{ "schema_version": 1, "generator": "TypeScript exported symbol resolution", "packages": [ { "package": "@openagentid/aegis-sdk", "url": "/reference/typescript/aegis-sdks-typescript", "exports": [ { "name": "chainCoinType", "signature": "export declare const chainCoinType: (chain: Chain) => number;", "documentation": "BIP-44 coin type for the given chain.", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 269 }, { "name": "derivationStandard", "signature": "export declare const derivationStandard: (chain: Chain) => \"BIP-44\" | \"SLIP-0010\";", "documentation": "Returns the derivation standard name for the given chain.", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 294 }, { "name": "makePagination", "signature": "export declare const makePagination: (limit: number, offset: number) => Pagination;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 355 }, { "name": "IdentityType", "signature": "// ---------------------------------------------------------------------------\n// Authentication (§7)\n// ---------------------------------------------------------------------------\n/** The type of entity being authenticated. */\nexport type IdentityType = \"human\" | \"agent\" | \"organization\" | \"enterprise\" | \"delegated\";", "documentation": "The type of entity being authenticated.", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 16 }, { "name": "AegisIdentity", "signature": "/** Identity information extracted from authentication. */\nexport interface AegisIdentity {\n did: string;\n identityType: IdentityType;\n displayName?: string | null;\n conformanceLevel?: number | null;\n}", "documentation": "Identity information extracted from authentication.", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 24 }, { "name": "AuthContext", "signature": "/** The output of successful authentication (AEGIS Spec §7.1). */\nexport interface AuthContext {\n provider: string;\n subject: string;\n did?: string | null;\n sessionId?: string | null;\n expiresAt?: string | null; // ISO-8601 UTC\n claims: Record;\n}", "documentation": "The output of successful authentication (AEGIS Spec §7.1).", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 32 }, { "name": "AuthCredential", "signature": "/** Discriminated union of credentials accepted by AEGIS auth providers (§7.2). */\nexport type AuthCredential = {\n type: \"bearer_token\";\n token: string;\n} | {\n type: \"session_cookie\";\n cookie: string;\n} | {\n type: \"api_key\";\n key: string;\n} | {\n type: \"signed_challenge\";\n did: string;\n challenge: string;\n signature: string;\n timestamp: string;\n nonce: string;\n} | {\n type: \"capability_token\";\n token: string;\n} | {\n type: \"passkey_assertion\";\n credentialId: string;\n authenticatorData: string;\n clientDataJson: string;\n signature: string;\n} | {\n type: \"custom\";\n provider: string;\n data: unknown;\n};", "documentation": "Discriminated union of credentials accepted by AEGIS auth providers (§7.2).", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 42 }, { "name": "Session", "signature": "/** Session token structure (AEGIS Spec §7.4). */\nexport interface Session {\n sessionId: string;\n did: string;\n provider: string;\n createdAt: string; // ISO-8601 UTC\n expiresAt: string; // ISO-8601 UTC\n scope: string[];\n deviceBinding?: string | null;\n}", "documentation": "Session token structure (AEGIS Spec §7.4).", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 65 }, { "name": "PolicyContext", "signature": "// ---------------------------------------------------------------------------\n// Policy (§8)\n// ---------------------------------------------------------------------------\nexport interface PolicyContext {\n authContext?: AuthContext | null;\n lineage?: LineageSummary | null;\n conformanceLevel?: number | null;\n session?: Session | null;\n extra: Record;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 79 }, { "name": "LineageSummary", "signature": "export interface LineageSummary {\n depth: number;\n humanRoot: string;\n verified: boolean;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 87 }, { "name": "PolicyRequest", "signature": "export interface PolicyRequest {\n principal: string;\n action: string;\n resource: string;\n context: PolicyContext;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 93 }, { "name": "ObligationType", "signature": "export type ObligationType = \"log\" | \"notify\" | \"approve\" | \"escrow\" | \"limit\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 100 }, { "name": "Obligation", "signature": "export interface Obligation {\n obligationType: ObligationType;\n params: Record;\n deadline?: string | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 102 }, { "name": "AuditInfo", "signature": "export interface AuditInfo {\n auditId: string;\n timestamp: string;\n engine: string;\n policiesEvaluated: string[];\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 108 }, { "name": "PolicyDecision", "signature": "export interface PolicyDecision {\n allowed: boolean;\n reason?: string | null;\n obligations: Obligation[];\n auditInfo: AuditInfo;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 115 }, { "name": "PermissionCheck", "signature": "export interface PermissionCheck {\n principal: string;\n permission: string;\n resource?: string | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 122 }, { "name": "RevocationStatus", "signature": "// ---------------------------------------------------------------------------\n// Verification (§5)\n// ---------------------------------------------------------------------------\nexport type RevocationStatus = \"active\" | \"revoked\" | \"suspended\" | \"expired\" | \"unknown\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 132 }, { "name": "LivenessStatus", "signature": "export type LivenessStatus = \"active\" | \"warning\" | \"stale\" | \"unknown\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 139 }, { "name": "VerificationResult", "signature": "export interface VerificationResult {\n did: string;\n signatureValid: boolean;\n lineageValid: boolean;\n lineageDepth: number;\n humanRoot?: string | null;\n revocationStatus: RevocationStatus;\n livenessStatus: LivenessStatus;\n conformanceLevel: number;\n warnings: string[];\n verifiedAt: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 141 }, { "name": "VerificationConfig", "signature": "export interface VerificationConfig {\n maxLineageDepth: number;\n perHopTimeoutSecs: number;\n totalTimeoutSecs: number;\n cacheTtlSecs: number;\n livenessPeriodDays: number;\n conformanceLevel: number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 154 }, { "name": "DEFAULT_VERIFICATION_CONFIG", "signature": "export declare const DEFAULT_VERIFICATION_CONFIG: VerificationConfig;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 163 }, { "name": "ActiveHours", "signature": "// ---------------------------------------------------------------------------\n// Delegation (§9)\n// ---------------------------------------------------------------------------\nexport interface ActiveHours {\n startHour: number;\n endHour: number;\n timezone: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 176 }, { "name": "TemporalConstraints", "signature": "export interface TemporalConstraints {\n validFrom?: string | null;\n validUntil?: string | null;\n activeHours?: ActiveHours | null;\n cooldown?: string | null; // ISO 8601 duration\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 182 }, { "name": "SpendingLimits", "signature": "export interface SpendingLimits {\n maxAmount?: string | null;\n dailyVolume?: string | null;\n assetAllowlist: string[];\n recipientAllowlist: string[];\n approvalThreshold?: string | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 189 }, { "name": "DelegationScope", "signature": "export interface DelegationScope {\n actions: string[];\n resources: string[];\n chains: string[];\n limits?: SpendingLimits | null;\n temporal?: TemporalConstraints | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 197 }, { "name": "DelegationProof", "signature": "export interface DelegationProof {\n type: \"AegisDelegationProof2025\";\n verificationMethod: string;\n created: string;\n jws: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 205 }, { "name": "Delegation", "signature": "export interface Delegation {\n id: string;\n delegator: string;\n delegate: string;\n scope: DelegationScope;\n created: string;\n expires?: string | null;\n revocable: boolean;\n proof: DelegationProof;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 212 }, { "name": "SessionKey", "signature": "export interface SessionKey {\n sessionKey: string; // multibase-encoded ephemeral verifying key\n principal: string;\n scope: DelegationScope;\n maxTransactions?: number | null;\n created: string;\n expires: string;\n proof: DelegationProof;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 223 }, { "name": "WalletType", "signature": "// ---------------------------------------------------------------------------\n// Wallet (§10)\n// ---------------------------------------------------------------------------\nexport type WalletType = \"eoa\" | \"smart\" | \"abstract\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 237 }, { "name": "Chain", "signature": "export type Chain = \"ethereum\" | \"polygon\" | \"arbitrum\" | \"optimism\" | \"base\" | \"solana\" | \"bitcoin\" | \"cosmos\" | \"osmosis\" | \"aptos\" | \"sui\" | \"starknet\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 239 }, { "name": "CHAIN_VALUES", "signature": "export declare const CHAIN_VALUES: readonly Chain[];", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 253 }, { "name": "SigningMode", "signature": "export type SigningMode = \"direct\" | \"mpc\" | \"tee\" | \"external\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 305 }, { "name": "BatchMode", "signature": "export type BatchMode = \"all_or_nothing\" | \"best_effort\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 307 }, { "name": "KeyRole", "signature": "// ---------------------------------------------------------------------------\n// Key Management (§6)\n// ---------------------------------------------------------------------------\nexport type KeyRole = \"identity\" | \"authentication\" | \"assertion\" | \"delegation\" | \"session\" | \"recovery\" | \"chain\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 313 }, { "name": "KeyGenerationMode", "signature": "export type KeyGenerationMode = \"direct\" | \"mpc\" | \"tee\" | \"hsm\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 322 }, { "name": "ThresholdConfig", "signature": "export interface ThresholdConfig {\n threshold: number;\n totalShares: number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 324 }, { "name": "GuardianType", "signature": "export type GuardianType = \"identity\" | \"email\" | \"phone\" | \"hardware\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 329 }, { "name": "Guardian", "signature": "export interface Guardian {\n guardianType: GuardianType;\n identifier: string;\n weight: number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 331 }, { "name": "RecoveryConfig", "signature": "export interface RecoveryConfig {\n guardians: Guardian[];\n threshold: number;\n timelock: string; // ISO 8601 duration\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 337 }, { "name": "MAX_PAGE_SIZE", "signature": "export declare const MAX_PAGE_SIZE: 1000;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 347 }, { "name": "DEFAULT_PAGE_SIZE", "signature": "export declare const DEFAULT_PAGE_SIZE: 100;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 348 }, { "name": "Pagination", "signature": "export interface Pagination {\n limit: number;\n offset: number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 350 }, { "name": "DEFAULT_PAGINATION", "signature": "export declare const DEFAULT_PAGINATION: Pagination;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 362 }, { "name": "IdentityTypeSchema", "signature": "export declare const IdentityTypeSchema: z.ZodEnum<{ human: \"human\"; agent: \"agent\"; organization: \"organization\"; enterprise: \"enterprise\"; delegated: \"delegated\"; }>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 371 }, { "name": "ChainSchema", "signature": "export declare const ChainSchema: z.ZodEnum<{ ethereum: \"ethereum\"; polygon: \"polygon\"; arbitrum: \"arbitrum\"; optimism: \"optimism\"; base: \"base\"; solana: \"solana\"; bitcoin: \"bitcoin\"; cosmos: \"cosmos\"; osmosis: \"osmosis\"; aptos: \"aptos\"; sui: \"sui\"; starknet: \"starknet\"; }>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 379 }, { "name": "KeyRoleSchema", "signature": "export declare const KeyRoleSchema: z.ZodEnum<{ identity: \"identity\"; authentication: \"authentication\"; assertion: \"assertion\"; delegation: \"delegation\"; session: \"session\"; recovery: \"recovery\"; chain: \"chain\"; }>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 394 }, { "name": "SpendingLimitsSchema", "signature": "export declare const SpendingLimitsSchema: z.ZodObject<{ maxAmount: z.ZodOptional>; dailyVolume: z.ZodOptional>; assetAllowlist: z.ZodDefault>; recipientAllowlist: z.ZodDefault>; approvalThreshold: z.ZodOptional>; }, z.core.$strip>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 404 }, { "name": "ActiveHoursSchema", "signature": "export declare const ActiveHoursSchema: z.ZodObject<{ startHour: z.ZodNumber; endHour: z.ZodNumber; timezone: z.ZodString; }, z.core.$strip>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 412 }, { "name": "TemporalConstraintsSchema", "signature": "export declare const TemporalConstraintsSchema: z.ZodObject<{ validFrom: z.ZodOptional>; validUntil: z.ZodOptional>; activeHours: z.ZodOptional>>; cooldown: z.ZodOptional>; }, z.core.$strip>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 418 }, { "name": "DelegationScopeSchema", "signature": "export declare const DelegationScopeSchema: z.ZodObject<{ actions: z.ZodDefault>; resources: z.ZodDefault>; chains: z.ZodDefault>; limits: z.ZodOptional>; dailyVolume: z.ZodOptional>; assetAllowlist: z.ZodDefault>; recipientAllowlist: z.ZodDefault>; approvalThreshold: z.ZodOptional>; }, z.core.