@orangecheck/agent-signer 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OrangeCheck
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,137 @@
+# @orangecheck/agent-signer
+
+High-level API for producing [OC Agent](https://github.com/orangecheck/oc-agent-protocol) envelopes from a BIP-322-capable signer.
+
+Three functions:
+
+| | |
+|---|---|
+| `createDelegation(input)` | Principal signs a scoped grant for an agent address. |
+| `signAsAgent(input)` | Agent produces an `agent-action` envelope over content, citing the delegation. |
+| `revoke(input)` | Principal (or agent, if authorized) burns the delegation. |
+
+The signer layer wraps [`@orangecheck/agent-core`](../agent-core): canonical messages, scope canonicalization, envelope ids, and verification are delegated to the core package. This module handles wallet plumbing, default timestamps and nonces, and input validation.
+
+Nothing here touches the network — OpenTimestamps submission and Nostr publication are separate steps. If you already have an OTS proof, pass it in via the `ots` field; otherwise the resulting envelope has `ots: null` and the caller submits to a calendar out of band.
+
+## Install
+
+```bash
+npm i @orangecheck/agent-signer
+```
+
+## Quickstart
+
+```ts
+import {
+    createDelegation,
+    signAsAgent,
+    revoke,
+} from '@orangecheck/agent-signer';
+
+// A SignerRef is any { address, signMessage } — the wallet adapter produced by
+// @orangecheck/wallet-adapter, or a custom BIP-322 signer for headless agents.
+const principal = {
+    address: 'bc1qprincipal…',
+    signMessage: async (msg: string) => wallet.signMessage(msg),
+};
+const agent = {
+    address: 'bc1qagent…',
+    signMessage: async (msg: string) => agentKey.signBip322(msg),
+};
+
+// 1. Principal grants the agent scoped authority.
+const delegation = await createDelegation({
+    principal,
+    agentAddress: agent.address,
+    scopes: [
+        'lock:seal(recipient=bc1qalice)',
+        'stamp:sign(mime=text/markdown)',
+    ],
+    bond: { sats: 500_000, attestation_id: '22…22' },
+    ttlMs: 7 * 24 * 60 * 60 * 1000, // 7 days
+});
+
+// 2. Agent exercises the delegation.
+const action = await signAsAgent({
+    agent,
+    delegation,
+    content: new TextEncoder().encode('hello world'),
+    mime: 'text/plain',
+    scopeExercised: 'lock:seal(recipient=bc1qalice)',
+});
+
+// 3. Principal revokes early (optional).
+const revocation = await revoke({
+    signer: principal,
+    delegation,
+    reason: 'key rotated',
+});
+```
+
+## API
+
+### `createDelegation(input)`
+
+```ts
+interface CreateDelegationInput {
+    principal: SignerRef;
+    agentAddress: string;
+    scopes: string[];                 // validated + canonicalized
+    bond?: { sats: number; attestation_id: string } | null;
+    issuedAt?: Date;                   // default: now
+    ttlMs?: number;                    // default: 7d, max: 365d
+    expiresAt?: Date;                  // overrides ttlMs if set
+    nonce?: string;                    // default: random 32-hex
+    revocationHolders?: ('principal' | 'agent')[]; // default: ['principal']
+    revocationRef?: string | null;
+    scopeMode?: 'strict' | 'permissive'; // default: 'strict'
+}
+```
+
+Returns a `DelegationEnvelope`. The principal's `signMessage` is called exactly once with the ASCII hex of the envelope id.
+
+### `signAsAgent(input)`
+
+```ts
+interface SignAsAgentInput {
+    agent: SignerRef;                 // must equal delegation.agent.address
+    delegation: DelegationEnvelope;
+    content: Uint8Array | { hash: string; length: number };
+    mime: string;
+    scopeExercised: string;           // must be a sub-scope of some granted scope (checked at verify time)
+    ref?: string | null;
+    signedAt?: Date;                  // default: now
+    ots?: ActionOts | null;           // default: null (caller submits separately)
+}
+```
+
+Returns an `ActionEnvelope` — a strict extension of an [OC Stamp](https://github.com/orangecheck/oc-stamp-protocol) envelope, so any stamp verifier reads it as a valid stamp.
+
+### `revoke(input)`
+
+```ts
+interface RevokeInput {
+    signer: SignerRef;                 // must be in delegation.revocation.holders
+    delegation: DelegationEnvelope;
+    reason?: string;                   // ASCII, <=128 bytes
+    signedAt?: Date;
+    ots?: ActionOts | null;
+}
+```
+
+Returns a `RevocationEnvelope`. The function throws if the signer isn't authorized to revoke per `delegation.revocation.holders`.
+
+## Verification
+
+Re-exports `verifyDelegation`, `verifyAction`, and `verifyRevocation` from `@orangecheck/agent-core` for convenience. See that package's README for full details.
+
+## Companion packages
+
+- [`@orangecheck/agent-core`](../agent-core) — canonical messages, scopes, verification.
+- [`@orangecheck/agent-mcp`](../agent-mcp) — MCP tool wrapper.
+- [`@orangecheck/wallet-adapter`](../wallet-adapter) — browser BIP-322 signers (UniSat, Xverse, Leather).
+
+## License
+
+MIT. See [LICENSE](./LICENSE).

package/dist/index.d.mts

@@ -0,0 +1,45 @@
+import { DelegationBond, RevocationHolder, ValidationOptions, DelegationEnvelope, ActionOts, RevocationEnvelope, ActionEnvelope } from '@orangecheck/agent-core';
+export { ActionEnvelope, ActionOts, AgentErrorCode, DelegationBond, DelegationEnvelope, REGISTERED_SCOPES, RevocationEnvelope, Scope, ScopeConstraint, canonicalizeScope, canonicalizeScopes, computeActionId, computeDelegationId, computeRevocationId, isSubScope, parseScope, verifyAction, verifyDelegation, verifyRevocation } from '@orangecheck/agent-core';
+
+interface SignerRef {
+    address: string;
+    signMessage: (msg: string) => Promise<string>;
+}
+interface CreateDelegationInput {
+    principal: SignerRef;
+    agentAddress: string;
+    scopes: string[];
+    bond?: DelegationBond | null;
+    issuedAt?: Date;
+    ttlMs?: number;
+    expiresAt?: Date;
+    nonce?: string;
+    revocationHolders?: RevocationHolder[];
+    revocationRef?: string | null;
+    scopeMode?: ValidationOptions['mode'];
+}
+declare function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope>;
+interface SignAsAgentInput {
+    agent: SignerRef;
+    delegation: DelegationEnvelope;
+    content: Uint8Array | {
+        hash: string;
+        length: number;
+    };
+    mime: string;
+    scopeExercised: string;
+    ref?: string | null;
+    signedAt?: Date;
+    ots?: ActionOts | null;
+}
+declare function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope>;
+interface RevokeInput {
+    signer: SignerRef;
+    delegation: DelegationEnvelope;
+    reason?: string;
+    signedAt?: Date;
+    ots?: ActionOts | null;
+}
+declare function revoke(input: RevokeInput): Promise<RevocationEnvelope>;
+
+export { type CreateDelegationInput, type RevokeInput, type SignAsAgentInput, type SignerRef, createDelegation, revoke, signAsAgent };

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+import { DelegationBond, RevocationHolder, ValidationOptions, DelegationEnvelope, ActionOts, RevocationEnvelope, ActionEnvelope } from '@orangecheck/agent-core';
+export { ActionEnvelope, ActionOts, AgentErrorCode, DelegationBond, DelegationEnvelope, REGISTERED_SCOPES, RevocationEnvelope, Scope, ScopeConstraint, canonicalizeScope, canonicalizeScopes, computeActionId, computeDelegationId, computeRevocationId, isSubScope, parseScope, verifyAction, verifyDelegation, verifyRevocation } from '@orangecheck/agent-core';
+
+interface SignerRef {
+    address: string;
+    signMessage: (msg: string) => Promise<string>;
+}
+interface CreateDelegationInput {
+    principal: SignerRef;
+    agentAddress: string;
+    scopes: string[];
+    bond?: DelegationBond | null;
+    issuedAt?: Date;
+    ttlMs?: number;
+    expiresAt?: Date;
+    nonce?: string;
+    revocationHolders?: RevocationHolder[];
+    revocationRef?: string | null;
+    scopeMode?: ValidationOptions['mode'];
+}
+declare function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope>;
+interface SignAsAgentInput {
+    agent: SignerRef;
+    delegation: DelegationEnvelope;
+    content: Uint8Array | {
+        hash: string;
+        length: number;
+    };
+    mime: string;
+    scopeExercised: string;
+    ref?: string | null;
+    signedAt?: Date;
+    ots?: ActionOts | null;
+}
+declare function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope>;
+interface RevokeInput {
+    signer: SignerRef;
+    delegation: DelegationEnvelope;
+    reason?: string;
+    signedAt?: Date;
+    ots?: ActionOts | null;
+}
+declare function revoke(input: RevokeInput): Promise<RevocationEnvelope>;
+
+export { type CreateDelegationInput, type RevokeInput, type SignAsAgentInput, type SignerRef, createDelegation, revoke, signAsAgent };

package/dist/index.js

@@ -0,0 +1,227 @@
+'use strict';
+
+var sha256 = require('@noble/hashes/sha256');
+var agentCore = require('@orangecheck/agent-core');
+
+// src/index.ts
+async function createDelegation(input) {
+  if (!input.scopes || input.scopes.length === 0) {
+    throw new Error("createDelegation: at least one scope is required");
+  }
+  const mode = input.scopeMode ?? "strict";
+  for (const s of input.scopes) agentCore.validateScope(agentCore.parseScope(s), { mode });
+  const scopes = agentCore.canonicalizeScopes(input.scopes);
+  const issuedAt = isoUtcSeconds(input.issuedAt ?? /* @__PURE__ */ new Date());
+  let expiresAtDate;
+  if (input.expiresAt) {
