClient.postActionToConsole; }
-});
 exports.canonicalizeInvocation = canonicalizeInvocation;
 exports.invocationHash = invocationHash;
 exports.invocationId = invocationId;
 exports.invokeWithStamp = invokeWithStamp;
-exports.invokeWithStampAndPost = invokeWithStampAndPost;
 exports.stampInvocation = stampInvocation;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","parseScope","isSubScope","signAsAgent","_post"],"mappings":";;;;;;;;AAqDO,SAAS,uBAAuB,GAAA,EAAgC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,MAAA,EAAQ,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAAA,IACxB,MAAM,GAAA,CAAI;AAAA,GACd;AACA,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,eAAe,GAAA,EAA4B;AACvD,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,sBAAA,CAAuB,GAAG,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,YAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,GAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,eAAe,GAAG,CAAA;AAAA,IAChC,cAAA,EAAgB,sBAAA,CAAuB,GAAG,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,8CAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAoBA,eAAsB,gBAAgB,KAAA,EAAsD;AACxF,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IACN,CAAA,kBAAA,EAAqB,KAAA,CAAM,UAAA,CAAW,MAAA,CAAO,IAAA,EAAM,CAAA,MAAA,EAAS,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,CAAA,CAAA;AAKrF,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,UAAA,CAAW,MAAA,CAAO,IAAIC,oBAAU,CAAA;AACtD,EAAA,MAAM,eAAA,GAAkBA,qBAAW,cAAc,CAAA;AACjD,EAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,CAAC,MAAMC,oBAAA,CAAW,eAAA,EAAiB,CAAC,CAAC,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,qCAAqC,cAAc,CAAA,yCAAA;AAAA,KACvD;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,KAAA,CAAM,UAAU,CAAA;AACrD,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,cAAA,CAAe,MAAM,UAAU,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IAC5E,IAAA,EAAM,8CAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAyBA,eAAsB,gBAAmB,KAAA,EAAmE;AACxG,EAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,UAAU,CAAA;AAChD,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B;AAkCA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAM,gBAAgB,KAAK,CAAA;AACtD,EAAA,IAAI,MAAA,GAAmC,IAAA;AACvC,EAAA,IAAI,MAAM,OAAA,EAAS;AACf,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAMC,sCAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AAEV,MAAA,OAAA,CAAQ,KAAA,CAAM,8CAA8C,GAAG,CAAA;AAAA,IACnE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAO;AACpC","file":"index.js","sourcesContent":["// @orangecheck/agent-mcp — wrap MCP tool invocations in OC Agent envelopes.\n//\n// An MCP client calls tools on an MCP server: { server, name, arguments }.\n// This module stamps each invocation as an `agent-action` whose `content.hash`\n// is a SHA-256 of the canonicalized (server, name, arguments) tuple, scoped\n// as `mcp:invoke(server=<url>,tool=<name>)`. The server — or any counterparty\n// — verifies the action before trusting the call.\n//\n// The wrapper is transport-agnostic. Wire it into whatever MCP client you use\n// by calling `invokeWithStamp()` around the raw call.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    isSubScope,\n    parseScope,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an MCP invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface McpInvocation {\n    /** Origin URL of the MCP server. Trimmed and lowercased for canonicalization. */\n    server: string;\n    /** Tool name (method) being invoked. */\n    tool: string;\n    /** JSON-serializable arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an MCP invocation. The bytes are what the\n * action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape:\n *   {\n *     \"arguments\": <canonical JSON of args>,\n *     \"server\":    <server url>,\n *     \"tool\":      <tool name>\n *   }\n *\n * The shape is intentionally minimal so verifiers can reconstruct it without\n * knowing anything server- or tool-specific.\n */\nexport function canonicalizeInvocation(inv: McpInvocation): Uint8Array {\n    const canon = {\n        arguments: inv.arguments,\n        server: inv.server.trim(),\n        tool: inv.tool,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function invocationHash(inv: McpInvocation): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeInvocation(inv)));\n}\n\nexport function invocationId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    inv: McpInvocation\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: invocationHash(inv),\n        content_length: canonicalizeInvocation(inv).byteLength,\n        content_mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampInvocationInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    invocation: McpInvocation;\n    /** Defaults to `mcp:invoke(server=<server>,tool=<tool>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\n/**\n * Stamp an MCP invocation without actually calling it. Useful when the caller\n * wants the signed envelope for out-of-band auditing before (or independent of)\n * running the tool.\n */\nexport async function stampInvocation(input: StampInvocationInput): Promise<ActionEnvelope> {\n    const scopeExercised =\n        input.scopeExercised ??