@orangecheck/agent-core / VerifySubdelegationInput
Interface: VerifySubdelegationInput
Defined in: agent-core/src/verify.ts:850
Extends
Properties
| Property | Type | Description | Inherited from | Defined in |
|---|---|---|---|---|
<a id="property-decryptscopeswith"></a> decryptScopesWith? | { device_id: string; secretKey: Uint8Array; } | v1.2 private-scope decryption key for the subdelegation envelope itself. Not used for the parent — the caller hydrates the parent. | - | agent-core/src/verify.ts:867 |
decryptScopesWith.device_id | string | - | - | agent-core/src/verify.ts:868 |
decryptScopesWith.secretKey | Uint8Array | - | - | agent-core/src/verify.ts:869 |
<a id="property-envelope"></a> envelope | SubdelegationEnvelope | - | - | agent-core/src/verify.ts:851 |
<a id="property-now"></a> now? | Date | Defaults to new Date(). | - | agent-core/src/verify.ts:862 |
<a id="property-parent"></a> parent | ChainLink | The immediate parent envelope. Required for linkage / containment checks. If the parent is itself v1.2 private-mode (scopes_encrypted) the caller MUST pre-hydrate it (e.g., via verifyDelegation's returned envelope) — the chain walker reads parent.scopes directly. | - | agent-core/src/verify.ts:858 |
<a id="property-revocations"></a> revocations? | RevocationEnvelope[] | Revocations to evaluate against the delegation (or, for an action, every link in its chain). Fetch these from kind-30085 by #delegation. | VerifyBase.revocations | agent-core/src/verify.ts:68 |
<a id="property-scopemode"></a> scopeMode? | "strict" | "permissive" | - | VerifyBase.scopeMode | agent-core/src/verify.ts:50 |
<a id="property-skiprevocationcheck"></a> skipRevocationCheck? | boolean | Verify WITHOUT consulting revocation feeds. Required to be explicit. SECURITY §7 item 7: "Query revocation feeds (Nostr kind-30085 by #delegation) for the cited delegation id before reporting OK, unless the caller explicitly opts out." The default was inverted — revocations were checked only when supplied, and omitting them skipped the check silently, so "checked, clean" was indistinguishable from "never checked". This library has no network by design, so the caller fetches the feed and passes revocations. Declining to is a decision they must state. | VerifyBase.skipRevocationCheck | agent-core/src/verify.ts:63 |
<a id="property-skipsignatureverification"></a> skipSignatureVerification? | boolean | - | VerifyBase.skipSignatureVerification | agent-core/src/verify.ts:49 |
<a id="property-skiptemporalcheck"></a> skipTemporalCheck? | boolean | Skip the "now ∈ [issued, expires)" check. Useful for inspection. | - | agent-core/src/verify.ts:860 |
<a id="property-verifybip322"></a> verifyBip322? | (msg: string, signatureB64: string, address: string) => Promise<boolean> | - | VerifyBase.verifyBip322 | agent-core/src/verify.ts:48 |