$strip>>>; temporal: z.ZodOptional>; validUntil: z.ZodOptional>; activeHours: z.ZodOptional>>; cooldown: z.ZodOptional>; }, z.core.$strip>>>; }, z.core.$strip>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 425 }, { "name": "DelegationProofSchema", "signature": "export declare const DelegationProofSchema: z.ZodObject<{ type: z.ZodLiteral<\"AegisDelegationProof2025\">; verificationMethod: z.ZodString; created: z.ZodString; jws: z.ZodString; }, z.core.$strip>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 433 }, { "name": "DelegationSchema", "signature": "export declare const DelegationSchema: z.ZodObject<{ id: z.ZodString; delegator: z.ZodString; delegate: z.ZodString; scope: z.ZodObject<{ actions: z.ZodDefault>; resources: z.ZodDefault>; chains: z.ZodDefault>; limits: z.ZodOptional>; dailyVolume: z.ZodOptional>; assetAllowlist: z.ZodDefault>; recipientAllowlist: z.ZodDefault>; approvalThreshold: z.ZodOptional>; }, z.core.$strip>>>; temporal: z.ZodOptional>; validUntil: z.ZodOptional>; activeHours: z.ZodOptional>>; cooldown: z.ZodOptional>; }, z.core.$strip>>>; }, z.core.$strip>; created: z.ZodString; expires: z.ZodOptional>; revocable: z.ZodBoolean; proof: z.ZodObject<{ type: z.ZodLiteral<\"AegisDelegationProof2025\">; verificationMethod: z.ZodString; created: z.ZodString; jws: z.ZodString; }, z.core.$strip>; }, z.core.$strip>;", "documentation": "", "source": "aegis/sdks/typescript/src/core/types.ts", "line": 440 }, { "name": "ResolverError", "signature": "// AEGIS Core — Tagged Errors\n//\n// Each AEGIS layer defines its own error variants. We use a discriminated\n// union of \"error tags\" rather than throwing untagged Error subclasses, so\n// callers can pattern-match safely on the `kind` field.\nexport type ResolverError = {\n kind: \"resolver/not_found\";\n did: string;\n message: string;\n} | {\n kind: \"resolver/invalid_format\";\n reason: string;\n message: string;\n} | {\n kind: \"resolver/timeout\";\n did: string;\n timeoutMs: number;\n message: string;\n} | {\n kind: \"resolver/deactivated\";\n did: string;\n message: string;\n} | {\n kind: \"resolver/network\";\n did: string;\n reason: string;\n message: string;\n} | {\n kind: \"resolver/creation_not_supported\";\n message: string;\n} | {\n kind: \"resolver/update_not_supported\";\n message: string;\n} | {\n kind: \"resolver/deactivation_not_supported\";\n message: string;\n};", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 7 }, { "name": "AuthError", "signature": "export type AuthError = {\n kind: \"auth/invalid_credential\";\n reason: string;\n message: string;\n} | {\n kind: \"auth/credential_expired\";\n expiredAt: string;\n message: string;\n} | {\n kind: \"auth/session_revoked\";\n sessionId: string;\n message: string;\n} | {\n kind: \"auth/session_expired\";\n sessionId: string;\n message: string;\n} | {\n kind: \"auth/challenge_invalid\";\n reason: string;\n message: string;\n} | {\n kind: \"auth/provider_unavailable\";\n provider: string;\n message: string;\n} | {\n kind: \"auth/refresh_not_supported\";\n provider: string;\n message: string;\n} | {\n kind: \"auth/revocation_not_supported\";\n provider: string;\n message: string;\n} | {\n kind: \"auth/internal\";\n reason: string;\n message: string;\n};", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 27 }, { "name": "PolicyError", "signature": "export type PolicyError = {\n kind: \"policy/evaluation_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"policy/timeout\";\n timeoutMs: number;\n message: string;\n} | {\n kind: \"policy/engine_unavailable\";\n message: string;\n} | {\n kind: \"policy/no_engine\";\n message: string;\n} | {\n kind: \"policy/config_error\";\n reason: string;\n message: string;\n};", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 42 }, { "name": "VerificationError", "signature": "export type VerificationError = {\n kind: \"verify/resolution_failed\";\n did: string;\n reason: string;\n message: string;\n} | {\n kind: \"verify/invalid_schema\";\n did: string;\n reason: string;\n message: string;\n} | {\n kind: \"verify/invalid_signature\";\n did: string;\n message: string;\n} | {\n kind: \"verify/lineage_failed\";\n did: string;\n reason: string;\n message: string;\n} | {\n kind: \"verify/max_depth_exceeded\";\n did: string;\n depth: number;\n maxDepth: number;\n message: string;\n} | {\n kind: \"verify/revoked\";\n did: string;\n message: string;\n} | {\n kind: \"verify/suspended\";\n did: string;\n message: string;\n} | {\n kind: \"verify/human_root_revoked\";\n humanRoot: string;\n message: string;\n} | {\n kind: \"verify/generation_mismatch\";\n did: string;\n expected: number;\n found: number;\n message: string;\n} | {\n kind: \"verify/timeout\";\n did: string;\n message: string;\n} | {\n kind: \"verify/consistency_violation\";\n did: string;\n reason: string;\n message: string;\n};", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 49 }, { "name": "KeyError", "signature": "export type KeyError = {\n kind: \"key/generation_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"key/derivation_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"key/rotation_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"key/recovery_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"key/mpc_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"key/not_found\";\n keyId: string;\n message: string;\n} | {\n kind: \"key/storage_error\";\n reason: string;\n message: string;\n} | {\n kind: \"key/signing_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"key/unsupported_type\";\n keyType: string;\n message: string;\n};", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 94 }, { "name": "DelegationError", "signature": "export type DelegationError = {\n kind: \"delegation/invalid_proof\";\n reason: string;\n message: string;\n} | {\n kind: \"delegation/revoked\";\n delegationId: string;\n message: string;\n} | {\n kind: \"delegation/expired\";\n delegationId: string;\n message: string;\n} | {\n kind: \"delegation/max_depth_exceeded\";\n depth: number;\n maxDepth: number;\n message: string;\n} | {\n kind: \"delegation/scope_amplification\";\n reason: string;\n message: string;\n} | {\n kind: \"delegation/delegator_not_found\";\n did: string;\n message: string;\n} | {\n kind: \"delegation/delegate_not_found\";\n did: string;\n message: string;\n};", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 105 }, { "name": "WalletError", "signature": "export type WalletError = {\n kind: \"wallet/authorization_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"wallet/signing_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"wallet/unsupported_chain\";\n chain: string;\n message: string;\n} | {\n kind: \"wallet/derivation_failed\";\n chain: string;\n reason: string;\n message: string;\n} | {\n kind: \"wallet/policy_denied\";\n reason: string;\n message: string;\n} | {\n kind: \"wallet/obligation_failed\";\n reason: string;\n message: string;\n} | {\n kind: \"wallet/batch_partial_failure\";\n succeeded: number;\n total: number;\n message: string;\n};", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 119 }, { "name": "AegisError", "signature": "export type AegisError = ResolverError | AuthError | PolicyError | VerificationError | KeyError | DelegationError | WalletError;", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 138 }, { "name": "AegisException", "signature": "export declare class AegisException {\n error: AegisError;\n constructor(error: AegisError): AegisException;\n}", "documentation": "Throwable wrapper around a tagged AegisError.", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 148 }, { "name": "resolverErrors", "signature": "export declare const resolverErrors: { notFound: (did: string) => ResolverError; invalidFormat: (reason: string) => ResolverError; timeout: (did: string, timeoutMs: number) => ResolverError; deactivated: (did: string) => ResolverError; network: (did: string, reason: string) => ResolverError; creationNotSupported: () => ResolverError; updateNotSupported: () => ResolverError; deactivationNotSupported: () => ResolverError; };", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 160 }, { "name": "authErrors", "signature": "export declare const authErrors: { invalidCredential: (reason: string) => AuthError; credentialExpired: (expiredAt: string) => AuthError; sessionRevoked: (sessionId: string) => AuthError; sessionExpired: (sessionId: string) => AuthError; challengeInvalid: (reason: string) => AuthError; providerUnavailable: (provider: string) => AuthError; refreshNotSupported: (provider: string) => AuthError; revocationNotSupported: (provider: string) => AuthError; internal: (reason: string) => AuthError; };", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 202 }, { "name": "policyErrors", "signature": "export declare const policyErrors: { evaluationFailed: (reason: string) => PolicyError; timeout: (timeoutMs: number) => PolicyError; engineUnavailable: () => PolicyError; noEngine: () => PolicyError; configError: (reason: string) => PolicyError; };", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 250 }, { "name": "verificationErrors", "signature": "export declare const verificationErrors: { resolutionFailed: (did: string, reason: string) => VerificationError; invalidSchema: (did: string, reason: string) => VerificationError; invalidSignature: (did: string) => VerificationError; lineageFailed: (did: string, reason: string) => VerificationError; maxDepthExceeded: (did: string, depth: number, maxDepth: number) => VerificationError; revoked: (did: string) => VerificationError; suspended: (did: string) => VerificationError; humanRootRevoked: (humanRoot: string) => VerificationError; timeout: (did: string) => VerificationError; };", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 276 }, { "name": "keyErrors", "signature": "export declare const keyErrors: { generationFailed: (reason: string) => KeyError; derivationFailed: (reason: string) => KeyError; rotationFailed: (reason: string) => KeyError; recoveryFailed: (reason: string) => KeyError; mpcFailed: (reason: string) => KeyError; notFound: (keyId: string) => KeyError; storageError: (reason: string) => KeyError; signingFailed: (reason: string) => KeyError; unsupportedKeyType: (keyType: string) => KeyError; };", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 333 }, { "name": "delegationErrors", "signature": "export declare const delegationErrors: { invalidProof: (reason: string) => DelegationError; revoked: (delegationId: string) => DelegationError; expired: (delegationId: string) => DelegationError; maxDepthExceeded: (depth: number, maxDepth: number) => DelegationError; scopeAmplification: (reason: string) => DelegationError; delegatorNotFound: (did: string) => DelegationError; delegateNotFound: (did: string) => DelegationError; };", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 381 }, { "name": "walletErrors", "signature": "export declare const walletErrors: { authorizationFailed: (reason: string) => WalletError; signingFailed: (reason: string) => WalletError; unsupportedChain: (chain: string) => WalletError; derivationFailed: (chain: string, reason: string) => WalletError; policyDenied: (reason: string) => WalletError; obligationFailed: (reason: string) => WalletError; batchPartialFailure: (succeeded: number, total: number) => WalletError; };", "documentation": "", "source": "aegis/sdks/typescript/src/core/errors.ts", "line": 420 }, { "name": "inferIdentityTypeFromDid", "signature": "export declare const inferIdentityTypeFromDid: (did: string) => \"human\" | \"organization\" | \"enterprise\" | \"agent\";", "documentation": "Infer the IdentityType from a `did:oas:::` string.\n\nReturns \"agent\" if the DID cannot be parsed.", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 113 }, { "name": "LifecycleStatus", "signature": "// AEGIS Core — OAS Document Interfaces\n//\n// AEGIS-TS does not vendor the OAS TypeScript SDK directly. Instead, it\n// declares the minimal subset of OAS types it needs (DidDocument shape,\n// LineageSection, VerificationMethod, lifecycle status, etc.) and accepts\n// any object satisfying these interfaces. Adapters in @oas/document or\n// custom implementations can supply documents that match.\n//\n// Reference: oas/oas/docs/oas/SPECIFICATION.md v1.1.0\nexport type LifecycleStatus = \"active\" | \"suspended\" | \"terminated\" | \"deprecated\" | \"draft\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 11 }, { "name": "EntityKind", "signature": "export type EntityKind = \"hmr\" | \"mhr\" | \"enr\" | \"ao\" | \"agent\" | \"agent:instance\" | \"tool\" | \"skill\" | \"workflow\" | \"model\" | \"dataset\" | \"service\";", "documentation": "", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 18 }, { "name": "VerificationMethod", "signature": "/** Verification method per W3C DID-Core. */\nexport interface VerificationMethod {\n id: string;\n type: string;\n controller: string;\n publicKeyMultibase: string;\n}", "documentation": "Verification method per W3C DID-Core.", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 33 }, { "name": "LineageSection", "signature": "/** Optional lineage section for non-root entities. */\nexport interface LineageSection {\n parent: string;\n generation: number;\n humanRootChain: string[];\n proof?: AgentLineageProof | null;\n}", "documentation": "Optional lineage section for non-root entities.", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 41 }, { "name": "AgentLineageProof", "signature": "export interface AgentLineageProof {\n type: string; // \"AgentLineageProof2025\"\n verificationMethod: string;\n created: string;\n jws: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 48 }, { "name": "DocumentMetadata", "signature": "export interface DocumentMetadata {\n created: string;\n updated?: string | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 55 }, { "name": "DocumentProof", "signature": "export interface DocumentProof {\n type: string; // e.g. \"Ed25519Signature2020\"\n verificationMethod: string;\n created: string;\n jws?: string;\n proofValue?: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 60 }, { "name": "OasDocument", "signature": "/** Minimal OAS Identity Document interface. */\nexport interface OasDocument {\n id: string;\n oasVersion: string;\n kind: string;\n verificationMethod: VerificationMethod[];\n authentication?: string[];\n assertionMethod?: string[];\n delegationMethod?: string[];\n metadata: DocumentMetadata;\n lineage?: LineageSection | null;\n lifecycleStatus?: LifecycleStatus | null;\n revoked?: boolean;\n proof?: DocumentProof | null;\n // Allow additional fields without complaining.