@orangecheck/agent-signer 0.1.0 → 0.2.0

package/dist/index.d.mts

@@ -17,6 +17,16 @@ interface CreateDelegationInput {
     revocationHolders?: RevocationHolder[];
     revocationRef?: string | null;
     scopeMode?: ValidationOptions['mode'];
+    privateScopes?: {
+        recipients: PrivateScopeRecipient[];
+        hint?: string;
+        envelopeExpiresAt?: Date | null;
+    };
+}
+interface PrivateScopeRecipient {
+    address: string;
+    device_id: string;
+    device_pk: string;
 }
 declare function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope>;
 interface SignAsAgentInput {
@@ -42,4 +52,4 @@ interface RevokeInput {
 }
 declare function revoke(input: RevokeInput): Promise<RevocationEnvelope>;
 
-export { type CreateDelegationInput, type RevokeInput, type SignAsAgentInput, type SignerRef, createDelegation, revoke, signAsAgent };
+export { type CreateDelegationInput, type PrivateScopeRecipient, type RevokeInput, type SignAsAgentInput, type SignerRef, createDelegation, revoke, signAsAgent };

package/dist/index.d.ts

@@ -17,6 +17,16 @@ interface CreateDelegationInput {
     revocationHolders?: RevocationHolder[];
     revocationRef?: string | null;
     scopeMode?: ValidationOptions['mode'];
+    privateScopes?: {
+        recipients: PrivateScopeRecipient[];
+        hint?: string;
+        envelopeExpiresAt?: Date | null;
+    };
+}
+interface PrivateScopeRecipient {
+    address: string;
+    device_id: string;
+    device_pk: string;
 }
 declare function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope>;
 interface SignAsAgentInput {
@@ -42,4 +52,4 @@ interface RevokeInput {
 }
 declare function revoke(input: RevokeInput): Promise<RevocationEnvelope>;
 
-export { type CreateDelegationInput, type RevokeInput, type SignAsAgentInput, type SignerRef, createDelegation, revoke, signAsAgent };
+export { type CreateDelegationInput, type PrivateScopeRecipient, type RevokeInput, type SignAsAgentInput, type SignerRef, createDelegation, revoke, signAsAgent };