+    expiresAtDate = input.expiresAt;
+  } else {
+    const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1e3;
+    expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);
+  }
+  const expiresAt = isoUtcSeconds(expiresAtDate);
+  const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();
+  if (durationMs <= 0) throw new Error("createDelegation: expires_at must be after issued_at");
+  if (durationMs > 365 * 24 * 60 * 60 * 1e3) {
+    throw new Error("createDelegation: delegation duration must not exceed 365 days");
+  }
+  const nonce = input.nonce ?? randomHex(16);
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    throw new Error("createDelegation: nonce must be 32 lowercase hex chars");
+  }
+  const bond = input.bond ?? null;
+  if (bond) {
+    if (!Number.isInteger(bond.sats) || bond.sats < 0) {
+      throw new Error("createDelegation: bond.sats must be a non-negative integer");
+    }
+    if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {
+      throw new Error("createDelegation: bond.attestation_id must be 64 lowercase hex chars");
+    }
+  }
+  const canonInput = {
+    principal: input.principal.address,
+    agent: input.agentAddress,
+    scopes,
+    bond_sats: bond?.sats ?? 0,
+    bond_attestation: bond?.attestation_id ?? "none",
+    issued_at: issuedAt,
+    expires_at: expiresAt,
+    nonce
+  };
+  const id = agentCore.computeDelegationId(canonInput);
+  const sigValue = await input.principal.signMessage(id);
+  const envelope = {
+    v: agentCore.ENVELOPE_VERSION,
+    kind: "agent-delegation",
+    id,
+    principal: { address: input.principal.address, alg: "bip322" },
+    agent: { address: input.agentAddress, alg: "bip322" },
+    scopes,
+    bond,
+    issued_at: issuedAt,
+    expires_at: expiresAt,
+    nonce,
+    revocation: {
+      holders: input.revocationHolders ?? ["principal"],
+      ref: input.revocationRef ?? null
+    },
+    sig: {
+      alg: "bip322",
+      pubkey: input.principal.address,
+      value: sigValue
+    }
+  };
+  return envelope;
+}
+async function signAsAgent(input) {
+  if (input.agent.address !== input.delegation.agent.address) {
+    throw new Error("signAsAgent: signer address does not match delegation.agent.address");
+  }
+  let contentHash;
+  let contentLength;
+  if (input.content instanceof Uint8Array) {
+    contentHash = "sha256:" + agentCore.hexEncode(sha256.sha256(input.content));
+    contentLength = input.content.byteLength;
+  } else {
+    if (!input.content.hash.startsWith("sha256:") || input.content.hash.length !== "sha256:".length + 64) {
+      throw new Error('signAsAgent: content.hash must be "sha256:" + 64 lowercase hex chars');
+    }
+    contentHash = input.content.hash;
+    contentLength = input.content.length;
+    if (!Number.isInteger(contentLength) || contentLength < 0) {
+      throw new Error("signAsAgent: content.length must be a non-negative integer");
+    }
+  }
+  const signedAt = isoUtcSeconds(input.signedAt ?? /* @__PURE__ */ new Date());
+  const canonInput = {
+    address: input.agent.address,
+    content_hash: contentHash,
+    content_length: contentLength,
+    content_mime: input.mime,
+    signed_at: signedAt,
+    delegation_id: input.delegation.id,
+    scope_exercised: input.scopeExercised
+  };
+  const id = agentCore.computeActionId(canonInput);
+  const sigValue = await input.agent.signMessage(id);
+  const envelope = {
+    v: agentCore.ENVELOPE_VERSION,
+    kind: "agent-action",
+    id,
+    content: {
+      hash: contentHash,
+      length: contentLength,
+      mime: input.mime,
+      ref: input.ref ?? null
+    },
+    signer: { address: input.agent.address, alg: "bip322" },
+    signed_at: signedAt,
+    delegation_id: input.delegation.id,
+    scope_exercised: input.scopeExercised,
+    ots: input.ots ?? null,
+    sig: { alg: "bip322", pubkey: input.agent.address, value: sigValue }
+  };
+  return envelope;
+}
+async function revoke(input) {
+  const holders = input.delegation.revocation?.holders ?? ["principal"];
+  const allowed = /* @__PURE__ */ new Set();
+  if (holders.includes("principal")) allowed.add(input.delegation.principal.address);
+  if (holders.includes("agent")) allowed.add(input.delegation.agent.address);
+  if (!allowed.has(input.signer.address)) {
+    throw new Error(
+      `revoke: signer ${input.signer.address} not authorized to revoke this delegation`
+    );
+  }
+  const reason = input.reason ?? "";
+  if (reason.length > 128) throw new Error("revoke: reason must be <=128 bytes");
+  const signedAt = isoUtcSeconds(input.signedAt ?? /* @__PURE__ */ new Date());
+  const canonInput = {
+    address: input.signer.address,
+    delegation_id: input.delegation.id,
+    reason,
+    signed_at: signedAt
+  };
+  const id = agentCore.computeRevocationId(canonInput);
+  const sigValue = await input.signer.signMessage(id);
+  const envelope = {
+    v: agentCore.ENVELOPE_VERSION,
+    kind: "agent-revocation",
+    id,
+    delegation_id: input.delegation.id,
+    signer: { address: input.signer.address, alg: "bip322" },
+    reason,
+    signed_at: signedAt,
+    ots: input.ots ?? null,
+    sig: { alg: "bip322", pubkey: input.signer.address, value: sigValue }
+  };
+  return envelope;
+}
+function isoUtcSeconds(d) {
+  return d.toISOString().replace(/\.\d+Z$/, "Z");
+}
+function randomHex(bytes) {
+  const buf = new Uint8Array(bytes);
+  const c = globalThis.crypto;
+  if (c && typeof c.getRandomValues === "function") {
+    c.getRandomValues(buf);
+  } else {
+    for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);
+  }
+  let out = "";
+  for (let i = 0; i < bytes; i++) {
+    const b = buf[i];
+    out += b.toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
+Object.defineProperty(exports, "REGISTERED_SCOPES", {
+  enumerable: true,
+  get: function () { return agentCore.REGISTERED_SCOPES; }
+});
+Object.defineProperty(exports, "canonicalizeScope", {
+  enumerable: true,
+  get: function () { return agentCore.canonicalizeScope; }
+});
+Object.defineProperty(exports, "canonicalizeScopes", {
+  enumerable: true,
+  get: function () { return agentCore.canonicalizeScopes; }
+});
+Object.defineProperty(exports, "computeActionId", {
+  enumerable: true,
+  get: function () { return agentCore.computeActionId; }
+});
+Object.defineProperty(exports, "computeDelegationId", {
+  enumerable: true,
+  get: function () { return agentCore.computeDelegationId; }
+});
+Object.defineProperty(exports, "computeRevocationId", {
+  enumerable: true,
+  get: function () { return agentCore.computeRevocationId; }
+});
+Object.defineProperty(exports, "isSubScope", {
+  enumerable: true,
+  get: function () { return agentCore.isSubScope; }
+});
+Object.defineProperty(exports, "parseScope", {
+  enumerable: true,
+  get: function () { return agentCore.parseScope; }
+});
+Object.defineProperty(exports, "verifyAction", {
+  enumerable: true,
+  get: function () { return agentCore.verifyAction; }
+});
+Object.defineProperty(exports, "verifyDelegation", {
+  enumerable: true,
+  get: function () { return agentCore.verifyDelegation; }
+});
+Object.defineProperty(exports, "verifyRevocation", {
+  enumerable: true,
+  get: function () { return agentCore.verifyRevocation; }
+});
+exports.createDelegation = createDelegation;
+exports.revoke = revoke;
+exports.signAsAgent = signAsAgent;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["validateScope","parseScope","canonicalizeScopes","computeDelegationId","ENVELOPE_VERSION","hexEncode","sha256","computeActionId","computeRevocationId"],"mappings":";;;;;;AAkEA,eAAsB,iBAAiB,KAAA,EAA2D;AAC9F,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,MAAA,CAAO,WAAW,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,IAAa,QAAA;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,MAAA,EAAQA,uBAAA,CAAcC,qBAAW,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AACnE,EAAA,MAAM,MAAA,GAASC,4BAAA,CAAmB,KAAA,CAAM,MAAM,CAAA;AAE9C,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,MAAM,SAAA,EAAW;AACjB,IAAA,aAAA,GAAgB,KAAA,CAAM,SAAA;AAAA,EAC1B,CAAA,MAAO;AACH,IAAA,MAAM,MAAM,KAAA,CAAM,KAAA,IAAS,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,GAAA;AAC9C,IAAA,aAAA,GAAgB,IAAI,KAAK,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,KAAY,GAAG,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,SAAA,GAAY,cAAc,aAAa,CAAA;AAE7C,EAAA,MAAM,UAAA,GAAa,IAAI,IAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ,GAAI,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAC9E,EAAA,IAAI,UAAA,IAAc,CAAA,EAAG,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAC3F,EAAA,IAAI,UAAA,GAAa,GAAA,GAAM,EAAA,GAAK,EAAA,GAAK,KAAK,GAAA,EAAM;AACxC,IAAA,MAAM,IAAI,MAAM,gEAAgE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,SAAA,CAAU,EAAE,CAAA;AACzC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAC3B,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AAAA,EACJ;AAEA,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,SAAA,EAAW,MAAM,SAAA,CAAU,OAAA;AAAA,IAC3B,OAAO,KAAA,CAAM,YAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,MAAM,IAAA,IAAQ,CAAA;AAAA,IACzB,gBAAA,EAAkB,MAAM,cAAA,IAAkB,MAAA;AAAA,IAC1C,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAKC,8BAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,CAAU,YAAY,EAAE,CAAA;AAErD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAGC,0BAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,WAAW,EAAE,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IAC7D,