\n        `mcp:invoke(server=${input.invocation.server.trim()},tool=${input.invocation.tool})`;\n\n    // Tiny pre-flight: confirm the exercised scope is a sub-scope of *some*\n    // granted scope. This keeps a common integration mistake from producing\n    // an envelope that later fails verifier-side.\n    const granted = input.delegation.scopes.map(parseScope);\n    const exercisedParsed = parseScope(scopeExercised);\n    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {\n        throw new Error(\n            `stampInvocation: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`\n        );\n    }\n\n    const bytes = canonicalizeInvocation(input.invocation);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation,\n        content: { hash: invocationHash(input.invocation), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampInvocationInput {\n    /** The underlying transport call. Returns whatever the MCP server returns. */\n    call: (inv: McpInvocation) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n}\n\n/**\n * Stamp the invocation *first*, then execute the call. The stamped envelope\n * is returned alongside the result so the caller can ship them together.\n *\n * Rationale for stamping first: if the downstream call hangs or fails, we\n * still have an on-record commitment that this agent attempted this specific\n * invocation. The server-side verifier sees a stamped intent plus the server's\n * own transcript.\n */\nexport async function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>> {\n    const action = await stampInvocation(input);\n    const result = await input.call(input.invocation);\n    return { result, action };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Console integration — re-export from the shared client\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    postActionToConsole,\n    type ConsoleClient,\n    type PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nimport {\n    postActionToConsole as _post,\n    type ConsoleClient as _ConsoleClient,\n    type PostActionResult as _PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Console credentials. If absent, behaves like invokeWithStamp + posted: null. */\n    console?: _ConsoleClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when console is configured AND the POST succeeded. */\n    posted: _PostActionResult | null;\n}\n\n/**\n * invokeWithStamp + post the stamped envelope to console.ochk.io. The\n * post happens AFTER the call so a failing post never prevents the\n * underlying MCP invocation from running. If `console` is omitted,\n * this is identical to invokeWithStamp + posted: null.\n */\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action } = await invokeWithStamp(input);\n    let posted: _PostActionResult | null = null;\n    if (input.console) {\n        try {\n            posted = await _post(action, input.console);\n        } catch (err) {\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-mcp] postActionToConsole failed:', err);\n        }\n    }\n    return { result, action, posted };\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","assertScopeGranted","signAsAgent"],"mappings":";;;;;;;AAoDO,SAAS,uBAAuB,GAAA,EAAgC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,MAAA,EAAQ,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAAA,IACxB,MAAM,GAAA,CAAI;AAAA,GACd;AACA,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,eAAe,GAAA,EAA4B;AACvD,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,sBAAA,CAAuB,GAAG,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,YAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,GAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,eAAe,GAAG,CAAA;AAAA,IAChC,cAAA,EAAgB,sBAAA,CAAuB,GAAG,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,8CAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAoBA,eAAsB,gBAAgB,KAAA,EAAsD;AACxF,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IACN,CAAA,kBAAA,EAAqB,KAAA,CAAM,UAAA,CAAW,MAAA,CAAO,IAAA,EAAM,CAAA,MAAA,EAAS,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,CAAA,CAAA;AAErF,EAAAC,4BAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,iBAAiB,CAAA;AAEtE,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,KAAA,CAAM,UAAU,CAAA;AACrD,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,cAAA,CAAe,MAAM,UAAU,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IAC5E,IAAA,EAAM,8CAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAyBA,eAAsB,gBAAmB,KAAA,EAAmE;AACxG,EAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,UAAU,CAAA;AAChD,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B","file":"index.js","sourcesContent":["// @orangecheck/agent-mcp — wrap MCP tool invocations in OC Agent envelopes.\n//\n// An MCP client calls tools on an MCP server: { server, name, arguments }.\n// This module stamps each invocation as an `agent-action` whose `content.hash`\n// is a SHA-256 of the canonicalized (server, name, arguments) tuple, scoped\n// as `mcp:invoke(server=<url>,tool=<name>)`. The server — or any counterparty\n// — verifies the action before trusting the call.\n//\n// The wrapper is transport-agnostic. Wire it into whatever MCP client you use\n// by calling `invokeWithStamp()` around the raw call.