package/dist/index.js

@@ -49,6 +49,28 @@ async function createDelegation(input) {
     nonce
   };
   const id = agentCore.computeDelegationId(canonInput);
+  let scopesEncrypted;
+  if (input.privateScopes) {
+    if (!input.privateScopes.recipients || input.privateScopes.recipients.length === 0) {
+      throw new Error(
+        "createDelegation: privateScopes.recipients must contain at least the agent device"
+      );
+    }
+    scopesEncrypted = await agentCore.sealScopes({
+      scopes,
+      sender: {
+        address: input.principal.address,
+        signMessage: input.principal.signMessage
+      },
+      recipients: input.privateScopes.recipients,
+      ...input.privateScopes.hint !== void 0 && {
+        hint: input.privateScopes.hint
+      },
+      ...input.privateScopes.envelopeExpiresAt !== void 0 && {
+        expiresAt: input.privateScopes.envelopeExpiresAt
+      }
+    });
+  }
   const sigValue = await input.principal.signMessage(id);
   const envelope = {
     v: agentCore.ENVELOPE_VERSION,
@@ -56,7 +78,8 @@ async function createDelegation(input) {
     id,
     principal: { address: input.principal.address, alg: "bip322" },
     agent: { address: input.agentAddress, alg: "bip322" },
-    scopes,
+    // Public OR private mode — never both. PRIVATE-SCOPE.md §1.1.
+    ...scopesEncrypted ? { scopes_encrypted: scopesEncrypted } : { scopes },
     bond,
     issued_at: issuedAt,
     expires_at: expiresAt,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["validateScope","parseScope","canonicalizeScopes","computeDelegationId","ENVELOPE_VERSION","hexEncode","sha256","computeActionId","computeRevocationId"],"mappings":";;;;;;AAkEA,eAAsB,iBAAiB,KAAA,EAA2D;AAC9F,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,MAAA,CAAO,WAAW,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,IAAa,QAAA;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,MAAA,EAAQA,uBAAA,CAAcC,qBAAW,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AACnE,EAAA,MAAM,MAAA,GAASC,4BAAA,CAAmB,KAAA,CAAM,MAAM,CAAA;AAE9C,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,MAAM,SAAA,EAAW;AACjB,IAAA,aAAA,GAAgB,KAAA,CAAM,SAAA;AAAA,EAC1B,CAAA,MAAO;AACH,IAAA,MAAM,MAAM,KAAA,CAAM,KAAA,IAAS,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,GAAA;AAC9C,IAAA,aAAA,GAAgB,IAAI,KAAK,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,KAAY,GAAG,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,SAAA,GAAY,cAAc,aAAa,CAAA;AAE7C,EAAA,MAAM,UAAA,GAAa,IAAI,IAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ,GAAI,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAC9E,EAAA,IAAI,UAAA,IAAc,CAAA,EAAG,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAC3F,EAAA,IAAI,UAAA,GAAa,GAAA,GAAM,EAAA,GAAK,EAAA,GAAK,KAAK,GAAA,EAAM;AACxC,IAAA,MAAM,IAAI,MAAM,gEAAgE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,SAAA,CAAU,EAAE,CAAA;AACzC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAC3B,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AAAA,EACJ;AAEA,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,SAAA,EAAW,MAAM,SAAA,CAAU,OAAA;AAAA,IAC3B,OAAO,KAAA,CAAM,YAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,MAAM,IAAA,IAAQ,CAAA;AAAA,IACzB,gBAAA,EAAkB,MAAM,cAAA,IAAkB,MAAA;AAAA,IAC1C,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAKC,8BAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,CAAU,YAAY,EAAE,CAAA;AAErD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAGC,0BAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,WAAW,EAAE,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IAC7D,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,YAAA,EAAc,KAAK,QAAA,EAAS;AAAA,IACpD,MAAA;AAAA,IACA,IAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ,KAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACR,OAAA,EAAS,KAAA,CAAM,iBAAA,IAAqB,CAAC,WAAW,CAAA;AAAA,MAChD,GAAA,EAAK,MAAM,aAAA,IAAiB;AAAA,KAChC;AAAA,IACA,GAAA,EAAK;AAAA,MACD,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,MAAM,SAAA,CAAU,OAAA;AAAA,MACxB,KAAA,EAAO;AAAA;AACX,GACJ;AACA,EAAA,OAAO,QAAA;AACX;AAoBA,eAAsB,YAAY,KAAA,EAAkD;AAChF,EAAA,IAAI,MAAM,KAAA,CAAM,OAAA,KAAY,KAAA,CAAM,UAAA,CAAW,MAAM,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,KAAA,CAAM,mBAAmB,UAAA,EAAY;AACrC,IAAA,WAAA,GAAc,SAAA,GAAYC,mBAAA,CAAUC,aAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AACzD,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,UAAA;AAAA,EAClC,CAAA,MAAO;AACH,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAA,KAAW,SAAA,CAAU,SAAS,EAAA,EAAI;AAClG,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AACA,IAAA,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA;AAC5B,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,MAAA;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAAK,gBAAgB,CAAA,EAAG;AACvD,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AAAA,EACJ;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA;AAAA,IACrB,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,cAAc,KAAA,CAAM,IAAA;AAAA,IACpB,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM;AAAA,GAC3B;AACA,EAAA,MAAM,EAAA,GAAKC,0BAAgB,UAAU,CAAA;AAErC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,YAAY,EAAE,CAAA;AAEjD,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC7B,CAAA,EAAGH,0BAAA;AAAA,IACH,IAAA,EAAM,cAAA;AAAA,IACN,EAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,MAAA,EAAQ,aAAA;AAAA,MACR,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,GAAA,EAAK,MAAM,GAAA,IAAO;AAAA,KACtB;AAAA,IACA,QAAQ,EAAE,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACtD,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM,cAAA;AAAA,IACvB,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACvE;AACA,EAAA,OAAO,QAAA;AACX;AAgBA,eAAsB,OAAO,KAAA,EAAiD;AAC1E,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,CAAW,UAAA,EAAY,OAAA,IAAW,CAAC,WAAW,CAAA;AACpE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAW,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAO,CAAA;AACjF,EAAA,IAAI,OAAA,CAAQ,SAAS,OAAO,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACzE,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,yCAAA;AAAA,KAC1C;AAAA,EACJ;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,GAAA,EAAK,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAE7E,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA;AAAA,IACtB,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,MAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACf;AACA,EAAA,MAAM,EAAA,GAAKI,8BAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,YAAY,EAAE,CAAA;AAElD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAGJ,0BAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,QAAQ,EAAE,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACvD,MAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACxE;AACA,EAAA,OAAO,QAAA;AACX;AAkCA,SAAS,cAAc,CAAA,EAAiB;AACpC,EAAA,OAAO,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,WAAW,GAAG,CAAA;AACjD;AAEA,SAAS,UAAU,KAAA,EAAuB;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,MAAM,IAAyB,UAAA,CAA8C,MAAA;AAC7E,EAAA,IAAI,CAAA,IAAK,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAA,EAAY;AAC9C,IAAA,CAAA,CAAE,gBAAgB,GAAG,CAAA;AAAA,EACzB,CAAA,MAAO;AAEH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AACf,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,GAAA;AACX","file":"index.js","sourcesContent":["// @orangecheck/agent-signer — high-level API for producing OC Agent envelopes.\n//\n//   createDelegation  — principal signs a scoped grant to an agent address.\n//   signAsAgent       — agent produces an agent-action envelope over content.\n//   revoke            — principal (or agent, if authorized) burns a delegation.\n//\n// Each function wraps @orangecheck/agent-core's canonical-message + id\n// computation with a caller-supplied `signMessage` wallet adapter. Nothing here\n// touches the network — OTS anchoring and Nostr publication are separate steps\n// the caller wires up.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    ENVELOPE_VERSION,\n    hexEncode,\n    parseScope,\n    validateScope,\n} from '@orangecheck/agent-core';\nimport type { ValidationOptions } from '@orangecheck/agent-core';\nimport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    RevocationHolder,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shared wallet-adapter shape (matches `@orangecheck/stamp-core` StampInput).\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignerRef {\n    address: string;\n    /** Returns a base64 BIP-322 signature over the given message as UTF-8 bytes. */\n    signMessage: (msg: string) => Promise<string>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// createDelegation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface CreateDelegationInput {\n    principal: SignerRef;\n    agentAddress: string;\n    scopes: string[];\n    bond?: DelegationBond | null;\n    issuedAt?: Date;\n    /** Duration from issuedAt in ms. Default 7 days. MAX 365 days per SPEC §4.4. */\n    ttlMs?: number;\n    /** Explicit expires_at overrides ttlMs. */\n    expiresAt?: Date;\n    /** 32-hex. Defaults to crypto.getRandomValues(16-byte) rendered as hex. */\n    nonce?: string;\n    /** Default ['principal']. */\n    revocationHolders?: RevocationHolder[];\n    /** Optional Nostr pointer to a revocation event. Non-cryptographic. */\n    revocationRef?: string | null;\n    /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */\n    scopeMode?: ValidationOptions['mode'];\n}\n\nexport async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {\n    if (!input.scopes || input.scopes.length === 0) {\n        throw new Error('createDelegation: at least one scope is required');\n    }\n    const mode = input.scopeMode ?? 'strict';\n    for (const s of input.scopes) validateScope(parseScope(s), { mode });\n    const scopes = canonicalizeScopes(input.scopes);\n\n    const issuedAt = isoUtcSeconds(input.issuedAt ?? new Date());\n    let expiresAtDate: Date;\n    if (input.expiresAt) {\n        expiresAtDate = input.expiresAt;\n    } else {\n        const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1000;\n        expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);\n    }\n    const expiresAt = isoUtcSeconds(expiresAtDate);\n\n    const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();\n    if (durationMs <= 0) throw new Error('createDelegation: expires_at must be after issued_at');\n    if (durationMs > 365 * 24 * 60 * 60 * 1000) {\n        throw new Error('createDelegation: delegation duration must not exceed 365 days');\n    }\n\n    const nonce = input.nonce ?? randomHex(16);\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('createDelegation: nonce must be 32 lowercase hex chars');\n    }\n\n    const bond = input.bond ?? null;\n    if (bond) {\n        if (!Number.isInteger(bond.sats) || bond.sats < 0) {\n            throw new Error('createDelegation: bond.sats must be a non-negative integer');\n        }\n        if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {\n            throw new Error('createDelegation: bond.attestation_id must be 64 lowercase hex chars');\n        }\n    }\n\n    const canonInput = {\n        principal: input.principal.address,\n        agent: input.agentAddress,\n        scopes,\n        bond_sats: bond?.sats ?? 0,\n        bond_attestation: bond?.attestation_id ?? 'none',\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n    };\n    const id = computeDelegationId(canonInput);\n\n    const sigValue = await input.principal.signMessage(id);\n\n    const envelope: DelegationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-delegation',\n        id,\n        principal: { address: input.principal.address, alg: 'bip322' },\n        agent: { address: input.agentAddress, alg: 'bip322' },\n        scopes,\n        bond,\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n        revocation: {\n            holders: input.revocationHolders ?? ['principal'],\n            ref: input.revocationRef ?? null,\n        },\n        sig: {\n            alg: 'bip322',\n            pubkey: input.principal.address,\n            value: sigValue,\n        },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// signAsAgent\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignAsAgentInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Raw bytes to stamp, or a pre-computed { hash, length } pair. */\n    content: Uint8Array | { hash: string; length: number };\n    mime: string;\n    /** Which scope from delegation.scopes is being exercised (or a narrower sub-scope). */\n    scopeExercised: string;\n    ref?: string | null;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope> {\n    if (input.agent.address !== input.delegation.agent.address) {\n        throw new Error('signAsAgent: signer address does not match delegation.agent.address');\n    }\n\n    let contentHash: string;\n    let contentLength: number;\n    if (input.content instanceof Uint8Array) {\n        contentHash = 'sha256:' + hexEncode(sha256(input.content));\n        contentLength = input.content.byteLength;\n    } else {\n        if (!input.content.hash.startsWith('sha256:') || input.content.hash.length !== 'sha256:'.length + 64) {\n            throw new Error('signAsAgent: content.hash must be \"sha256:\" + 64 lowercase hex chars');\n        }\n        contentHash = input.content.hash;\n        contentLength = input.content.length;\n        if (!Number.isInteger(contentLength) || contentLength < 0) {\n            throw new Error('signAsAgent: content.length must be a non-negative integer');\n        }\n    }\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n\n    const canonInput = {\n        address: input.agent.address,\n        content_hash: contentHash,\n        content_length: contentLength,\n        content_mime: input.mime,\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n    };\n    const id = computeActionId(canonInput);\n\n    const sigValue = await input.agent.signMessage(id);\n\n    const envelope: ActionEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-action',\n        id,\n        content: {\n            hash: contentHash,\n            length: contentLength,\n            mime: input.mime,\n            ref: input.ref ?? null,\n        },\n        signer: { address: input.agent.address, alg: 'bip322' },\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.agent.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// revoke\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RevokeInput {\n    signer: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Short ASCII rationale. Defaults to empty string. */\n    reason?: string;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function revoke(input: RevokeInput): Promise<RevocationEnvelope> {\n    const holders = input.delegation.revocation?.holders ?? ['principal'];\n    const allowed = new Set<string>();\n    if (holders.includes('principal')) allowed.add(input.delegation.principal.address);\n    if (holders.includes('agent')) allowed.add(input.delegation.agent.address);\n    if (!allowed.has(input.signer.address)) {\n        throw new Error(\n            `revoke: signer ${input.signer.address} not authorized to revoke this delegation`\n        );\n    }\n\n    const reason = input.reason ?? '';\n    if (reason.length > 128) throw new Error('revoke: reason must be <=128 bytes');\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n    const canonInput = {\n        address: input.signer.address,\n        delegation_id: input.delegation.id,\n        reason,\n        signed_at: signedAt,\n    };\n    const id = computeRevocationId(canonInput);\n\n    const sigValue = await input.signer.signMessage(id);\n\n    const envelope: RevocationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-revocation',\n        id,\n        delegation_id: input.delegation.id,\n        signer: { address: input.signer.address, alg: 'bip322' },\n        reason,\n        signed_at: signedAt,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.signer.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Re-exports for convenience\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    verifyAction,\n    verifyDelegation,\n    verifyRevocation,\n    parseScope,\n    isSubScope,\n    canonicalizeScope,\n    REGISTERED_SCOPES,\n} from '@orangecheck/agent-core';\nexport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    Scope,\n    ScopeConstraint,\n    AgentErrorCode,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction isoUtcSeconds(d: Date): string {\n    return d.toISOString().replace(/\\.\\d+Z$/, 'Z');\n}\n\nfunction randomHex(bytes: number): string {\n    const buf = new Uint8Array(bytes);\n    const c: Crypto | undefined = (globalThis as unknown as { crypto?: Crypto }).crypto;\n    if (c && typeof c.getRandomValues === 'function') {\n        c.getRandomValues(buf);\n    } else {\n        // Non-browser fallback. Node ≥18 exposes globalThis.crypto, so this is unlikely to fire.