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,YAAA,EAAc,KAAK,QAAA,EAAS;AAAA,IACpD,MAAA;AAAA,IACA,IAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ,KAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACR,OAAA,EAAS,KAAA,CAAM,iBAAA,IAAqB,CAAC,WAAW,CAAA;AAAA,MAChD,GAAA,EAAK,MAAM,aAAA,IAAiB;AAAA,KAChC;AAAA,IACA,GAAA,EAAK;AAAA,MACD,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,MAAM,SAAA,CAAU,OAAA;AAAA,MACxB,KAAA,EAAO;AAAA;AACX,GACJ;AACA,EAAA,OAAO,QAAA;AACX;AAoBA,eAAsB,YAAY,KAAA,EAAkD;AAChF,EAAA,IAAI,MAAM,KAAA,CAAM,OAAA,KAAY,KAAA,CAAM,UAAA,CAAW,MAAM,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,KAAA,CAAM,mBAAmB,UAAA,EAAY;AACrC,IAAA,WAAA,GAAc,SAAA,GAAYC,mBAAA,CAAUC,aAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AACzD,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,UAAA;AAAA,EAClC,CAAA,MAAO;AACH,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAA,KAAW,SAAA,CAAU,SAAS,EAAA,EAAI;AAClG,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AACA,IAAA,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA;AAC5B,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,MAAA;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAAK,gBAAgB,CAAA,EAAG;AACvD,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AAAA,EACJ;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA;AAAA,IACrB,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,cAAc,KAAA,CAAM,IAAA;AAAA,IACpB,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM;AAAA,GAC3B;AACA,EAAA,MAAM,EAAA,GAAKC,0BAAgB,UAAU,CAAA;AAErC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,YAAY,EAAE,CAAA;AAEjD,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC7B,CAAA,EAAGH,0BAAA;AAAA,IACH,IAAA,EAAM,cAAA;AAAA,IACN,EAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,MAAA,EAAQ,aAAA;AAAA,MACR,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,GAAA,EAAK,MAAM,GAAA,IAAO;AAAA,KACtB;AAAA,IACA,QAAQ,EAAE,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACtD,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM,cAAA;AAAA,IACvB,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACvE;AACA,EAAA,OAAO,QAAA;AACX;AAgBA,eAAsB,OAAO,KAAA,EAAiD;AAC1E,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,CAAW,UAAA,EAAY,OAAA,IAAW,CAAC,WAAW,CAAA;AACpE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAW,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAO,CAAA;AACjF,EAAA,IAAI,OAAA,CAAQ,SAAS,OAAO,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACzE,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,yCAAA;AAAA,KAC1C;AAAA,EACJ;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,GAAA,EAAK,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAE7E,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA;AAAA,IACtB,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,MAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACf;AACA,EAAA,MAAM,EAAA,GAAKI,8BAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,YAAY,EAAE,CAAA;AAElD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAGJ,0BAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,QAAQ,EAAE,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACvD,MAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACxE;AACA,EAAA,OAAO,QAAA;AACX;AAkCA,SAAS,cAAc,CAAA,EAAiB;AACpC,EAAA,OAAO,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,WAAW,GAAG,CAAA;AACjD;AAEA,SAAS,UAAU,KAAA,EAAuB;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,MAAM,IAAyB,UAAA,CAA8C,MAAA;AAC7E,EAAA,IAAI,CAAA,IAAK,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAA,EAAY;AAC9C,IAAA,CAAA,CAAE,gBAAgB,GAAG,CAAA;AAAA,EACzB,CAAA,MAAO;AAEH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AACf,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,GAAA;AACX","file":"index.js","sourcesContent":["// @orangecheck/agent-signer — high-level API for producing OC Agent envelopes.\n//\n//   createDelegation  — principal signs a scoped grant to an agent address.\n//   signAsAgent       — agent produces an agent-action envelope over content.\n//   revoke            — principal (or agent, if authorized) burns a delegation.\n//\n// Each function wraps @orangecheck/agent-core's canonical-message + id\n// computation with a caller-supplied `signMessage` wallet adapter. Nothing here\n// touches the network — OTS anchoring and Nostr publication are separate steps\n// the caller wires up.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    ENVELOPE_VERSION,\n    hexEncode,\n    parseScope,\n    validateScope,\n} from '@orangecheck/agent-core';\nimport type { ValidationOptions } from '@orangecheck/agent-core';\nimport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    RevocationHolder,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shared wallet-adapter shape (matches `@orangecheck/stamp-core` StampInput).\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignerRef {\n    address: string;\n    /** Returns a base64 BIP-322 signature over the given message as UTF-8 bytes. */\n    signMessage: (msg: string) => Promise<string>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// createDelegation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface CreateDelegationInput {\n    principal: SignerRef;\n    agentAddress: string;\n    scopes: string[];\n    bond?: DelegationBond | null;\n    issuedAt?: Date;\n    /** Duration from issuedAt in ms. Default 7 days. MAX 365 days per SPEC §4.4. */\n    ttlMs?: number;\n    /** Explicit expires_at overrides ttlMs. */\n    expiresAt?: Date;\n    /** 32-hex. Defaults to crypto.getRandomValues(16-byte) rendered as hex. */\n    nonce?: string;\n    /** Default ['principal']. */\n    revocationHolders?: RevocationHolder[];\n    /** Optional Nostr pointer to a revocation event. Non-cryptographic. */\n    revocationRef?: string | null;\n    /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */\n    scopeMode?: ValidationOptions['mode'];\n}\n\nexport async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {\n    if (!input.scopes || input.scopes.length === 0) {\n        throw new Error('createDelegation: at least one scope is required');\n    }\n    const mode = input.scopeMode ?? 'strict';\n    for (const s of input.scopes) validateScope(parseScope(s), { mode });\n    const scopes = canonicalizeScopes(input.scopes);\n\n    const issuedAt = isoUtcSeconds(input.issuedAt ?? new Date());\n    let expiresAtDate: Date;\n    if (input.expiresAt) {\n        expiresAtDate = input.expiresAt;\n    } else {\n        const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1000;\n        expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);\n    }\n    const expiresAt = isoUtcSeconds(expiresAtDate);\n\n    const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();\n    if (durationMs <= 0) throw new Error('createDelegation: expires_at must be after issued_at');\n    if (durationMs > 365 * 24 * 60 * 60 * 1000) {\n        throw new Error('createDelegation: delegation duration must not exceed 365 days');\n    }\n\n    const nonce = input.nonce ?? randomHex(16);\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('createDelegation: nonce must be 32 lowercase hex chars');\n    }\n\n    const bond = input.bond ?? null;\n    if (bond) {\n        if (!Number.isInteger(bond.sats) || bond.sats < 0) {\n            throw new Error('createDelegation: bond.sats must be a non-negative integer');\n        }\n        if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {\n            throw new Error('createDelegation: bond.attestation_id must be 64 lowercase hex chars');\n        }\n    }\n\n    const canonInput = {\n        principal: input.principal.address,\n        agent: input.agentAddress,\n        scopes,\n        bond_sats: bond?.sats ?? 0,\n        bond_attestation: bond?.attestation_id ?? 'none',\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n    };\n    const id = computeDelegationId(canonInput);\n\n    const sigValue = await input.principal.signMessage(id);\n\n    const envelope: DelegationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-delegation',\n        id,\n        principal: { address: input.principal.address, alg: 'bip322' },\n        agent: { address: input.agentAddress, alg: 'bip322' },\n        scopes,\n        bond,\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n        revocation: {\n            holders: input.revocationHolders ?? ['principal'],\n            ref: input.revocationRef ?? null,\n        },\n        sig: {\n            alg: 'bip322',\n            pubkey: input.principal.address,\n            value: sigValue,\n        },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// signAsAgent\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignAsAgentInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Raw bytes to stamp, or a pre-computed { hash, length } pair. */\n    content: Uint8Array | { hash: string; length: number };\n    mime: string;\n    /** Which scope from delegation.scopes is being exercised (or a narrower sub-scope). */\n    scopeExercised: string;\n    ref?: string | null;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope> {\n    if (input.agent.address !== input.delegation.agent.address) {\n        throw new Error('signAsAgent: signer address does not match delegation.agent.address');\n    }\n\n    let contentHash: string;\n    let contentLength: number;\n    if (input.content instanceof Uint8Array) {\n        contentHash = 'sha256:' + hexEncode(sha256(input.content));\n        contentLength = input.content.byteLength;\n    } else {\n        if (!input.content.hash.startsWith('sha256:') || input.content.hash.length !