/**
 * Delegation-as-Claim skeleton — agent authorization via Claim Algebra.
 *
 * Implements the delegation operator from §3 of
 * `vauban-privacy-protocol/docs/research/03-agentic-privacy.md`.
 *
 * A DelegationClaim records that a parent Claim (held by a human or another agent)
 * authorizes a delegatee pseudonym to act within a bounded scope and time window.
 *
 * The full ZK proof of delegation (STARK proof walking the chain) is out of scope
 * for this TypeScript slice. This module provides the data structures and builder
 * so the agent SDK can produce delegation-compatible payloads for future proof
 * generation (handled by the Rust HDNT crate).
 *
 * @module privacy/delegation
 */
// ─── Helpers ──────────────────────────────────────────────────────────────────
/**
 * Serialize a DelegationScope to a deterministic JSON witness string.
 * Keys are sorted (JCS-compatible) for reproducibility in proof circuits.
 */
export function serializeDelegationScope(scope) {
    return JSON.stringify({
        allowedActions: [...scope.allowedActions].sort(),
        expiry: scope.expiry,
    });
}
/**
 * Return true if the scope is still valid at the given Unix timestamp.
 *
 * @param scope - DelegationScope to check.
 * @param nowSec - Current time in Unix seconds. Defaults to `Date.now() / 1000`.
 */
export function isDelegationScopeValid(scope, nowSec = Math.floor(Date.now() / 1000)) {
    return nowSec < scope.expiry;
}
/**
 * Return true if the given action type is permitted by the scope.
 *
 * `["*"]` grants permission to all action types (wildcard).
 */
export function isActionAllowed(scope, actionType) {
    return scope.allowedActions.includes("*") || scope.allowedActions.includes(actionType);
}
// ─── Public API ───────────────────────────────────────────────────────────────
/**
 * Build a DelegationClaim from a parent ClaimRef, delegatee pseudonym, and scope.
 *
 * The returned object is a proof-ready payload. The STARK proof of correct
 * delegation (proving the delegation chain without revealing identity) is
 * generated by the Rust HDNT crate from this payload.
 *
 * @param parentClaim       - ClaimRef of the root or intermediate claim granting authority.
 * @param delegateePseudonym - Agent nullifier (felt252 BigInt) for the delegatee.
 * @param scope             - Authorized action scope and expiry.
 * @returns DelegationClaim ready for proof generation.
 */
export function buildDelegationClaim(parentClaim, delegateePseudonym, scope) {
    return {
        parentClaim,
        delegateePseudonym: `0x${delegateePseudonym.toString(16)}`,
        scope,
        issuedAt: new Date().toISOString(),
        scopeWitness: serializeDelegationScope(scope),
    };
}
//# sourceMappingURL=delegation.js.map