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    assertScopeGranted,\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an MCP invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface McpInvocation {\n    /** Origin URL of the MCP server. Trimmed and lowercased for canonicalization. */\n    server: string;\n    /** Tool name (method) being invoked. */\n    tool: string;\n    /** JSON-serializable arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an MCP invocation. The bytes are what the\n * action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape:\n *   {\n *     \"arguments\": <canonical JSON of args>,\n *     \"server\":    <server url>,\n *     \"tool\":      <tool name>\n *   }\n *\n * The shape is intentionally minimal so verifiers can reconstruct it without\n * knowing anything server- or tool-specific.\n */\nexport function canonicalizeInvocation(inv: McpInvocation): Uint8Array {\n    const canon = {\n        arguments: inv.arguments,\n        server: inv.server.trim(),\n        tool: inv.tool,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function invocationHash(inv: McpInvocation): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeInvocation(inv)));\n}\n\nexport function invocationId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    inv: McpInvocation\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: invocationHash(inv),\n        content_length: canonicalizeInvocation(inv).byteLength,\n        content_mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampInvocationInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    invocation: McpInvocation;\n    /** Defaults to `mcp:invoke(server=<server>,tool=<tool>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\n/**\n * Stamp an MCP invocation without actually calling it. Useful when the caller\n * wants the signed envelope for out-of-band auditing before (or independent of)\n * running the tool.\n */\nexport async function stampInvocation(input: StampInvocationInput): Promise<ActionEnvelope> {\n    const scopeExercised =\n        input.scopeExercised ??\n        `mcp:invoke(server=${input.invocation.server.trim()},tool=${input.invocation.tool})`;\n\n    assertScopeGranted(input.delegation, scopeExercised, 'stampInvocation');\n\n    const bytes = canonicalizeInvocation(input.invocation);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation,\n        content: { hash: invocationHash(input.invocation), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampInvocationInput {\n    /** The underlying transport call. Returns whatever the MCP server returns. */\n    call: (inv: McpInvocation) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n}\n\n/**\n * Stamp the invocation *first*, then execute the call. The stamped envelope\n * is returned alongside the result so the caller can ship them together.\n *\n * Rationale for stamping first: if the downstream call hangs or fails, we\n * still have an on-record commitment that this agent attempted this specific\n * invocation. The server-side verifier sees a stamped intent plus the server's\n * own transcript.\n */\nexport async function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>> {\n    const action = await stampInvocation(input);\n    const result = await input.call(input.invocation);\n    return { result, action };\n}\n"]}

package/dist/index.mjs

@@ -1,8 +1,6 @@
 import { sha256 } from '@noble/hashes/sha256';
-import { canonicalize, hexEncode, computeActionId, parseScope, isSubScope } from '@orangecheck/agent-core';
+import { canonicalize, hexEncode, computeActionId, assertScopeGranted } from '@orangecheck/agent-core';
 import { signAsAgent } from '@orangecheck/agent-signer';
-import { postActionToConsole } from '@orangecheck/agent-console-client';
-export { postActionToConsole } from '@orangecheck/agent-console-client';
 
 // src/index.ts
 function canonicalizeInvocation(inv) {
@@ -30,13 +28,7 @@ function invocationId(agentAddress, signedAt, delegationId, scopeExercised, inv)
 }
 async function stampInvocation(input) {
   const scopeExercised = input.scopeExercised ?? `mcp:invoke(server=${input.invocation.server.trim()},tool=${input.invocation.tool})`;
-  const granted = input.delegation.scopes.map(parseScope);
-  const exercisedParsed = parseScope(scopeExercised);
-  if (!granted.some((g) => isSubScope(exercisedParsed, g))) {
-    throw new Error(
-      `stampInvocation: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
-    );
-  }
+  assertScopeGranted(input.delegation, scopeExercised, "stampInvocation");
   const bytes = canonicalizeInvocation(input.invocation);
   return signAsAgent({
     agent: input.agent,
@@ -52,19 +44,7 @@ async function invokeWithStamp(input) {
   const result = await input.call(input.invocation);
   return { result, action };
 }
-async function invokeWithStampAndPost(input) {
-  const { result, action } = await invokeWithStamp(input);
-  let posted = null;
-  if (input.console) {
-    try {
-      posted = await postActionToConsole(action, input.console);
-    } catch (err) {
-      console.error("[oc-agent-mcp] postActionToConsole failed:", err);
-    }
-  }
-  return { result, action, posted };
-}
 
-export { canonicalizeInvocation, invocationHash, invocationId, invokeWithStamp, invokeWithStampAndPost, stampInvocation };
