@orangecheck/agent-openai 0.1.1 → 0.3.0

package/README.md

@@ -1,5 +1,9 @@
 # @orangecheck/agent-openai
 
+> **Full reference:** [docs.ochk.io/sdk/agent-openai](https://docs.ochk.io/sdk/agent-openai) — auto-generated from the TypeScript source on every release.
+> Hand-written prose below is the high-level overview; the docs site is the source of truth for every export, type, and signature.
+
+
 Wrap [OpenAI function calls](https://platform.openai.com/docs/guides/function-calling) with [OC Agent](https://github.com/orangecheck/oc-agent-protocol) scope enforcement and emit a signed `agent-action` envelope per invocation. Covers both the new **Responses API** (`function_call` items) and the legacy **Chat Completions** tool path (`tool_calls`).
 
 ## Why
@@ -72,4 +76,4 @@ MIT.
 - [@orangecheck/agent-core](https://www.npmjs.com/package/@orangecheck/agent-core) — verifier library.
 - [@orangecheck/agent-mcp](https://www.npmjs.com/package/@orangecheck/agent-mcp) — same pattern, for MCP.
 - [@orangecheck/agent-anthropic](https://www.npmjs.com/package/@orangecheck/agent-anthropic) — same pattern, for Claude Tool Use.
-- [console.ochk.io/integrations/openai](https://console.ochk.io/integrations/openai) — managed-tier story.
+- [fleet.ochk.io/integrations/openai](https://fleet.ochk.io/integrations/openai) — managed-tier story.

package/dist/index.d.mts

@@ -1,7 +1,5 @@
 import { DelegationEnvelope } from '@orangecheck/agent-core';
 import { SignerRef, ActionEnvelope } from '@orangecheck/agent-signer';
-import { ConsoleClient, PostActionResult } from '@orangecheck/agent-console-client';
-export { ConsoleClient, PostActionResult, postActionToConsole } from '@orangecheck/agent-console-client';
 
 interface OpenAiFunctionCall {
     id: string;
@@ -29,13 +27,24 @@ interface InvokeWithStampResult<T> {
     call: OpenAiFunctionCall;
 }
 declare function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>>;
-
+interface FleetClient {
+    baseUrl?: string;
+    apiToken: string;
+    projectId: string;
+    fetch?: typeof fetch;
+}
+interface PostActionResult {
+    id: string;
+    project_id: string;
+    delegation_id: string;
+}
+declare function postActionToFleet(action: ActionEnvelope, client: FleetClient): Promise<PostActionResult>;
 interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
-    console?: ConsoleClient;
+    fleet?: FleetClient;
 }
 interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
     posted: PostActionResult | null;
 }
 declare function invokeWithStampAndPost<T>(input: InvokeWithStampAndPostInput<T>): Promise<InvokeWithStampAndPostResult<T>>;
 
-export { type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type OpenAiFunctionCall, type StampFunctionCallInput, canonicalizeFunctionCall, functionCallActionId, functionCallHash, invokeWithStamp, invokeWithStampAndPost, parseFunctionCall, stampFunctionCall };
+export { type FleetClient, type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type OpenAiFunctionCall, type PostActionResult, type StampFunctionCallInput, canonicalizeFunctionCall, functionCallActionId, functionCallHash, invokeWithStamp, invokeWithStampAndPost, parseFunctionCall, postActionToFleet, stampFunctionCall };

package/dist/index.d.ts

@@ -1,7 +1,5 @@
 import { DelegationEnvelope } from '@orangecheck/agent-core';
 import { SignerRef, ActionEnvelope } from '@orangecheck/agent-signer';
-import { ConsoleClient, PostActionResult } from '@orangecheck/agent-console-client';
-export { ConsoleClient, PostActionResult, postActionToConsole } from '@orangecheck/agent-console-client';
 
 interface OpenAiFunctionCall {
     id: string;
@@ -29,13 +27,24 @@ interface InvokeWithStampResult<T> {
     call: OpenAiFunctionCall;
 }
 declare function invokeWithStamp<T>(input: InvokeWithStampInput<T>): Promise<InvokeWithStampResult<T>>;
-
+interface FleetClient {
+    baseUrl?: string;
+    apiToken: string;
+    projectId: string;
+    fetch?: typeof fetch;
+}
+interface PostActionResult {
+    id: string;
+    project_id: string;
+    delegation_id: string;
+}
+declare function postActionToFleet(action: ActionEnvelope, client: FleetClient): Promise<PostActionResult>;
 interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
-    console?: ConsoleClient;
+    fleet?: FleetClient;
 }
 interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
     posted: PostActionResult | null;
 }
 declare function invokeWithStampAndPost<T>(input: InvokeWithStampAndPostInput<T>): Promise<InvokeWithStampAndPostResult<T>>;
 
-export { type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type OpenAiFunctionCall, type StampFunctionCallInput, canonicalizeFunctionCall, functionCallActionId, functionCallHash, invokeWithStamp, invokeWithStampAndPost, parseFunctionCall, stampFunctionCall };
+export { type FleetClient, type InvokeWithStampAndPostInput, type InvokeWithStampAndPostResult, type InvokeWithStampInput, type InvokeWithStampResult, type OpenAiFunctionCall, type PostActionResult, type StampFunctionCallInput, canonicalizeFunctionCall, functionCallActionId, functionCallHash, invokeWithStamp, invokeWithStampAndPost, parseFunctionCall, postActionToFleet, stampFunctionCall };

package/dist/index.js

@@ -3,7 +3,6 @@
 var sha256 = require('@noble/hashes/sha256');
 var agentCore = require('@orangecheck/agent-core');
 var agentSigner = require('@orangecheck/agent-signer');
-var agentConsoleClient = require('@orangecheck/agent-console-client');
 
 // src/index.ts
 function parseFunctionCall(raw) {
@@ -65,13 +64,7 @@ function functionCallActionId(agentAddress, signedAt, delegationId, scopeExercis
 async function stampFunctionCall(input) {
   const fc = typeof input.call === "object" && input.call !== null && "arguments" in input.call && typeof input.call.arguments !== "string" ? input.call : parseFunctionCall(input.call);
   const scopeExercised = input.scopeExercised ?? `openai:function(name=${fc.name})`;
-  const granted = (input.delegation.scopes ?? []).map(agentCore.parseScope);
-  const exercisedParsed = agentCore.parseScope(scopeExercised);
-  if (!granted.some((g) => agentCore.isSubScope(exercisedParsed, g))) {
-    throw new Error(
-      `stampFunctionCall: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
-    );
-  }
+  agentCore.assertScopeGranted(input.delegation, scopeExercised, "stampFunctionCall");
   const bytes = canonicalizeFunctionCall(fc);
   return agentSigner.signAsAgent({
     agent: input.agent,
@@ -88,29 +81,61 @@ async function invokeWithStamp(input) {
   const result = await input.execute(fc);
   return { result, action, call: fc };
 }
+async function postActionToFleet(action, client) {
+  const baseUrl = client.baseUrl ?? "https://fleet.ochk.io";
+  const f = client.fetch ?? fetch;
+  const body = {
+    project_id: client.projectId,
+    delegation_id: action.delegation_id,
+    agent_address: action.signer.address,
+    scope_exercised: action.scope_exercised,
+    content_hash: action.content.hash,
+    content_length: action.content.length,
+    content_mime: action.content.mime,
+    signed_at: action.signed_at,
+    signature: action.sig.value,
+    id: action.id
+  };
+  const r = await f(`${baseUrl}/api/actions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${client.apiToken}`
+    },
+    body: JSON.stringify(body)
+  });
+  if (!r.ok) {
+    let reason = `http_${r.status}`;
+    try {
+      const j2 = await r.json();
+      if (j2.reason) reason = j2.reason;
+    } catch {
+    }
+    throw new Error(`postActionToFleet failed: ${reason}`);
+  }
+  const j = await r.json();
+  return j.action;
+}
 async function invokeWithStampAndPost(input) {
   const { result, action, call } = await invokeWithStamp(input);
   let posted = null;
-  if (input.console) {
+  if (input.fleet) {
     try {
-      posted = await agentConsoleClient.postActionToConsole(action, input.console);
+      posted = await postActionToFleet(action, input.fleet);
     } catch (err) {
-      console.error("[oc-agent-openai] postActionToConsole failed:", err);
+      console.error("[oc-agent-openai] postActionToFleet failed:", err);
     }
   }
   return { result, action, call, posted };
 }
 