\n        for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);\n    }\n    let out = '';\n    for (let i = 0; i < bytes; i++) {\n        const b = buf[i]!;\n        out += b.toString(16).padStart(2, '0');\n    }\n    return out;\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["validateScope","parseScope","canonicalizeScopes","computeDelegationId","sealScopes","ENVELOPE_VERSION","hexEncode","sha256","computeActionId","computeRevocationId"],"mappings":";;;;;;AAuGA,eAAsB,iBAAiB,KAAA,EAA2D;AAC9F,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,MAAA,CAAO,WAAW,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,IAAa,QAAA;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,MAAA,EAAQA,uBAAA,CAAcC,qBAAW,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AACnE,EAAA,MAAM,MAAA,GAASC,4BAAA,CAAmB,KAAA,CAAM,MAAM,CAAA;AAE9C,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,MAAM,SAAA,EAAW;AACjB,IAAA,aAAA,GAAgB,KAAA,CAAM,SAAA;AAAA,EAC1B,CAAA,MAAO;AACH,IAAA,MAAM,MAAM,KAAA,CAAM,KAAA,IAAS,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,GAAA;AAC9C,IAAA,aAAA,GAAgB,IAAI,KAAK,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,KAAY,GAAG,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,SAAA,GAAY,cAAc,aAAa,CAAA;AAE7C,EAAA,MAAM,UAAA,GAAa,IAAI,IAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ,GAAI,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAC9E,EAAA,IAAI,UAAA,IAAc,CAAA,EAAG,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAC3F,EAAA,IAAI,UAAA,GAAa,GAAA,GAAM,EAAA,GAAK,EAAA,GAAK,KAAK,GAAA,EAAM;AACxC,IAAA,MAAM,IAAI,MAAM,gEAAgE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,SAAA,CAAU,EAAE,CAAA;AACzC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAC3B,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AAAA,EACJ;AAEA,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,SAAA,EAAW,MAAM,SAAA,CAAU,OAAA;AAAA,IAC3B,OAAO,KAAA,CAAM,YAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,MAAM,IAAA,IAAQ,CAAA;AAAA,IACzB,gBAAA,EAAkB,MAAM,cAAA,IAAkB,MAAA;AAAA,IAC1C,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAKC,8BAAoB,UAAU,CAAA;AAKzC,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI,MAAM,aAAA,EAAe;AACrB,IAAA,IAAI,CAAC,MAAM,aAAA,CAAc,UAAA,IAAc,MAAM,aAAA,CAAc,UAAA,CAAW,WAAW,CAAA,EAAG;AAChF,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,eAAA,GAAkB,MAAMC,oBAAA,CAAW;AAAA,MAC/B,MAAA;AAAA,MACA,MAAA,EAAQ;AAAA,QACJ,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA;AAAA,QACzB,WAAA,EAAa,MAAM,SAAA,CAAU;AAAA,OACjC;AAAA,MACA,UAAA,EAAY,MAAM,aAAA,CAAc,UAAA;AAAA,MAChC,GAAI,KAAA,CAAM,aAAA,CAAc,IAAA,KAAS,MAAA,IAAa;AAAA,QAC1C,IAAA,EAAM,MAAM,aAAA,CAAc;AAAA,OAC9B;AAAA,MACA,GAAI,KAAA,CAAM,aAAA,CAAc,iBAAA,KAAsB,MAAA,IAAa;AAAA,QACvD,SAAA,EAAW,MAAM,aAAA,CAAc;AAAA;AACnC,KACH,CAAA;AAAA,EACL;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,CAAU,YAAY,EAAE,CAAA;AAErD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAGC,0BAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,WAAW,EAAE,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IAC7D,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,YAAA,EAAc,KAAK,QAAA,EAAS;AAAA;AAAA,IAEpD,GAAI,eAAA,GAAkB,EAAE,kBAAkB,eAAA,EAAgB,GAAI,EAAE,MAAA,EAAO;AAAA,IACvE,IAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ,KAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACR,OAAA,EAAS,KAAA,CAAM,iBAAA,IAAqB,CAAC,WAAW,CAAA;AAAA,MAChD,GAAA,EAAK,MAAM,aAAA,IAAiB;AAAA,KAChC;AAAA,IACA,GAAA,EAAK;AAAA,MACD,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,MAAM,SAAA,CAAU,OAAA;AAAA,MACxB,KAAA,EAAO;AAAA;AACX,GACJ;AACA,EAAA,OAAO,QAAA;AACX;AAoBA,eAAsB,YAAY,KAAA,EAAkD;AAChF,EAAA,IAAI,MAAM,KAAA,CAAM,OAAA,KAAY,KAAA,CAAM,UAAA,CAAW,MAAM,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,KAAA,CAAM,mBAAmB,UAAA,EAAY;AACrC,IAAA,WAAA,GAAc,SAAA,GAAYC,mBAAA,CAAUC,aAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AACzD,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,UAAA;AAAA,EAClC,CAAA,MAAO;AACH,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAA,KAAW,SAAA,CAAU,SAAS,EAAA,EAAI;AAClG,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AACA,IAAA,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA;AAC5B,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,MAAA;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAAK,gBAAgB,CAAA,EAAG;AACvD,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AAAA,EACJ;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA;AAAA,IACrB,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,cAAc,KAAA,CAAM,IAAA;AAAA,IACpB,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM;AAAA,GAC3B;AACA,EAAA,MAAM,EAAA,GAAKC,0BAAgB,UAAU,CAAA;AAErC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,YAAY,EAAE,CAAA;AAEjD,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC7B,CAAA,EAAGH,0BAAA;AAAA,IACH,IAAA,EAAM,cAAA;AAAA,IACN,EAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,MAAA,EAAQ,aAAA;AAAA,MACR,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,GAAA,EAAK,MAAM,GAAA,IAAO;AAAA,KACtB;AAAA,IACA,QAAQ,EAAE,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACtD,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM,cAAA;AAAA,IACvB,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACvE;AACA,EAAA,OAAO,QAAA;AACX;AAgBA,eAAsB,OAAO,KAAA,EAAiD;AAC1E,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,CAAW,UAAA,EAAY,OAAA,IAAW,CAAC,WAAW,CAAA;AACpE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAW,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAO,CAAA;AACjF,EAAA,IAAI,OAAA,CAAQ,SAAS,OAAO,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACzE,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,yCAAA;AAAA,KAC1C;AAAA,EACJ;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,GAAA,EAAK,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAE7E,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA;AAAA,IACtB,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,MAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACf;AACA,EAAA,MAAM,EAAA,GAAKI,8BAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,YAAY,EAAE,CAAA;AAElD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAGJ,0BAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,QAAQ,EAAE,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACvD,MAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACxE;AACA,EAAA,OAAO,QAAA;AACX;AAkCA,SAAS,cAAc,CAAA,EAAiB;AACpC,EAAA,OAAO,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,WAAW,GAAG,CAAA;AACjD;AAEA,SAAS,UAAU,KAAA,EAAuB;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,MAAM,IAAyB,UAAA,CAA8C,MAAA;AAC7E,EAAA,IAAI,CAAA,IAAK,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAA,EAAY;AAC9C,IAAA,CAAA,CAAE,gBAAgB,GAAG,CAAA;AAAA,EACzB,CAAA,MAAO;AAEH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AACf,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,GAAA;AACX","file":"index.js","sourcesContent":["// @orangecheck/agent-signer — high-level API for producing OC Agent envelopes.\n//\n//   createDelegation  — principal signs a scoped grant to an agent address.\n//   signAsAgent       — agent produces an agent-action envelope over content.\n//   revoke            — principal (or agent, if authorized) burns a delegation.\n//\n// Each function wraps @orangecheck/agent-core's canonical-message + id\n// computation with a caller-supplied `signMessage` wallet adapter. Nothing here\n// touches the network — OTS anchoring and Nostr publication are separate steps\n// the caller wires up.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    ENVELOPE_VERSION,\n    hexEncode,\n    parseScope,\n    sealScopes,\n    validateScope,\n} from '@orangecheck/agent-core';\nimport type {\n    ScopesEncryptedEnvelope,\n    ValidationOptions,\n} from '@orangecheck/agent-core';\nimport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    RevocationHolder,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shared wallet-adapter shape (matches `@orangecheck/stamp-core` StampInput).\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignerRef {\n    address: string;\n    /** Returns a base64 BIP-322 signature over the given message as UTF-8 bytes. */\n    signMessage: (msg: string) => Promise<string>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// createDelegation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface CreateDelegationInput {\n    principal: SignerRef;\n    agentAddress: string;\n    scopes: string[];\n    bond?: DelegationBond | null;\n    issuedAt?: Date;\n    /** Duration from issuedAt in ms. Default 7 days. MAX 365 days per SPEC §4.4. */\n    ttlMs?: number;\n    /** Explicit expires_at overrides ttlMs. */\n    expiresAt?: Date;\n    /** 32-hex. Defaults to crypto.getRandomValues(16-byte) rendered as hex. */\n    nonce?: string;\n    /** Default ['principal']. */\n    revocationHolders?: RevocationHolder[];\n    /** Optional Nostr pointer to a revocation event. Non-cryptographic. */\n    revocationRef?: string | null;\n    /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */\n    scopeMode?: ValidationOptions['mode'];\n    /**\n     * v1.2 private-scope (PRIVATE-SCOPE.md). When supplied, the resulting\n     * delegation envelope omits the public `scopes` field and instead carries\n     * `scopes_encrypted` — an OC Lock envelope wrapping the canonical scope\n     * list, sealed to one or more recipient device keys. The principal signs\n     * BOTH the inner OC Lock envelope (via the `signMessage` callback already\n     * provided on `principal`) AND the outer OC Agent canonical message.\n     *\n     * Recipients MUST include at least the agent's device. Additional\n     * recipients (compliance auditors, third-party verifiers) are optional.\n     */\n    privateScopes?: {\n        /**\n         * Devices authorized to read the scope set. Each is `{ address,\n         * device_id, device_pk }` matching OC Lock's `DeviceRecord` shape.\n         * The same `signMessage` callback on `principal` is used to sign the\n         * inner OC Lock envelope.\n         */\n        recipients: PrivateScopeRecipient[];\n        /** Optional human hint stored in the OC Lock envelope. */\n        hint?: string;\n        /** Optional expiry on the OC Lock envelope. Independent of the\n         *  delegation's expires_at; usually left unset. */\n        envelopeExpiresAt?: Date | null;\n    };\n}\n\n/** Mirror of @orangecheck/lock-core's DeviceRecord. */\nexport interface PrivateScopeRecipient {\n    address: string;\n    device_id: string;\n    /** 32-byte hex X25519 public key. */\n    device_pk: string;\n}\n\nexport async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {\n    if (!input.scopes || input.scopes.length === 0) {\n        throw new Error('createDelegation: at least one scope is required');\n    }\n    const mode = input.scopeMode ?? 'strict';\n    for (const s of input.scopes) validateScope(parseScope(s), { mode });\n    const scopes = canonicalizeScopes(input.scopes);\n\n    const issuedAt = isoUtcSeconds(input.issuedAt ?? new Date());\n    let expiresAtDate: Date;\n    if (input.expiresAt) {\n        expiresAtDate = input.expiresAt;\n    } else {\n        const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1000;\n        expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);\n    }\n    const expiresAt = isoUtcSeconds(expiresAtDate);\n\n    const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();\n    if (durationMs <= 0) throw new Error('createDelegation: expires_at must be after issued_at');\n    if (durationMs > 365 * 24 * 60 * 60 * 1000) {\n        throw new Error('createDelegation: delegation duration must not exceed 365 days');\n    }\n\n    const nonce = input.nonce ?? randomHex(16);\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('createDelegation: nonce must be 32 lowercase hex chars');\n    }\n\n    const bond = input.bond ?? null;\n    if (bond) {\n        if (!Number.isInteger(bond.sats) || bond.sats < 0) {\n            throw new Error('createDelegation: bond.sats must be a non-negative integer');\n        }\n        if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {\n            throw new Error('createDelegation: bond.attestation_id must be 64 lowercase hex chars');\n        }\n    }\n\n    const canonInput = {\n        principal: input.principal.address,\n        agent: input.agentAddress,\n        scopes,\n        bond_sats: bond?.sats ?? 0,\n        bond_attestation: bond?.attestation_id ?? 'none',\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n    };\n    const id = computeDelegationId(canonInput);\n\n    // v1.2 private-scope: seal BEFORE the principal's outer signature so the\n    // user's wallet sees both prompts in a deterministic order (inner Lock\n    // sig first, outer OC Agent sig second).\n    let scopesEncrypted: ScopesEncryptedEnvelope | undefined;\n    if (input.privateScopes) {\n        if (!input.privateScopes.recipients || input.privateScopes.recipients.length === 0) {\n            throw new Error(\n                'createDelegation: privateScopes.recipients must contain at least the agent device'\n            );\n        }\n        scopesEncrypted = await sealScopes({\n            scopes,\n            sender: {\n                address: input.principal.address,\n                signMessage: input.principal.signMessage,\n            },\n            recipients: input.privateScopes.recipients,\n            ...(input.privateScopes.hint !== undefined && {\n                hint: input.privateScopes.hint,\n            }),\n            ...(input.privateScopes.envelopeExpiresAt !== undefined && {\n                expiresAt: input.privateScopes.envelopeExpiresAt,\n            }),\n        });\n    }\n\n    const sigValue = await input.principal.signMessage(id);\n\n    const envelope: DelegationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-delegation',\n        id,\n        principal: { address: input.principal.address, alg: 'bip322' },\n        agent: { address: input.agentAddress, alg: 'bip322' },\n        // Public OR private mode — never both. PRIVATE-SCOPE.md §1.1.\n        ...(scopesEncrypted ? { scopes_encrypted: scopesEncrypted } : { scopes }),\n        bond,\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n        revocation: {\n            holders: input.revocationHolders ?? ['principal'],\n            ref: input.revocationRef ?? null,\n        },\n        sig: {\n            alg: 'bip322',\n            pubkey: input.principal.address,\n            value: sigValue,\n        },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// signAsAgent\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignAsAgentInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Raw bytes to stamp, or a pre-computed { hash, length } pair. */\n    content: Uint8Array | { hash: string; length: number };\n    mime: string;\n    /** Which scope from delegation.scopes is being exercised (or a narrower sub-scope). */\n    scopeExercised: string;\n    ref?: string | null;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope> {\n    if (input.agent.address !== input.delegation.agent.address) {\n        throw new Error('signAsAgent: signer address does not match delegation.agent.address');\n    }\n\n    let contentHash: string;\n    let contentLength: number;\n    if (input.content instanceof Uint8Array) {\n        contentHash = 'sha256:' + hexEncode(sha256(input.content));\n        contentLength = input.content.byteLength;\n    } else {\n        if (!input.content.hash.startsWith('sha256:') || input.content.hash.length !== 'sha256:'.length + 64) {\n            throw new Error('signAsAgent: content.hash must be \"sha256:\" + 64 lowercase hex chars');\n        }\n        contentHash = input.content.hash;\n        contentLength = input.content.length;\n        if (!Number.isInteger(contentLength) || contentLength < 0) {\n            throw new Error('signAsAgent: content.length must be a non-negative integer');\n        }\n    }\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n\n    const canonInput = {\n        address: input.agent.address,\n        content_hash: contentHash,\n        content_length: contentLength,\n        content_mime: input.mime,\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n    };\n    const id = computeActionId(canonInput);\n\n    const sigValue = await input.agent.signMessage(id);\n\n    const envelope: ActionEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-action',\n        id,\n        content: {\n            hash: contentHash,\n            length: contentLength,\n            mime: input.mime,\n            ref: input.ref ?? null,\n        },\n        signer: { address: input.agent.address, alg: 'bip322' },\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.agent.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// revoke\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RevokeInput {\n    signer: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Short ASCII rationale. Defaults to empty string. */\n    reason?: string;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function revoke(input: RevokeInput): Promise<RevocationEnvelope> {\n    const holders = input.delegation.revocation?.holders ?? ['principal'];\n    const allowed = new Set<string>();\n    if (holders.includes('principal')) allowed.add(input.delegation.principal.address);\n    if (holders.includes('agent')) allowed.add(input.delegation.agent.address);\n    if (!allowed.has(input.signer.address)) {\n        throw new Error(\n            `revoke: signer ${input.signer.address} not authorized to revoke this delegation`\n        );\n    }\n\n    const reason = input.reason ?? '';\n    if (reason.length > 128) throw new Error('revoke: reason must be <=128 bytes');\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n    const canonInput = {\n        address: input.signer.address,\n        delegation_id: input.delegation.id,\n        reason,\n        signed_at: signedAt,\n    };\n    const id = computeRevocationId(canonInput);\n\n    const sigValue = await input.signer.signMessage(id);\n\n    const envelope: RevocationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-revocation',\n        id,\n        delegation_id: input.delegation.id,\n        signer: { address: input.signer.address, alg: 'bip322' },\n        reason,\n        signed_at: signedAt,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.signer.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Re-exports for convenience\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    verifyAction,\n    verifyDelegation,\n    verifyRevocation,\n    parseScope,\n    isSubScope,\n    canonicalizeScope,\n    REGISTERED_SCOPES,\n} from '@orangecheck/agent-core';\nexport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    Scope,\n    ScopeConstraint,\n    AgentErrorCode,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction isoUtcSeconds(d: Date): string {\n    return d.toISOString().replace(/\\.\\d+Z$/, 'Z');\n}\n\nfunction randomHex(bytes: number): string {\n    const buf = new Uint8Array(bytes);\n    const c: Crypto | undefined = (globalThis as unknown as { crypto?: Crypto }).crypto;\n    if (c && typeof c.getRandomValues === 'function') {\n        c.getRandomValues(buf);\n    } else {\n        // Non-browser fallback. Node ≥18 exposes globalThis.crypto, so this is unlikely to fire.\n        for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);\n    }\n    let out = '';\n    for (let i = 0; i < bytes; i++) {\n        const b = buf[i]!;\n        out += b.toString(16).padStart(2, '0');\n    }\n    return out;\n}\n"]}