\n [key: string]: unknown;\n}", "documentation": "Minimal OAS Identity Document interface.", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 69 }, { "name": "oasDocument", "signature": "export declare const oasDocument: { isRoot(doc: OasDocument): boolean; isRevoked(doc: OasDocument): boolean; primaryPublicKeyMultibase(doc: OasDocument): string | null; findVerificationMethod(doc: OasDocument, id: string): VerificationMethod | null; };", "documentation": "Helpers for inspecting OAS documents without coupling to a specific SDK.", "source": "aegis/sdks/typescript/src/core/oas.ts", "line": 87 }, { "name": "CreateDidParams", "signature": "// ---------------------------------------------------------------------------\n// DID Resolver Interface (§4.1)\n// ---------------------------------------------------------------------------\nexport interface CreateDidParams {\n entityKind: string;\n namespace: string;\n identifier: string;\n metadata: Record;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/plugin.ts", "line": 30 }, { "name": "DidCreationResult", "signature": "export interface DidCreationResult {\n did: string;\n document: OasDocument;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/plugin.ts", "line": 37 }, { "name": "DidResolver", "signature": "/**\n * DID Resolver plugin interface (§4.1).\n *\n * Enables AEGIS to resolve any DID method without coupling to a specific\n * resolution mechanism. Each resolver handles one or more DID methods.\n *\n * Implementations MUST resolve within 5 seconds.\n */\nexport interface DidResolver {\n resolve(did: string): Promise;\n handles(did: string): boolean;\n supportedMethods(): readonly string[];\n create?(params: CreateDidParams): Promise;\n update?(did: string, document: OasDocument): Promise;\n deactivate?(did: string): Promise;\n}", "documentation": "DID Resolver plugin interface (§4.1).\n\nEnables AEGIS to resolve any DID method without coupling to a specific\nresolution mechanism. Each resolver handles one or more DID methods.\n\nImplementations MUST resolve within 5 seconds.", "source": "aegis/sdks/typescript/src/core/plugin.ts", "line": 50 }, { "name": "AuthProvider", "signature": "// ---------------------------------------------------------------------------\n// Auth Provider Interface (§4.2)\n// ---------------------------------------------------------------------------\nexport interface AuthProvider {\n validate(credential: AuthCredential): Promise;\n getIdentity(ctx: AuthContext): Promise;\n providerName(): string;\n refresh?(ctx: AuthContext): Promise;\n revoke?(ctx: AuthContext): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/plugin.ts", "line": 63 }, { "name": "PolicyEngine", "signature": "// ---------------------------------------------------------------------------\n// Policy Engine Interface (§4.3)\n// ---------------------------------------------------------------------------\nexport interface PolicyEngine {\n evaluate(request: PolicyRequest): Promise;\n checkPermission(check: PermissionCheck): Promise;\n engineName(): string;\n getPolicies?(did: string): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/plugin.ts", "line": 75 }, { "name": "PluginRegistry", "signature": "export declare class PluginRegistry {\n registerResolver(resolver: DidResolver): void;\n registerAuthProvider(provider: AuthProvider): void;\n setPolicyEngine(engine: PolicyEngine): void;\n resolverCount(): number;\n authProviderCount(): number;\n hasPolicyEngine(): boolean;\n getResolverFor(did: string): DidResolver | null;\n getAuthProvider(name: string): AuthProvider | null;\n getPolicyEngine(): PolicyEngine | null;\n resolveDid(did: string): Promise;\n validateCredential(credential: AuthCredential, providerName?: string | null): Promise;\n evaluatePolicy(request: PolicyRequest): Promise;\n checkPermission(check: PermissionCheck): Promise;\n}", "documentation": "The Plugin Registry manages all loaded plugins and routes requests\nto the appropriate plugin (AEGIS Spec §4.4).\n\n- Multiple DID Resolvers (routed by `handles()` matching)\n- Multiple Auth Providers (keyed by `providerName()`)\n- Exactly one Policy Engine\n\nPlugin registration order is deterministic. Resolvers are tried in\nregistration order; the first whose `handles()` returns true is used.", "source": "aegis/sdks/typescript/src/core/plugin.ts", "line": 97 }, { "name": "setCryptoBackend", "signature": "export declare const setCryptoBackend: (impl: CryptoBackend) => void;", "documentation": "Inject a custom crypto backend implementation. Call this once at SDK\ninitialization (typically with the `@openagentid/crypto-wasm` exports).", "source": "aegis/sdks/typescript/src/core/wasm.ts", "line": 106 }, { "name": "cryptoBackend", "signature": "export declare const cryptoBackend: () => CryptoBackend;", "documentation": "Returns the active crypto backend. Throws if none has been registered.\n\nIn Node.js, the backend can be auto-loaded by `loadDefaultCryptoBackend`\nwhich dynamically imports `@openagentid/crypto-wasm`.", "source": "aegis/sdks/typescript/src/core/wasm.ts", "line": 116 }, { "name": "loadDefaultCryptoBackend", "signature": "export declare const loadDefaultCryptoBackend: () => Promise;", "documentation": "Attempts to load `@openagentid/crypto-wasm` lazily. Falls back to a\nstub error backend if the module isn't available — callers should\nrely on this for one-time setup in tests/examples.", "source": "aegis/sdks/typescript/src/core/wasm.ts", "line": 131 }, { "name": "CryptoBackend", "signature": "// AEGIS Core — WASM Crypto Bridge\n//\n// AEGIS-TS delegates all primitive cryptographic operations to a single\n// audited Rust implementation compiled to WebAssembly via wasm-pack. The\n// canonical package is `@openagentid/crypto-wasm`. We import its named\n// exports lazily so that the rest of the SDK works in environments where\n// the WASM module is loaded asynchronously (Workers, Deno, etc.).\n//\n// The contract below is the API surface AEGIS depends on. The actual\n// `@openagentid/crypto-wasm` package is built in parallel; until it ships,\n// callers can inject a custom implementation via `setCryptoBackend()`.\n//\n// All byte parameters use Uint8Array. All return types are Uint8Array\n// except for canonicalize which returns Uint8Array (UTF-8 of canonical\n// JSON) and hash functions which return raw bytes.\nexport interface CryptoBackend {\n // -- Ed25519 --\n ed25519GenerateKeypair(): {\n signingKey: Uint8Array;\n verifyingKey: Uint8Array;\n };\n ed25519PublicFromPrivate(signingKey: Uint8Array): Uint8Array;\n ed25519Sign(signingKey: Uint8Array, message: Uint8Array): Uint8Array;\n ed25519Verify(verifyingKey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;\n // -- HKDF-SHA256 --\n hkdfSha256(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array, length: number): Uint8Array;\n // -- BLAKE3 --\n blake3Hash(input: Uint8Array): Uint8Array;\n // -- SHA --\n sha256(input: Uint8Array): Uint8Array;\n sha512(input: Uint8Array): Uint8Array;\n // -- AES-256-GCM --\n aes256GcmEncrypt(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array): Uint8Array;\n aes256GcmDecrypt(key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array): Uint8Array;\n // -- JCS --\n jcsCanonicalize(value: unknown): Uint8Array;\n // -- Multibase base58btc --\n multibaseEncode(bytes: Uint8Array): string;\n multibaseDecode(encoded: string): Uint8Array;\n // -- Random bytes (CSPRNG) --\n randomBytes(length: number): Uint8Array;\n // -- FROST-Ed25519 (raw protocol primitives) --\n frostTrustedKeygen(minSigners: number, maxSigners: number): {\n keyPackages: FrostKeyPackage[];\n publicKeyPackage: Uint8Array;\n };\n frostSignRound1(signingShare: Uint8Array): {\n nonces: Uint8Array;\n commitments: Uint8Array;\n };\n frostSignRound2(signingPackage: Uint8Array, nonces: Uint8Array, keyPackage: Uint8Array): Uint8Array;\n frostBuildSigningPackage(commitments: Map, message: Uint8Array): Uint8Array;\n frostAggregate(signingPackage: Uint8Array, signatureShares: Map, publicKeyPackage: Uint8Array): Uint8Array;\n frostVerify(publicKeyPackage: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/wasm.ts", "line": 17 }, { "name": "FrostKeyPackage", "signature": "export interface FrostKeyPackage {\n identifier: number; // 1..max_signers\n bytes: Uint8Array;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/core/wasm.ts", "line": 95 }, { "name": "base64UrlEncode", "signature": "export declare const base64UrlEncode: (bytes: Uint8Array) => string;", "documentation": "Encode bytes as URL-safe base64 without padding.", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 11 }, { "name": "base64UrlDecode", "signature": "export declare const base64UrlDecode: (input: string) => Uint8Array;", "documentation": "Decode a URL-safe base64 string (with or without padding) to bytes.", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 50 }, { "name": "hexEncode", "signature": "export declare const hexEncode: (bytes: Uint8Array) => string;", "documentation": "", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 97 }, { "name": "hexDecode", "signature": "export declare const hexDecode: (input: string) => Uint8Array;", "documentation": "", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 105 }, { "name": "utf8Encode", "signature": "export declare const utf8Encode: (s: string) => Uint8Array;", "documentation": "", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 127 }, { "name": "utf8Decode", "signature": "export declare const utf8Decode: (bytes: Uint8Array) => string;", "documentation": "", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 131 }, { "name": "concatBytes", "signature": "export declare const concatBytes: (...chunks: Uint8Array[]) => Uint8Array;", "documentation": "", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 135 }, { "name": "u32BeBytes", "signature": "export declare const u32BeBytes: (n: number) => Uint8Array;", "documentation": "big-endian u32 → 4 bytes", "source": "aegis/sdks/typescript/src/core/encoding.ts", "line": 148 }, { "name": "VerificationPipeline", "signature": "export declare class VerificationPipeline {\n constructor(registry: PluginRegistry, config?: VerificationConfig): VerificationPipeline;\n cache(): VerificationCache;\n verify(did: string): Promise;\n verifyForceRefresh(did: string): Promise;\n}", "documentation": "The AEGIS Verification Pipeline.\n\nPerforms complete verification of OAS identity documents per AEGIS\nSpecification §5. Results are cached with a configurable TTL (max\n300 seconds per spec).", "source": "aegis/sdks/typescript/src/verify/pipeline.ts", "line": 49 }, { "name": "VerificationCache", "signature": "export declare class VerificationCache {\n constructor(ttlSecs: number): VerificationCache;\n ttl(): number;\n size(): number;\n isEmpty(): boolean;\n get(did: string): VerificationResult | null;\n insert(did: string, result: VerificationResult): void;\n invalidate(did: string): void;\n clear(): void;\n cleanupExpired(): number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/verify/cache.ts", "line": 18 }, { "name": "VerificationCacheStore", "signature": "export interface VerificationCacheStore {\n getCached(did: string): Promise;\n storeCached(did: string, result: VerificationResult): Promise;\n invalidate(did: string): Promise;\n cleanupExpired(): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/verify/store.ts", "line": 9 }, { "name": "InMemoryVerificationCacheStore", "signature": "export declare class InMemoryVerificationCacheStore {\n constructor(ttlSecs: number): InMemoryVerificationCacheStore;\n ttlSecs(): number;\n getCached(did: string): Promise;\n storeCached(did: string, result: VerificationResult): Promise;\n invalidate(did: string): Promise;\n cleanupExpired(): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/verify/store.ts", "line": 24 }, { "name": "deriveLineageKey", "signature": "export declare const deriveLineageKey: (parentPrivate: Uint8Array, childDid: string, generation: number) => Uint8Array;", "documentation": "Derive a lineage key from a parent private key using HKDF-SHA256.\n\nAlgorithm:\n HKDF-SHA256(\n IKM = parent_private_key (32 bytes),\n Salt = child_did_utf8,\n Info = \"oas-lineage-v1\" || generation_be32,\n L = 32\n )", "source": "aegis/sdks/typescript/src/keys/derivation.ts", "line": 28 }, { "name": "derivationPath", "signature": "export declare const derivationPath: (chain: Chain, account: number, index: number) => string;", "documentation": "Build a BIP-44 derivation path for a given blockchain chain.\n\nReturns the standard `m/44'/coin_type'/account'/0/index` path\nused for HD key derivation across most chains.", "source": "aegis/sdks/typescript/src/keys/derivation.ts", "line": 58 }, { "name": "EncryptedKey", "signature": "export declare class EncryptedKey {\n ciphertext: Uint8Array;\n nonce: Uint8Array;\n encrypt(signingKeyBytes: Uint8Array, encryptionKey: Uint8Array): EncryptedKey;\n decrypt(encryptionKey: Uint8Array): Uint8Array;\n fromParts(ciphertext: Uint8Array, nonce: Uint8Array): EncryptedKey;\n}", "documentation": "An encrypted private key blob.