@orangecheck/agent-mcp 0.4.1 → 0.4.3

package/README.md

@@ -92,11 +92,16 @@ A server receiving a stamped invocation verifies it with `@orangecheck/agent-cor
 
 ```ts
 import { verifyAction } from '@orangecheck/agent-core';
+import { verifySignature } from '@orangecheck/bip322';
 
+// `revocations` is required: the kind-30085 envelopes you fetched with
+// "#t": [delegation.id] (see @orangecheck/agent-core's README), or
+// `skipRevocationCheck: true` to state that you are not checking.
 const r = await verifyAction({
     action,
     delegation,
-    verifyBip322: async (m, s, a) => bip322.verify(a, m, s),
+    revocations,
+    verifyBip322: async (m, s, a) => verifySignature(a, m, s),
 });
 if (!r.ok) throw new Error(`auth failed: ${r.code}`);
 
@@ -126,13 +131,14 @@ action.ots = await stampCommit(action.id);
 
 ## Composing with Nostr
 
-Publish the action for public auditability (OC Agent reuses OC Stamp's kind-30084 transport, disambiguated by envelope `kind`):
+Publish the action for public auditability on kind 30084, OC Agent's action kind. The `t` tag carries the delegation id, so anyone can list a delegation's actions with `{ kinds: [30084], '#t': [delegation.id] }` (oc-agent-protocol SPEC §10.3). Tags sit on the Nostr event, outside the signed envelope, so they change no id:
 
 ```ts
 await nostr.publish({
     kind: 30084,
     tags: [
         ['d', 'oc-agent-act:' + action.id],
+        ['t', action.delegation_id],
         ['kind', 'agent-action'],
         ['delegation', action.delegation_id],
         ['agent', action.signer.address],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangecheck/agent-mcp",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Wrap Model Context Protocol tool invocations in OC Agent envelopes — every call produces a signed, scope-constrained, verifiable agent-action stamp.",
   "keywords": [
     "bitcoin",