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { sha256 } from '@noble/hashes/sha256';
-import { validateScope, parseScope, canonicalizeScopes, computeDelegationId, ENVELOPE_VERSION, hexEncode, computeActionId, computeRevocationId } from '@orangecheck/agent-core';
+import { validateScope, parseScope, canonicalizeScopes, computeDelegationId, sealScopes, ENVELOPE_VERSION, hexEncode, computeActionId, computeRevocationId } from '@orangecheck/agent-core';
 export { REGISTERED_SCOPES, canonicalizeScope, canonicalizeScopes, computeActionId, computeDelegationId, computeRevocationId, isSubScope, parseScope, verifyAction, verifyDelegation, verifyRevocation } from '@orangecheck/agent-core';
 
 // src/index.ts
@@ -48,6 +48,28 @@ async function createDelegation(input) {
     nonce
   };
   const id = computeDelegationId(canonInput);
+  let scopesEncrypted;
+  if (input.privateScopes) {
+    if (!input.privateScopes.recipients || input.privateScopes.recipients.length === 0) {
+      throw new Error(
+        "createDelegation: privateScopes.recipients must contain at least the agent device"
+      );
+    }
+    scopesEncrypted = await sealScopes({
+      scopes,
+      sender: {
+        address: input.principal.address,
+        signMessage: input.principal.signMessage
+      },
+      recipients: input.privateScopes.recipients,
+      ...input.privateScopes.hint !== void 0 && {
+        hint: input.privateScopes.hint
+      },
+      ...input.privateScopes.envelopeExpiresAt !== void 0 && {
+        expiresAt: input.privateScopes.envelopeExpiresAt
+      }
+    });
+  }
   const sigValue = await input.principal.signMessage(id);
   const envelope = {
     v: ENVELOPE_VERSION,
@@ -55,7 +77,8 @@ async function createDelegation(input) {
     id,
     principal: { address: input.principal.address, alg: "bip322" },
     agent: { address: input.agentAddress, alg: "bip322" },
-    scopes,
+    // Public OR private mode — never both. PRIVATE-SCOPE.md §1.1.
+    ...scopesEncrypted ? { scopes_encrypted: scopesEncrypted } : { scopes },
     bond,
     issued_at: issuedAt,
     expires_at: expiresAt,