-Object.defineProperty(exports, "postActionToConsole", {
-  enumerable: true,
-  get: function () { return agentConsoleClient.postActionToConsole; }
-});
 exports.canonicalizeFunctionCall = canonicalizeFunctionCall;
 exports.functionCallActionId = functionCallActionId;
 exports.functionCallHash = functionCallHash;
 exports.invokeWithStamp = invokeWithStamp;
 exports.invokeWithStampAndPost = invokeWithStampAndPost;
 exports.parseFunctionCall = parseFunctionCall;
+exports.postActionToFleet = postActionToFleet;
 exports.stampFunctionCall = stampFunctionCall;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","parseScope","isSubScope","signAsAgent","_post"],"mappings":";;;;;;;;AAqDO,SAAS,kBAAkB,GAAA,EAAkC;AAChE,EAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AACxC,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,CAAA,GAAI,GAAA;AAGV,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,OAAO,CAAA,CAAE,aAAa,QAAA,EAAU;AAC9C,IAAA,MAAM,IAAI,CAAA,CAAE,QAAA;AACZ,IAAA,OAAO;AAAA,MACH,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,EAAE,CAAA;AAAA,MACrB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,MACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,KACpC;AAAA,EACJ;AAGA,EAAA,OAAO;AAAA,IACH,IAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,CAAA,CAAE,WAAW,EAAE,CAAA;AAAA,IAClC,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,IACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,GACpC;AACJ;AAEA,SAAS,UAAU,IAAA,EAAwC;AACvD,EAAA,IAAI,IAAA,IAAQ,IAAA,EAAM,OAAO,EAAC;AAC1B,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,IAAI,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AACvC,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAI,CAAA,EAAE;AAChC;AAiBO,SAAS,yBAAyB,CAAA,EAAmC;AACxE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,CAAA,CAAE,SAAA;AAAA,IACb,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,iBAAiB,CAAA,EAA+B;AAC5D,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,wBAAA,CAAyB,CAAC,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,oBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,iBAAiB,CAAC,CAAA;AAAA,IAChC,cAAA,EAAgB,wBAAA,CAAyB,CAAC,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,oDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAgBA,eAAsB,kBAClB,KAAA,EACuB;AACvB,EAAA,MAAM,EAAA,GACF,OAAO,KAAA,CAAM,IAAA,KAAS,YACtB,KAAA,CAAM,IAAA,KAAS,QACf,WAAA,IAAgB,KAAA,CAAM,QACtB,OAAQ,KAAA,CAAM,KAAiC,SAAA,KAAc,QAAA,GACtD,MAAM,IAAA,GACP,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAEtC,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IAAkB,CAAA,qBAAA,EAAwB,GAAG,IAAI,CAAA,CAAA,CAAA;AAE3D,EAAA,MAAM,WAAW,KAAA,CAAM,UAAA,CAAW,UAAU,EAAC,EAAG,IAAIC,oBAAU,CAAA;AAC9D,EAAA,MAAM,eAAA,GAAkBA,qBAAW,cAAc,CAAA;AACjD,EAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,CAAC,MAAMC,oBAAA,CAAW,eAAA,EAAiB,CAAC,CAAC,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,uCAAuC,cAAc,CAAA,yCAAA;AAAA,KACzD;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,yBAAyB,EAAE,CAAA;AACzC,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,gBAAA,CAAiB,EAAE,CAAA,EAAG,MAAA,EAAQ,MAAM,UAAA,EAAW;AAAA,IAChE,IAAA,EAAM,oDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAaA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,KAAK,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,iBAAA,CAAkB,KAAA,CAAM,IAAI,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,EAAE,CAAA;AACrC,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,EAAA,EAAG;AACtC;AA4BA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAK,GAAI,MAAM,gBAAgB,KAAK,CAAA;AAC5D,EAAA,IAAI,MAAA,GAAmC,IAAA;AACvC,EAAA,IAAI,MAAM,OAAA,EAAS;AACf,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAMC,sCAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AAEV,MAAA,OAAA,CAAQ,KAAA,CAAM,iDAAiD,GAAG,CAAA;AAAA,IACtE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAC1C","file":"index.js","sourcesContent":["// @orangecheck/agent-openai — wrap OpenAI function calls in OC Agent\n// action envelopes.\n//\n// Covers both surfaces:\n//   - Responses API:        response.output → tool_call items with\n//                            { type: 'function_call', name, arguments, call_id }\n//                            (`arguments` is a JSON string)\n//   - Chat Completions:     message.tool_calls[i] = { id, function: { name, arguments } }\n//                            (`arguments` is also a JSON string)\n//\n// Both shapes normalize through `parseFunctionCall()` to the canonical\n// {id, name, arguments} form before hashing.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    isSubScope,\n    parseScope,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shape normalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OpenAiFunctionCall {\n    /** OpenAI's `id` for this call (Chat Completions: `tool_call.id`; Responses: `call_id`). */\n    id: string;\n    /** The function name. */\n    name: string;\n    /** The (already-parsed) function arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Normalize either a Chat Completions `tool_call` or a Responses\n * `function_call` item into our canonical {id, name, arguments} shape.\n *\n * Accepts:\n *   - { id, function: { name, arguments } }                      (Chat Completions)\n *   - { call_id, name, arguments }                               (Responses, function_call)\n *   - { id, name, arguments }                                    (already normalized)\n *\n * `arguments` may be either a JSON string (OpenAI's wire shape) or an\n * already-parsed object (your post-processing). Both work.\n */\nexport function parseFunctionCall(raw: unknown): OpenAiFunctionCall {\n    if (raw == null || typeof raw !== 'object') {\n        throw new TypeError('parseFunctionCall: input is not an object');\n    }\n    const r = raw as Record<string, unknown>;\n\n    // Chat Completions shape\n    if (r.function && typeof r.function === 'object') {\n        const f = r.function as Record<string, unknown>;\n        return {\n            id: String(r.id ?? ''),\n            name: String(f.name ?? ''),\n            arguments: parseArgs(f.arguments),\n        };\n    }\n\n    // Responses API or already-normalized\n    return {\n        id: String(r.id ?? r.call_id ?? ''),\n        name: String(r.name ?? ''),\n        arguments: parseArgs(r.arguments),\n    };\n}\n\nfunction parseArgs(args: unknown): Record<string, unknown> {\n    if (args == null) return {};\n    if (typeof args === 'object') return args as Record<string, unknown>;\n    if (typeof args === 'string') {\n        try {\n            const v = JSON.parse(args);\n            if (v && typeof v === 'object') return v as Record<string, unknown>;\n            return { _raw: args };\n        } catch {\n            return { _raw: args };\n        }\n    }\n    return { _raw: String(args) };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Produce the canonical bytes for an OpenAI function call. The bytes are\n * what the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n *   {\n *     \"arguments\": <canonical JSON of arguments>,\n *     \"id\":        <call id>,\n *     \"name\":      <function name>\n *   }\n */\nexport function canonicalizeFunctionCall(c: OpenAiFunctionCall): Uint8Array {\n    const canon = {\n        arguments: c.arguments,\n        id: c.id,\n        name: c.name,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function functionCallHash(c: OpenAiFunctionCall): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeFunctionCall(c)));\n}\n\nexport function functionCallActionId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    c: OpenAiFunctionCall\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: functionCallHash(c),\n        content_length: canonicalizeFunctionCall(c).byteLength,\n        content_mime: 'application/vnd.oc-agent.openai-function-call+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping + invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampFunctionCallInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Either a normalized `OpenAiFunctionCall` or a raw OpenAI tool_call / function_call object. */\n    call: OpenAiFunctionCall | unknown;\n    /** Defaults to `openai:function(name=<name>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\nexport async function stampFunctionCall(\n    input: StampFunctionCallInput\n): Promise<ActionEnvelope> {\n    const fc =\n        typeof input.call === 'object' &&\n        input.call !== null &&\n        'arguments' in (input.call as Record<string, unknown>) &&\n        typeof (input.call as Record<string, unknown>).arguments !== 'string'\n            ? (input.call as OpenAiFunctionCall)\n            : parseFunctionCall(input.call);\n\n    const scopeExercised =\n        input.scopeExercised ?? `openai:function(name=${fc.name})`;\n\n    const granted = (input.delegation.scopes ?? []).map(parseScope);\n    const exercisedParsed = parseScope(scopeExercised);\n    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {\n        throw new Error(\n            `stampFunctionCall: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`\n        );\n    }\n\n    const bytes = canonicalizeFunctionCall(fc);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation as never,\n        content: { hash: functionCallHash(fc), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.openai-function-call+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\nexport interface InvokeWithStampInput<T> extends StampFunctionCallInput {\n    /** Your handler. Receives the normalized OpenAiFunctionCall. */\n    execute: (call: OpenAiFunctionCall) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n    call: OpenAiFunctionCall;\n}\n\nexport async function invokeWithStamp<T>(\n    input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n    const action = await stampFunctionCall(input);\n    const fc = parseFunctionCall(input.call);\n    const result = await input.execute(fc);\n    return { result, action, call: fc };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Console integration — re-export from the shared client\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    postActionToConsole,\n    type ConsoleClient,\n    type PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nimport {\n    postActionToConsole as _post,\n    type ConsoleClient as _ConsoleClient,\n    type PostActionResult as _PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Console credentials. If absent, behaves like invokeWithStamp + posted: null. */\n    console?: _ConsoleClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when console is configured AND the POST succeeded. */\n    posted: _PostActionResult | null;\n}\n\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action, call } = await invokeWithStamp(input);\n    let posted: _PostActionResult | null = null;\n    if (input.console) {\n        try {\n            posted = await _post(action, input.console);\n        } catch (err) {\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-openai] postActionToConsole failed:', err);\n        }\n    }\n    return { result, action, call, posted };\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["canonicalize","hexEncode","sha256","computeActionId","assertScopeGranted","signAsAgent","j"],"mappings":";;;;;;;AAoDO,SAAS,kBAAkB,GAAA,EAAkC;AAChE,EAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AACxC,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,CAAA,GAAI,GAAA;AAGV,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,OAAO,CAAA,CAAE,aAAa,QAAA,EAAU;AAC9C,IAAA,MAAM,IAAI,CAAA,CAAE,QAAA;AACZ,IAAA,OAAO;AAAA,MACH,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,EAAE,CAAA;AAAA,MACrB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,MACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,KACpC;AAAA,EACJ;AAGA,EAAA,OAAO;AAAA,IACH,IAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,CAAA,CAAE,WAAW,EAAE,CAAA;AAAA,IAClC,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,IACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,GACpC;AACJ;AAEA,SAAS,UAAU,IAAA,EAAwC;AACvD,EAAA,IAAI,IAAA,IAAQ,IAAA,EAAM,OAAO,EAAC;AAC1B,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,IAAI,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AACvC,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAI,CAAA,EAAE;AAChC;AAiBO,SAAS,yBAAyB,CAAA,EAAmC;AACxE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,CAAA,CAAE,SAAA;AAAA,IACb,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAMA,uBAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,iBAAiB,CAAA,EAA+B;AAC5D,EAAA,OAAO,YAAYC,mBAAA,CAAUC,aAAA,CAAO,wBAAA,CAAyB,CAAC,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,oBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAOC,yBAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,iBAAiB,CAAC,CAAA;AAAA,IAChC,cAAA,EAAgB,wBAAA,CAAyB,CAAC,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,oDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAgBA,eAAsB,kBAClB,KAAA,EACuB;AACvB,EAAA,MAAM,EAAA,GACF,OAAO,KAAA,CAAM,IAAA,KAAS,YACtB,KAAA,CAAM,IAAA,KAAS,QACf,WAAA,IAAgB,KAAA,CAAM,QACtB,OAAQ,KAAA,CAAM,KAAiC,SAAA,KAAc,QAAA,GACtD,MAAM,IAAA,GACP,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAEtC,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IAAkB,CAAA,qBAAA,EAAwB,GAAG,IAAI,CAAA,CAAA,CAAA;AAE3D,EAAAC,4BAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,mBAAmB,CAAA;AAExE,EAAA,MAAM,KAAA,GAAQ,yBAAyB,EAAE,CAAA;AACzC,EAAA,OAAOC,uBAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,gBAAA,CAAiB,EAAE,CAAA,EAAG,MAAA,EAAQ,MAAM,UAAA,EAAW;AAAA,IAChE,IAAA,EAAM,oDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAaA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,KAAK,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,iBAAA,CAAkB,KAAA,CAAM,IAAI,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,EAAE,CAAA;AACrC,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,EAAA,EAAG;AACtC;AA8BA,eAAsB,iBAAA,CAClB,QACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,IAAW,uBAAA;AAClC,EAAA,MAAM,CAAA,GAAI,OAAO,KAAA,IAAS,KAAA;AAC1B,EAAA,MAAM,IAAA,GAAO;AAAA,IACT,YAAY,MAAA,CAAO,SAAA;AAAA,IACnB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,aAAA,EAAe,OAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,iBAAiB,MAAA,CAAO,eAAA;AAAA,IACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,cAAA,EAAgB,OAAO,OAAA,CAAQ,MAAA;AAAA,IAC/B,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAA,EAAW,OAAO,GAAA,CAAI,KAAA;AAAA,IACtB,IAAI,MAAA,CAAO;AAAA,GACf;AACA,EAAA,MAAM,CAAA,GAAI,MAAM,CAAA,CAAE,CAAA,EAAG,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,IACxC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,GAC5B,CAAA;AACD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI;AACP,IAAA,IAAI,MAAA,GAAS,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAA;AAC7B,IAAA,IAAI;AACA,MAAA,MAAMC,EAAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,MAAA,IAAIA,EAAAA,CAAE,MAAA,EAAQ,MAAA,GAASA,EAAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,EAAA,OAAO,CAAA,CAAE,MAAA;AACb;AAYA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAK,GAAI,MAAM,gBAAgB,KAAK,CAAA;AAC5D,EAAA,IAAI,MAAA,GAAkC,IAAA;AACtC,EAAA,IAAI,MAAM,KAAA,EAAO;AACb,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAM,iBAAA,CAAkB,MAAA,EAAQ,KAAA,CAAM,KAAK,CAAA;AAAA,IACxD,SAAS,GAAA,EAAK;AAEV,MAAA,OAAA,CAAQ,KAAA,CAAM,+CAA+C,GAAG,CAAA;AAAA,IACpE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAC1C","file":"index.js","sourcesContent":["// @orangecheck/agent-openai — wrap OpenAI function calls in OC Agent\n// action envelopes.\n//\n// Covers both surfaces:\n//   - Responses API:        response.output → tool_call items with\n//                            { type: 'function_call', name, arguments, call_id }\n//                            (`arguments` is a JSON string)\n//   - Chat Completions:     message.tool_calls[i] = { id, function: { name, arguments } }\n//                            (`arguments` is also a JSON string)\n//\n// Both shapes normalize through `parseFunctionCall()` to the canonical\n// {id, name, arguments} form before hashing.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    assertScopeGranted,\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shape normalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OpenAiFunctionCall {\n    /** OpenAI's `id` for this call (Chat Completions: `tool_call.id`; Responses: `call_id`). */\n    id: string;\n    /** The function name. */\n    name: string;\n    /** The (already-parsed) function arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Normalize either a Chat Completions `tool_call` or a Responses\n * `function_call` item into our canonical {id, name, arguments} shape.\n *\n * Accepts:\n *   - { id, function: { name, arguments } }                      (Chat Completions)\n *   - { call_id, name, arguments }                               (Responses, function_call)\n *   - { id, name, arguments }                                    (already normalized)\n *\n * `arguments` may be either a JSON string (OpenAI's wire shape) or an\n * already-parsed object (your post-processing). Both work.\n */\nexport function parseFunctionCall(raw: unknown): OpenAiFunctionCall {\n    if (raw == null || typeof raw !== 'object') {\n        throw new TypeError('parseFunctionCall: input is not an object');\n    }\n    const r = raw as Record<string, unknown>;\n\n    // Chat Completions shape\n    if (r.function && typeof r.function === 'object') {\n        const f = r.function as Record<string, unknown>;\n        return {\n            id: String(r.id ?? ''),\n            name: String(f.name ?? ''),\n            arguments: parseArgs(f.arguments),\n        };\n    }\n\n    // Responses API or already-normalized\n    return {\n        id: String(r.id ?? r.call_id ?? ''),\n        name: String(r.name ?? ''),\n        arguments: parseArgs(r.arguments),\n    };\n}\n\nfunction parseArgs(args: unknown): Record<string, unknown> {\n    if (args == null) return {};\n    if (typeof args === 'object') return args as Record<string, unknown>;\n    if (typeof args === 'string') {\n        try {\n            const v = JSON.parse(args);\n            if (v && typeof v === 'object') return v as Record<string, unknown>;\n            return { _raw: args };\n        } catch {\n            return { _raw: args };\n        }\n    }\n    return { _raw: String(args) };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Produce the canonical bytes for an OpenAI function call. The bytes are\n * what the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n *   {\n *     \"arguments\": <canonical JSON of arguments>,\n *     \"id\":        <call id>,\n *     \"name\":      <function name>\n *   }\n */\nexport function canonicalizeFunctionCall(c: OpenAiFunctionCall): Uint8Array {\n    const canon = {\n        arguments: c.arguments,\n        id: c.id,\n        name: c.name,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function functionCallHash(c: OpenAiFunctionCall): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeFunctionCall(c)));\n}\n\nexport function functionCallActionId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    c: OpenAiFunctionCall\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: functionCallHash(c),\n        content_length: canonicalizeFunctionCall(c).byteLength,\n        content_mime: 'application/vnd.oc-agent.openai-function-call+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping + invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampFunctionCallInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Either a normalized `OpenAiFunctionCall` or a raw OpenAI tool_call / function_call object. */\n    call: OpenAiFunctionCall | unknown;\n    /** Defaults to `openai:function(name=<name>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\nexport async function stampFunctionCall(\n    input: StampFunctionCallInput\n): Promise<ActionEnvelope> {\n    const fc =\n        typeof input.call === 'object' &&\n        input.call !== null &&\n        'arguments' in (input.call as Record<string, unknown>) &&\n        typeof (input.call as Record<string, unknown>).arguments !== 'string'\n            ? (input.call as OpenAiFunctionCall)\n            : parseFunctionCall(input.call);\n\n    const scopeExercised =\n        input.scopeExercised ?? `openai:function(name=${fc.name})`;\n\n    assertScopeGranted(input.delegation, scopeExercised, 'stampFunctionCall');\n\n    const bytes = canonicalizeFunctionCall(fc);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation as never,\n        content: { hash: functionCallHash(fc), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.openai-function-call+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\nexport interface InvokeWithStampInput<T> extends StampFunctionCallInput {\n    /** Your handler. Receives the normalized OpenAiFunctionCall. */\n    execute: (call: OpenAiFunctionCall) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n    call: OpenAiFunctionCall;\n}\n\nexport async function invokeWithStamp<T>(\n    input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n    const action = await stampFunctionCall(input);\n    const fc = parseFunctionCall(input.call);\n    const result = await input.execute(fc);\n    return { result, action, call: fc };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Fleet integration: POST stamped actions to fleet.ochk.io/api/actions\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface FleetClient {\n    /** Defaults to https://fleet.ochk.io. */\n    baseUrl?: string;\n    /** Bearer token from /settings § 03 (`ock_<hex>`). */\n    apiToken: string;\n    /** Project the action belongs to (proj_*). */\n    projectId: string;\n    /** Optional fetch override for runtimes that need it. */\n    fetch?: typeof fetch;\n}\n\nexport interface PostActionResult {\n    id: string;\n    project_id: string;\n    delegation_id: string;\n}\n\n/**\n * POST a stamped action envelope to fleet.ochk.io/api/actions. The\n * fleet re-derives the action id, validates agent-must-match-\n * delegation, persists, fans out to Nostr (kind 30084), submits to\n * OC Stamp, and triggers any subscribed webhooks. Throws on non-2xx\n * with the server's reason string.\n */\nexport async function postActionToFleet(\n    action: ActionEnvelope,\n    client: FleetClient\n): Promise<PostActionResult> {\n    const baseUrl = client.baseUrl ?? 'https://fleet.ochk.io';\n    const f = client.fetch ?? fetch;\n    const body = {\n        project_id: client.projectId,\n        delegation_id: action.delegation_id,\n        agent_address: action.signer.address,\n        scope_exercised: action.scope_exercised,\n        content_hash: action.content.hash,\n        content_length: action.content.length,\n        content_mime: action.content.mime,\n        signed_at: action.signed_at,\n        signature: action.sig.value,\n        id: action.id,\n    };\n    const r = await f(`${baseUrl}/api/actions`, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: `Bearer ${client.apiToken}`,\n        },\n        body: JSON.stringify(body),\n    });\n    if (!r.ok) {\n        let reason = `http_${r.status}`;\n        try {\n            const j = (await r.json()) as { reason?: string };\n            if (j.reason) reason = j.reason;\n        } catch {\n            // body wasn't json\n        }\n        throw new Error(`postActionToFleet failed: ${reason}`);\n    }\n    const j = (await r.json()) as { ok: true; action: PostActionResult };\n    return j.action;\n}\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Fleet credentials. If absent, behaves like invokeWithStamp. */\n    fleet?: FleetClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when fleet is configured AND the POST succeeded. */\n    posted: PostActionResult | null;\n}\n\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action, call } = await invokeWithStamp(input);\n    let posted: PostActionResult | null = null;\n    if (input.fleet) {\n        try {\n            posted = await postActionToFleet(action, input.fleet);\n        } catch (err) {\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-openai] postActionToFleet failed:', err);\n        }\n    }\n    return { result, action, call, posted };\n}\n"]}