\n\nUses AES-256-GCM with a random 96-bit nonce. The ciphertext contains\nthe 32-byte Ed25519 signing key material plus a 16-byte authentication tag.", "source": "aegis/sdks/typescript/src/keys/generation.ts", "line": 25 }, { "name": "ManagedKey", "signature": "export declare class ManagedKey {\n keyId: string;\n role: KeyRole;\n generationMode: KeyGenerationMode;\n publicKey: Uint8Array;\n encryptedPrivate: EncryptedKey;\n createdAt: string;\n constructor(params: { keyId: string; role: KeyRole; generationMode: KeyGenerationMode; publicKey: Uint8Array; encryptedPrivate: EncryptedKey; createdAt: string; }): ManagedKey;\n publicKeyMultibase(): string;\n decryptPrivate(encryptionKey: Uint8Array): Uint8Array;\n}", "documentation": "A managed key with metadata. The private key is stored encrypted; access\nto the raw signing key requires presenting the encryption key.", "source": "aegis/sdks/typescript/src/keys/generation.ts", "line": 100 }, { "name": "KeyGenerator", "signature": "export declare class KeyGenerator {\n generateDirect(role: KeyRole, encryptionKey: Uint8Array): ManagedKey;\n generateKeyId(): string;\n}", "documentation": "Key generator supporting multiple generation modes (§6.2).\n\nCurrently implements `direct` generation via the WASM backend's CSPRNG.\nMPC, TEE, and HSM modes are stubs that throw an unsupported error.", "source": "aegis/sdks/typescript/src/keys/generation.ts", "line": 142 }, { "name": "isRotationEligible", "signature": "export declare const isRotationEligible: (role: KeyRole) => boolean;", "documentation": "Convenience function: returns true if the role is eligible for standard\nrotation. Session and Recovery keys are excluded.", "source": "aegis/sdks/typescript/src/keys/rotation.ts", "line": 64 }, { "name": "RotationRequest", "signature": "export interface RotationRequest {\n keyId: string;\n /** Grace period in milliseconds. */\n gracePeriodMs: number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/keys/rotation.ts", "line": 15 }, { "name": "RotationResult", "signature": "export interface RotationResult {\n oldKeyId: string;\n newKey: ManagedKey;\n /** ISO-8601 timestamp at which the grace period ends. */\n gracePeriodEnds: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/keys/rotation.ts", "line": 21 }, { "name": "KeyRotation", "signature": "export declare class KeyRotation {\n initiate(old: ManagedKey, encryptionKey: Uint8Array): RotationResult;\n initiateWithGrace(old: ManagedKey, encryptionKey: Uint8Array, gracePeriodMs: number): RotationResult;\n isGracePeriodExpired(result: RotationResult): boolean;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/keys/rotation.ts", "line": 28 }, { "name": "parseIso8601DurationMs", "signature": "export declare const parseIso8601DurationMs: (input: string) => number;", "documentation": "Parse a simplified ISO 8601 duration into milliseconds.\n\nSupports `PT{n}S`, `PT{n}M`, `PT{n}H`, and `P{n}D`. Falls back to 24 hours\nfor unrecognized formats.", "source": "aegis/sdks/typescript/src/keys/recovery.ts", "line": 85 }, { "name": "GuardianAuthorization", "signature": "export interface GuardianAuthorization {\n guardian: Guardian;\n authorizedAt: string; // ISO-8601 UTC\n signature: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/keys/recovery.ts", "line": 14 }, { "name": "RecoveryCeremony", "signature": "export declare class RecoveryCeremony {\n ceremonyId: string;\n config: RecoveryConfig;\n authorizations: GuardianAuthorization[];\n initiatedAt: string;\n timelockUntil: string;\n constructor(config: RecoveryConfig): RecoveryCeremony;\n addAuthorization(auth: GuardianAuthorization): void;\n isThresholdMet(): boolean;\n isTimelockExpired(): boolean;\n canExecute(): boolean;\n accumulatedWeight(): number;\n authorizationCount(): number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/keys/recovery.ts", "line": 20 }, { "name": "KeyStore", "signature": "export interface KeyStore {\n store(key: ManagedKey): Promise;\n load(keyId: string): Promise;\n delete(keyId: string): Promise;\n list(role: KeyRole | null, pagination?: Pagination): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/keys/storage.ts", "line": 15 }, { "name": "InMemoryKeyStore", "signature": "export declare class InMemoryKeyStore {\n size(): number;\n isEmpty(): boolean;\n store(key: ManagedKey): Promise;\n load(keyId: string): Promise;\n delete(keyId: string): Promise;\n list(role: KeyRole | null, pagination?: Pagination): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/keys/storage.ts", "line": 26 }, { "name": "generateShares", "signature": "export declare const generateShares: (minSigners: number, maxSigners: number) => ThresholdKeyPackages;", "documentation": "Generate threshold key shares using FROST trusted dealer.\n\nCreates a `t-of-n` setup: any `minSigners` of `maxSigners` participants\nmay cooperate to produce a valid signature. The dealer is trusted to\ndestroy its copy of the master secret after distribution.", "source": "aegis/sdks/typescript/src/keys/threshold.ts", "line": 29 }, { "name": "signWithThreshold", "signature": "export declare const signWithThreshold: (message: Uint8Array, keyPackages: Map, publicKeyPackage: Uint8Array) => Uint8Array;", "documentation": "Run a complete FROST signing round in a single process.\n\nIn production, each participant would perform round1 and round2\nindependently. This helper executes the full 2-round protocol locally\nfor testing, validation, and single-process orchestration scenarios.", "source": "aegis/sdks/typescript/src/keys/threshold.ts", "line": 73 }, { "name": "verifyThresholdSignature", "signature": "export declare const verifyThresholdSignature: (message: Uint8Array, signature: Uint8Array, publicKeyPackage: Uint8Array) => boolean;", "documentation": "Verify an aggregated FROST signature against the group public key.", "source": "aegis/sdks/typescript/src/keys/threshold.ts", "line": 136 }, { "name": "ThresholdKeyPackages", "signature": "/** Result of FROST trusted-dealer key generation. */\nexport interface ThresholdKeyPackages {\n /** Per-participant key packages, indexed by FROST identifier (1..n). */\n keyPackages: Map;\n /** The serialized group public key package. */\n publicKeyPackage: Uint8Array;\n}", "documentation": "Result of FROST trusted-dealer key generation.", "source": "aegis/sdks/typescript/src/keys/threshold.ts", "line": 15 }, { "name": "FrostCeremony", "signature": "export declare class FrostCeremony {\n constructor(publicKeyPackage: Uint8Array, threshold: number): FrostCeremony;\n addCommitment(id: number, commitments: Uint8Array): void;\n hasEnoughCommitments(): boolean;\n buildSigningPackage(message: Uint8Array): Uint8Array;\n addSignatureShare(id: number, share: Uint8Array): void;\n hasEnoughShares(): boolean;\n aggregate(): Uint8Array;\n}", "documentation": "State of a distributed FROST signing ceremony, suitable for orchestrating\nthe protocol across multiple machines/processes. Each participant calls\nthe methods in order:\n\n 1. `addCommitment(id, commitments)` — gather round 1 outputs\n 2. `buildSigningPackage(message)` — build signing package once all\n participants have committed\n 3. `addSignatureShare(id, share)` — gather round 2 outputs\n 4. `aggregate()` — produce the final aggregated signature\n\nThe ceremony does NOT hold any participant key material — those remain\non the participant's own machine.", "source": "aegis/sdks/typescript/src/keys/threshold.ts", "line": 165 }, { "name": "generateChallenge", "signature": "export declare const generateChallenge: () => Challenge;", "documentation": "Generate a new random challenge.", "source": "aegis/sdks/typescript/src/auth/challenge.ts", "line": 31 }, { "name": "buildChallengePayload", "signature": "export declare const buildChallengePayload: (challenge: Challenge, did: string) => Uint8Array;", "documentation": "Build the JCS-canonical payload bytes for challenge signing/verification.\n\nCanonical form is a JSON object with keys in alphabetical order:\n\n {\"challenge\":\"\",\"did\":\"\",\"nonce\":\"\",\"timestamp\":\"\"}\n\nThe WASM crypto backend's `jcsCanonicalize` handles RFC 8785 ordering.", "source": "aegis/sdks/typescript/src/auth/challenge.ts", "line": 53 }, { "name": "Challenge", "signature": "/** A challenge issued by the verifier to an authenticating entity. */\nexport interface Challenge {\n /** 32 cryptographically random bytes. */\n challengeBytes: Uint8Array;\n /** ISO 8601 timestamp of challenge creation. */\n timestamp: string;\n /** Verifier-generated nonce (UUID v7). */\n nonce: string;\n /** Expiry timestamp (creation time + 60 seconds). */\n expiresAt: string;\n}", "documentation": "A challenge issued by the verifier to an authenticating entity.", "source": "aegis/sdks/typescript/src/auth/challenge.ts", "line": 19 }, { "name": "ChallengeVerifier", "signature": "export declare class ChallengeVerifier {\n verifyResponse(challenge: Challenge, did: string, signatureB64: string, publicKey: Uint8Array): void;\n clearNonces(): void;\n}", "documentation": "Challenge-response verifier with in-memory nonce tracking.\n\nProduction deployments should swap the in-memory nonce set for a TTL-\nbacked cache or database via the {@link NonceStore } abstraction in\n`auth/store.ts`.", "source": "aegis/sdks/typescript/src/auth/challenge.ts", "line": 71 }, { "name": "SessionManagerOptions", "signature": "export interface SessionManagerOptions {\n humanLifetimeMs?: number;\n agentLifetimeMs?: number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/auth/session.ts", "line": 17 }, { "name": "SessionManager", "signature": "export declare class SessionManager {\n humanLifetimeMs: number;\n agentLifetimeMs: number;\n constructor(opts?: SessionManagerOptions): SessionManager;\n createSession(params: { did: string; provider: string; scope?: string[]; isAgent: boolean; deviceBinding?: string | null; }): Session;\n getSession(sessionId: string): Session;\n revokeSession(sessionId: string): void;\n isValid(sessionId: string): boolean;\n cleanupExpired(): number;\n sessionCount(): number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/auth/session.ts", "line": 22 }, { "name": "ChallengeResponseProvider", "signature": "export declare class ChallengeResponseProvider {\n constructor(resolver: DidResolver): ChallengeResponseProvider;\n providerName(): string;\n verifier(): ChallengeVerifier;\n validate(credential: AuthCredential): Promise;\n getIdentity(ctx: AuthContext): Promise;\n}", "documentation": "Auth provider implementing the AEGIS challenge-response protocol.\n\nValidates `signed_challenge` credentials by:\n 1. Resolving the DID via the registered DID resolver\n 2. Extracting the primary authentication public key\n 3. Reconstructing the challenge and verifying the Ed25519 signature", "source": "aegis/sdks/typescript/src/auth/provider.ts", "line": 33 }, { "name": "ApiKeyProvider", "signature": "export declare class ApiKeyProvider {\n constructor(initial?: Record): ApiKeyProvider;\n providerName(): string;\n registerKey(key: string, did: string): void;\n revokeKey(key: string): boolean;\n validate(credential: AuthCredential): Promise;\n getIdentity(ctx: AuthContext): Promise;\n}", "documentation": "Simple API key auth provider for service-to-service communication.\n\nMaps opaque API keys to DIDs. Suitable for internal services that\nauthenticate via pre-shared keys rather than challenge-response.", "source": "aegis/sdks/typescript/src/auth/provider.ts", "line": 145 }, { "name": "SessionStore", "signature": "// ---------------------------------------------------------------------------\n// SessionStore\n// ---------------------------------------------------------------------------\nexport interface SessionStore {\n storeSession(session: Session): Promise;\n getSession(sessionId: string): Promise;\n deleteSession(sessionId: string): Promise;\n listByDid(did: string, pagination?: Pagination): Promise;\n cleanupExpired(): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/auth/store.ts", "line": 17 }, { "name": "InMemorySessionStore", "signature": "export declare class InMemorySessionStore {\n storeSession(session: Session): Promise;\n getSession(sessionId: string): Promise;\n deleteSession(sessionId: string): Promise;\n listByDid(did: string, pagination?: Pagination): Promise;\n cleanupExpired(): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/auth/store.ts", "line": 25 }, { "name": "NonceStore", "signature": "// ---------------------------------------------------------------------------\n// NonceStore\n// ---------------------------------------------------------------------------\nexport interface NonceStore {\n /** Returns true if newly recorded, false if already present (replay). */\n recordNonce(nonce: string): Promise;\n hasNonce(nonce: string): Promise;\n cleanup(): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/auth/store.ts", "line": 65 }, { "name": "InMemoryNonceStore", "signature": "export declare class InMemoryNonceStore {\n recordNonce(nonce: string): Promise;\n hasNonce(nonce: string): Promise;\n cleanup(): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/auth/store.ts", "line": 72 }, { "name": "TemporalPolicyEvaluator", "signature": "export declare class TemporalPolicyEvaluator {\n evaluate(constraints: TemporalConstraints, now?: Date): PolicyDecision;\n evaluateWithCooldown(constraints: TemporalConstraints, now: Date, lastOperation: Date | null): PolicyDecision;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/temporal.ts", "line": 17 }, { "name": "parseAmount", "signature": "export declare const parseAmount: (s: string) => number;", "documentation": "Parse a decimal amount string. Throws PolicyError on invalid input.", "source": "aegis/sdks/typescript/src/policy/spending.ts", "line": 128 }, { "name": "TransactionInfo", "signature": "export interface TransactionInfo {\n asset: string;\n amount: string;\n recipient: string;\n chain: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/spending.ts", "line": 17 }, { "name": "SpendingPolicyEvaluator", "signature": "export declare class SpendingPolicyEvaluator {\n evaluate(limits: SpendingLimits, tx: TransactionInfo, dailySpent: string): PolicyDecision;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/spending.ts", "line": 26 }, { "name": "LineagePolicy", "signature": "export interface LineagePolicy {\n minConformanceLevel?: number | null;\n maxLineageDepth?: number | null;\n /** When set, requires `verification.livenessStatus === \"active\"`. */\n requiredHumanRootLiveness?: number | null;\n requiredAttestations: string[];\n bannedHumanRoots: string[];\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/lineage.ts", "line": 17 }, { "name": "LineagePolicyEvaluator", "signature": "export declare class LineagePolicyEvaluator {\n evaluate(policy: LineagePolicy, verification: VerificationResult): PolicyDecision;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/lineage.ts", "line": 26 }, { "name": "ContractPolicy", "signature": "export interface ContractPolicy {\n contractAllowlist: string[];\n functionAllowlist: string[];\n chainAllowlist: string[];\n gasLimit?: number | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/contract.ts", "line": 13 }, { "name": "ContractInteraction", "signature": "export interface ContractInteraction {\n contractAddress: string;\n functionName: string;\n chain: string;\n gasEstimate?: number | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/contract.ts", "line": 20 }, { "name": "ContractPolicyEvaluator", "signature": "export declare class ContractPolicyEvaluator {\n evaluate(policy: ContractPolicy, interaction: ContractInteraction): PolicyDecision;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/policy/contract.ts", "line": 27 }, { "name": "composeDecisions", "signature": "export declare const composeDecisions: (decisions: readonly PolicyDecision[]) => PolicyDecision;", "documentation": "", "source": "aegis/sdks/typescript/src/policy/composition.ts", "line": 18 }, { "name": "isScopeSubset", "signature": "export declare const isScopeSubset: (child: DelegationScope, parent: DelegationScope) => boolean;", "documentation": "Returns true if `child` scope is a subset of `parent` scope.