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;AAkEA,eAAsB,iBAAiB,KAAA,EAA2D;AAC9F,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,MAAA,CAAO,WAAW,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,IAAa,QAAA;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,MAAA,EAAQ,aAAA,CAAc,WAAW,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AACnE,EAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,KAAA,CAAM,MAAM,CAAA;AAE9C,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,MAAM,SAAA,EAAW;AACjB,IAAA,aAAA,GAAgB,KAAA,CAAM,SAAA;AAAA,EAC1B,CAAA,MAAO;AACH,IAAA,MAAM,MAAM,KAAA,CAAM,KAAA,IAAS,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,GAAA;AAC9C,IAAA,aAAA,GAAgB,IAAI,KAAK,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,KAAY,GAAG,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,SAAA,GAAY,cAAc,aAAa,CAAA;AAE7C,EAAA,MAAM,UAAA,GAAa,IAAI,IAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ,GAAI,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAC9E,EAAA,IAAI,UAAA,IAAc,CAAA,EAAG,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAC3F,EAAA,IAAI,UAAA,GAAa,GAAA,GAAM,EAAA,GAAK,EAAA,GAAK,KAAK,GAAA,EAAM;AACxC,IAAA,MAAM,IAAI,MAAM,gEAAgE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,SAAA,CAAU,EAAE,CAAA;AACzC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAC3B,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AAAA,EACJ;AAEA,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,SAAA,EAAW,MAAM,SAAA,CAAU,OAAA;AAAA,IAC3B,OAAO,KAAA,CAAM,YAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,MAAM,IAAA,IAAQ,CAAA;AAAA,IACzB,gBAAA,EAAkB,MAAM,cAAA,IAAkB,MAAA;AAAA,IAC1C,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,CAAU,YAAY,EAAE,CAAA;AAErD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,WAAW,EAAE,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IAC7D,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,YAAA,EAAc,KAAK,QAAA,EAAS;AAAA,IACpD,MAAA;AAAA,IACA,IAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ,KAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACR,OAAA,EAAS,KAAA,CAAM,iBAAA,IAAqB,CAAC,WAAW,CAAA;AAAA,MAChD,GAAA,EAAK,MAAM,aAAA,IAAiB;AAAA,KAChC;AAAA,IACA,GAAA,EAAK;AAAA,MACD,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,MAAM,SAAA,CAAU,OAAA;AAAA,MACxB,KAAA,EAAO;AAAA;AACX,GACJ;AACA,EAAA,OAAO,QAAA;AACX;AAoBA,eAAsB,YAAY,KAAA,EAAkD;AAChF,EAAA,IAAI,MAAM,KAAA,CAAM,OAAA,KAAY,KAAA,CAAM,UAAA,CAAW,MAAM,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,KAAA,CAAM,mBAAmB,UAAA,EAAY;AACrC,IAAA,WAAA,GAAc,SAAA,GAAY,SAAA,CAAU,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AACzD,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,UAAA;AAAA,EAClC,CAAA,MAAO;AACH,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAA,KAAW,SAAA,CAAU,SAAS,EAAA,EAAI;AAClG,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AACA,IAAA,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA;AAC5B,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,MAAA;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAAK,gBAAgB,CAAA,EAAG;AACvD,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AAAA,EACJ;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA;AAAA,IACrB,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,cAAc,KAAA,CAAM,IAAA;AAAA,IACpB,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM;AAAA,GAC3B;AACA,EAAA,MAAM,EAAA,GAAK,gBAAgB,UAAU,CAAA;AAErC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,YAAY,EAAE,CAAA;AAEjD,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC7B,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,cAAA;AAAA,IACN,EAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,MAAA,EAAQ,aAAA;AAAA,MACR,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,GAAA,EAAK,MAAM,GAAA,IAAO;AAAA,KACtB;AAAA,IACA,QAAQ,EAAE,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACtD,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM,cAAA;AAAA,IACvB,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACvE;AACA,EAAA,OAAO,QAAA;AACX;AAgBA,eAAsB,OAAO,KAAA,EAAiD;AAC1E,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,CAAW,UAAA,EAAY,OAAA,IAAW,CAAC,WAAW,CAAA;AACpE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAW,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAO,CAAA;AACjF,EAAA,IAAI,OAAA,CAAQ,SAAS,OAAO,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACzE,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,yCAAA;AAAA,KAC1C;AAAA,EACJ;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,GAAA,EAAK,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAE7E,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA;AAAA,IACtB,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,MAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACf;AACA,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,YAAY,EAAE,CAAA;AAElD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,QAAQ,EAAE,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACvD,MAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACxE;AACA,EAAA,OAAO,QAAA;AACX;AAkCA,SAAS,cAAc,CAAA,EAAiB;AACpC,EAAA,OAAO,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,WAAW,GAAG,CAAA;AACjD;AAEA,SAAS,UAAU,KAAA,EAAuB;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,MAAM,IAAyB,UAAA,CAA8C,MAAA;AAC7E,EAAA,IAAI,CAAA,IAAK,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAA,EAAY;AAC9C,IAAA,CAAA,CAAE,gBAAgB,GAAG,CAAA;AAAA,EACzB,CAAA,MAAO;AAEH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AACf,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,GAAA;AACX","file":"index.mjs","sourcesContent":["// @orangecheck/agent-signer — high-level API for producing OC Agent envelopes.\n//\n//   createDelegation  — principal signs a scoped grant to an agent address.\n//   signAsAgent       — agent produces an agent-action envelope over content.\n//   revoke            — principal (or agent, if authorized) burns a delegation.\n//\n// Each function wraps @orangecheck/agent-core's canonical-message + id\n// computation with a caller-supplied `signMessage` wallet adapter. Nothing here\n// touches the network — OTS anchoring and Nostr publication are separate steps\n// the caller wires up.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    ENVELOPE_VERSION,\n    hexEncode,\n    parseScope,\n    validateScope,\n} from '@orangecheck/agent-core';\nimport type { ValidationOptions } from '@orangecheck/agent-core';\nimport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    RevocationHolder,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shared wallet-adapter shape (matches `@orangecheck/stamp-core` StampInput).\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignerRef {\n    address: string;\n    /** Returns a base64 BIP-322 signature over the given message as UTF-8 bytes. */\n    signMessage: (msg: string) => Promise<string>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// createDelegation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface CreateDelegationInput {\n    principal: SignerRef;\n    agentAddress: string;\n    scopes: string[];\n    bond?: DelegationBond | null;\n    issuedAt?: Date;\n    /** Duration from issuedAt in ms. Default 7 days. MAX 365 days per SPEC §4.4. */\n    ttlMs?: number;\n    /** Explicit expires_at overrides ttlMs. */\n    expiresAt?: Date;\n    /** 32-hex. Defaults to crypto.getRandomValues(16-byte) rendered as hex. */\n    nonce?: string;\n    /** Default ['principal']. */\n    revocationHolders?: RevocationHolder[];\n    /** Optional Nostr pointer to a revocation event. Non-cryptographic. */\n    revocationRef?: string | null;\n    /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */\n    scopeMode?: ValidationOptions['mode'];\n}\n\nexport async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {\n    if (!input.scopes || input.scopes.length === 0) {\n        throw new Error('createDelegation: at least one scope is required');\n    }\n    const mode = input.scopeMode ?? 'strict';\n    for (const s of input.scopes) validateScope(parseScope(s), { mode });\n    const scopes = canonicalizeScopes(input.scopes);\n\n    const issuedAt = isoUtcSeconds(input.issuedAt ?? new Date());\n    let expiresAtDate: Date;\n    if (input.expiresAt) {\n        expiresAtDate = input.expiresAt;\n    } else {\n        const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1000;\n        expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);\n    }\n    const expiresAt = isoUtcSeconds(expiresAtDate);\n\n    const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();\n    if (durationMs <= 0) throw new Error('createDelegation: expires_at must be after issued_at');\n    if (durationMs > 365 * 24 * 60 * 60 * 1000) {\n        throw new Error('createDelegation: delegation duration must not exceed 365 days');\n    }\n\n    const nonce = input.nonce ?? randomHex(16);\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('createDelegation: nonce must be 32 lowercase hex chars');\n    }\n\n    const bond = input.bond ?? null;\n    if (bond) {\n        if (!Number.isInteger(bond.sats) || bond.sats < 0) {\n            throw new Error('createDelegation: bond.sats must be a non-negative integer');\n        }\n        if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {\n            throw new Error('createDelegation: bond.attestation_id must be 64 lowercase hex chars');\n        }\n    }\n\n    const canonInput = {\n        principal: input.principal.address,\n        agent: input.agentAddress,\n        scopes,\n        bond_sats: bond?.sats ?? 0,\n        bond_attestation: bond?.attestation_id ?? 'none',\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n    };\n    const id = computeDelegationId(canonInput);\n\n    const sigValue = await input.principal.signMessage(id);\n\n    const envelope: DelegationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-delegation',\n        id,\n        principal: { address: input.principal.address, alg: 'bip322' },\n        agent: { address: input.agentAddress, alg: 'bip322' },\n        scopes,\n        bond,\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n        revocation: {\n            holders: input.revocationHolders ?? ['principal'],\n            ref: input.revocationRef ?? null,\n        },\n        sig: {\n            alg: 'bip322',\n            pubkey: input.principal.address,\n            value: sigValue,\n        },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// signAsAgent\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignAsAgentInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Raw bytes to stamp, or a pre-computed { hash, length } pair. */\n    content: Uint8Array | { hash: string; length: number };\n    mime: string;\n    /** Which scope from delegation.scopes is being exercised (or a narrower sub-scope). */\n    scopeExercised: string;\n    ref?: string | null;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope> {\n    if (input.agent.address !== input.delegation.agent.address) {\n        throw new Error('signAsAgent: signer address does not match delegation.agent.address');\n    }\n\n    let contentHash: string;\n    let contentLength: number;\n    if (input.content instanceof Uint8Array) {\n        contentHash = 'sha256:' + hexEncode(sha256(input.content));\n        contentLength = input.content.byteLength;\n    } else {\n        if (!input.content.hash.startsWith('sha256:') || input.content.hash.length !== 'sha256:'.length + 64) {\n            throw new Error('signAsAgent: content.hash must be \"sha256:\" + 64 lowercase hex chars');\n        }\n        contentHash = input.content.hash;\n        contentLength = input.content.length;\n        if (!Number.isInteger(contentLength) || contentLength < 0) {\n            throw new Error('signAsAgent: content.length must be a non-negative integer');\n        }\n    }\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n\n    const canonInput = {\n        address: input.agent.address,\n        content_hash: contentHash,\n        content_length: contentLength,\n        content_mime: input.mime,\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n    };\n    const id = computeActionId(canonInput);\n\n    const sigValue = await input.agent.signMessage(id);\n\n    const envelope: ActionEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-action',\n        id,\n        content: {\n            hash: contentHash,\n            length: contentLength,\n            mime: input.mime,\n            ref: input.ref ?? null,\n        },\n        signer: { address: input.agent.address, alg: 'bip322' },\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.agent.