package/dist/index.mjs

@@ -1,8 +1,6 @@
 import { sha256 } from '@noble/hashes/sha256';
-import { canonicalize, hexEncode, computeActionId, parseScope, isSubScope } from '@orangecheck/agent-core';
+import { canonicalize, hexEncode, computeActionId, assertScopeGranted } from '@orangecheck/agent-core';
 import { signAsAgent } from '@orangecheck/agent-signer';
-import { postActionToConsole } from '@orangecheck/agent-console-client';
-export { postActionToConsole } from '@orangecheck/agent-console-client';
 
 // src/index.ts
 function parseFunctionCall(raw) {
@@ -64,13 +62,7 @@ function functionCallActionId(agentAddress, signedAt, delegationId, scopeExercis
 async function stampFunctionCall(input) {
   const fc = typeof input.call === "object" && input.call !== null && "arguments" in input.call && typeof input.call.arguments !== "string" ? input.call : parseFunctionCall(input.call);
   const scopeExercised = input.scopeExercised ?? `openai:function(name=${fc.name})`;
-  const granted = (input.delegation.scopes ?? []).map(parseScope);
-  const exercisedParsed = parseScope(scopeExercised);
-  if (!granted.some((g) => isSubScope(exercisedParsed, g))) {
-    throw new Error(
-      `stampFunctionCall: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
-    );
-  }
+  assertScopeGranted(input.delegation, scopeExercised, "stampFunctionCall");
   const bytes = canonicalizeFunctionCall(fc);
   return signAsAgent({
     agent: input.agent,
@@ -87,19 +79,54 @@ async function invokeWithStamp(input) {
   const result = await input.execute(fc);
   return { result, action, call: fc };
 }
+async function postActionToFleet(action, client) {
+  const baseUrl = client.baseUrl ?? "https://fleet.ochk.io";
+  const f = client.fetch ?? fetch;
+  const body = {
+    project_id: client.projectId,
+    delegation_id: action.delegation_id,
+    agent_address: action.signer.address,
+    scope_exercised: action.scope_exercised,
+    content_hash: action.content.hash,
+    content_length: action.content.length,
+    content_mime: action.content.mime,
+    signed_at: action.signed_at,
+    signature: action.sig.value,
+    id: action.id
+  };
+  const r = await f(`${baseUrl}/api/actions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${client.apiToken}`
+    },
+    body: JSON.stringify(body)
+  });
+  if (!r.ok) {
+    let reason = `http_${r.status}`;
+    try {
+      const j2 = await r.json();
+      if (j2.reason) reason = j2.reason;
+    } catch {
+    }
+    throw new Error(`postActionToFleet failed: ${reason}`);
+  }
+  const j = await r.json();
+  return j.action;
+}
 async function invokeWithStampAndPost(input) {
   const { result, action, call } = await invokeWithStamp(input);
   let posted = null;
-  if (input.console) {
+  if (input.fleet) {
     try {
-      posted = await postActionToConsole(action, input.console);
+      posted = await postActionToFleet(action, input.fleet);
     } catch (err) {
-      console.error("[oc-agent-openai] postActionToConsole failed:", err);
+      console.error("[oc-agent-openai] postActionToFleet failed:", err);
     }
   }
   return { result, action, call, posted };
 }
 