== 'sha256:'.length + 64) {\n            throw new Error('signAsAgent: content.hash must be \"sha256:\" + 64 lowercase hex chars');\n        }\n        contentHash = input.content.hash;\n        contentLength = input.content.length;\n        if (!Number.isInteger(contentLength) || contentLength < 0) {\n            throw new Error('signAsAgent: content.length must be a non-negative integer');\n        }\n    }\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n\n    const canonInput = {\n        address: input.agent.address,\n        content_hash: contentHash,\n        content_length: contentLength,\n        content_mime: input.mime,\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n    };\n    const id = computeActionId(canonInput);\n\n    const sigValue = await input.agent.signMessage(id);\n\n    const envelope: ActionEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-action',\n        id,\n        content: {\n            hash: contentHash,\n            length: contentLength,\n            mime: input.mime,\n            ref: input.ref ?? null,\n        },\n        signer: { address: input.agent.address, alg: 'bip322' },\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.agent.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// revoke\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RevokeInput {\n    signer: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Short ASCII rationale. Defaults to empty string. */\n    reason?: string;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function revoke(input: RevokeInput): Promise<RevocationEnvelope> {\n    const holders = input.delegation.revocation?.holders ?? ['principal'];\n    const allowed = new Set<string>();\n    if (holders.includes('principal')) allowed.add(input.delegation.principal.address);\n    if (holders.includes('agent')) allowed.add(input.delegation.agent.address);\n    if (!allowed.has(input.signer.address)) {\n        throw new Error(\n            `revoke: signer ${input.signer.address} not authorized to revoke this delegation`\n        );\n    }\n\n    const reason = input.reason ?? '';\n    if (reason.length > 128) throw new Error('revoke: reason must be <=128 bytes');\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n    const canonInput = {\n        address: input.signer.address,\n        delegation_id: input.delegation.id,\n        reason,\n        signed_at: signedAt,\n    };\n    const id = computeRevocationId(canonInput);\n\n    const sigValue = await input.signer.signMessage(id);\n\n    const envelope: RevocationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-revocation',\n        id,\n        delegation_id: input.delegation.id,\n        signer: { address: input.signer.address, alg: 'bip322' },\n        reason,\n        signed_at: signedAt,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.signer.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Re-exports for convenience\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    verifyAction,\n    verifyDelegation,\n    verifyRevocation,\n    parseScope,\n    isSubScope,\n    canonicalizeScope,\n    REGISTERED_SCOPES,\n} from '@orangecheck/agent-core';\nexport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    Scope,\n    ScopeConstraint,\n    AgentErrorCode,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction isoUtcSeconds(d: Date): string {\n    return d.toISOString().replace(/\\.\\d+Z$/, 'Z');\n}\n\nfunction randomHex(bytes: number): string {\n    const buf = new Uint8Array(bytes);\n    const c: Crypto | undefined = (globalThis as unknown as { crypto?: Crypto }).crypto;\n    if (c && typeof c.getRandomValues === 'function') {\n        c.getRandomValues(buf);\n    } else {\n        // Non-browser fallback. Node ≥18 exposes globalThis.crypto, so this is unlikely to fire.\n        for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);\n    }\n    let out = '';\n    for (let i = 0; i < bytes; i++) {\n        const b = buf[i]!;\n        out += b.toString(16).padStart(2, '0');\n    }\n    return out;\n}\n"]}

package/dist/index.mjs

@@ -0,0 +1,180 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { validateScope, parseScope, canonicalizeScopes, computeDelegationId, ENVELOPE_VERSION, hexEncode, computeActionId, computeRevocationId } from '@orangecheck/agent-core';
+export { REGISTERED_SCOPES, canonicalizeScope, canonicalizeScopes, computeActionId, computeDelegationId, computeRevocationId, isSubScope, parseScope, verifyAction, verifyDelegation, verifyRevocation } from '@orangecheck/agent-core';
+
+// src/index.ts
+async function createDelegation(input) {
+  if (!input.scopes || input.scopes.length === 0) {
+    throw new Error("createDelegation: at least one scope is required");
+  }
+  const mode = input.scopeMode ?? "strict";
+  for (const s of input.scopes) validateScope(parseScope(s), { mode });
+  const scopes = canonicalizeScopes(input.scopes);
+  const issuedAt = isoUtcSeconds(input.issuedAt ?? /* @__PURE__ */ new Date());
+  let expiresAtDate;
+  if (input.expiresAt) {
+    expiresAtDate = input.expiresAt;
+  } else {
+    const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1e3;
+    expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);
+  }
+  const expiresAt = isoUtcSeconds(expiresAtDate);
+  const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();
+  if (durationMs <= 0) throw new Error("createDelegation: expires_at must be after issued_at");
+  if (durationMs > 365 * 24 * 60 * 60 * 1e3) {
+    throw new Error("createDelegation: delegation duration must not exceed 365 days");
+  }
+  const nonce = input.nonce ?? randomHex(16);
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    throw new Error("createDelegation: nonce must be 32 lowercase hex chars");
+  }
+  const bond = input.bond ?? null;
+  if (bond) {
+    if (!Number.isInteger(bond.sats) || bond.sats < 0) {
+      throw new Error("createDelegation: bond.sats must be a non-negative integer");
+    }
+    if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {
+      throw new Error("createDelegation: bond.attestation_id must be 64 lowercase hex chars");
+    }
+  }
+  const canonInput = {
+    principal: input.principal.address,
+    agent: input.agentAddress,
+    scopes,
+    bond_sats: bond?.sats ?? 0,
+    bond_attestation: bond?.attestation_id ?? "none",
+    issued_at: issuedAt,
+    expires_at: expiresAt,
+    nonce
+  };
+  const id = computeDelegationId(canonInput);
+  const sigValue = await input.principal.signMessage(id);
+  const envelope = {
+    v: ENVELOPE_VERSION,
+    kind: "agent-delegation",
+    id,
+    principal: { address: input.principal.address, alg: "bip322" },
+    agent: { address: input.agentAddress, alg: "bip322" },
+    scopes,
+    bond,
+    issued_at: issuedAt,
+    expires_at: expiresAt,
+    nonce,
+    revocation: {
+      holders: input.revocationHolders ?? ["principal"],
+      ref: input.revocationRef ?? null
+    },
+    sig: {
+      alg: "bip322",
+      pubkey: input.principal.address,
+      value: sigValue
+    }
+  };
+  return envelope;
+}
+async function signAsAgent(input) {
+  if (input.agent.address !== input.delegation.agent.address) {
+    throw new Error("signAsAgent: signer address does not match delegation.agent.address");
+  }
+  let contentHash;
+  let contentLength;
+  if (input.content instanceof Uint8Array) {
+    contentHash = "sha256:" + hexEncode(sha256(input.content));
+    contentLength = input.content.byteLength;
+  } else {
+    if (!input.content.hash.startsWith("sha256:") || input.content.hash.length !== "sha256:".length + 64) {
+      throw new Error('signAsAgent: content.hash must be "sha256:" + 64 lowercase hex chars');
+    }
+    contentHash = input.content.hash;
+    contentLength = input.content.length;
+    if (!Number.isInteger(contentLength) || contentLength < 0) {
+      throw new Error("signAsAgent: content.length must be a non-negative integer");
+    }
+  }
+  const signedAt = isoUtcSeconds(input.signedAt ?? /* @__PURE__ */ new Date());
+  const canonInput = {
+    address: input.agent.address,
+    content_hash: contentHash,
+    content_length: contentLength,
+    content_mime: input.mime,
+    signed_at: signedAt,
+    delegation_id: input.delegation.id,
+    scope_exercised: input.scopeExercised
+  };
+  const id = computeActionId(canonInput);
+  const sigValue = await input.agent.signMessage(id);
+  const envelope = {
+    v: ENVELOPE_VERSION,
+    kind: "agent-action",
+    id,
+    content: {
+      hash: contentHash,
+      length: contentLength,
+      mime: input.mime,
+      ref: input.ref ?? null
+    },
+    signer: { address: input.agent.address, alg: "bip322" },
+    signed_at: signedAt,
+    delegation_id: input.delegation.id,
+    scope_exercised: input.scopeExercised,
+    ots: input.ots ?? null,
+    sig: { alg: "bip322", pubkey: input.agent.address, value: sigValue }
+  };
+  return envelope;
+}
+async function revoke(input) {
+  const holders = input.delegation.revocation?.holders ?? ["principal"];
+  const allowed = /* @__PURE__ */ new Set();
+  if (holders.includes("principal")) allowed.add(input.delegation.principal.address);
+  if (holders.includes("agent")) allowed.add(input.delegation.agent.address);
+  if (!allowed.has(input.signer.address)) {
+    throw new Error(