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// revoke\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RevokeInput {\n    signer: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Short ASCII rationale. Defaults to empty string. */\n    reason?: string;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function revoke(input: RevokeInput): Promise<RevocationEnvelope> {\n    const holders = input.delegation.revocation?.holders ?? ['principal'];\n    const allowed = new Set<string>();\n    if (holders.includes('principal')) allowed.add(input.delegation.principal.address);\n    if (holders.includes('agent')) allowed.add(input.delegation.agent.address);\n    if (!allowed.has(input.signer.address)) {\n        throw new Error(\n            `revoke: signer ${input.signer.address} not authorized to revoke this delegation`\n        );\n    }\n\n    const reason = input.reason ?? '';\n    if (reason.length > 128) throw new Error('revoke: reason must be <=128 bytes');\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n    const canonInput = {\n        address: input.signer.address,\n        delegation_id: input.delegation.id,\n        reason,\n        signed_at: signedAt,\n    };\n    const id = computeRevocationId(canonInput);\n\n    const sigValue = await input.signer.signMessage(id);\n\n    const envelope: RevocationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-revocation',\n        id,\n        delegation_id: input.delegation.id,\n        signer: { address: input.signer.address, alg: 'bip322' },\n        reason,\n        signed_at: signedAt,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.signer.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Re-exports for convenience\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    verifyAction,\n    verifyDelegation,\n    verifyRevocation,\n    parseScope,\n    isSubScope,\n    canonicalizeScope,\n    REGISTERED_SCOPES,\n} from '@orangecheck/agent-core';\nexport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    Scope,\n    ScopeConstraint,\n    AgentErrorCode,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction isoUtcSeconds(d: Date): string {\n    return d.toISOString().replace(/\\.\\d+Z$/, 'Z');\n}\n\nfunction randomHex(bytes: number): string {\n    const buf = new Uint8Array(bytes);\n    const c: Crypto | undefined = (globalThis as unknown as { crypto?: Crypto }).crypto;\n    if (c && typeof c.getRandomValues === 'function') {\n        c.getRandomValues(buf);\n    } else {\n        // Non-browser fallback. Node ≥18 exposes globalThis.crypto, so this is unlikely to fire.\n        for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);\n    }\n    let out = '';\n    for (let i = 0; i < bytes; i++) {\n        const b = buf[i]!;\n        out += b.toString(16).padStart(2, '0');\n    }\n    return out;\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;AAuGA,eAAsB,iBAAiB,KAAA,EAA2D;AAC9F,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,MAAA,CAAO,WAAW,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,IAAa,QAAA;AAChC,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,MAAA,EAAQ,aAAA,CAAc,WAAW,CAAC,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AACnE,EAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,KAAA,CAAM,MAAM,CAAA;AAE9C,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,MAAM,SAAA,EAAW;AACjB,IAAA,aAAA,GAAgB,KAAA,CAAM,SAAA;AAAA,EAC1B,CAAA,MAAO;AACH,IAAA,MAAM,MAAM,KAAA,CAAM,KAAA,IAAS,CAAA,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,GAAA;AAC9C,IAAA,aAAA,GAAgB,IAAI,KAAK,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,KAAY,GAAG,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,SAAA,GAAY,cAAc,aAAa,CAAA;AAE7C,EAAA,MAAM,UAAA,GAAa,IAAI,IAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ,GAAI,IAAI,IAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAC9E,EAAA,IAAI,UAAA,IAAc,CAAA,EAAG,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAC3F,EAAA,IAAI,UAAA,GAAa,GAAA,GAAM,EAAA,GAAK,EAAA,GAAK,KAAK,GAAA,EAAM;AACxC,IAAA,MAAM,IAAI,MAAM,gEAAgE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,SAAA,CAAU,EAAE,CAAA;AACzC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAC3B,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AACA,IAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,IAAA,CAAK,cAAc,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AAAA,EACJ;AAEA,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,SAAA,EAAW,MAAM,SAAA,CAAU,OAAA;AAAA,IAC3B,OAAO,KAAA,CAAM,YAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA,EAAW,MAAM,IAAA,IAAQ,CAAA;AAAA,IACzB,gBAAA,EAAkB,MAAM,cAAA,IAAkB,MAAA;AAAA,IAC1C,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AAKzC,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI,MAAM,aAAA,EAAe;AACrB,IAAA,IAAI,CAAC,MAAM,aAAA,CAAc,UAAA,IAAc,MAAM,aAAA,CAAc,UAAA,CAAW,WAAW,CAAA,EAAG;AAChF,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,eAAA,GAAkB,MAAM,UAAA,CAAW;AAAA,MAC/B,MAAA;AAAA,MACA,MAAA,EAAQ;AAAA,QACJ,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA;AAAA,QACzB,WAAA,EAAa,MAAM,SAAA,CAAU;AAAA,OACjC;AAAA,MACA,UAAA,EAAY,MAAM,aAAA,CAAc,UAAA;AAAA,MAChC,GAAI,KAAA,CAAM,aAAA,CAAc,IAAA,KAAS,MAAA,IAAa;AAAA,QAC1C,IAAA,EAAM,MAAM,aAAA,CAAc;AAAA,OAC9B;AAAA,MACA,GAAI,KAAA,CAAM,aAAA,CAAc,iBAAA,KAAsB,MAAA,IAAa;AAAA,QACvD,SAAA,EAAW,MAAM,aAAA,CAAc;AAAA;AACnC,KACH,CAAA;AAAA,EACL;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,SAAA,CAAU,YAAY,EAAE,CAAA;AAErD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,WAAW,EAAE,OAAA,EAAS,MAAM,SAAA,CAAU,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IAC7D,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,YAAA,EAAc,KAAK,QAAA,EAAS;AAAA;AAAA,IAEpD,GAAI,eAAA,GAAkB,EAAE,kBAAkB,eAAA,EAAgB,GAAI,EAAE,MAAA,EAAO;AAAA,IACvE,IAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,UAAA,EAAY,SAAA;AAAA,IACZ,KAAA;AAAA,IACA,UAAA,EAAY;AAAA,MACR,OAAA,EAAS,KAAA,CAAM,iBAAA,IAAqB,CAAC,WAAW,CAAA;AAAA,MAChD,GAAA,EAAK,MAAM,aAAA,IAAiB;AAAA,KAChC;AAAA,IACA,GAAA,EAAK;AAAA,MACD,GAAA,EAAK,QAAA;AAAA,MACL,MAAA,EAAQ,MAAM,SAAA,CAAU,OAAA;AAAA,MACxB,KAAA,EAAO;AAAA;AACX,GACJ;AACA,EAAA,OAAO,QAAA;AACX;AAoBA,eAAsB,YAAY,KAAA,EAAkD;AAChF,EAAA,IAAI,MAAM,KAAA,CAAM,OAAA,KAAY,KAAA,CAAM,UAAA,CAAW,MAAM,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACzF;AAEA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,KAAA,CAAM,mBAAmB,UAAA,EAAY;AACrC,IAAA,WAAA,GAAc,SAAA,GAAY,SAAA,CAAU,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AACzD,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,UAAA;AAAA,EAClC,CAAA,MAAO;AACH,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAA,KAAW,SAAA,CAAU,SAAS,EAAA,EAAI;AAClG,MAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,IAC1F;AACA,IAAA,WAAA,GAAc,MAAM,OAAA,CAAQ,IAAA;AAC5B,IAAA,aAAA,GAAgB,MAAM,OAAA,CAAQ,MAAA;AAC9B,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,aAAa,CAAA,IAAK,gBAAgB,CAAA,EAAG;AACvD,MAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,IAChF;AAAA,EACJ;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAE3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA;AAAA,IACrB,YAAA,EAAc,WAAA;AAAA,IACd,cAAA,EAAgB,aAAA;AAAA,IAChB,cAAc,KAAA,CAAM,IAAA;AAAA,IACpB,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM;AAAA,GAC3B;AACA,EAAA,MAAM,EAAA,GAAK,gBAAgB,UAAU,CAAA;AAErC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,YAAY,EAAE,CAAA;AAEjD,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC7B,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,cAAA;AAAA,IACN,EAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,MAAA,EAAQ,aAAA;AAAA,MACR,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,GAAA,EAAK,MAAM,GAAA,IAAO;AAAA,KACtB;AAAA,IACA,QAAQ,EAAE,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACtD,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,iBAAiB,KAAA,CAAM,cAAA;AAAA,IACvB,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACvE;AACA,EAAA,OAAO,QAAA;AACX;AAgBA,eAAsB,OAAO,KAAA,EAAiD;AAC1E,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,CAAW,UAAA,EAAY,OAAA,IAAW,CAAC,WAAW,CAAA;AACpE,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAY;AAChC,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAW,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,SAAA,CAAU,OAAO,CAAA;AACjF,EAAA,IAAI,OAAA,CAAQ,SAAS,OAAO,CAAA,UAAW,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA;AACzE,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG;AACpC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,yCAAA;AAAA,KAC1C;AAAA,EACJ;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,EAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,GAAA,EAAK,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAE7E,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,QAAA,oBAAY,IAAI,MAAM,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa;AAAA,IACf,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA;AAAA,IACtB,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,MAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACf;AACA,EAAA,MAAM,EAAA,GAAK,oBAAoB,UAAU,CAAA;AAEzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,MAAA,CAAO,YAAY,EAAE,CAAA;AAElD,EAAA,MAAM,QAAA,GAA+B;AAAA,IACjC,CAAA,EAAG,gBAAA;AAAA,IACH,IAAA,EAAM,kBAAA;AAAA,IACN,EAAA;AAAA,IACA,aAAA,EAAe,MAAM,UAAA,CAAW,EAAA;AAAA,IAChC,QAAQ,EAAE,OAAA,EAAS,MAAM,MAAA,CAAO,OAAA,EAAS,KAAK,QAAA,EAAS;AAAA,IACvD,MAAA;AAAA,IACA,SAAA,EAAW,QAAA;AAAA,IACX,GAAA,EAAK,MAAM,GAAA,IAAO,IAAA;AAAA,IAClB,GAAA,EAAK,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,KAAA,EAAO,QAAA;AAAS,GACxE;AACA,EAAA,OAAO,QAAA;AACX;AAkCA,SAAS,cAAc,CAAA,EAAiB;AACpC,EAAA,OAAO,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,WAAW,GAAG,CAAA;AACjD;AAEA,SAAS,UAAU,KAAA,EAAuB;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAK,CAAA;AAChC,EAAA,MAAM,IAAyB,UAAA,CAA8C,MAAA;AAC7E,EAAA,IAAI,CAAA,IAAK,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAA,EAAY;AAC9C,IAAA,CAAA,CAAE,gBAAgB,GAAG,CAAA;AAAA,EACzB,CAAA,MAAO;AAEH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EAC3E;AACA,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AACf,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,GAAA;AACX","file":"index.mjs","sourcesContent":["// @orangecheck/agent-signer — high-level API for producing OC Agent envelopes.\n//\n//   createDelegation  — principal signs a scoped grant to an agent address.\n//   signAsAgent       — agent produces an agent-action envelope over content.\n//   revoke            — principal (or agent, if authorized) burns a delegation.\n//\n// Each function wraps @orangecheck/agent-core's canonical-message + id\n// computation with a caller-supplied `signMessage` wallet adapter. Nothing here\n// touches the network — OTS anchoring and Nostr publication are separate steps\n// the caller wires up.\n\nimport { sha256 } from '@noble/hashes/sha256';\nimport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    ENVELOPE_VERSION,\n    hexEncode,\n    parseScope,\n    sealScopes,\n    validateScope,\n} from '@orangecheck/agent-core';\nimport type {\n    ScopesEncryptedEnvelope,\n    ValidationOptions,\n} from '@orangecheck/agent-core';\nimport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    RevocationHolder,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Shared wallet-adapter shape (matches `@orangecheck/stamp-core` StampInput).