-export { canonicalizeFunctionCall, functionCallActionId, functionCallHash, invokeWithStamp, invokeWithStampAndPost, parseFunctionCall, stampFunctionCall };
+export { canonicalizeFunctionCall, functionCallActionId, functionCallHash, invokeWithStamp, invokeWithStampAndPost, parseFunctionCall, postActionToFleet, stampFunctionCall };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["_post"],"mappings":";;;;;;;AAqDO,SAAS,kBAAkB,GAAA,EAAkC;AAChE,EAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AACxC,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,CAAA,GAAI,GAAA;AAGV,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,OAAO,CAAA,CAAE,aAAa,QAAA,EAAU;AAC9C,IAAA,MAAM,IAAI,CAAA,CAAE,QAAA;AACZ,IAAA,OAAO;AAAA,MACH,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,EAAE,CAAA;AAAA,MACrB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,MACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,KACpC;AAAA,EACJ;AAGA,EAAA,OAAO;AAAA,IACH,IAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,CAAA,CAAE,WAAW,EAAE,CAAA;AAAA,IAClC,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,IACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,GACpC;AACJ;AAEA,SAAS,UAAU,IAAA,EAAwC;AACvD,EAAA,IAAI,IAAA,IAAQ,IAAA,EAAM,OAAO,EAAC;AAC1B,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,IAAI,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AACvC,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAI,CAAA,EAAE;AAChC;AAiBO,SAAS,yBAAyB,CAAA,EAAmC;AACxE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,CAAA,CAAE,SAAA;AAAA,IACb,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,iBAAiB,CAAA,EAA+B;AAC5D,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,wBAAA,CAAyB,CAAC,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,oBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,iBAAiB,CAAC,CAAA;AAAA,IAChC,cAAA,EAAgB,wBAAA,CAAyB,CAAC,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,oDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAgBA,eAAsB,kBAClB,KAAA,EACuB;AACvB,EAAA,MAAM,EAAA,GACF,OAAO,KAAA,CAAM,IAAA,KAAS,YACtB,KAAA,CAAM,IAAA,KAAS,QACf,WAAA,IAAgB,KAAA,CAAM,QACtB,OAAQ,KAAA,CAAM,KAAiC,SAAA,KAAc,QAAA,GACtD,MAAM,IAAA,GACP,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAEtC,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IAAkB,CAAA,qBAAA,EAAwB,GAAG,IAAI,CAAA,CAAA,CAAA;AAE3D,EAAA,MAAM,WAAW,KAAA,CAAM,UAAA,CAAW,UAAU,EAAC,EAAG,IAAI,UAAU,CAAA;AAC9D,EAAA,MAAM,eAAA,GAAkB,WAAW,cAAc,CAAA;AACjD,EAAA,IAAI,CAAC,QAAQ,IAAA,CAAK,CAAC,MAAM,UAAA,CAAW,eAAA,EAAiB,CAAC,CAAC,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,uCAAuC,cAAc,CAAA,yCAAA;AAAA,KACzD;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,yBAAyB,EAAE,CAAA;AACzC,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,gBAAA,CAAiB,EAAE,CAAA,EAAG,MAAA,EAAQ,MAAM,UAAA,EAAW;AAAA,IAChE,IAAA,EAAM,oDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAaA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,KAAK,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,iBAAA,CAAkB,KAAA,CAAM,IAAI,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,EAAE,CAAA;AACrC,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,EAAA,EAAG;AACtC;AA4BA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAK,GAAI,MAAM,gBAAgB,KAAK,CAAA;AAC5D,EAAA,IAAI,MAAA,GAAmC,IAAA;AACvC,EAAA,IAAI,MAAM,OAAA,EAAS;AACf,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAMA,mBAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AAEV,MAAA,OAAA,CAAQ,KAAA,CAAM,iDAAiD,GAAG,CAAA;AAAA,IACtE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAC1C","file":"index.mjs","sourcesContent":["// @orangecheck/agent-openai — wrap OpenAI function calls in OC Agent\n// action envelopes.\n//\n// Covers both surfaces:\n//   - Responses API:        response.output → tool_call items with\n//                            { type: 'function_call', name, arguments, call_id }\n//                            (`arguments` is a JSON string)\n//   - Chat Completions:     message.tool_calls[i] = { id, function: { name, arguments } }\n//                            (`arguments` is also a JSON string)\n//\n// Both shapes normalize through `parseFunctionCall()` to the canonical\n// {id, name, arguments} form before hashing.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    isSubScope,\n    parseScope,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shape normalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OpenAiFunctionCall {\n    /** OpenAI's `id` for this call (Chat Completions: `tool_call.id`; Responses: `call_id`). */\n    id: string;\n    /** The function name. */\n    name: string;\n    /** The (already-parsed) function arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Normalize either a Chat Completions `tool_call` or a Responses\n * `function_call` item into our canonical {id, name, arguments} shape.\n *\n * Accepts:\n *   - { id, function: { name, arguments } }                      (Chat Completions)\n *   - { call_id, name, arguments }                               (Responses, function_call)\n *   - { id, name, arguments }                                    (already normalized)\n *\n * `arguments` may be either a JSON string (OpenAI's wire shape) or an\n * already-parsed object (your post-processing). Both work.\n */\nexport function parseFunctionCall(raw: unknown): OpenAiFunctionCall {\n    if (raw == null || typeof raw !== 'object') {\n        throw new TypeError('parseFunctionCall: input is not an object');\n    }\n    const r = raw as Record<string, unknown>;\n\n    // Chat Completions shape\n    if (r.function && typeof r.function === 'object') {\n        const f = r.function as Record<string, unknown>;\n        return {\n            id: String(r.id ?? ''),\n            name: String(f.name ?? ''),\n            arguments: parseArgs(f.arguments),\n        };\n    }\n\n    // Responses API or already-normalized\n    return {\n        id: String(r.id ?? r.call_id ?? ''),\n        name: String(r.name ?? ''),\n        arguments: parseArgs(r.arguments),\n    };\n}\n\nfunction parseArgs(args: unknown): Record<string, unknown> {\n    if (args == null) return {};\n    if (typeof args === 'object') return args as Record<string, unknown>;\n    if (typeof args === 'string') {\n        try {\n            const v = JSON.parse(args);\n            if (v && typeof v === 'object') return v as Record<string, unknown>;\n            return { _raw: args };\n        } catch {\n            return { _raw: args };\n        }\n    }\n    return { _raw: String(args) };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Produce the canonical bytes for an OpenAI function call. The bytes are\n * what the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n *   {\n *     \"arguments\": <canonical JSON of arguments>,\n *     \"id\":        <call id>,\n *     \"name\":      <function name>\n *   }\n */\nexport function canonicalizeFunctionCall(c: OpenAiFunctionCall): Uint8Array {\n    const canon = {\n        arguments: c.arguments,\n        id: c.id,\n        name: c.name,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function functionCallHash(c: OpenAiFunctionCall): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeFunctionCall(c)));\n}\n\nexport function functionCallActionId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    c: OpenAiFunctionCall\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: functionCallHash(c),\n        content_length: canonicalizeFunctionCall(c).byteLength,\n        content_mime: 'application/vnd.oc-agent.openai-function-call+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping + invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampFunctionCallInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Either a normalized `OpenAiFunctionCall` or a raw OpenAI tool_call / function_call object. */\n    call: OpenAiFunctionCall | unknown;\n    /** Defaults to `openai:function(name=<name>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\nexport async function stampFunctionCall(\n    input: StampFunctionCallInput\n): Promise<ActionEnvelope> {\n    const fc =\n        typeof input.call === 'object' &&\n        input.call !== null &&\n        'arguments' in (input.call as Record<string, unknown>) &&\n        typeof (input.call as Record<string, unknown>).arguments !