+      `revoke: signer ${input.signer.address} not authorized to revoke this delegation`
+    );
+  }
+  const reason = input.reason ?? "";
+  if (reason.length > 128) throw new Error("revoke: reason must be <=128 bytes");
+  const signedAt = isoUtcSeconds(input.signedAt ?? /* @__PURE__ */ new Date());
+  const canonInput = {
+    address: input.signer.address,
+    delegation_id: input.delegation.id,
+    reason,
+    signed_at: signedAt
+  };
+  const id = computeRevocationId(canonInput);
+  const sigValue = await input.signer.signMessage(id);
+  const envelope = {
+    v: ENVELOPE_VERSION,
+    kind: "agent-revocation",
+    id,
+    delegation_id: input.delegation.id,
+    signer: { address: input.signer.address, alg: "bip322" },
+    reason,
+    signed_at: signedAt,
+    ots: input.ots ?? null,
+    sig: { alg: "bip322", pubkey: input.signer.address, value: sigValue }
+  };
+  return envelope;
+}
+function isoUtcSeconds(d) {
+  return d.toISOString().replace(/\.\d+Z$/, "Z");
+}
+function randomHex(bytes) {
+  const buf = new Uint8Array(bytes);
+  const c = globalThis.crypto;
+  if (c && typeof c.getRandomValues === "function") {
+    c.getRandomValues(buf);
+  } else {
+    for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);
+  }
+  let out = "";
+  for (let i = 0; i < bytes; i++) {
+    const b = buf[i];
+    out += b.toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
+export { createDelegation, revoke, signAsAgent };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;AAkEA,eAAsB,iBAAiB,KAAA,EAA2D;AAC9F,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,MAAA,CAAO,WAAW,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,IAAa,QAAA;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,MAAA,EAAQ,aAAA,CAAc,WAAW,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AACnE,EAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,KAAA,CAAM,MAAM,CAAA;AAE9C,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,MAAM,SAAA,EAAW;AACjB,IAAA,aAAA,GAAgB,KAAA,CAAM,SAAA;AAAA,EAC1B,CAAA,MAAO;AACH,IAAA,MAAM,MAAM,KAAA,CAAM,KAAA,IAAS,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,GAAA;AAC9C,IAAA,aAAA,GAAgB,IAAI,KAAK,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,KAAY,GAAG,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,SAAA,GAAY,cAAc,aAAa,CAAA;AAE7C,EAAA,MAAM,UAAA,GAAa,IAAI,IAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ,GAAI,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAC9E,EAAA,IAAI,UAAA,IAAc,CAAA,EAAG,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAC3F,EAAA,IAAI,UAAA,GAAa,GAAA,GAAM,EAAA,GAAK,EAAA,GAAK,KAAK,GAAA,EAAM;AACxC,IAAA,MAAM,IAAI,MAAM,gEAAgE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,SAAA,CAAU,EAAE,CAAA;AACzC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAC3B,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AAAA,EACJ;AAEA,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,SAAA,EAAW,MAAM,SAAA,CAAU,OAAA;AAAA,IAC3B,OAAO,KAAA,CAAM,YAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,MAAM,IAAA,IAAQ,CAAA;AAAA,IACzB,gBAAA,EAAkB,MAAM,cAAA,IAAkB,MAAA;AAAA,IAC1C,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,CAAU,YAAY,EAAE,CAAA;AAErD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,WAAW,EAAE,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IAC7D,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,YAAA,EAAc,KAAK,QAAA,EAAS;AAAA,IACpD,MAAA;AAAA,IACA,IAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ,KAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACR,OAAA,EAAS,KAAA,CAAM,iBAAA,IAAqB,CAAC,WAAW,CAAA;AAAA,MAChD,GAAA,EAAK,MAAM,aAAA,IAAiB;AAAA,KAChC;AAAA,IACA,GAAA,EAAK;AAAA,MACD,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,MAAM,SAAA,CAAU,OAAA;AAAA,MACxB,KAAA,EAAO;AAAA;AACX,GACJ;AACA,EAAA,OAAO,QAAA;AACX;AAoBA,eAAsB,YAAY,KAAA,EAAkD;AAChF,EAAA,IAAI,MAAM,KAAA,CAAM,OAAA,KAAY,KAAA,CAAM,UAAA,CAAW,MAAM,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,KAAA,CAAM,mBAAmB,UAAA,EAAY;AACrC,IAAA,WAAA,GAAc,SAAA,GAAY,SAAA,CAAU,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AACzD,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,UAAA;AAAA,EAClC,CAAA,MAAO;AACH,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAA,KAAW,SAAA,CAAU,SAAS,EAAA,EAAI;AAClG,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AACA,IAAA,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA;AAC5B,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,MAAA;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAAK,gBAAgB,CAAA,EAAG;AACvD,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AAAA,EACJ;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA;AAAA,IACrB,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,cAAc,KAAA,CAAM,IAAA;AAAA,IACpB,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM;AAAA,GAC3B;AACA,EAAA,MAAM,EAAA,GAAK,gBAAgB,UAAU,CAAA;AAErC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,YAAY,EAAE,CAAA;AAEjD,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC7B,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,cAAA;AAAA,IACN,EAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,MAAA,EAAQ,aAAA;AAAA,MACR,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,GAAA,EAAK,MAAM,GAAA,IAAO;AAAA,KACtB;AAAA,IACA,QAAQ,EAAE,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACtD,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM,cAAA;AAAA,IACvB,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACvE;AACA,EAAA,OAAO,QAAA;AACX;AAgBA,eAAsB,OAAO,KAAA,EAAiD;AAC1E,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,CAAW,UAAA,EAAY,OAAA,IAAW,CAAC,WAAW,CAAA;AACpE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAW,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAO,CAAA;AACjF,EAAA,IAAI,OAAA,CAAQ,SAAS,OAAO,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACzE,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,yCAAA;AAAA,KAC1C;AAAA,EACJ;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,GAAA,EAAK,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAE7E,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA;AAAA,IACtB,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,MAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACf;AACA,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,YAAY,EAAE,CAAA;AAElD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,QAAQ,EAAE,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACvD,MAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACxE;AACA,EAAA,OAAO,QAAA;AACX;AAkCA,SAAS,cAAc,CAAA,EAAiB;AACpC,EAAA,OAAO,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,WAAW,GAAG,CAAA;AACjD;AAEA,SAAS,UAAU,KAAA,EAAuB;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,MAAM,IAAyB,UAAA,CAA8C,MAAA;AAC7E,EAAA,IAAI,CAAA,IAAK,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAA,EAAY;AAC9C,IAAA,CAAA,CAAE,gBAAgB,GAAG,CAAA;AAAA,EACzB,CAAA,MAAO;AAEH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AACf,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,GAAA;AACX","file":"index.mjs","sourcesContent":["// @orangecheck/agent-signer — high-level API for producing OC Agent envelopes.\n//\n//   createDelegation  — principal signs a scoped grant to an agent address.\n//   signAsAgent       — agent produces an agent-action envelope over content.\n//   revoke            — principal (or agent, if authorized) burns a delegation.\n//\n// Each function wraps @orangecheck/agent-core's canonical-message + id\n// computation with a caller-supplied `signMessage` wallet adapter. Nothing here\n// touches the network — OTS anchoring and Nostr publication are separate steps\n// the caller wires up.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    ENVELOPE_VERSION,\n    hexEncode,\n    parseScope,\n    validateScope,\n} from '@orangecheck/agent-core';\nimport type { ValidationOptions } from '@orangecheck/agent-core';\nimport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    RevocationHolder,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shared wallet-adapter shape (matches `@orangecheck/stamp-core` StampInput).\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignerRef {\n    address: string;\n    /** Returns a base64 BIP-322 signature over the given message as UTF-8 bytes. */\n    signMessage: (msg: string) => Promise<string>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// createDelegation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface CreateDelegationInput {\n    principal: SignerRef;\n    agentAddress: string;\n    scopes: string[];\n    bond?: DelegationBond | null;\n    issuedAt?: Date;\n    /** Duration from issuedAt in ms. Default 7 days. MAX 365 days per SPEC §4.4. */\n    ttlMs?: number;\n    /** Explicit expires_at overrides ttlMs. */\n    expiresAt?: Date;\n    /** 32-hex. Defaults to crypto.getRandomValues(16-byte) rendered as hex. */\n    nonce?: string;\n    /** Default ['principal']. */\n    revocationHolders?: RevocationHolder[];\n    /** Optional Nostr pointer to a revocation event. Non-cryptographic. */\n    revocationRef?: string | null;\n    /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */\n    scopeMode?: ValidationOptions['mode'];\n}\n\nexport async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {\n    if (!input.scopes || input.scopes.length === 0) {\n        throw new Error('createDelegation: at least one scope is required');\n    }\n    const mode = input.scopeMode ?? 