\n\nEmpty fields on `parent` mean \"wildcard\" — they accept any child value.\nLimits on `child` must be at least as restrictive as the parent's.", "source": "aegis/sdks/typescript/src/delegate/scope.ts", "line": 21 }, { "name": "intersectScopes", "signature": "export declare const intersectScopes: (a: DelegationScope, b: DelegationScope) => DelegationScope;", "documentation": "Compute the intersection of two scopes.\n\n- Empty list = wildcard, take the other side\n- Otherwise, set intersection\n- For limits, take the most restrictive value", "source": "aegis/sdks/typescript/src/delegate/scope.ts", "line": 95 }, { "name": "validateScope", "signature": "export declare const validateScope: (scope: DelegationScope) => void;", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/scope.ts", "line": 186 }, { "name": "createDelegationProof", "signature": "export declare const createDelegationProof: (params: { delegatorDid: string; delegateDid: string; scope: DelegationScope; expires?: string | null; signingKey: Uint8Array; verificationMethod: string; }) => Delegation;", "documentation": "Create a delegation proof by signing the delegation with the delegator's key.\n\nSteps per spec §9.7:\n 1. Construct delegation object (excluding proof field)\n 2. Canonicalize via JCS (RFC 8785)\n 3. Sign canonical bytes with delegator's delegation key (Ed25519)", "source": "aegis/sdks/typescript/src/delegate/proof.ts", "line": 41 }, { "name": "verifyDelegationProof", "signature": "export declare const verifyDelegationProof: (delegation: Delegation, delegatorPublicKey: Uint8Array) => boolean;", "documentation": "Verify a delegation proof against the delegator's public key.\n\nReconstructs the canonical form of the delegation (without the proof),\nthen verifies the Ed25519 signature in the proof's JWS field.", "source": "aegis/sdks/typescript/src/delegate/proof.ts", "line": 99 }, { "name": "DelegationTree", "signature": "export declare class DelegationTree {\n maxDepth: number;\n constructor(maxDepth?: number): DelegationTree;\n addDelegation(delegation: Delegation): void;\n getDelegationChain(delegateDid: string): Delegation[];\n effectiveScope(delegateDid: string): DelegationScope | null;\n depth(delegateDid: string): number;\n revoke(delegationId: string): string[];\n}", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/tree.ts", "line": 18 }, { "name": "RevocationRegistry", "signature": "export declare class RevocationRegistry {\n revoke(delegationId: string): void;\n isRevoked(delegationId: string): boolean;\n revokeCascade(ids: readonly string[]): void;\n size(): number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/revocation.ts", "line": 8 }, { "name": "createSessionKey", "signature": "export declare const createSessionKey: (params: { principalDid: string; scope: DelegationScope; maxTransactions?: number | null; lifetimeMs: number; principalSigningKey: Uint8Array; verificationMethod: string; }) => CreatedSessionKey;", "documentation": "Create a session key (temporary, scoped, max 24h).\n\nGenerates a fresh Ed25519 keypair for the session and signs the\ngrant with the principal's identity key.", "source": "aegis/sdks/typescript/src/delegate/session_key.ts", "line": 43 }, { "name": "CreatedSessionKey", "signature": "export interface CreatedSessionKey {\n sessionKey: SessionKey;\n /** The ephemeral 32-byte signing key. Caller is responsible for safekeeping. */\n ephemeralSigningKey: Uint8Array;\n ephemeralVerifyingKey: Uint8Array;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/session_key.ts", "line": 21 }, { "name": "DelegationStore", "signature": "// ---------------------------------------------------------------------------\n// DelegationStore\n// ---------------------------------------------------------------------------\nexport interface DelegationStore {\n storeDelegation(delegation: Delegation): Promise;\n getDelegation(id: string): Promise;\n listByDelegator(delegatorDid: string, pagination?: Pagination): Promise;\n listByDelegate(delegateDid: string, pagination?: Pagination): Promise;\n deleteDelegation(id: string): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/store.ts", "line": 17 }, { "name": "InMemoryDelegationStore", "signature": "export declare class InMemoryDelegationStore {\n storeDelegation(delegation: Delegation): Promise;\n getDelegation(id: string): Promise;\n listByDelegator(delegatorDid: string, pagination?: Pagination): Promise;\n listByDelegate(delegateDid: string, pagination?: Pagination): Promise;\n deleteDelegation(id: string): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/store.ts", "line": 25 }, { "name": "RevocationStore", "signature": "// ---------------------------------------------------------------------------\n// RevocationStore\n// ---------------------------------------------------------------------------\nexport interface RevocationStore {\n revoke(delegationId: string): Promise;\n isRevoked(delegationId: string): Promise;\n revokeBatch(ids: readonly string[]): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/store.ts", "line": 65 }, { "name": "InMemoryRevocationStore", "signature": "export declare class InMemoryRevocationStore {\n revoke(delegationId: string): Promise;\n isRevoked(delegationId: string): Promise;\n revokeBatch(ids: readonly string[]): Promise;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/delegate/store.ts", "line": 71 }, { "name": "WalletAddress", "signature": "export interface WalletAddress {\n chain: Chain;\n address: string;\n derivationPath: string;\n publicKeyHex: string;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/address.ts", "line": 26 }, { "name": "AddressDeriver", "signature": "export declare class AddressDeriver {\n derivationPath(chain: Chain, account: number, index: number): string;\n deriveAddress(chain: Chain, publicKeyBytes: Uint8Array): WalletAddress;\n deriveAll(publicKeyBytes: Uint8Array, chains: readonly Chain[]): WalletAddress[];\n}", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/address.ts", "line": 33 }, { "name": "verifySignature", "signature": "export declare const verifySignature: (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => boolean;", "documentation": "Verify an Ed25519 signature against a message and public key.", "source": "aegis/sdks/typescript/src/wallet/ceremony.ts", "line": 81 }, { "name": "SigningRequest", "signature": "export interface SigningRequest {\n message: Uint8Array;\n signerDid: string;\n chain?: Chain | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/ceremony.ts", "line": 16 }, { "name": "SigningResult", "signature": "export interface SigningResult {\n signature: Uint8Array;\n publicKey: Uint8Array;\n mode: SigningMode;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/ceremony.ts", "line": 22 }, { "name": "SigningBackend", "signature": "export interface SigningBackend {\n sign(request: SigningRequest): Promise;\n publicKey(): Uint8Array;\n mode(): SigningMode;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/ceremony.ts", "line": 28 }, { "name": "DirectSigner", "signature": "export declare class DirectSigner {\n constructor(signingKey: Uint8Array): DirectSigner;\n sign(request: SigningRequest): Promise;\n publicKey(): Uint8Array;\n mode(): SigningMode;\n}", "documentation": "Direct signing backend using a single Ed25519 key.\n\nThe signing key is stored in memory; callers should treat the instance\nas sensitive material and zeroize when done.", "source": "aegis/sdks/typescript/src/wallet/ceremony.ts", "line": 40 }, { "name": "makeTransaction", "signature": "export declare const makeTransaction: (params: { fromDid: string; to: string; chain: string; data: Uint8Array; value?: string | null; }) => Transaction;", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/pipeline.ts", "line": 36 }, { "name": "Transaction", "signature": "export interface Transaction {\n txId: string;\n fromDid: string;\n to: string;\n chain: string;\n data: Uint8Array;\n value?: string | null;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/pipeline.ts", "line": 27 }, { "name": "AuthorizedTransaction", "signature": "export interface AuthorizedTransaction {\n transaction: Transaction;\n signature: Uint8Array;\n fulfilledObligations: string[];\n}", "documentation": "", "source": "aegis/sdks/typescript/src/wallet/pipeline.ts", "line": 53 }, { "name": "TransactionPipeline", "signature": "export declare class TransactionPipeline {\n constructor(signer: SigningBackend): TransactionPipeline;\n authorizeAndSign(tx: Transaction, auth: AuthContext, policyDecision: PolicyDecision): Promise;\n}", "documentation": "Full transaction authorization pipeline per AEGIS Spec §10.4.\n\nEnforces a strict 5-step process; if any step fails the transaction\nis NOT signed.", "source": "aegis/sdks/typescript/src/wallet/pipeline.ts", "line": 65 }, { "name": "StorageBackend", "signature": "/** Storage backend selection. */\nexport type StorageBackend = {\n type: \"in_memory\";\n} | {\n type: \"postgres\";\n url: string;\n};", "documentation": "Storage backend selection.", "source": "aegis/sdks/typescript/src/sdk/config.ts", "line": 11 }, { "name": "SessionConfig", "signature": "export interface SessionConfig {\n /** Maximum lifetime for human sessions in seconds (default: 86400 = 24h). */\n humanLifetimeSecs: number;\n /** Maximum lifetime for agent sessions in seconds (default: 3600 = 1h). */\n agentLifetimeSecs: number;\n /** Maximum lifetime for session keys in seconds (default: 86400 = 24h). */\n sessionKeyMaxSecs: number;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/sdk/config.ts", "line": 15 }, { "name": "KeyConfig", "signature": "export interface KeyConfig {\n encryptionAlgorithm: string;\n zeroizeOnDrop: boolean;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/sdk/config.ts", "line": 24 }, { "name": "AegisConfig", "signature": "export interface AegisConfig {\n verification: VerificationConfig;\n sessions: SessionConfig;\n keys: KeyConfig;\n storageBackend: StorageBackend;\n}", "documentation": "", "source": "aegis/sdks/typescript/src/sdk/config.ts", "line": 29 }, { "name": "DEFAULT_SESSION_CONFIG", "signature": "export declare const DEFAULT_SESSION_CONFIG: SessionConfig;", "documentation": "", "source": "aegis/sdks/typescript/src/sdk/config.ts", "line": 36 }, { "name": "DEFAULT_KEY_CONFIG", "signature": "export declare const DEFAULT_KEY_CONFIG: KeyConfig;", "documentation": "", "source": "aegis/sdks/typescript/src/sdk/config.ts", "line": 42 }, { "name": "DEFAULT_AEGIS_CONFIG", "signature": "export declare const DEFAULT_AEGIS_CONFIG: AegisConfig;", "documentation": "", "source": "aegis/sdks/typescript/src/sdk/config.ts", "line": 47 }, { "name": "defaultAegisStores", "signature": "export declare const defaultAegisStores: () => AegisStores;", "documentation": "", "source": "aegis/sdks/typescript/src/sdk/client.ts", "line": 81 }, { "name": "AegisStores", "signature": "/**\n * Collection of pluggable persistent storage backends used by the client.\n *\n * Defaults to in-memory implementations. Application code may inject\n * Postgres-backed (or any other) implementations via `withStores`.\n */\nexport interface AegisStores {\n sessionStore: SessionStore;\n nonceStore: NonceStore;\n delegationStore: DelegationStore;\n revocationStore: RevocationStore;\n keyStore: KeyStore;\n verificationCacheStore: VerificationCacheStore;\n}", "documentation": "Collection of pluggable persistent storage backends used by the client.\n\nDefaults to in-memory implementations. Application code may inject\nPostgres-backed (or any other) implementations via `withStores`.", "source": "aegis/sdks/typescript/src/sdk/client.ts", "line": 72 }, { "name": "AegisClient", "signature": "export declare class AegisClient {\n registry: PluginRegistry;\n verifier: VerificationPipeline;\n sessions: SessionManager;\n delegations: DelegationTree;\n config: AegisConfig;\n stores: AegisStores;\n constructor(params: { registry: PluginRegistry; config?: AegisConfig; stores?: AegisStores; }): AegisClient;\n withDefaults(registry: PluginRegistry): AegisClient;\n withSigner(signer: SigningBackend): this;\n verifyIdentity(did: string): Promise;\n verifyIdentityFresh(did: string): Promise;\n authenticate(credential: AuthCredential, identityType: IdentityType): Promise;\n getSession(sessionId: string): Session;\n revokeSession(sessionId: string): void;\n isSessionValid(sessionId: string): boolean;\n authorize(request: PolicyRequest): Promise;\n composePolicyDecisions(decisions: readonly PolicyDecision[]): PolicyDecision;\n delegate(params: { delegatorDid: string; delegateDid: string; scope: DelegationScope; expires?: string | null; signingKey: Uint8Array; verificationMethod: string; }): Delegation;\n verifyDelegation(delegation: Delegation, delegatorPublicKey: Uint8Array): boolean;\n revokeDelegation(delegationId: string): string[];\n signTransaction(tx: Transaction, auth: AuthContext, policyDecision: PolicyDecision): Promise;\n transactions(): TransactionPipeline | null;\n}", "documentation": "Unified AEGIS client.