== 'string'\n            ? (input.call as OpenAiFunctionCall)\n            : parseFunctionCall(input.call);\n\n    const scopeExercised =\n        input.scopeExercised ?? `openai:function(name=${fc.name})`;\n\n    const granted = (input.delegation.scopes ?? []).map(parseScope);\n    const exercisedParsed = parseScope(scopeExercised);\n    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {\n        throw new Error(\n            `stampFunctionCall: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`\n        );\n    }\n\n    const bytes = canonicalizeFunctionCall(fc);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation as never,\n        content: { hash: functionCallHash(fc), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.openai-function-call+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\nexport interface InvokeWithStampInput<T> extends StampFunctionCallInput {\n    /** Your handler. Receives the normalized OpenAiFunctionCall. */\n    execute: (call: OpenAiFunctionCall) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n    call: OpenAiFunctionCall;\n}\n\nexport async function invokeWithStamp<T>(\n    input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n    const action = await stampFunctionCall(input);\n    const fc = parseFunctionCall(input.call);\n    const result = await input.execute(fc);\n    return { result, action, call: fc };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Console integration — re-export from the shared client\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    postActionToConsole,\n    type ConsoleClient,\n    type PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nimport {\n    postActionToConsole as _post,\n    type ConsoleClient as _ConsoleClient,\n    type PostActionResult as _PostActionResult,\n} from '@orangecheck/agent-console-client';\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Console credentials. If absent, behaves like invokeWithStamp + posted: null. */\n    console?: _ConsoleClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when console is configured AND the POST succeeded. */\n    posted: _PostActionResult | null;\n}\n\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action, call } = await invokeWithStamp(input);\n    let posted: _PostActionResult | null = null;\n    if (input.console) {\n        try {\n            posted = await _post(action, input.console);\n        } catch (err) {\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-openai] postActionToConsole failed:', err);\n        }\n    }\n    return { result, action, call, posted };\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["j"],"mappings":";;;;;AAoDO,SAAS,kBAAkB,GAAA,EAAkC;AAChE,EAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AACxC,IAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,CAAA,GAAI,GAAA;AAGV,EAAA,IAAI,CAAA,CAAE,QAAA,IAAY,OAAO,CAAA,CAAE,aAAa,QAAA,EAAU;AAC9C,IAAA,MAAM,IAAI,CAAA,CAAE,QAAA;AACZ,IAAA,OAAO;AAAA,MACH,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,EAAE,CAAA;AAAA,MACrB,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,MACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,KACpC;AAAA,EACJ;AAGA,EAAA,OAAO;AAAA,IACH,IAAI,MAAA,CAAO,CAAA,CAAE,EAAA,IAAM,CAAA,CAAE,WAAW,EAAE,CAAA;AAAA,IAClC,IAAA,EAAM,MAAA,CAAO,CAAA,CAAE,IAAA,IAAQ,EAAE,CAAA;AAAA,IACzB,SAAA,EAAW,SAAA,CAAU,CAAA,CAAE,SAAS;AAAA,GACpC;AACJ;AAEA,SAAS,UAAU,IAAA,EAAwC;AACvD,EAAA,IAAI,IAAA,IAAQ,IAAA,EAAM,OAAO,EAAC;AAC1B,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,IAAI,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AACvC,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,IACxB;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAI,CAAA,EAAE;AAChC;AAiBO,SAAS,yBAAyB,CAAA,EAAmC;AACxE,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,WAAW,CAAA,CAAE,SAAA;AAAA,IACb,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,MAAM,CAAA,CAAE;AAAA,GACZ;AACA,EAAA,MAAM,GAAA,GAAM,aAAa,KAAsD,CAAA;AAC/E,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,IAAI,CAAA;AAC9C;AAEO,SAAS,iBAAiB,CAAA,EAA+B;AAC5D,EAAA,OAAO,YAAY,SAAA,CAAU,MAAA,CAAO,wBAAA,CAAyB,CAAC,CAAC,CAAC,CAAA;AACpE;AAEO,SAAS,oBAAA,CACZ,YAAA,EACA,QAAA,EACA,YAAA,EACA,gBACA,CAAA,EACM;AACN,EAAA,OAAO,eAAA,CAAgB;AAAA,IACnB,OAAA,EAAS,YAAA;AAAA,IACT,YAAA,EAAc,iBAAiB,CAAC,CAAA;AAAA,IAChC,cAAA,EAAgB,wBAAA,CAAyB,CAAC,CAAA,CAAE,UAAA;AAAA,IAC5C,YAAA,EAAc,oDAAA;AAAA,IACd,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,YAAA;AAAA,IACf,eAAA,EAAiB;AAAA,GACpB,CAAA;AACL;AAgBA,eAAsB,kBAClB,KAAA,EACuB;AACvB,EAAA,MAAM,EAAA,GACF,OAAO,KAAA,CAAM,IAAA,KAAS,YACtB,KAAA,CAAM,IAAA,KAAS,QACf,WAAA,IAAgB,KAAA,CAAM,QACtB,OAAQ,KAAA,CAAM,KAAiC,SAAA,KAAc,QAAA,GACtD,MAAM,IAAA,GACP,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAEtC,EAAA,MAAM,cAAA,GACF,KAAA,CAAM,cAAA,IAAkB,CAAA,qBAAA,EAAwB,GAAG,IAAI,CAAA,CAAA,CAAA;AAE3D,EAAA,kBAAA,CAAmB,KAAA,CAAM,UAAA,EAAY,cAAA,EAAgB,mBAAmB,CAAA;AAExE,EAAA,MAAM,KAAA,GAAQ,yBAAyB,EAAE,CAAA;AACzC,EAAA,OAAO,WAAA,CAAY;AAAA,IACf,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAA,EAAS,EAAE,IAAA,EAAM,gBAAA,CAAiB,EAAE,CAAA,EAAG,MAAA,EAAQ,MAAM,UAAA,EAAW;AAAA,IAChE,IAAA,EAAM,oDAAA;AAAA,IACN,cAAA;AAAA,IACA,UAAU,KAAA,CAAM;AAAA,GACnB,CAAA;AACL;AAaA,eAAsB,gBAClB,KAAA,EACiC;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,KAAK,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,iBAAA,CAAkB,KAAA,CAAM,IAAI,CAAA;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,EAAE,CAAA;AACrC,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,EAAA,EAAG;AACtC;AA8BA,eAAsB,iBAAA,CAClB,QACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,IAAW,uBAAA;AAClC,EAAA,MAAM,CAAA,GAAI,OAAO,KAAA,IAAS,KAAA;AAC1B,EAAA,MAAM,IAAA,GAAO;AAAA,IACT,YAAY,MAAA,CAAO,SAAA;AAAA,IACnB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,aAAA,EAAe,OAAO,MAAA,CAAO,OAAA;AAAA,IAC7B,iBAAiB,MAAA,CAAO,eAAA;AAAA,IACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,cAAA,EAAgB,OAAO,OAAA,CAAQ,MAAA;AAAA,IAC/B,YAAA,EAAc,OAAO,OAAA,CAAQ,IAAA;AAAA,IAC7B,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,SAAA,EAAW,OAAO,GAAA,CAAI,KAAA;AAAA,IACtB,IAAI,MAAA,CAAO;AAAA,GACf;AACA,EAAA,MAAM,CAAA,GAAI,MAAM,CAAA,CAAE,CAAA,EAAG,OAAO,CAAA,YAAA,CAAA,EAAgB;AAAA,IACxC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,GAC5B,CAAA;AACD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI;AACP,IAAA,IAAI,MAAA,GAAS,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAA;AAC7B,IAAA,IAAI;AACA,MAAA,MAAMA,EAAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,MAAA,IAAIA,EAAAA,CAAE,MAAA,EAAQ,MAAA,GAASA,EAAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAE,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AACxB,EAAA,OAAO,CAAA,CAAE,MAAA;AACb;AAYA,eAAsB,uBAClB,KAAA,EACwC;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAK,GAAI,MAAM,gBAAgB,KAAK,CAAA;AAC5D,EAAA,IAAI,MAAA,GAAkC,IAAA;AACtC,EAAA,IAAI,MAAM,KAAA,EAAO;AACb,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,MAAM,iBAAA,CAAkB,MAAA,EAAQ,KAAA,CAAM,KAAK,CAAA;AAAA,IACxD,SAAS,GAAA,EAAK;AAEV,MAAA,OAAA,CAAQ,KAAA,CAAM,+CAA+C,GAAG,CAAA;AAAA,IACpE;AAAA,EACJ;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAO;AAC1C","file":"index.mjs","sourcesContent":["// @orangecheck/agent-openai — wrap OpenAI function calls in OC Agent\n// action envelopes.\n//\n// Covers both surfaces:\n//   - Responses API:        response.output → tool_call items with\n//                            { type: 'function_call', name, arguments, call_id }\n//                            (`arguments` is a JSON string)\n//   - Chat Completions:     message.tool_calls[i] = { id, function: { name, arguments } }\n//                            (`arguments` is also a JSON string)\n//\n// Both shapes normalize through `parseFunctionCall()` to the canonical\n// {id, name, arguments} form before hashing.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    assertScopeGranted,\n    canonicalize,\n    computeActionId,\n    hexEncode,\n    type DelegationEnvelope,\n} from '@orangecheck/agent-core';\nimport {\n    signAsAgent,\n    type ActionEnvelope,\n    type SignerRef,\n} from '@orangecheck/agent-signer';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shape normalization\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface OpenAiFunctionCall {\n    /** OpenAI's `id` for this call (Chat Completions: `tool_call.id`; Responses: `call_id`). */\n    id: string;\n    /** The function name. */\n    name: string;\n    /** The (already-parsed) function arguments. */\n    arguments: Record<string, unknown>;\n}\n\n/**\n * Normalize either a Chat Completions `tool_call` or a Responses\n * `function_call` item into our canonical {id, name, arguments} shape.\n *\n * Accepts:\n *   - { id, function: { name, arguments } }                      (Chat Completions)\n *   - { call_id, name, arguments }                               (Responses, function_call)\n *   - { id, name, arguments }                                    (already normalized)\n *\n * `arguments` may be either a JSON string (OpenAI's wire shape) or an\n * already-parsed object (your post-processing). Both work.\n */\nexport function parseFunctionCall(raw: unknown): OpenAiFunctionCall {\n    if (raw == null || typeof raw !