'strict';\n    for (const s of input.scopes) validateScope(parseScope(s), { mode });\n    const scopes = canonicalizeScopes(input.scopes);\n\n    const issuedAt = isoUtcSeconds(input.issuedAt ?? new Date());\n    let expiresAtDate: Date;\n    if (input.expiresAt) {\n        expiresAtDate = input.expiresAt;\n    } else {\n        const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1000;\n        expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);\n    }\n    const expiresAt = isoUtcSeconds(expiresAtDate);\n\n    const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();\n    if (durationMs <= 0) throw new Error('createDelegation: expires_at must be after issued_at');\n    if (durationMs > 365 * 24 * 60 * 60 * 1000) {\n        throw new Error('createDelegation: delegation duration must not exceed 365 days');\n    }\n\n    const nonce = input.nonce ?? randomHex(16);\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('createDelegation: nonce must be 32 lowercase hex chars');\n    }\n\n    const bond = input.bond ?? null;\n    if (bond) {\n        if (!Number.isInteger(bond.sats) || bond.sats < 0) {\n            throw new Error('createDelegation: bond.sats must be a non-negative integer');\n        }\n        if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {\n            throw new Error('createDelegation: bond.attestation_id must be 64 lowercase hex chars');\n        }\n    }\n\n    const canonInput = {\n        principal: input.principal.address,\n        agent: input.agentAddress,\n        scopes,\n        bond_sats: bond?.sats ?? 0,\n        bond_attestation: bond?.attestation_id ?? 'none',\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n    };\n    const id = computeDelegationId(canonInput);\n\n    const sigValue = await input.principal.signMessage(id);\n\n    const envelope: DelegationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-delegation',\n        id,\n        principal: { address: input.principal.address, alg: 'bip322' },\n        agent: { address: input.agentAddress, alg: 'bip322' },\n        scopes,\n        bond,\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n        revocation: {\n            holders: input.revocationHolders ?? ['principal'],\n            ref: input.revocationRef ?? null,\n        },\n        sig: {\n            alg: 'bip322',\n            pubkey: input.principal.address,\n            value: sigValue,\n        },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// signAsAgent\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignAsAgentInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Raw bytes to stamp, or a pre-computed { hash, length } pair. */\n    content: Uint8Array | { hash: string; length: number };\n    mime: string;\n    /** Which scope from delegation.scopes is being exercised (or a narrower sub-scope). */\n    scopeExercised: string;\n    ref?: string | null;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope> {\n    if (input.agent.address !== input.delegation.agent.address) {\n        throw new Error('signAsAgent: signer address does not match delegation.agent.address');\n    }\n\n    let contentHash: string;\n    let contentLength: number;\n    if (input.content instanceof Uint8Array) {\n        contentHash = 'sha256:' + hexEncode(sha256(input.content));\n        contentLength = input.content.byteLength;\n    } else {\n        if (!input.content.hash.startsWith('sha256:') || input.content.hash.length !== 'sha256:'.length + 64) {\n            throw new Error('signAsAgent: content.hash must be \"sha256:\" + 64 lowercase hex chars');\n        }\n        contentHash = input.content.hash;\n        contentLength = input.content.length;\n        if (!Number.isInteger(contentLength) || contentLength < 0) {\n            throw new Error('signAsAgent: content.length must be a non-negative integer');\n        }\n    }\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n\n    const canonInput = {\n        address: input.agent.address,\n        content_hash: contentHash,\n        content_length: contentLength,\n        content_mime: input.mime,\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n    };\n    const id = computeActionId(canonInput);\n\n    const sigValue = await input.agent.signMessage(id);\n\n    const envelope: ActionEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-action',\n        id,\n        content: {\n            hash: contentHash,\n            length: contentLength,\n            mime: input.mime,\n            ref: input.ref ?? null,\n        },\n        signer: { address: input.agent.address, alg: 'bip322' },\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.agent.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// revoke\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RevokeInput {\n    signer: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Short ASCII rationale. Defaults to empty string. */\n    reason?: string;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function revoke(input: RevokeInput): Promise<RevocationEnvelope> {\n    const holders = input.delegation.revocation?.holders ?? ['principal'];\n    const allowed = new Set<string>();\n    if (holders.includes('principal')) allowed.add(input.delegation.principal.address);\n    if (holders.includes('agent')) allowed.add(input.delegation.agent.address);\n    if (!allowed.has(input.signer.address)) {\n        throw new Error(\n            `revoke: signer ${input.signer.address} not authorized to revoke this delegation`\n        );\n    }\n\n    const reason = input.reason ?? '';\n    if (reason.length > 128) throw new Error('revoke: reason must be <=128 bytes');\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n    const canonInput = {\n        address: input.signer.address,\n        delegation_id: input.delegation.id,\n        reason,\n        signed_at: signedAt,\n    };\n    const id = computeRevocationId(canonInput);\n\n    const sigValue = await input.signer.signMessage(id);\n\n    const envelope: RevocationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-revocation',\n        id,\n        delegation_id: input.delegation.id,\n        signer: { address: input.signer.address, alg: 'bip322' },\n        reason,\n        signed_at: signedAt,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.signer.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Re-exports for convenience\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    verifyAction,\n    verifyDelegation,\n    verifyRevocation,\n    parseScope,\n    isSubScope,\n    canonicalizeScope,\n    REGISTERED_SCOPES,\n} from '@orangecheck/agent-core';\nexport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    Scope,\n    ScopeConstraint,\n    AgentErrorCode,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction isoUtcSeconds(d: Date): string {\n    return d.toISOString().replace(/\\.\\d+Z$/, 'Z');\n}\n\nfunction randomHex(bytes: number): string {\n    const buf = new Uint8Array(bytes);\n    const c: Crypto | undefined = (globalThis as unknown as { crypto?: Crypto }).crypto;\n    if (c && typeof c.getRandomValues === 'function') {\n        c.getRandomValues(buf);\n    } else {\n        // Non-browser fallback. Node ≥18 exposes globalThis.crypto, so this is unlikely to fire.\n        for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);\n    }\n    let out = '';\n    for (let i = 0; i < bytes; i++) {\n        const b = buf[i]!;\n        out += b.toString(16).padStart(2, '0');\n    }\n    return out;\n}\n"]}

package/package.json

@@ -0,0 +1,60 @@
+{
+    "name": "@orangecheck/agent-signer",
+    "version": "0.1.0",
+    "description": "OC Agent signer: createDelegation(), signAsAgent(), revoke(). Composes @orangecheck/agent-core with a wallet-adapter signing function and optional OTS anchoring.",
+    "keywords": [
+        "bitcoin",
+        "agent",
+        "authority",
+        "delegation",
+        "bip322",
+        "oc-agent",
+        "orangecheck"
+    ],
+    "author": "OrangeCheck",
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/orangecheck/oc-packages.git",
+        "directory": "agent-signer"
+    },
+    "homepage": "https://github.com/orangecheck/oc-agent-protocol",
+    "bugs": {
+        "url": "https://github.com/orangecheck/oc-agent-protocol/issues"
+    },
+    "main": "./dist/index.js",
+    "module": "./dist/index.mjs",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.mjs",
+            "require": "./dist/index.js"
+        }
+    },
+    "files": [
+        "dist",
+        "src",
+        "README.md",
+        "LICENSE"
+    ],
+    "scripts": {
+        "build": "tsup",
+        "dev": "tsup --watch",
+        "type-check": "tsc --noEmit",
+        "test": "vitest run",
+        "test:watch": "vitest",
+        "clean": "rm -rf dist",
+        "prepublishOnly": "npm run clean && npm run build"
+    },
+    "dependencies": {
+        "@noble/hashes": "^1.5.0",
+        "@orangecheck/agent-core": "^0.1.0"
+    },
+    "devDependencies": {
+        "@types/node": "^22.10.2",
+        "tsup": "^8.3.5",
+        "typescript": "^5.7.2",
+        "vitest": "^3.2.4"
+    }
+}

package/src/index.test.ts

@@ -0,0 +1,185 @@
+import { describe, expect, it } from 'vitest';
+
+import { verifyAction, verifyDelegation, verifyRevocation } from '@orangecheck/agent-core';
+
+import { createDelegation, revoke, signAsAgent } from './index.js';
+
+// Fake BIP-322 signer/verifier: the signer just base64-encodes "sig:<address>:<hex(msg)>",
+// and the verifier confirms the pattern. This is enough to exercise the envelope
+// plumbing; real signatures need a wallet-adapter.