\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignerRef {\n    address: string;\n    /** Returns a base64 BIP-322 signature over the given message as UTF-8 bytes. */\n    signMessage: (msg: string) => Promise<string>;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// createDelegation\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface CreateDelegationInput {\n    principal: SignerRef;\n    agentAddress: string;\n    scopes: string[];\n    bond?: DelegationBond | null;\n    issuedAt?: Date;\n    /** Duration from issuedAt in ms. Default 7 days. MAX 365 days per SPEC §4.4. */\n    ttlMs?: number;\n    /** Explicit expires_at overrides ttlMs. */\n    expiresAt?: Date;\n    /** 32-hex. Defaults to crypto.getRandomValues(16-byte) rendered as hex. */\n    nonce?: string;\n    /** Default ['principal']. */\n    revocationHolders?: RevocationHolder[];\n    /** Optional Nostr pointer to a revocation event. Non-cryptographic. */\n    revocationRef?: string | null;\n    /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */\n    scopeMode?: ValidationOptions['mode'];\n    /**\n     * v1.2 private-scope (PRIVATE-SCOPE.md). When supplied, the resulting\n     * delegation envelope omits the public `scopes` field and instead carries\n     * `scopes_encrypted` — an OC Lock envelope wrapping the canonical scope\n     * list, sealed to one or more recipient device keys. The principal signs\n     * BOTH the inner OC Lock envelope (via the `signMessage` callback already\n     * provided on `principal`) AND the outer OC Agent canonical message.\n     *\n     * Recipients MUST include at least the agent's device. Additional\n     * recipients (compliance auditors, third-party verifiers) are optional.\n     */\n    privateScopes?: {\n        /**\n         * Devices authorized to read the scope set. Each is `{ address,\n         * device_id, device_pk }` matching OC Lock's `DeviceRecord` shape.\n         * The same `signMessage` callback on `principal` is used to sign the\n         * inner OC Lock envelope.\n         */\n        recipients: PrivateScopeRecipient[];\n        /** Optional human hint stored in the OC Lock envelope. */\n        hint?: string;\n        /** Optional expiry on the OC Lock envelope. Independent of the\n         *  delegation's expires_at; usually left unset. */\n        envelopeExpiresAt?: Date | null;\n    };\n}\n\n/** Mirror of @orangecheck/lock-core's DeviceRecord. */\nexport interface PrivateScopeRecipient {\n    address: string;\n    device_id: string;\n    /** 32-byte hex X25519 public key. */\n    device_pk: string;\n}\n\nexport async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {\n    if (!input.scopes || input.scopes.length === 0) {\n        throw new Error('createDelegation: at least one scope is required');\n    }\n    const mode = input.scopeMode ?? 'strict';\n    for (const s of input.scopes) validateScope(parseScope(s), { mode });\n    const scopes = canonicalizeScopes(input.scopes);\n\n    const issuedAt = isoUtcSeconds(input.issuedAt ?? new Date());\n    let expiresAtDate: Date;\n    if (input.expiresAt) {\n        expiresAtDate = input.expiresAt;\n    } else {\n        const ttl = input.ttlMs ?? 7 * 24 * 60 * 60 * 1000;\n        expiresAtDate = new Date(new Date(issuedAt).getTime() + ttl);\n    }\n    const expiresAt = isoUtcSeconds(expiresAtDate);\n\n    const durationMs = new Date(expiresAt).getTime() - new Date(issuedAt).getTime();\n    if (durationMs <= 0) throw new Error('createDelegation: expires_at must be after issued_at');\n    if (durationMs > 365 * 24 * 60 * 60 * 1000) {\n        throw new Error('createDelegation: delegation duration must not exceed 365 days');\n    }\n\n    const nonce = input.nonce ?? randomHex(16);\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('createDelegation: nonce must be 32 lowercase hex chars');\n    }\n\n    const bond = input.bond ?? null;\n    if (bond) {\n        if (!Number.isInteger(bond.sats) || bond.sats < 0) {\n            throw new Error('createDelegation: bond.sats must be a non-negative integer');\n        }\n        if (!/^[0-9a-f]{64}$/.test(bond.attestation_id)) {\n            throw new Error('createDelegation: bond.attestation_id must be 64 lowercase hex chars');\n        }\n    }\n\n    const canonInput = {\n        principal: input.principal.address,\n        agent: input.agentAddress,\n        scopes,\n        bond_sats: bond?.sats ?? 0,\n        bond_attestation: bond?.attestation_id ?? 'none',\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n    };\n    const id = computeDelegationId(canonInput);\n\n    // v1.2 private-scope: seal BEFORE the principal's outer signature so the\n    // user's wallet sees both prompts in a deterministic order (inner Lock\n    // sig first, outer OC Agent sig second).\n    let scopesEncrypted: ScopesEncryptedEnvelope | undefined;\n    if (input.privateScopes) {\n        if (!input.privateScopes.recipients || input.privateScopes.recipients.length === 0) {\n            throw new Error(\n                'createDelegation: privateScopes.recipients must contain at least the agent device'\n            );\n        }\n        scopesEncrypted = await sealScopes({\n            scopes,\n            sender: {\n                address: input.principal.address,\n                signMessage: input.principal.signMessage,\n            },\n            recipients: input.privateScopes.recipients,\n            ...(input.privateScopes.hint !== undefined && {\n                hint: input.privateScopes.hint,\n            }),\n            ...(input.privateScopes.envelopeExpiresAt !== undefined && {\n                expiresAt: input.privateScopes.envelopeExpiresAt,\n            }),\n        });\n    }\n\n    const sigValue = await input.principal.signMessage(id);\n\n    const envelope: DelegationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-delegation',\n        id,\n        principal: { address: input.principal.address, alg: 'bip322' },\n        agent: { address: input.agentAddress, alg: 'bip322' },\n        // Public OR private mode — never both. PRIVATE-SCOPE.md §1.1.\n        ...(scopesEncrypted ? { scopes_encrypted: scopesEncrypted } : { scopes }),\n        bond,\n        issued_at: issuedAt,\n        expires_at: expiresAt,\n        nonce,\n        revocation: {\n            holders: input.revocationHolders ?? ['principal'],\n            ref: input.revocationRef ?? null,\n        },\n        sig: {\n            alg: 'bip322',\n            pubkey: input.principal.address,\n            value: sigValue,\n        },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// signAsAgent\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface SignAsAgentInput {\n    agent: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Raw bytes to stamp, or a pre-computed { hash, length } pair. */\n    content: Uint8Array | { hash: string; length: number };\n    mime: string;\n    /** Which scope from delegation.scopes is being exercised (or a narrower sub-scope). */\n    scopeExercised: string;\n    ref?: string | null;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function signAsAgent(input: SignAsAgentInput): Promise<ActionEnvelope> {\n    if (input.agent.address !== input.delegation.agent.address) {\n        throw new Error('signAsAgent: signer address does not match delegation.agent.address');\n    }\n\n    let contentHash: string;\n    let contentLength: number;\n    if (input.content instanceof Uint8Array) {\n        contentHash = 'sha256:' + hexEncode(sha256(input.content));\n        contentLength = input.content.byteLength;\n    } else {\n        if (!input.content.hash.startsWith('sha256:') || input.content.hash.length !== 'sha256:'.length + 64) {\n            throw new Error('signAsAgent: content.hash must be \"sha256:\" + 64 lowercase hex chars');\n        }\n        contentHash = input.content.hash;\n        contentLength = input.content.length;\n        if (!Number.isInteger(contentLength) || contentLength < 0) {\n            throw new Error('signAsAgent: content.length must be a non-negative integer');\n        }\n    }\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n\n    const canonInput = {\n        address: input.agent.address,\n        content_hash: contentHash,\n        content_length: contentLength,\n        content_mime: input.mime,\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n    };\n    const id = computeActionId(canonInput);\n\n    const sigValue = await input.agent.signMessage(id);\n\n    const envelope: ActionEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-action',\n        id,\n        content: {\n            hash: contentHash,\n            length: contentLength,\n            mime: input.mime,\n            ref: input.ref ?? null,\n        },\n        signer: { address: input.agent.address, alg: 'bip322' },\n        signed_at: signedAt,\n        delegation_id: input.delegation.id,\n        scope_exercised: input.scopeExercised,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.agent.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// revoke\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport interface RevokeInput {\n    signer: SignerRef;\n    delegation: DelegationEnvelope;\n    /** Short ASCII rationale. Defaults to empty string. */\n    reason?: string;\n    signedAt?: Date;\n    /** OTS proof / anchor data if the caller has already submitted; otherwise null. */\n    ots?: ActionOts | null;\n}\n\nexport async function revoke(input: RevokeInput): Promise<RevocationEnvelope> {\n    const holders = input.delegation.revocation?.holders ?? ['principal'];\n    const allowed = new Set<string>();\n    if (holders.includes('principal')) allowed.add(input.delegation.principal.address);\n    if (holders.includes('agent')) allowed.add(input.delegation.agent.address);\n    if (!allowed.has(input.signer.address)) {\n        throw new Error(\n            `revoke: signer ${input.signer.address} not authorized to revoke this delegation`\n        );\n    }\n\n    const reason = input.reason ?? '';\n    if (reason.length > 128) throw new Error('revoke: reason must be <=128 bytes');\n\n    const signedAt = isoUtcSeconds(input.signedAt ?? new Date());\n    const canonInput = {\n        address: input.signer.address,\n        delegation_id: input.delegation.id,\n        reason,\n        signed_at: signedAt,\n    };\n    const id = computeRevocationId(canonInput);\n\n    const sigValue = await input.signer.signMessage(id);\n\n    const envelope: RevocationEnvelope = {\n        v: ENVELOPE_VERSION,\n        kind: 'agent-revocation',\n        id,\n        delegation_id: input.delegation.id,\n        signer: { address: input.signer.address, alg: 'bip322' },\n        reason,\n        signed_at: signedAt,\n        ots: input.ots ?? null,\n        sig: { alg: 'bip322', pubkey: input.signer.address, value: sigValue },\n    };\n    return envelope;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Re-exports for convenience\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport {\n    canonicalizeScopes,\n    computeActionId,\n    computeDelegationId,\n    computeRevocationId,\n    verifyAction,\n    verifyDelegation,\n    verifyRevocation,\n    parseScope,\n    isSubScope,\n    canonicalizeScope,\n    REGISTERED_SCOPES,\n} from '@orangecheck/agent-core';\nexport type {\n    ActionEnvelope,\n    ActionOts,\n    DelegationBond,\n    DelegationEnvelope,\n    RevocationEnvelope,\n    Scope,\n    ScopeConstraint,\n    AgentErrorCode,\n} from '@orangecheck/agent-core';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction isoUtcSeconds(d: Date): string {\n    return d.toISOString().replace(/\\.\\d+Z$/, 'Z');\n}\n\nfunction randomHex(bytes: number): string {\n    const buf = new Uint8Array(bytes);\n    const c: Crypto | undefined = (globalThis as unknown as { crypto?: Crypto }).crypto;\n    if (c && typeof c.getRandomValues === 'function') {\n        c.getRandomValues(buf);\n    } else {\n        // Non-browser fallback. Node ≥18 exposes globalThis.crypto, so this is unlikely to fire.\n        for (let i = 0; i < bytes; i++) buf[i] = Math.floor(Math.random() * 256);\n    }\n    let out = '';\n    for (let i = 0; i < bytes; i++) {\n        const b = buf[i]!;\n        out += b.toString(16).padStart(2, '0');\n    }\n    return out;\n}\n"]}