== 'object') {\n        throw new TypeError('parseFunctionCall: input is not an object');\n    }\n    const r = raw as Record<string, unknown>;\n\n    // Chat Completions shape\n    if (r.function && typeof r.function === 'object') {\n        const f = r.function as Record<string, unknown>;\n        return {\n            id: String(r.id ?? ''),\n            name: String(f.name ?? ''),\n            arguments: parseArgs(f.arguments),\n        };\n    }\n\n    // Responses API or already-normalized\n    return {\n        id: String(r.id ?? r.call_id ?? ''),\n        name: String(r.name ?? ''),\n        arguments: parseArgs(r.arguments),\n    };\n}\n\nfunction parseArgs(args: unknown): Record<string, unknown> {\n    if (args == null) return {};\n    if (typeof args === 'object') return args as Record<string, unknown>;\n    if (typeof args === 'string') {\n        try {\n            const v = JSON.parse(args);\n            if (v && typeof v === 'object') return v as Record<string, unknown>;\n            return { _raw: args };\n        } catch {\n            return { _raw: args };\n        }\n    }\n    return { _raw: String(args) };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Canonicalization\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Produce the canonical bytes for an OpenAI function call. The bytes are\n * what the agent-action envelope's `content.hash` is a SHA-256 of.\n *\n * Shape (RFC 8785 canonical JSON, then trailing LF):\n *   {\n *     \"arguments\": <canonical JSON of arguments>,\n *     \"id\":        <call id>,\n *     \"name\":      <function name>\n *   }\n */\nexport function canonicalizeFunctionCall(c: OpenAiFunctionCall): Uint8Array {\n    const canon = {\n        arguments: c.arguments,\n        id: c.id,\n        name: c.name,\n    };\n    const str = canonicalize(canon as unknown as Parameters<typeof canonicalize>[0]);\n    return new TextEncoder().encode(str + '\\n');\n}\n\nexport function functionCallHash(c: OpenAiFunctionCall): string {\n    return 'sha256:' + hexEncode(sha256(canonicalizeFunctionCall(c)));\n}\n\nexport function functionCallActionId(\n    agentAddress: string,\n    signedAt: string,\n    delegationId: string,\n    scopeExercised: string,\n    c: OpenAiFunctionCall\n): string {\n    return computeActionId({\n        address: agentAddress,\n        content_hash: functionCallHash(c),\n        content_length: canonicalizeFunctionCall(c).byteLength,\n        content_mime: 'application/vnd.oc-agent.openai-function-call+json',\n        signed_at: signedAt,\n        delegation_id: delegationId,\n        scope_exercised: scopeExercised,\n    });\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Stamping + invocation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface StampFunctionCallInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Either a normalized `OpenAiFunctionCall` or a raw OpenAI tool_call / function_call object. */\n    call: OpenAiFunctionCall | unknown;\n    /** Defaults to `openai:function(name=<name>)` — the tightest admissible sub-scope. */\n    scopeExercised?: string;\n    signedAt?: Date;\n}\n\nexport async function stampFunctionCall(\n    input: StampFunctionCallInput\n): Promise<ActionEnvelope> {\n    const fc =\n        typeof input.call === 'object' &&\n        input.call !== null &&\n        'arguments' in (input.call as Record<string, unknown>) &&\n        typeof (input.call as Record<string, unknown>).arguments !== 'string'\n            ? (input.call as OpenAiFunctionCall)\n            : parseFunctionCall(input.call);\n\n    const scopeExercised =\n        input.scopeExercised ?? `openai:function(name=${fc.name})`;\n\n    assertScopeGranted(input.delegation, scopeExercised, 'stampFunctionCall');\n\n    const bytes = canonicalizeFunctionCall(fc);\n    return signAsAgent({\n        agent: input.agent,\n        delegation: input.delegation as never,\n        content: { hash: functionCallHash(fc), length: bytes.byteLength },\n        mime: 'application/vnd.oc-agent.openai-function-call+json',\n        scopeExercised,\n        signedAt: input.signedAt,\n    });\n}\n\nexport interface InvokeWithStampInput<T> extends StampFunctionCallInput {\n    /** Your handler. Receives the normalized OpenAiFunctionCall. */\n    execute: (call: OpenAiFunctionCall) => Promise<T>;\n}\n\nexport interface InvokeWithStampResult<T> {\n    result: T;\n    action: ActionEnvelope;\n    call: OpenAiFunctionCall;\n}\n\nexport async function invokeWithStamp<T>(\n    input: InvokeWithStampInput<T>\n): Promise<InvokeWithStampResult<T>> {\n    const action = await stampFunctionCall(input);\n    const fc = parseFunctionCall(input.call);\n    const result = await input.execute(fc);\n    return { result, action, call: fc };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Fleet integration: POST stamped actions to fleet.ochk.io/api/actions\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface FleetClient {\n    /** Defaults to https://fleet.ochk.io. */\n    baseUrl?: string;\n    /** Bearer token from /settings § 03 (`ock_<hex>`). */\n    apiToken: string;\n    /** Project the action belongs to (proj_*). */\n    projectId: string;\n    /** Optional fetch override for runtimes that need it. */\n    fetch?: typeof fetch;\n}\n\nexport interface PostActionResult {\n    id: string;\n    project_id: string;\n    delegation_id: string;\n}\n\n/**\n * POST a stamped action envelope to fleet.ochk.io/api/actions. The\n * fleet re-derives the action id, validates agent-must-match-\n * delegation, persists, fans out to Nostr (kind 30084), submits to\n * OC Stamp, and triggers any subscribed webhooks. Throws on non-2xx\n * with the server's reason string.\n */\nexport async function postActionToFleet(\n    action: ActionEnvelope,\n    client: FleetClient\n): Promise<PostActionResult> {\n    const baseUrl = client.baseUrl ?? 'https://fleet.ochk.io';\n    const f = client.fetch ?? fetch;\n    const body = {\n        project_id: client.projectId,\n        delegation_id: action.delegation_id,\n        agent_address: action.signer.address,\n        scope_exercised: action.scope_exercised,\n        content_hash: action.content.hash,\n        content_length: action.content.length,\n        content_mime: action.content.mime,\n        signed_at: action.signed_at,\n        signature: action.sig.value,\n        id: action.id,\n    };\n    const r = await f(`${baseUrl}/api/actions`, {\n        method: 'POST',\n        headers: {\n            'Content-Type': 'application/json',\n            Authorization: `Bearer ${client.apiToken}`,\n        },\n        body: JSON.stringify(body),\n    });\n    if (!r.ok) {\n        let reason = `http_${r.status}`;\n        try {\n            const j = (await r.json()) as { reason?: string };\n            if (j.reason) reason = j.reason;\n        } catch {\n            // body wasn't json\n        }\n        throw new Error(`postActionToFleet failed: ${reason}`);\n    }\n    const j = (await r.json()) as { ok: true; action: PostActionResult };\n    return j.action;\n}\n\nexport interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {\n    /** Fleet credentials. If absent, behaves like invokeWithStamp. */\n    fleet?: FleetClient;\n}\n\nexport interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {\n    /** Set when fleet is configured AND the POST succeeded. */\n    posted: PostActionResult | null;\n}\n\nexport async function invokeWithStampAndPost<T>(\n    input: InvokeWithStampAndPostInput<T>\n): Promise<InvokeWithStampAndPostResult<T>> {\n    const { result, action, call } = await invokeWithStamp(input);\n    let posted: PostActionResult | null = null;\n    if (input.fleet) {\n        try {\n            posted = await postActionToFleet(action, input.fleet);\n        } catch (err) {\n            // eslint-disable-next-line no-console\n            console.error('[oc-agent-openai] postActionToFleet failed:', err);\n        }\n    }\n    return { result, action, call, posted };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangecheck/agent-openai",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Wrap OpenAI function-calling (Responses API + Chat Completions tool path) with OC Agent scope enforcement and emit a signed agent-action envelope per function invocation.",
   "keywords": [
     "bitcoin",
@@ -52,9 +52,8 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@orangecheck/agent-console-client": "0.1.0",
-    "@orangecheck/agent-core": "^0.3.0",
-    "@orangecheck/agent-signer": "^0.1.0"
+    "@orangecheck/agent-core": "^1.2.0",
+    "@orangecheck/agent-signer": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/src/index.ts