+export { canonicalizeInvocation, invocationHash, invocationId, invokeWithStamp, stampInvocation };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["_post"],"mappings":";;;;;;;AAqDO,SAAS,uBAAuB,GAAA,EAAgC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,MAAA,EAAQ,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAAA,IACxB,MAAM,GAAA,CAAI;AAAA,GACd;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,eAAe,GAAA,EAA4B;AACvD,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,sBAAA,CAAuB,GAAG,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,YAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,GAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,eAAe,GAAG,CAAA;AAAA,IAChC,cAAA,EAAgB,sBAAA,CAAuB,GAAG,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,8CAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAoBA,eAAsB,gBAAgB,KAAA,EAAsD;AACxF,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IACN,CAAA,kBAAA,EAAqB,KAAA,CAAM,UAAA,CAAW,MAAA,CAAO,IAAA,EAAM,CAAA,MAAA,EAAS,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,CAAA,CAAA;AAKrF,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,UAAA,CAAW,MAAA,CAAO,IAAI,UAAU,CAAA;AACtD,EAAA,MAAM,eAAA,GAAkB,WAAW,cAAc,CAAA;AACjD,EAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,CAAC,MAAM,UAAA,CAAW,eAAA,EAAiB,CAAC,CAAC,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,qCAAqC,cAAc,CAAA,yCAAA;AAAA,KACvD;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,KAAA,CAAM,UAAU,CAAA;AACrD,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,cAAA,CAAe,MAAM,UAAU,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IAC5E,IAAA,EAAM,8CAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAyBA,eAAsB,gBAAmB,KAAA,EAAmE;AACxG,EAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,UAAU,CAAA;AAChD,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B;AAkCA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,MAAM,gBAAgB,KAAK,CAAA;AACtD,EAAA,IAAI,MAAA,GAAmC,IAAA;AACvC,EAAA,IAAI,MAAM,OAAA,EAAS;AACf,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAMA,mBAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AAEV,MAAA,OAAA,CAAQ,KAAA,CAAM,8CAA8C,GAAG,CAAA;AAAA,IACnE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAO;AACpC","file":"index.mjs","sourcesContent":["// @orangecheck/agent-mcp — wrap MCP tool invocations in OC Agent envelopes.\n//\n// An MCP client calls tools on an MCP server: { server, name, arguments }.\n// This module stamps each invocation as an `agent-action` whose `content.hash`\n// is a SHA-256 of the canonicalized (server, name, arguments) tuple, scoped\n// as `mcp:invoke(server=<url>,tool=<name>)`. The server — or any counterparty\n// — verifies the action before trusting the call.\n//\n// The wrapper is transport-agnostic. Wire it into whatever MCP client you use\n// by calling `invokeWithStamp()` around the raw call.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    isSubScope,\n    parseScope,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an MCP invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface McpInvocation {\n    /** Origin URL of the MCP server. Trimmed and lowercased for canonicalization. */\n    server: string;\n    /** Tool name (method) being invoked. */\n    tool: string;\n    /** JSON-serializable arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an MCP invocation. The bytes are what the\n * action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape:\n *   {\n *     \"arguments\": <canonical JSON of args>,\n *     \"server\":    <server url>,\n *     \"tool\":      <tool name>\n *   }\n *\n * The shape is intentionally minimal so verifiers can reconstruct it without\n * knowing anything server- or tool-specific.\n */\nexport function canonicalizeInvocation(inv: McpInvocation): Uint8Array {\n    const canon = {\n        arguments: inv.arguments,\n        server: inv.server.trim(),\n        tool: inv.tool,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function invocationHash(inv: McpInvocation): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeInvocation(inv)));\n}\n\nexport function invocationId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    inv: McpInvocation\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: invocationHash(inv),\n        content_length: canonicalizeInvocation(inv).byteLength,\n        content_mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampInvocationInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    invocation: McpInvocation;\n    /** Defaults to `mcp:invoke(server=<server>,tool=<tool>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\n/**\n * Stamp an MCP invocation without actually calling it. Useful when the caller\n * wants the signed envelope for out-of-band auditing before (or independent of)\n * running the tool.\n */\nexport async function stampInvocation(input: StampInvocationInput): Promise<ActionEnvelope> {\n    const scopeExercised =\n        input.scopeExercised ??\n        `mcp:invoke(server=${input.invocation.server.trim()},tool=${input.invocation.tool})`;\n\n    // Tiny pre-flight: confirm the exercised scope is a sub-scope of *some*\n    // granted scope. This keeps a common integration mistake from producing\n    // an envelope that later fails verifier-side.