\n\nHolds a [`PluginRegistry`], a verification pipeline, a session manager,\na delegation tree, and (optionally) a transaction pipeline. Storage\nbackends are accessible via the `stores` field.", "source": "aegis/sdks/typescript/src/sdk/client.ts", "line": 99 } ] }, { "package": "@openagentid/arsenal-sdk", "url": "/reference/typescript/arsenal-sdks-typescript", "exports": [ { "name": "VERSION", "signature": "export declare const VERSION: \"0.1.0\";", "documentation": "", "source": "arsenal/sdks/typescript/src/index.ts", "line": 48 }, { "name": "isClientError", "signature": "export declare const isClientError: (code: number) => boolean;", "documentation": "Returns true if the error code falls into the 1000..5999 client-error range.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 108 }, { "name": "isServerError", "signature": "export declare const isServerError: (code: number) => boolean;", "documentation": "Returns true if the error code falls into the 6000..6999 server-error range.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 113 }, { "name": "isProxyError", "signature": "export declare const isProxyError: (code: number) => boolean;", "documentation": "Returns true if the error code falls into the 8000..8999 proxy error range.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 118 }, { "name": "isConsentError", "signature": "export declare const isConsentError: (code: number) => boolean;", "documentation": "Returns true if the error code falls into the 9000..9999 consent error range.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 123 }, { "name": "isFingerprintError", "signature": "export declare const isFingerprintError: (code: number) => boolean;", "documentation": "Returns true if the error code falls into the 10000..10999 fingerprint range.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 128 }, { "name": "isPermanentError", "signature": "export declare const isPermanentError: (code: number) => boolean;", "documentation": "Returns true if the error is permanent (retry will not help).", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 133 }, { "name": "sanitizeResourceId", "signature": "export declare const sanitizeResourceId: (id: string) => string;", "documentation": "Strip path-traversal characters and cap length.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 360 }, { "name": "sanitizeScope", "signature": "export declare const sanitizeScope: (scope: string) => string;", "documentation": "Strip unsafe characters from a scope; keep separators.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 371 }, { "name": "sanitizeFieldName", "signature": "export declare const sanitizeFieldName: (field: string) => string;", "documentation": "Strip unsafe characters from a field name.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 382 }, { "name": "ErrorCode", "signature": "export declare const ErrorCode: { readonly AuthenticationFailed: 1001; readonly TokenExpired: 1002; readonly TokenSignatureInvalid: 1003; readonly PopVerificationFailed: 1004; readonly IdentityInvalid: 1005; readonly SessionExpired: 1006; readonly InsufficientPermissions: 2001; readonly ScopeExceeded: 2002; readonly PolicyDenied: 2003; readonly DelegationInvalid: 2004; readonly RateLimitExceeded: 2005; readonly BudgetExhausted: 2006; readonly TimeConstraintViolation: 3001; readonly EnvironmentBindingViolation: 3002; readonly NetworkConstraintViolation: 3003; readonly DeviceBindingViolation: 3004; readonly OriginBindingViolation: 3005; readonly SecretNotFound: 4001; readonly SecretVersionNotFound: 4002; readonly SecretRevoked: 4003; readonly SecretRotationInProgress: 4004; readonly SecretUnwrapLimitExceeded: 4005; readonly CryptoOperationFailed: 4006; readonly ValidationFailed: 5001; readonly MalformedRequest: 5002; readonly InvalidTokenFormat: 5003; readonly InvalidScopeFormat: 5004; readonly InvalidConstraint: 5005; readonly InternalError: 6001; readonly StorageError: 6002; readonly ConfigurationError: 6003; readonly CryptoSubsystemError: 6004; readonly AuditError: 6005; readonly SerializationFailed: 6006; readonly TokenRevoked: 7001; readonly AgentDeactivated: 7002; readonly TenantSuspended: 7003; readonly RevocationStatusUnknown: 7004; readonly ProxyDestinationViolation: 8001; readonly ProxyRequestFailed: 8002; readonly ProxyTimeout: 8003; readonly SsrfBlocked: 8004; readonly TemplateVariableNotFound: 8005; readonly TemplateVariableAccessDenied: 8006; readonly InvalidTemplateVariable: 8007; readonly OAuthReauthRequired: 8008; readonly ConsentRequired: 9001; readonly ConsentDenied: 9002; readonly ConsentExpired: 9003; readonly ConsentRevoked: 9004; readonly FingerprintMismatch: 10001; readonly FingerprintStateNotFound: 10002; readonly DctScopeAmplification: 11001; readonly DctDepthExceeded: 11002; };", "documentation": "Error codes for programmatic handling. Numeric values match the Rust crate\n`arsenal_core::error::ErrorCode` so wire-level cross-language parity holds.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 15 }, { "name": "ErrorCodeValue", "signature": "export type ErrorCodeValue = (typeof ErrorCode)[keyof typeof ErrorCode];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 93 }, { "name": "ErrorContext", "signature": "/**\n * Additional structured context attached to an ArsenalError. All fields are\n * sanitized — never include raw secrets or internal paths.\n */\nexport interface ErrorContext {\n operation?: string;\n resource?: string;\n constraint?: string;\n timestamp?: string; // ISO 8601\n}", "documentation": "Additional structured context attached to an ArsenalError. All fields are\nsanitized — never include raw secrets or internal paths.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 141 }, { "name": "ArsenalError", "signature": "export declare class ArsenalError {\n name: \"ArsenalError\";\n code: number;\n correlationId: string | undefined;\n context: ErrorContext | undefined;\n constructor(code: number, message: string, options?: { correlationId?: string; context?: ErrorContext; cause?: unknown; }): ArsenalError;\n toString(): string;\n toJSON(): { code: number; message: string; correlation_id?: string; context?: ErrorContext; };\n withCorrelationId(id: string): ArsenalError;\n withContext(context: ErrorContext): ArsenalError;\n authenticationFailed(): ArsenalError;\n tokenExpired(): ArsenalError;\n tokenSignatureInvalid(): ArsenalError;\n tokenRevoked(): ArsenalError;\n scopeExceeded(): ArsenalError;\n insufficientPermissions(requiredScope: string): ArsenalError;\n policyDenied(policyId: string): ArsenalError;\n rateLimitExceeded(retryAfterSecs?: number): ArsenalError;\n secretNotFound(): ArsenalError;\n validationFailed(field: string, reason: string): ArsenalError;\n internal(): ArsenalError;\n sessionExpired(): ArsenalError;\n proxyDestinationViolation(domain: string): ArsenalError;\n ssrfBlocked(): ArsenalError;\n templateVariableNotFound(variable: string): ArsenalError;\n invalidTemplateVariable(name: string): ArsenalError;\n consentRequired(): ArsenalError;\n consentDenied(): ArsenalError;\n fingerprintMismatch(): ArsenalError;\n configurationError(component: string): ArsenalError;\n cryptoOperationFailed(): ArsenalError;\n}", "documentation": "Main error type for ARSENAL operations.\n\nExtends the native `Error` class so it interoperates with standard JS error\nhandling while carrying structured code/correlation/context fields.", "source": "arsenal/sdks/typescript/src/core/errors.ts", "line": 154 }, { "name": "TenantId", "signature": "export declare class TenantId {\n parse(id: string): TenantId;\n generate(): TenantId;\n asString(): string;\n toString(): string;\n toJSON(): string;\n equals(other: TenantId): boolean;\n}", "documentation": "Tenant identifier — represents an organization or customer.", "source": "arsenal/sdks/typescript/src/core/identity.ts", "line": 21 }, { "name": "PrincipalId", "signature": "export declare class PrincipalId {\n parse(id: string): PrincipalId;\n generate(): PrincipalId;\n system(): PrincipalId;\n isSystem(): boolean;\n asString(): string;\n toString(): string;\n toJSON(): string;\n}", "documentation": "Principal identifier — user, service account, or system principal.", "source": "arsenal/sdks/typescript/src/core/identity.ts", "line": 63 }, { "name": "AgentId", "signature": "export declare class AgentId {\n fromUuid(uuid: string): AgentId;\n generate(): AgentId;\n asUuid(): string;\n toString(): string;\n toJSON(): string;\n equals(other: AgentId): boolean;\n}", "documentation": "Agent identifier (UUID v4).", "source": "arsenal/sdks/typescript/src/core/identity.ts", "line": 109 }, { "name": "DeviceId", "signature": "export declare class DeviceId {\n parse(id: string): DeviceId;\n asString(): string;\n toString(): string;\n toJSON(): string;\n}", "documentation": "Device identifier for device binding.", "source": "arsenal/sdks/typescript/src/core/identity.ts", "line": 145 }, { "name": "KeyFingerprint", "signature": "export declare class KeyFingerprint {\n fromBytes(bytes: Uint8Array): KeyFingerprint;\n fromPublicKey(publicKey: Uint8Array): Promise;\n fromHex(hex: string): KeyFingerprint;\n asBytes(): Uint8Array;\n toHex(): string;\n toString(): string;\n constantTimeEquals(other: KeyFingerprint): boolean;\n toJSON(): string;\n}", "documentation": "Public-key fingerprint — BLAKE3 hash (32 bytes) of a public key.\n\nUses a constant-time compare for equality checks.", "source": "arsenal/sdks/typescript/src/core/identity.ts", "line": 180 }, { "name": "AgentIdentityData", "signature": "/**\n * Agent identity — the public cryptographic identity of an agent.\n *\n * Contains only public key material — the private key is never stored.\n */\nexport interface AgentIdentityData {\n id: AgentId;\n publicKeyFingerprint: KeyFingerprint;\n tenantId: TenantId;\n name: string;\n createdAt: string; // ISO 8601\n expiresAt: string | null;\n isActive: boolean;\n tags: readonly string[];\n}", "documentation": "Agent identity — the public cryptographic identity of an agent.\n\nContains only public key material — the private key is never stored.", "source": "arsenal/sdks/typescript/src/core/identity.ts", "line": 249 }, { "name": "AgentIdentity", "signature": "export declare class AgentIdentity {\n create(tenantId: TenantId, name: string, publicKeyFingerprint: KeyFingerprint): AgentIdentity;\n id(): AgentId;\n publicKeyFingerprint(): KeyFingerprint;\n tenantId(): TenantId;\n name(): string;\n isActive(): boolean;\n tags(): readonly string[];\n isValid(now?: Date): boolean;\n deactivate(): AgentIdentity;\n withExpiresAt(expiresAt: Date): AgentIdentity;\n withTag(tag: string): AgentIdentity;\n toJSON(): { id: string; public_key_fingerprint: string; tenant_id: string; name: string; created_at: string; expires_at: string | null; is_active: boolean; tags: readonly string[]; };\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/identity.ts", "line": 260 }, { "name": "permissionImplies", "signature": "export declare const permissionImplies: (a: PermissionValue, b: PermissionValue) => boolean;", "documentation": "Check if permission `a` implies permission `b`.", "source": "arsenal/sdks/typescript/src/core/scope.ts", "line": 228 }, { "name": "parsePermission", "signature": "export declare const parsePermission: (s: string) => PermissionValue;", "documentation": "Parse a string into a Permission value. Throws on unknown input.", "source": "arsenal/sdks/typescript/src/core/scope.ts", "line": 234 }, { "name": "Scope", "signature": "export declare class Scope {\n parse(scope: string): Scope;\n wildcard(): Scope;\n readOnly(service: string): Scope;\n fullAccess(service: string): Scope;\n service(): string;\n resource(): string;\n action(): string;\n isWildcard(): boolean;\n implies(other: Scope): boolean;\n asString(): string;\n toString(): string;\n toJSON(): string;\n equals(other: Scope): boolean;\n}", "documentation": "A single permission scope.", "source": "arsenal/sdks/typescript/src/core/scope.ts", "line": 19 }, { "name": "ScopeSet", "signature": "export declare class ScopeSet {\n empty(): ScopeSet;\n single(scope: Scope): ScopeSet;\n fromStrings(scopes: readonly string[]): ScopeSet;\n fromScopes(scopes: readonly Scope[]): ScopeSet;\n add(scope: Scope): ScopeSet;\n remove(scope: Scope): ScopeSet;\n contains(scope: Scope): boolean;\n allows(requested: Scope): boolean;\n isSupersetOf(other: ScopeSet): boolean;\n intersection(other: ScopeSet): ScopeSet;\n union(other: ScopeSet): ScopeSet;\n length(): number;\n isEmpty(): boolean;\n toArray(): readonly Scope[];\n toStrings(): readonly string[];\n [Symbol.iterator](): Iterator;\n toJSON(): readonly string[];\n}", "documentation": "A set of scopes, maintained as a sorted list for deterministic encoding.", "source": "arsenal/sdks/typescript/src/core/scope.ts", "line": 124 }, { "name": "Permission", "signature": "export declare const Permission: { readonly Read: \"read\"; readonly Create: \"create\"; readonly Update: \"update\"; readonly Delete: \"delete\"; readonly Admin: \"admin\"; };", "documentation": "CRUD permission classification.", "source": "arsenal/sdks/typescript/src/core/scope.ts", "line": 217 }, { "name": "PermissionValue", "signature": "export type PermissionValue = (typeof Permission)[keyof typeof Permission];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/scope.ts", "line": 225 }, { "name": "noConstraints", "signature": "export declare const noConstraints: () => Constraints;", "documentation": "Build an empty constraint object (no restrictions).", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 75 }, { "name": "withPop", "signature": "export declare const withPop: () => Constraints;", "documentation": "Create constraints requiring proof-of-possession.", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 80 }, { "name": "withDevice", "signature": "export declare const withDevice: (base: Constraints, deviceId: string) => Constraints;", "documentation": "Create constraints with a required device binding.", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 85 }, { "name": "withOrigins", "signature": "export declare const withOrigins: (base: Constraints, origins: readonly string[]) => Constraints;", "documentation": "Create constraints with an allowed-origins binding.", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 95 }, { "name": "withTimeWindow", "signature": "export declare const withTimeWindow: (base: Constraints, notBefore: Date, notAfter: Date) => Constraints;", "documentation": "Create constraints with a time window.", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 103 }, { "name": "contextNow", "signature": "export declare const contextNow: () => ConstraintContext;", "documentation": "Create a fresh ConstraintContext with current_time=now().", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 118 }, { "name": "validateConstraints", "signature": "export declare const validateConstraints: (constraints: Constraints, ctx: ConstraintContext) => void;", "documentation": "Validate a set of constraints against a request context. Throws an\n`ArsenalError` on the first violation.", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 129 }, { "name": "ipInCidrRange", "signature": "export declare const ipInCidrRange: (ip: string, cidr: string) => boolean;", "documentation": "Check if a dotted-quad or IPv6 address falls inside a CIDR range.