+const fakeSign = (address: string) => async (msg: string) => {
+    const payload = `sig:${address}:${msg}`;
+    return Buffer.from(payload, 'utf8').toString('base64');
+};
+const fakeVerify = async (msg: string, sig: string, address: string) => {
+    const expected = Buffer.from(`sig:${address}:${msg}`, 'utf8').toString('base64');
+    return sig === expected;
+};
+
+const PRINCIPAL = 'bc1qprincipal000000000000000000000000000000';
+const AGENT = 'bc1qagent0000000000000000000000000000000000';
+
+describe('createDelegation', () => {
+    it('produces a delegation envelope that verifies', async () => {
+        const envelope = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['lock:seal(recipient=bc1qalice000000000000000000000000000000000)'],
+            ttlMs: 24 * 60 * 60 * 1000,
+        });
+        expect(envelope.kind).toBe('agent-delegation');
+        expect(envelope.id).toMatch(/^[0-9a-f]{64}$/);
+        expect(envelope.scopes).toHaveLength(1);
+
+        const r = await verifyDelegation({ envelope, verifyBip322: fakeVerify });
+        expect(r.ok).toBe(true);
+    });
+
+    it('rejects unregistered scopes by default (strict)', async () => {
+        await expect(
+            createDelegation({
+                principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+                agentAddress: AGENT,
+                scopes: ['made_up:scope'],
+                ttlMs: 60_000,
+            })
+        ).rejects.toThrow();
+    });
+
+    it('throws when scopes is empty', async () => {
+        await expect(
+            createDelegation({
+                principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+                agentAddress: AGENT,
+                scopes: [],
+            })
+        ).rejects.toThrow(/at least one scope/);
+    });
+
+    it('normalizes nonce default and scope order', async () => {
+        const env = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['stamp:sign(mime=text/markdown)', 'lock:seal(recipient=bc1qalice000000000000000000000000000000000)'],
+            ttlMs: 60_000,
+        });
+        expect(env.scopes[0]!.startsWith('lock:')).toBe(true);
+        expect(/^[0-9a-f]{32}$/.test(env.nonce)).toBe(true);
+    });
+});
+
+describe('signAsAgent', () => {
+    it('produces an action that verifies against its delegation', async () => {
+        const delegation = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['lock:seal(recipient=bc1qalice000000000000000000000000000000000)'],
+            ttlMs: 60 * 60 * 1000,
+        });
+
+        const content = new TextEncoder().encode('hello agent');
+        const action = await signAsAgent({
+            agent: { address: AGENT, signMessage: fakeSign(AGENT) },
+            delegation,
+            content,
+            mime: 'text/plain',
+            scopeExercised: 'lock:seal(recipient=bc1qalice000000000000000000000000000000000)',
+        });
+        expect(action.kind).toBe('agent-action');
+        expect(action.delegation_id).toBe(delegation.id);
+
+        const r = await verifyAction({
+            action,
+            delegation,
+            verifyBip322: fakeVerify,
+        });
+        expect(r.ok).toBe(true);
+    });
+
+    it('rejects when signer address does not match delegation.agent', async () => {
+        const delegation = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['stamp:sign(mime=text/markdown)'],
+            ttlMs: 60_000,
+        });
+        await expect(
+            signAsAgent({
+                agent: { address: 'bc1qotheragent', signMessage: fakeSign('bc1qotheragent') },
+                delegation,
+                content: new Uint8Array([1, 2, 3]),
+                mime: 'text/plain',
+                scopeExercised: 'stamp:sign(mime=text/markdown)',
+            })
+        ).rejects.toThrow(/delegation.agent/);
+    });
+
+    it('fails verification when exercised scope is not a sub-scope', async () => {
+        const delegation = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['stamp:sign(mime=text/markdown)'],
+            ttlMs: 60 * 60 * 1000,
+        });
+        const action = await signAsAgent({
+            agent: { address: AGENT, signMessage: fakeSign(AGENT) },
+            delegation,
+            content: new TextEncoder().encode('x'),
+            mime: 'application/pdf',
+            scopeExercised: 'stamp:sign(mime=application/pdf)',
+        });
+        const r = await verifyAction({ action, delegation, verifyBip322: fakeVerify });
+        expect(r.ok).toBe(false);
+        if (!r.ok) expect(r.code).toBe('E_SCOPE_DENIED');
+    });
+});
+
+describe('revoke', () => {
+    it('produces a revocation that verifies and applies to the delegation', async () => {
+        const delegation = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['lock:seal(recipient=bc1qalice000000000000000000000000000000000)'],
+            ttlMs: 60 * 60 * 1000,
+        });
+        const rev = await revoke({
+            signer: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            delegation,
+            reason: 'key rotated',
+        });
+        const r = await verifyRevocation({ envelope: rev, delegation, verifyBip322: fakeVerify });
+        expect(r.ok).toBe(true);
+    });
+
+    it('rejects a revocation from an unauthorized signer', async () => {
+        const delegation = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['stamp:sign(mime=text/markdown)'],
+            ttlMs: 60_000,
+        });
+        await expect(
+            revoke({
+                signer: { address: AGENT, signMessage: fakeSign(AGENT) },
+                delegation, // revocation.holders default = ['principal']
+            })
+        ).rejects.toThrow(/not authorized/);
+    });
+
+    it('allows agent revocation when delegation opts in', async () => {
+        const delegation = await createDelegation({
+            principal: { address: PRINCIPAL, signMessage: fakeSign(PRINCIPAL) },
+            agentAddress: AGENT,
+            scopes: ['stamp:sign(mime=text/markdown)'],
+            ttlMs: 60_000,
+            revocationHolders: ['principal', 'agent'],
+        });
+        const rev = await revoke({
+            signer: { address: AGENT, signMessage: fakeSign(AGENT) },
+            delegation,
+            reason: 'self-revoke',
+        });
+        const r = await verifyRevocation({ envelope: rev, delegation, verifyBip322: fakeVerify });
+        expect(r.ok).toBe(true);
+    });
+});

package/src/index.ts

@@ -0,0 +1,322 @@
+// @orangecheck/agent-signer — high-level API for producing OC Agent envelopes.
+//
+//   createDelegation  — principal signs a scoped grant to an agent address.
+//   signAsAgent       — agent produces an agent-action envelope over content.
+//   revoke            — principal (or agent, if authorized) burns a delegation.
+//
+// Each function wraps @orangecheck/agent-core's canonical-message + id
+// computation with a caller-supplied `signMessage` wallet adapter. Nothing here
+// touches the network — OTS anchoring and Nostr publication are separate steps
+// the caller wires up.
+
+import { sha256 } from '@noble/hashes/sha256';
+import {
+    canonicalizeScopes,
+    computeActionId,
+    computeDelegationId,
+    computeRevocationId,
+    ENVELOPE_VERSION,
+    hexEncode,
+    parseScope,
+    validateScope,
+} from '@orangecheck/agent-core';
+import type { ValidationOptions } from '@orangecheck/agent-core';
+import type {
+    ActionEnvelope,
+    ActionOts,
+    DelegationBond,
+    DelegationEnvelope,
+    RevocationEnvelope,
+    RevocationHolder,
+} from '@orangecheck/agent-core';
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Shared wallet-adapter shape (matches `@orangecheck/stamp-core` StampInput).