\n    const granted = input.delegation.scopes.map(parseScope);\n    const exercisedParsed = parseScope(scopeExercised);\n    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {\n        throw new Error(\n            `stampInvocation: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`\n        );\n    }\n\n    const bytes = canonicalizeInvocation(input.invocation);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation,\n        content: { hash: invocationHash(input.invocation), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampInvocationInput {\n    /** The underlying transport call. Returns whatever the MCP server returns. */\n    call: (inv: McpInvocation) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n}\n\n/**\n * Stamp the invocation *first*, then execute the call. The stamped envelope\n * is returned alongside the result so the caller can ship them together.\n *\n * Rationale for stamping first: if the downstream call hangs or fails, we\n * still have an on-record commitment that this agent attempted this specific\n * invocation. The server-side verifier sees a stamped intent plus the server's\n * own transcript.\n */\nexport async function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>> {\n    const action = await stampInvocation(input);\n    const result = await input.call(input.invocation);\n    return { result, action };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Console integration — re-export from the shared client\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    postActionToConsole,\n    type ConsoleClient,\n    type PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nimport {\n    postActionToConsole as _post,\n    type ConsoleClient as _ConsoleClient,\n    type PostActionResult as _PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Console credentials. If absent, behaves like invokeWithStamp + posted: null. */\n    console?: _ConsoleClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when console is configured AND the POST succeeded. */\n    posted: _PostActionResult | null;\n}\n\n/**\n * invokeWithStamp + post the stamped envelope to console.ochk.io. The\n * post happens AFTER the call so a failing post never prevents the\n * underlying MCP invocation from running. If `console` is omitted,\n * this is identical to invokeWithStamp + posted: null.\n */\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action } = await invokeWithStamp(input);\n    let posted: _PostActionResult | null = null;\n    if (input.console) {\n        try {\n            posted = await _post(action, input.console);\n        } catch (err) {\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-mcp] postActionToConsole failed:', err);\n        }\n    }\n    return { result, action, posted };\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;AAoDO,SAAS,uBAAuB,GAAA,EAAgC;AACnE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,MAAA,EAAQ,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAAA,IACxB,MAAM,GAAA,CAAI;AAAA,GACd;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,eAAe,GAAA,EAA4B;AACvD,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,sBAAA,CAAuB,GAAG,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,YAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,GAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,eAAe,GAAG,CAAA;AAAA,IAChC,cAAA,EAAgB,sBAAA,CAAuB,GAAG,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,8CAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAoBA,eAAsB,gBAAgB,KAAA,EAAsD;AACxF,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IACN,CAAA,kBAAA,EAAqB,KAAA,CAAM,UAAA,CAAW,MAAA,CAAO,IAAA,EAAM,CAAA,MAAA,EAAS,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,CAAA,CAAA;AAErF,EAAA,kBAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,iBAAiB,CAAA;AAEtE,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,KAAA,CAAM,UAAU,CAAA;AACrD,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,cAAA,CAAe,MAAM,UAAU,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAW;AAAA,IAC5E,IAAA,EAAM,8CAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAyBA,eAAsB,gBAAmB,KAAA,EAAmE;AACxG,EAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,KAAK,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,MAAM,UAAU,CAAA;AAChD,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC5B","file":"index.mjs","sourcesContent":["// @orangecheck/agent-mcp — wrap MCP tool invocations in OC Agent envelopes.\n//\n// An MCP client calls tools on an MCP server: { server, name, arguments }.\n// This module stamps each invocation as an `agent-action` whose `content.hash`\n// is a SHA-256 of the canonicalized (server, name, arguments) tuple, scoped\n// as `mcp:invoke(server=<url>,tool=<name>)`. The server — or any counterparty\n// — verifies the action before trusting the call.\n//\n// The wrapper is transport-agnostic. Wire it into whatever MCP client you use\n// by calling `invokeWithStamp()` around the raw call.