\nSupports both IPv4 and IPv6. Invalid CIDR or IP input returns false.", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 317 }, { "name": "BindingType", "signature": "export declare const BindingType: { readonly Required: \"required\"; readonly Preferred: \"preferred\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 12 }, { "name": "BindingTypeValue", "signature": "export type BindingTypeValue = (typeof BindingType)[keyof typeof BindingType];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 17 }, { "name": "DeviceBinding", "signature": "export interface DeviceBinding {\n device_id: string;\n binding_type: BindingTypeValue;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 19 }, { "name": "SessionBinding", "signature": "export interface SessionBinding {\n session_id: string;\n session_key_hash?: Uint8Array; // 32 bytes when set\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 24 }, { "name": "OriginBinding", "signature": "export interface OriginBinding {\n allowed_origins: ReadonlySet;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 29 }, { "name": "NetworkConstraints", "signature": "export interface NetworkConstraints {\n allowed_ips?: ReadonlySet;\n denied_ips?: ReadonlySet;\n allowed_cidrs?: readonly string[];\n allowed_asns?: ReadonlySet;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 33 }, { "name": "TimeConstraints", "signature": "export interface TimeConstraints {\n not_before?: string; // ISO 8601\n not_after?: string; // ISO 8601\n allowed_hours?: readonly number[];\n allowed_days?: readonly number[];\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 40 }, { "name": "EnvironmentConstraint", "signature": "export interface EnvironmentConstraint {\n required_environment?: string;\n required_tags?: ReadonlySet;\n forbidden_tags?: ReadonlySet;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 47 }, { "name": "Constraints", "signature": "export interface Constraints {\n device_binding?: DeviceBinding;\n session_binding?: SessionBinding;\n origin_binding?: OriginBinding;\n network_constraints?: NetworkConstraints;\n time_constraints?: TimeConstraints;\n environment_constraints?: EnvironmentConstraint;\n require_pop: boolean;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 53 }, { "name": "ConstraintContext", "signature": "export interface ConstraintContext {\n current_time: Date;\n device_id?: string;\n session_id?: string;\n session_key_hash?: Uint8Array;\n origin?: string;\n client_ip?: string;\n environment?: string;\n tags: ReadonlySet;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/constraints.ts", "line": 63 }, { "name": "defaultRateLimits", "signature": "export declare const defaultRateLimits: () => RateLimits;", "documentation": "Default moderate rate limits (same as Rust `RateLimits::default()`).", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 17 }, { "name": "unlimitedRateLimits", "signature": "export declare const unlimitedRateLimits: () => RateLimits;", "documentation": "All unlimited — use with care.", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 29 }, { "name": "strictRateLimits", "signature": "export declare const strictRateLimits: () => RateLimits;", "documentation": "Strict lockdown rate limits.", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 34 }, { "name": "mergeRateLimits", "signature": "export declare const mergeRateLimits: (a: RateLimits, b: RateLimits) => RateLimits;", "documentation": "Merge two limit configs taking the more restrictive (minimum) value.", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 46 }, { "name": "defaultUsageBudget", "signature": "export declare const defaultUsageBudget: () => UsageBudget;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 78 }, { "name": "unlimitedUsageBudget", "signature": "export declare const unlimitedUsageBudget: () => UsageBudget;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 88 }, { "name": "minimalUsageBudget", "signature": "export declare const minimalUsageBudget: () => UsageBudget;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 92 }, { "name": "mergeUsageBudget", "signature": "export declare const mergeUsageBudget: (a: UsageBudget, b: UsageBudget) => UsageBudget;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 102 }, { "name": "RateLimits", "signature": "export interface RateLimits {\n requests_per_second?: number;\n requests_per_minute?: number;\n requests_per_hour?: number;\n max_concurrent?: number;\n max_request_size?: number;\n max_response_size?: number;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 7 }, { "name": "UsageBudget", "signature": "export interface UsageBudget {\n max_requests?: number;\n max_bytes?: number;\n max_cost_units?: number;\n max_secret_unwraps?: number;\n max_delegation_depth?: number;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 70 }, { "name": "UsageStats", "signature": "/** Current usage snapshot. */\nexport interface UsageStats {\n request_count: number;\n bytes_transferred: number;\n cost_units: number;\n secret_unwraps: number;\n elapsed_ms: number;\n}", "documentation": "Current usage snapshot.", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 126 }, { "name": "RemainingBudget", "signature": "/** Remaining budget (undefined entries are unlimited). */\nexport interface RemainingBudget {\n requests?: number;\n bytes?: number;\n cost_units?: number;\n secret_unwraps?: number;\n}", "documentation": "Remaining budget (undefined entries are unlimited).", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 135 }, { "name": "UsageTracker", "signature": "export declare class UsageTracker {\n constructor(budget: UsageBudget): UsageTracker;\n recordRequest(): void;\n recordBytes(bytes: number): void;\n recordCost(units: number): void;\n recordSecretUnwrap(): void;\n getStats(): UsageStats;\n remaining(): RemainingBudget;\n}", "documentation": "Runtime usage tracker that enforces a budget.\n\nEach `record*` call either succeeds or throws an ArsenalError with code\n`BudgetExhausted` (or `SecretUnwrapLimitExceeded`).", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 148 }, { "name": "TokenBucketLimiter", "signature": "export declare class TokenBucketLimiter {\n constructor(maxTokens: number, refillAmount: number, refillIntervalMs: number): TokenBucketLimiter;\n perSecond(rate: number): TokenBucketLimiter;\n perMinute(rate: number): TokenBucketLimiter;\n perHour(rate: number): TokenBucketLimiter;\n tryAcquire(): void;\n available(): number;\n}", "documentation": "Token-bucket rate limiter. Lock-free single-threaded (JS single-threaded\nexecution model) — refills on each try_acquire based on elapsed wall clock.", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 236 }, { "name": "CompositeRateLimiter", "signature": "export declare class CompositeRateLimiter {\n constructor(limits: RateLimits): CompositeRateLimiter;\n acquire(): () => void;\n}", "documentation": "Composite rate limiter combining multiple time windows + concurrent cap.\n\nUse `acquire()` which returns a release function — call it when the\nrequest completes (e.g. in a `finally`) to decrement the concurrent\ncounter. If any individual limit rejects, already-consumed slots are\nrolled back.", "source": "arsenal/sdks/typescript/src/core/limits.ts", "line": 295 }, { "name": "createSecretMetadata", "signature": "export declare const createSecretMetadata: (tenantId: string, name: string, secretType: SecretTypeValue) => SecretMetadata;", "documentation": "Create a new secret metadata record.", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 142 }, { "name": "latestSecretRef", "signature": "export declare const latestSecretRef: (id: string) => SecretRef;", "documentation": "Reference to the latest version.", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 178 }, { "name": "specificSecretRef", "signature": "export declare const specificSecretRef: (id: string, version: number) => SecretRef;", "documentation": "Reference to a specific version.", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 183 }, { "name": "SecretId", "signature": "export declare class SecretId {\n generate(): SecretId;\n fromString(id: string): SecretId;\n asString(): string;\n toString(): string;\n toJSON(): string;\n}", "documentation": "Secret identifier.", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 18 }, { "name": "SecretVersion", "signature": "export declare class SecretVersion {\n initial(): SecretVersion;\n fromNumber(n: number): SecretVersion;\n asNumber(): number;\n next(): SecretVersion;\n isInitial(): boolean;\n toString(): string;\n toJSON(): number;\n}", "documentation": "Secret version number (1-based).", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 52 }, { "name": "SecretType", "signature": "export declare const SecretType: { readonly ApiKey: \"api_key\"; readonly OAuthClientCredentials: \"o_auth_client_credentials\"; readonly OAuthAccessToken: \"o_auth_access_token\"; readonly OAuthRefreshToken: \"o_auth_refresh_token\"; readonly DatabaseCredentials: \"database_credentials\"; readonly SshKey: \"ssh_key\"; readonly TlsCertificate: \"tls_certificate\"; readonly SigningKey: \"signing_key\"; readonly EncryptionKey: \"encryption_key\"; readonly Generic: \"generic\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 91 }, { "name": "SecretTypeValue", "signature": "export type SecretTypeValue = (typeof SecretType)[keyof typeof SecretType];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 104 }, { "name": "SecretVersionState", "signature": "export declare const SecretVersionState: { readonly Active: \"active\"; readonly Previous: \"previous\"; readonly Disabled: \"disabled\"; readonly PendingDeletion: \"pending_deletion\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 106 }, { "name": "SecretVersionStateValue", "signature": "export type SecretVersionStateValue = (typeof SecretVersionState)[keyof typeof SecretVersionState];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 113 }, { "name": "SecretVersionInfo", "signature": "export interface SecretVersionInfo {\n version: number;\n created_at: string;\n created_by?: string;\n state: SecretVersionStateValue;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 116 }, { "name": "SecretMetadata", "signature": "export interface SecretMetadata {\n id: string;\n tenant_id: string;\n name: string;\n description?: string;\n secret_type: SecretTypeValue;\n current_version: number;\n versions: readonly SecretVersionInfo[];\n created_at: string;\n updated_at: string;\n expires_at?: string;\n last_rotated_at?: string;\n next_rotation_at?: string;\n is_active: boolean;\n labels: Readonly>;\n service?: string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 123 }, { "name": "SecretRef", "signature": "/** Reference to a secret — used when the value shouldn't be inlined. */\nexport interface SecretRef {\n id: string;\n version?: number;\n}", "documentation": "Reference to a secret — used when the value shouldn't be inlined.", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 172 }, { "name": "SecretValue", "signature": "export declare class SecretValue {\n fromBytes(bytes: Uint8Array): SecretValue;\n fromString(s: string): SecretValue;\n asBytes(): Uint8Array;\n asString(): string;\n length(): number;\n isEmpty(): boolean;\n zeroize(): void;\n}", "documentation": "Secret value holder that clears its internal buffer when `zeroize()` is\ncalled. JS has no destructors, so callers must explicitly invoke\n`zeroize()` in a `finally` block after use.", "source": "arsenal/sdks/typescript/src/core/secret.ts", "line": 192 }, { "name": "buildTokenClaims", "signature": "export declare const buildTokenClaims: (opts: TokenClaimsBuildOptions) => TokenClaims;", "documentation": "Validate and build a fresh set of token claims.", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 89 }, { "name": "SignatureAlgorithm", "signature": "export declare const SignatureAlgorithm: { readonly Ed25519: \"ED25519\"; readonly Es256: \"ES256\"; readonly Es384: \"ES384\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 23 }, { "name": "SignatureAlgorithmValue", "signature": "export type SignatureAlgorithmValue = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 