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface SignerRef {
+    address: string;
+    /** Returns a base64 BIP-322 signature over the given message as UTF-8 bytes. */
+    signMessage: (msg: string) => Promise<string>;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// createDelegation
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface CreateDelegationInput {
+    principal: SignerRef;
+    agentAddress: string;
+    scopes: string[];
+    bond?: DelegationBond | null;
+    issuedAt?: Date;
+    /** Duration from issuedAt in ms. Default 7 days. MAX 365 days per SPEC §4.4. */
+    ttlMs?: number;
+    /** Explicit expires_at overrides ttlMs. */
+    expiresAt?: Date;
+    /** 32-hex. Defaults to crypto.getRandomValues(16-byte) rendered as hex. */
+    nonce?: string;
+    /** Default ['principal']. */
+    revocationHolders?: RevocationHolder[];
+    /** Optional Nostr pointer to a revocation event. Non-cryptographic. */
+    revocationRef?: string | null;
+    /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */
+    scopeMode?: ValidationOptions['mode'];
+}
+
+export async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {
+    if (!input.scopes || input.scopes.length === 0) {
+        throw new Error('createDelegation: at least one scope is required');
+    }
+    const mode = input.scopeMode ?? 'strict';
+    for (const s of input.scopes) validateScope(parseScope(s), { mode });
+    const scopes = canonicalizeScopes(input.scopes);
+
+    const issuedAt = isoUtcSeconds(input.issuedAt ?? new Date());
+    let expiresAtDate: Date;
+    if (input.expiresAt) {
+        expiresAtDate = input.expiresAt;
+    } else {
+        const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1000;
+        expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);
+    }
+    const expiresAt = isoUtcSeconds(expiresAtDate);
+
+    const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();
+    if (durationMs <= 0) throw new Error('createDelegation: expires_at must be after issued_at');
+    if (durationMs > 365 * 24 * 60 * 60 * 1000) {
+        throw new Error('createDelegation: delegation duration must not exceed 365 days');
+    }
+
+    const nonce = input.nonce ?? randomHex(16);
+    if (!/^[0-9a-f]{32}$/.test(nonce)) {
+        throw new Error('createDelegation: nonce must be 32 lowercase hex chars');
+    }
+
+    const bond = input.bond ?? null;
+    if (bond) {
+        if (!Number.isInteger(bond.sats) || bond.sats < 0) {
+            throw new Error('createDelegation: bond.sats must be a non-negative integer');
+        }
+        if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {
+            throw new Error('createDelegation: bond.attestation_id must be 64 lowercase hex chars');
+        }
+    }
+
+    const canonInput = {
+        principal: input.principal.address,
+        agent: input.agentAddress,
+        scopes,
+        bond_sats: bond?.sats ?? 0,
+        bond_attestation: bond?.attestation_id ?? 'none',
+        issued_at: issuedAt,
+        expires_at: expiresAt,
+        nonce,
+    };
+    const id = computeDelegationId(canonInput);
+
+    const sigValue = await input.principal.signMessage(id);
+
+    const envelope: DelegationEnvelope = {
+        v: ENVELOPE_VERSION,
+        kind: 'agent-delegation',
+        id,
+        principal: { address: input.principal.address, alg: 'bip322' },
+        agent: { address: input.agentAddress, alg: 'bip322' },
+        scopes,
+        bond,
+        issued_at: issuedAt,
+        expires_at: expiresAt,
+        nonce,
+        revocation: {
+            holders: input.revocationHolders ?? ['principal'],
+            ref: input.revocationRef ?? null,
+        },
+        sig: {
+            alg: 'bip322',
+            pubkey: input.principal.address,
+            value: sigValue,
+        },
+    };
+    return envelope;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// signAsAgent
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface SignAsAgentInput {
+    agent: SignerRef;
+    delegation: DelegationEnvelope;
+    /** Raw bytes to stamp, or a pre-computed { hash, length } pair. */
+    content: Uint8Array | { hash: string; length: number };
+    mime: string;
+    /** Which scope from delegation.scopes is being exercised (or a narrower sub-scope). */
+    scopeExercised: string;
+    ref?: string | null;
+    signedAt?: Date;
+    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */
+    ots?: ActionOts | null;
+}
+
+export async function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope> {
+    if (input.agent.address !== input.delegation.agent.address) {
+        throw new Error('signAsAgent: signer address does not match delegation.agent.address');
+    }
+
+    let contentHash: string;
+    let contentLength: number;
+    if (input.content instanceof Uint8Array) {
+        contentHash = 'sha256:' + hexEncode(sha256(input.content));
+        contentLength = input.content.byteLength;
+    } else {
+        if (!input.content.hash.startsWith('sha256:') || input.content.hash.length !== 'sha256:'.length + 64) {
+            throw new Error('signAsAgent: content.hash must be "sha256:" + 64 lowercase hex chars');
+        }
+        contentHash = input.content.hash;
+        contentLength = input.content.length;
+        if (!Number.isInteger(contentLength) || contentLength < 0) {
+            throw new Error('signAsAgent: content.length must be a non-negative integer');
+        }
+    }
+
+    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());
+
+    const canonInput = {
+        address: input.agent.address,
+        content_hash: contentHash,
+        content_length: contentLength,
+        content_mime: input.mime,
+        signed_at: signedAt,
+        delegation_id: input.delegation.id,
+        scope_exercised: input.scopeExercised,
+    };
+    const id = computeActionId(canonInput);
+
+    const sigValue = await input.agent.signMessage(id);
+
+    const envelope: ActionEnvelope = {
+        v: ENVELOPE_VERSION,
+        kind: 'agent-action',
+        id,
+        content: {
+            hash: contentHash,
+            length: contentLength,
+            mime: input.mime,
+            ref: input.ref ?? null,
+        },
+        signer: { address: input.agent.address, alg: 'bip322' },
+        signed_at: signedAt,
+        delegation_id: input.delegation.id,
+        scope_exercised: input.scopeExercised,
+        ots: input.ots ?? null,
+        sig: { alg: 'bip322', pubkey: input.agent.address, value: sigValue },
+    };
+    return envelope;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// revoke
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface RevokeInput {
+    signer: SignerRef;
+    delegation: DelegationEnvelope;
+    /** Short ASCII rationale. Defaults to empty string. */
+    reason?: string;
+    signedAt?: Date;
+    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */
+    ots?: ActionOts | null;
+}
+
+export async function revoke(input: RevokeInput): Promise<RevocationEnvelope> {
+    const holders = input.delegation.revocation?.holders ?? ['principal'];
+    const allowed = new Set<string>();
+    if (holders.includes('principal')) allowed.add(input.delegation.principal.address);
+    if (holders.includes('agent')) allowed.add(input.delegation.agent.address);
+    if (!allowed.has(input.signer.address)) {
+        throw new Error(
+            `revoke: signer ${input.signer.address} not authorized to revoke this delegation`
+        );
+    }
+
+    const reason = input.reason ?? '';
+    if (reason.length > 128) throw new Error('revoke: reason must be <=128 bytes');
+
+    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());
+    const canonInput = {
+        address: input.signer.address,
+        delegation_id: input.delegation.id,
+        reason,
+        signed_at: signedAt,
+    };
+    const id = computeRevocationId(canonInput);
+
+    const sigValue = await input.signer.signMessage(id);
+
+    const envelope: RevocationEnvelope = {
+        v: ENVELOPE_VERSION,
+        kind: 'agent-revocation',
+        id,
+        delegation_id: input.delegation.id,
+        signer: { address: input.signer.address, alg: 'bip322' },
+        reason,
+        signed_at: signedAt,
+        ots: input.ots ?? null,
+        sig: { alg: 'bip322', pubkey: input.signer.address, value: sigValue },
+    };
+    return envelope;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Re-exports for convenience
+// ─────────────────────────────────────────────────────────────────────────────
+
+export {
+    canonicalizeScopes,
+    computeActionId,
+    computeDelegationId,
+    computeRevocationId,
+    verifyAction,
+    verifyDelegation,
+    verifyRevocation,
+    parseScope,
+    isSubScope,
+    canonicalizeScope,
+    REGISTERED_SCOPES,
+} from '@orangecheck/agent-core';
+export type {
+    ActionEnvelope,
+    ActionOts,
+    DelegationBond,
+    DelegationEnvelope,
+    RevocationEnvelope,
+    Scope,
+    ScopeConstraint,
+    AgentErrorCode,
+} from '@orangecheck/agent-core';
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Helpers
+// ─────────────────────────────────────────────────────────────────────────────
+
+function isoUtcSeconds(d: Date): string {
+    return d.toISOString().replace(/\.\d+Z$/, 'Z');
+}
+
+function randomHex(bytes: number): string {
+    const buf = new Uint8Array(bytes);
+    const c: Crypto | undefined = (globalThis as unknown as { crypto?: Crypto }).crypto;
+    if (c && typeof c.getRandomValues === 'function') {
+        c.getRandomValues(buf);
+    } else {
+        // Non-browser fallback. Node ≥18 exposes globalThis.crypto, so this is unlikely to fire.
+        for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);
+    }
+    let out = '';
+    for (let i = 0; i < bytes; i++) {
+        const b = buf[i]!;
+        out += b.toString(16).padStart(2, '0');
+    }
+    return out;
+}