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    assertScopeGranted,\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization of an MCP invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface McpInvocation {\n    /** Origin URL of the MCP server. Trimmed and lowercased for canonicalization. */\n    server: string;\n    /** Tool name (method) being invoked. */\n    tool: string;\n    /** JSON-serializable arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Produce the canonical bytes for an MCP invocation. The bytes are what the\n * action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape:\n *   {\n *     \"arguments\": <canonical JSON of args>,\n *     \"server\":    <server url>,\n *     \"tool\":      <tool name>\n *   }\n *\n * The shape is intentionally minimal so verifiers can reconstruct it without\n * knowing anything server- or tool-specific.\n */\nexport function canonicalizeInvocation(inv: McpInvocation): Uint8Array {\n    const canon = {\n        arguments: inv.arguments,\n        server: inv.server.trim(),\n        tool: inv.tool,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function invocationHash(inv: McpInvocation): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeInvocation(inv)));\n}\n\nexport function invocationId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    inv: McpInvocation\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: invocationHash(inv),\n        content_length: canonicalizeInvocation(inv).byteLength,\n        content_mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamped invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampInvocationInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    invocation: McpInvocation;\n    /** Defaults to `mcp:invoke(server=<server>,tool=<tool>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\n/**\n * Stamp an MCP invocation without actually calling it. Useful when the caller\n * wants the signed envelope for out-of-band auditing before (or independent of)\n * running the tool.\n */\nexport async function stampInvocation(input: StampInvocationInput): Promise<ActionEnvelope> {\n    const scopeExercised =\n        input.scopeExercised ??\n        `mcp:invoke(server=${input.invocation.server.trim()},tool=${input.invocation.tool})`;\n\n    assertScopeGranted(input.delegation, scopeExercised, 'stampInvocation');\n\n    const bytes = canonicalizeInvocation(input.invocation);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation,\n        content: { hash: invocationHash(input.invocation), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.mcp-invocation+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// invokeWithStamp — call the tool AND produce the stamp around it\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface InvokeWithStampInput<T> extends StampInvocationInput {\n    /** The underlying transport call. Returns whatever the MCP server returns. */\n    call: (inv: McpInvocation) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n}\n\n/**\n * Stamp the invocation *first*, then execute the call. The stamped envelope\n * is returned alongside the result so the caller can ship them together.\n *\n * Rationale for stamping first: if the downstream call hangs or fails, we\n * still have an on-record commitment that this agent attempted this specific\n * invocation. The server-side verifier sees a stamped intent plus the server's\n * own transcript.\n */\nexport async function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>> {\n    const action = await stampInvocation(input);\n    const result = await input.call(input.invocation);\n    return { result, action };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangecheck/agent-mcp",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Wrap Model Context Protocol tool invocations in OC Agent envelopes — every call produces a signed, scope-constrained, verifiable agent-action stamp.",
   "keywords": [
     "bitcoin",
@@ -50,15 +50,14 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@orangecheck/agent-console-client": "0.1.0",
-    "@orangecheck/agent-core": "^0.1.0",
-    "@orangecheck/agent-signer": "^0.1.0"
+    "@orangecheck/agent-core": "^2.1.0",
+    "@orangecheck/agent-signer": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   },
   "publishConfig": {
     "access": "public"

package/src/index.test.ts

@@ -62,7 +62,7 @@ describe('stampInvocation', () => {
             },
         });
         expect(action.content.mime).toBe('application/vnd.oc-agent.mcp-invocation+json');
-        const r = await verifyAction({ action, delegation, verifyBip322: fakeVerify });
+        const r = await verifyAction({ action, delegation, verifyBip322: fakeVerify, skipRevocationCheck: true });
         expect(r.ok).toBe(true);
     });
 

package/src/index.ts

@@ -11,11 +11,10 @@
 
 import { sha256 } from '@noble/hashes/sha256';
 import {
+    assertScopeGranted,
     canonicalize,
     computeActionId,
     hexEncode,
-    isSubScope,
-    parseScope,
     type DelegationEnvelope,
 } from '@orangecheck/agent-core';
 import {
@@ -106,16 +105,7 @@ export async function stampInvocation(input: StampInvocationInput): Promise<Acti
         input.scopeExercised ??
         `mcp:invoke(server=${input.invocation.server.trim()},tool=${input.invocation.tool})`;
 
-    // Tiny pre-flight: confirm the exercised scope is a sub-scope of *some*
-    // granted scope. This keeps a common integration mistake from producing
-    // an envelope that later fails verifier-side.