@@ -13,11 +13,10 @@
 
 import { sha256 } from '@noble/hashes/sha256';
 import {
+    assertScopeGranted,
     canonicalize,
     computeActionId,
     hexEncode,
-    isSubScope,
-    parseScope,
     type DelegationEnvelope,
 } from '@orangecheck/agent-core';
 import {
@@ -165,13 +164,7 @@ export async function stampFunctionCall(
     const scopeExercised =
         input.scopeExercised ?? `openai:function(name=${fc.name})`;
 
-    const granted = (input.delegation.scopes ?? []).map(parseScope);
-    const exercisedParsed = parseScope(scopeExercised);
-    if (!granted.some((g) => isSubScope(exercisedParsed, g))) {
-        throw new Error(
-            `stampFunctionCall: scope_exercised (${scopeExercised}) is not a sub-scope of any granted scope`
-        );
-    }
+    assertScopeGranted(input.delegation, scopeExercised, 'stampFunctionCall');
 
     const bytes = canonicalizeFunctionCall(fc);
     return signAsAgent({
@@ -205,42 +198,94 @@ export async function invokeWithStamp<T>(
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Console integration — re-export from the shared client
+// Fleet integration: POST stamped actions to fleet.ochk.io/api/actions
 // ─────────────────────────────────────────────────────────────────────────────
 
-export {
-    postActionToConsole,
-    type ConsoleClient,
-    type PostActionResult,
-} from '@orangecheck/agent-console-client';
+export interface FleetClient {
+    /** Defaults to https://fleet.ochk.io. */
+    baseUrl?: string;
+    /** Bearer token from /settings § 03 (`ock_<hex>`). */
+    apiToken: string;
+    /** Project the action belongs to (proj_*). */
+    projectId: string;
+    /** Optional fetch override for runtimes that need it. */
+    fetch?: typeof fetch;
+}
 
-import {
-    postActionToConsole as _post,
-    type ConsoleClient as _ConsoleClient,
-    type PostActionResult as _PostActionResult,
-} from '@orangecheck/agent-console-client';
+export interface PostActionResult {
+    id: string;
+    project_id: string;
+    delegation_id: string;
+}
+
+/**
+ * POST a stamped action envelope to fleet.ochk.io/api/actions. The
+ * fleet re-derives the action id, validates agent-must-match-
+ * delegation, persists, fans out to Nostr (kind 30084), submits to
+ * OC Stamp, and triggers any subscribed webhooks. Throws on non-2xx
+ * with the server's reason string.
+ */
+export async function postActionToFleet(
+    action: ActionEnvelope,
+    client: FleetClient
+): Promise<PostActionResult> {
+    const baseUrl = client.baseUrl ?? 'https://fleet.ochk.io';
+    const f = client.fetch ?? fetch;
+    const body = {
+        project_id: client.projectId,
+        delegation_id: action.delegation_id,
+        agent_address: action.signer.address,
+        scope_exercised: action.scope_exercised,
+        content_hash: action.content.hash,
+        content_length: action.content.length,
+        content_mime: action.content.mime,
+        signed_at: action.signed_at,
+        signature: action.sig.value,
+        id: action.id,
+    };
+    const r = await f(`${baseUrl}/api/actions`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${client.apiToken}`,
+        },
+        body: JSON.stringify(body),
+    });
+    if (!r.ok) {
+        let reason = `http_${r.status}`;
+        try {
+            const j = (await r.json()) as { reason?: string };
+            if (j.reason) reason = j.reason;
+        } catch {
+            // body wasn't json
+        }
+        throw new Error(`postActionToFleet failed: ${reason}`);
+    }
+    const j = (await r.json()) as { ok: true; action: PostActionResult };
+    return j.action;
+}
 
 export interface InvokeWithStampAndPostInput<T> extends InvokeWithStampInput<T> {
-    /** Console credentials. If absent, behaves like invokeWithStamp + posted: null. */
-    console?: _ConsoleClient;
+    /** Fleet credentials. If absent, behaves like invokeWithStamp. */
+    fleet?: FleetClient;
 }
 
 export interface InvokeWithStampAndPostResult<T> extends InvokeWithStampResult<T> {
-    /** Set when console is configured AND the POST succeeded. */
-    posted: _PostActionResult | null;
+    /** Set when fleet is configured AND the POST succeeded. */
+    posted: PostActionResult | null;
 }
 
 export async function invokeWithStampAndPost<T>(
     input: InvokeWithStampAndPostInput<T>
 ): Promise<InvokeWithStampAndPostResult<T>> {
     const { result, action, call } = await invokeWithStamp(input);
-    let posted: _PostActionResult | null = null;
-    if (input.console) {
+    let posted: PostActionResult | null = null;
+    if (input.fleet) {
         try {
-            posted = await _post(action, input.console);
+            posted = await postActionToFleet(action, input.fleet);
         } catch (err) {
             // eslint-disable-next-line no-console
-            console.error('[oc-agent-openai] postActionToConsole failed:', err);
+            console.error('[oc-agent-openai] postActionToFleet failed:', err);
         }
     }
     return { result, action, call, posted };

package/src/scope-preflight.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest';
+
+import { ScopeNotGrantedError } from '@orangecheck/agent-core';
+
+import { stampFunctionCall } from './index.js';
+
+const AGENT = 'bc1qagent0000000000000000000000000000000000';
+const sign = () => async (msg: string) => Buffer.from(msg, 'utf8').toString('base64');
+
+const SEALED = {
+    v: 1,
+    alg: 'x25519-xchacha20poly1305',
+    recipients: [{ device_id: 'dev1', ct: 'AA' }],
+    ct: 'BB',
+    nonce: 'CC',
+} as never;
+
+/**
+ * This adapter used to open-code the pre-flight scope check. It now routes to
+ * agent-core's `assertScopeGranted`, and these assert the routing rather than
+ * the check — agent-core owns testing the check itself.
+ *
+ * The case that matters is the encrypted one: a v1.2 private delegation has no
+ * readable `scopes`, and the old `?? []` reported that as "not a sub-scope of
+ * any granted scope" — pointing the integrator at a scope string that was
+ * probably fine, when the actual need was to decrypt the grant.
+ */
+describe('stampFunctionCall scope pre-flight', () => {
+    const base = {
+        agent: { address: AGENT, sign: sign() },
+        call: { name: 'search', arguments: { q: 'x' } },
+    } as never;
+
+    it('names encrypted scopes rather than blaming the scope string', async () => {
+        const err = await stampFunctionCall({
+            ...(base as object),
+            delegation: { scopes_encrypted: SEALED },
+            scopeExercised: 'openai:tool(name=search)',
+        } as never).catch((e: unknown) => e);
+
+        expect(err).toBeInstanceOf(ScopeNotGrantedError);
+        expect((err as ScopeNotGrantedError).reason).toBe('scopes_encrypted');
+        expect((err as Error).message).toMatch(/decryptPrivateScopes/);
+    });
+
+    it('treats an absent grant as granting nothing', async () => {
+        const err = await stampFunctionCall({
+            ...(base as object),
+            delegation: {},
+            scopeExercised: 'openai:tool(name=search)',
+        } as never).catch((e: unknown) => e);
+
+        expect((err as ScopeNotGrantedError).reason).toBe('no_scopes');
+    });
+});