package/package.json

@@ -1,60 +1,63 @@
 {
-    "name": "@orangecheck/agent-signer",
-    "version": "0.1.0",
-    "description": "OC Agent signer: createDelegation(), signAsAgent(), revoke(). Composes @orangecheck/agent-core with a wallet-adapter signing function and optional OTS anchoring.",
-    "keywords": [
-        "bitcoin",
-        "agent",
-        "authority",
-        "delegation",
-        "bip322",
-        "oc-agent",
-        "orangecheck"
-    ],
-    "author": "OrangeCheck",
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/orangecheck/oc-packages.git",
-        "directory": "agent-signer"
-    },
-    "homepage": "https://github.com/orangecheck/oc-agent-protocol",
-    "bugs": {
-        "url": "https://github.com/orangecheck/oc-agent-protocol/issues"
-    },
-    "main": "./dist/index.js",
-    "module": "./dist/index.mjs",
-    "types": "./dist/index.d.ts",
-    "exports": {
-        ".": {
-            "types": "./dist/index.d.ts",
-            "import": "./dist/index.mjs",
-            "require": "./dist/index.js"
-        }
-    },
-    "files": [
-        "dist",
-        "src",
-        "README.md",
-        "LICENSE"
-    ],
-    "scripts": {
-        "build": "tsup",
-        "dev": "tsup --watch",
-        "type-check": "tsc --noEmit",
-        "test": "vitest run",
-        "test:watch": "vitest",
-        "clean": "rm -rf dist",
-        "prepublishOnly": "npm run clean && npm run build"
-    },
-    "dependencies": {
-        "@noble/hashes": "^1.5.0",
-        "@orangecheck/agent-core": "^0.1.0"
-    },
-    "devDependencies": {
-        "@types/node": "^22.10.2",
-        "tsup": "^8.3.5",
-        "typescript": "^5.7.2",
-        "vitest": "^3.2.4"
+  "name": "@orangecheck/agent-signer",
+  "version": "0.2.0",
+  "description": "OC Agent signer: createDelegation(), signAsAgent(), revoke(). Composes @orangecheck/agent-core with a wallet-adapter signing function and optional OTS anchoring.",
+  "keywords": [
+    "bitcoin",
+    "agent",
+    "authority",
+    "delegation",
+    "bip322",
+    "oc-agent",
+    "orangecheck"
+  ],
+  "author": "OrangeCheck",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/orangecheck/oc-packages.git",
+    "directory": "agent-signer"
+  },
+  "homepage": "https://github.com/orangecheck/oc-agent-protocol",
+  "bugs": {
+    "url": "https://github.com/orangecheck/oc-agent-protocol/issues"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
     }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.5.0",
+    "@orangecheck/agent-core": "^0.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^3.2.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/src/index.ts

@@ -18,9 +18,13 @@ import {
     ENVELOPE_VERSION,
     hexEncode,
     parseScope,
+    sealScopes,
     validateScope,
 } from '@orangecheck/agent-core';
-import type { ValidationOptions } from '@orangecheck/agent-core';
+import type {
+    ScopesEncryptedEnvelope,
+    ValidationOptions,
+} from '@orangecheck/agent-core';
 import type {
     ActionEnvelope,
     ActionOts,
@@ -62,6 +66,39 @@ export interface CreateDelegationInput {
     revocationRef?: string | null;
     /** Default 'strict'. 'permissive' allows unregistered scopes / constraint keys. */
     scopeMode?: ValidationOptions['mode'];
+    /**
+     * v1.2 private-scope (PRIVATE-SCOPE.md). When supplied, the resulting
+     * delegation envelope omits the public `scopes` field and instead carries
+     * `scopes_encrypted` — an OC Lock envelope wrapping the canonical scope
+     * list, sealed to one or more recipient device keys. The principal signs
+     * BOTH the inner OC Lock envelope (via the `signMessage` callback already
+     * provided on `principal`) AND the outer OC Agent canonical message.
+     *
+     * Recipients MUST include at least the agent's device. Additional
+     * recipients (compliance auditors, third-party verifiers) are optional.
+     */
+    privateScopes?: {
+        /**
+         * Devices authorized to read the scope set. Each is `{ address,
+         * device_id, device_pk }` matching OC Lock's `DeviceRecord` shape.
+         * The same `signMessage` callback on `principal` is used to sign the
+         * inner OC Lock envelope.
+         */
+        recipients: PrivateScopeRecipient[];
+        /** Optional human hint stored in the OC Lock envelope. */
+        hint?: string;
+        /** Optional expiry on the OC Lock envelope. Independent of the
+         *  delegation's expires_at; usually left unset. */
+        envelopeExpiresAt?: Date | null;
+    };
+}
+
+/** Mirror of @orangecheck/lock-core's DeviceRecord. */
+export interface PrivateScopeRecipient {
+    address: string;
+    device_id: string;
+    /** 32-byte hex X25519 public key. */
+    device_pk: string;
 }
 
 export async function createDelegation(input: CreateDelegationInput): Promise<DelegationEnvelope> {
@@ -115,6 +152,32 @@ export async function createDelegation(input: CreateDelegationInput): Promise<De
     };
     const id = computeDelegationId(canonInput);
 
+    // v1.2 private-scope: seal BEFORE the principal's outer signature so the
+    // user's wallet sees both prompts in a deterministic order (inner Lock
+    // sig first, outer OC Agent sig second).
+    let scopesEncrypted: ScopesEncryptedEnvelope | undefined;
+    if (input.privateScopes) {
+        if (!input.privateScopes.recipients || input.privateScopes.recipients.length === 0) {
+            throw new Error(
+                'createDelegation: privateScopes.recipients must contain at least the agent device'
+            );
+        }
+        scopesEncrypted = await sealScopes({
+            scopes,
+            sender: {
+                address: input.principal.address,
+                signMessage: input.principal.signMessage,
+            },
+            recipients: input.privateScopes.recipients,
+            ...(input.privateScopes.hint !== undefined && {
+                hint: input.privateScopes.hint,
+            }),
+            ...(input.privateScopes.envelopeExpiresAt !== undefined && {
+                expiresAt: input.privateScopes.envelopeExpiresAt,
+            }),
+        });
+    }
+
     const sigValue = await input.principal.signMessage(id);
 
     const envelope: DelegationEnvelope = {
@@ -123,7 +186,8 @@ export async function createDelegation(input: CreateDelegationInput): Promise<De
         id,
         principal: { address: input.principal.address, alg: 'bip322' },
         agent: { address: input.agentAddress, alg: 'bip322' },
-        scopes,
+        // Public OR private mode — never both. PRIVATE-SCOPE.md §1.1.
+        ...(scopesEncrypted ? { scopes_encrypted: scopesEncrypted } : { scopes }),
         bond,
         issued_at: issuedAt,
         expires_at: expiresAt,