-    const granted = input.delegation.scopes.map(parseScope);
-    const exercisedParsed = parseScope(scopeExercised);
-    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {
-        throw new Error(
-            `stampInvocation: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
-        );
-    }
+    assertScopeGranted(input.delegation, scopeExercised, 'stampInvocation');
 
     const bytes = canonicalizeInvocation(input.invocation);
     return signAsAgent({
@@ -156,51 +146,3 @@ export async function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promis
     const result = await input.call(input.invocation);
     return { result, action };
 }
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Console integration — re-export from the shared client
-// ─────────────────────────────────────────────────────────────────────────────
-
-export {
-    postActionToConsole,
-    type ConsoleClient,
-    type PostActionResult,
-} from '@orangecheck/agent-console-client';
-
-import {
-    postActionToConsole as _post,
-    type ConsoleClient as _ConsoleClient,
-    type PostActionResult as _PostActionResult,
-} from '@orangecheck/agent-console-client';
-
-export interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
-    /** Console credentials. If absent, behaves like invokeWithStamp + posted: null. */
-    console?: _ConsoleClient;
-}
-
-export interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
-    /** Set when console is configured AND the POST succeeded. */
-    posted: _PostActionResult | null;
-}
-
-/**
- * invokeWithStamp + post the stamped envelope to console.ochk.io. The
- * post happens AFTER the call so a failing post never prevents the
- * underlying MCP invocation from running. If `console` is omitted,
- * this is identical to invokeWithStamp + posted: null.
- */
-export async function invokeWithStampAndPost<T>(
-    input: InvokeWithStampAndPostInput<T>
-): Promise<InvokeWithStampAndPostResult<T>> {
-    const { result, action } = await invokeWithStamp(input);
-    let posted: _PostActionResult | null = null;
-    if (input.console) {
-        try {
-            posted = await _post(action, input.console);
-        } catch (err) {
-            // eslint-disable-next-line no-console
-            console.error('[oc-agent-mcp] postActionToConsole failed:', err);
-        }
-    }
-    return { result, action, posted };
-}

package/src/scope-preflight.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest';
+
+import { ScopeNotGrantedError } from '@orangecheck/agent-core';
+
+import { stampInvocation } from './index.js';
+
+const AGENT = 'bc1qagent0000000000000000000000000000000000';
+const sign = () => async (msg: string) => Buffer.from(msg, 'utf8').toString('base64');
+
+const SEALED = {
+    v: 1,
+    alg: 'x25519-xchacha20poly1305',
+    recipients: [{ device_id: 'dev1', ct: 'AA' }],
+    ct: 'BB',
+    nonce: 'CC',
+} as never;
+
+/**
+ * This adapter used to open-code the pre-flight scope check. It now routes to
+ * agent-core's `assertScopeGranted`, and these assert the routing rather than
+ * the check — agent-core owns testing the check itself.
+ *
+ * The case that matters is the encrypted one: a v1.2 private delegation has no
+ * readable `scopes`, and the old `?? []` reported that as "not a sub-scope of
+ * any granted scope" — pointing the integrator at a scope string that was
+ * probably fine, when the actual need was to decrypt the grant.
+ */
+describe('stampInvocation scope pre-flight', () => {
+    const base = {
+        agent: { address: AGENT, sign: sign() },
+        invocation: { server: 'https://m.example.com', tool: 'search', arguments: { q: 'x' } },
+    } as never;
+
+    it('names encrypted scopes rather than blaming the scope string', async () => {
+        const err = await stampInvocation({
+            ...(base as object),
+            delegation: { scopes_encrypted: SEALED },
+            scopeExercised: 'mcp:invoke(server=https://m.example.com,tool=search)',
+        } as never).catch((e: unknown) => e);
+
+        expect(err).toBeInstanceOf(ScopeNotGrantedError);
+        expect((err as ScopeNotGrantedError).reason).toBe('scopes_encrypted');
+        expect((err as Error).message).toMatch(/decryptPrivateScopes/);
+    });
+
+    it('treats an absent grant as granting nothing', async () => {
+        const err = await stampInvocation({
+            ...(base as object),
+            delegation: {},
+            scopeExercised: 'mcp:invoke(server=https://m.example.com,tool=search)',
+        } as never).catch((e: unknown) => e);
+
+        expect((err as ScopeNotGrantedError).reason).toBe('no_scopes');
+    });
+});