29 }, { "name": "TokenSignature", "signature": "export interface TokenSignature {\n bytes: Uint8Array;\n algorithm: SignatureAlgorithmValue;\n key_id?: string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 32 }, { "name": "ProofOfPossession", "signature": "export interface ProofOfPossession {\n /** Hex-encoded BLAKE3 public key fingerprint. */\n key_fingerprint: string;\n /** Algorithm label, e.g. \"Ed25519\". */\n alg: string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 38 }, { "name": "TokenTrace", "signature": "export interface TokenTrace {\n issuance_id: string;\n parent_token_id?: string;\n policy_id?: string;\n delegation_depth: number;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 45 }, { "name": "TokenClaims", "signature": "export interface TokenClaims {\n jti: string; // Token ID (UUID v7)\n sub: string; // Subject (agent ID UUID)\n iss: string; // Issuer\n aud: string; // Audience\n iat: string; // Issued-at ISO timestamp\n nbf: string; // Not-before ISO timestamp\n exp: string; // Expiration ISO timestamp\n tenant_id: string;\n scope: readonly string[];\n constraints?: Constraints;\n limits?: RateLimits;\n budget?: UsageBudget;\n trace?: TokenTrace;\n cnf?: ProofOfPossession;\n delegated_variables?: readonly string[];\n max_delegation_depth?: number;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 52 }, { "name": "TokenClaimsBuildOptions", "signature": "/** Options for building a fresh set of claims. */\nexport interface TokenClaimsBuildOptions {\n subject: string;\n issuer: string;\n audience: string;\n tenant_id: string;\n scopes: ScopeSet;\n ttl_seconds?: number;\n constraints?: Constraints;\n limits?: RateLimits;\n budget?: UsageBudget;\n parent_token_id?: string;\n cnf?: ProofOfPossession;\n delegated_variables?: readonly string[];\n max_delegation_depth?: number;\n}", "documentation": "Options for building a fresh set of claims.", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 72 }, { "name": "AgentCapabilityToken", "signature": "export declare class AgentCapabilityToken {\n fromClaims(claims: TokenClaims): AgentCapabilityToken;\n fromClaimsAndSignature(claims: TokenClaims, signature: TokenSignature): AgentCapabilityToken;\n id(): string;\n subject(): string;\n audience(): string;\n scopes(): ScopeSet;\n isExpired(now?: Date): boolean;\n isNotYetValid(now?: Date): boolean;\n isTimeValid(now?: Date): boolean;\n remainingTtlMs(now?: Date): number;\n isSigned(): boolean;\n validateStructure(now?: Date): void;\n toCbor(): Uint8Array;\n claimsToCbor(): Uint8Array;\n toBase64Url(): string;\n fromCbor(bytes: Uint8Array): AgentCapabilityToken;\n fromBase64Url(s: string): AgentCapabilityToken;\n}", "documentation": "Immutable Agent Capability Token. Wraps a set of claims and an optional\nsignature, and provides validation + CBOR (de)serialization.", "source": "arsenal/sdks/typescript/src/core/token.ts", "line": 135 }, { "name": "consentStatusAllowsOperation", "signature": "export declare const consentStatusAllowsOperation: (status: ConsentStatusValue) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 26 }, { "name": "consentRecordIsValid", "signature": "export declare const consentRecordIsValid: (record: ConsentRecord, now?: Date) => boolean;", "documentation": "Validity check (not revoked and not expired).", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 61 }, { "name": "consentRecordCoversVariable", "signature": "export declare const consentRecordCoversVariable: (record: ConsentRecord, variable: string) => boolean;", "documentation": "Returns true if the record covers the given variable name.", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 67 }, { "name": "consentRecordCoversDomain", "signature": "export declare const consentRecordCoversDomain: (record: ConsentRecord, domain: string) => boolean;", "documentation": "Returns true if the record covers the given destination domain (case-insensitive).", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 75 }, { "name": "revokeConsentRecord", "signature": "export declare const revokeConsentRecord: (record: ConsentRecord, at?: Date) => ConsentRecord;", "documentation": "Return a revoked copy of the consent record.", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 84 }, { "name": "consentRecordSigningBytes", "signature": "export declare const consentRecordSigningBytes: (record: ConsentRecord) => Uint8Array;", "documentation": "Canonical CBOR encoding of the signable subset (excludes signature,\nrevoked, revoked_at). This is the byte sequence a human root key signs\nwith Ed25519 to produce `record.signature`.", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 96 }, { "name": "createConsentRequest", "signature": "export declare const createConsentRequest: (opts: { agent_did: string; human_root_did: string; variables: readonly string[]; destination_domains: readonly string[]; scopes: readonly string[]; ttl_seconds?: number; }) => ConsentRequest;", "documentation": "Create a new consent request with validation.", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 123 }, { "name": "consentRequestIsExpired", "signature": "export declare const consentRequestIsExpired: (req: ConsentRequest, now?: Date) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 156 }, { "name": "ConsentStatus", "signature": "export declare const ConsentStatus: { readonly PreApproved: \"pre_approved\"; readonly Approved: \"approved\"; readonly Pending: \"pending\"; readonly Denied: \"denied\"; readonly Revoked: \"revoked\"; readonly NotRequired: \"not_required\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 15 }, { "name": "ConsentStatusValue", "signature": "export type ConsentStatusValue = (typeof ConsentStatus)[keyof typeof ConsentStatus];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 24 }, { "name": "ConsentPolicy", "signature": "export declare const ConsentPolicy: { readonly PerVariable: \"per_variable\"; readonly PerProvider: \"per_provider\"; readonly PerAgent: \"per_agent\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 34 }, { "name": "ConsentPolicyValue", "signature": "export type ConsentPolicyValue = (typeof ConsentPolicy)[keyof typeof ConsentPolicy];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 40 }, { "name": "ConsentRecord", "signature": "export interface ConsentRecord {\n consent_id: string;\n tenant_id: string;\n agent_did: string;\n human_root_did: string;\n variables: readonly string[];\n destination_domains: readonly string[];\n scopes: readonly string[];\n granted_by: string;\n granted_at: string;\n expires_at: string;\n /** Ed25519 signature bytes over the signing payload. */\n signature: Uint8Array;\n revocable: boolean;\n revoked: boolean;\n revoked_at?: string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 42 }, { "name": "ConsentRequest", "signature": "export interface ConsentRequest {\n request_id: string;\n agent_did: string;\n human_root_did: string;\n variables: readonly string[];\n destination_domains: readonly string[];\n scopes: readonly string[];\n created_at: string;\n expires_at: string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/consent.ts", "line": 111 }, { "name": "createDestinationBinding", "signature": "export declare const createDestinationBinding: (allowedDomains: readonly string[], opts?: Partial>) => DestinationBinding;", "documentation": "Create and validate a destination binding.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 61 }, { "name": "validateDestinationBinding", "signature": "export declare const validateDestinationBinding: (binding: DestinationBinding) => void;", "documentation": "Throws if the binding is malformed.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 78 }, { "name": "isDomainAllowed", "signature": "export declare const isDomainAllowed: (binding: DestinationBinding, domain: string) => boolean;", "documentation": "Check if a domain is allowed by the binding.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 109 }, { "name": "isMethodAllowed", "signature": "export declare const isMethodAllowed: (binding: DestinationBinding, method: string) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 119 }, { "name": "isPortAllowed", "signature": "export declare const isPortAllowed: (binding: DestinationBinding, port: number) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 124 }, { "name": "isPathAllowed", "signature": "export declare const isPathAllowed: (binding: DestinationBinding, path: string) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 129 }, { "name": "createTemplateVariable", "signature": "export declare const createTemplateVariable: (name: string) => TemplateVariable;", "documentation": "Create a template variable, validating the name.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 165 }, { "name": "validateVariableName", "signature": "export declare const validateVariableName: (name: string) => void;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 170 }, { "name": "inferVariablePrefix", "signature": "export declare const inferVariablePrefix: (name: string) => VariablePrefixValue;", "documentation": "Infer the credential-type prefix from a variable name.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 192 }, { "name": "parseTemplateVariables", "signature": "export declare const parseTemplateVariables: (input: string) => readonly TemplateVariable[];", "documentation": "Parse all `{{VARIABLE}}` placeholders from a string. Invalid names\ninside `{{}}` are silently skipped. Duplicates are deduplicated.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 207 }, { "name": "validateProxyRequest", "signature": "export declare const validateProxyRequest: (req: ProxyRequest) => void;", "documentation": "Validate structural fields of a proxy request.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 243 }, { "name": "effectiveTimeoutMs", "signature": "export declare const effectiveTimeoutMs: (req: ProxyRequest) => number;", "documentation": "Resolve the effective timeout, capped to MAX_TIMEOUT_MS.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 263 }, { "name": "extractProxyRequestVariables", "signature": "export declare const extractProxyRequestVariables: (req: ProxyRequest) => readonly TemplateVariable[];", "documentation": "Extract all template variables used anywhere in a proxy request.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 268 }, { "name": "VariablePrefix", "signature": "export declare const VariablePrefix: { readonly OAuth2: \"OAUTH2\"; readonly OAuth1: \"OAUTH1\"; readonly ApiKey: \"API_KEY\"; readonly Basic: \"BASIC\"; readonly Bearer: \"BEARER\"; readonly Cert: \"CERT\"; readonly Custom: \"CUSTOM\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 38 }, { "name": "VariablePrefixValue", "signature": "export type VariablePrefixValue = (typeof VariablePrefix)[keyof typeof VariablePrefix];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 48 }, { "name": "DestinationBinding", "signature": "/** Destination binding restricting which endpoints a credential can reach. */\nexport interface DestinationBinding {\n allowed_domains: readonly string[];\n allowed_paths?: readonly string[];\n allowed_methods?: readonly string[];\n allowed_ports?: readonly number[];\n require_tls: boolean;\n allow_subdomains: boolean;\n}", "documentation": "Destination binding restricting which endpoints a credential can reach.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 51 }, { "name": "TemplateVariable", "signature": "/** Parsed template variable reference. */\nexport interface TemplateVariable {\n name: string;\n prefix: VariablePrefixValue;\n}", "documentation": "Parsed template variable reference.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 159 }, { "name": "ProxyRequest", "signature": "/** Proxy request envelope sent to the broker. */\nexport interface ProxyRequest {\n method: string;\n url: string;\n headers?: Readonly>;\n body?: Uint8Array;\n capability_token: string;\n timeout_ms?: number;\n}", "documentation": "Proxy request envelope sent to the broker.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 233 }, { "name": "ProxyResponse", "signature": "/** Response from a proxy request. */\nexport interface ProxyResponse {\n status: number;\n headers: Readonly>;\n body: Uint8Array;\n proxy_metadata: ProxyMetadata;\n}", "documentation": "Response from a proxy request.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 296 }, { "name": "ProxyMetadata", "signature": "/** Metadata about proxy processing (never includes resolved values). */\nexport interface ProxyMetadata {\n variables_resolved: readonly string[];\n destination_verified: boolean;\n fingerprint_verified: boolean;\n consent_status: ConsentStatusValue;\n latency_ms: number;\n request_id: string;\n}", "documentation": "Metadata about proxy processing (never includes resolved values).", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 304 }, { "name": "VariableResolutionTable", "signature": "export declare class VariableResolutionTable {\n register(variableName: string, secretRef: { id: string; version?: number; }): void;\n unregister(variableName: string): boolean;\n resolve(variableName: string): { id: string; version?: number; } | undefined;\n variableNames(): readonly string[];\n size(): number;\n isEmpty(): boolean;\n}", "documentation": "In-memory variable → secret-ref table used by the broker.", "source": "arsenal/sdks/typescript/src/core/proxy.ts", "line": 314 }, { "name": "createPolicyRule", "signature": "export declare const createPolicyRule: (id: string, effect: PolicyEffectValue, conditions?: readonly PolicyCondition[]) => PolicyRule;", "documentation": "Create a simple rule. Conditions are added via spread.", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 104 }, { "name": "createPolicyDocument", "signature": "export declare const createPolicyDocument: (tenantId: string, name: string) => PolicyDocument;", "documentation": "Build a new policy document (no rules yet).", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 136 }, { "name": "addPolicyRule", "signature": "export declare const addPolicyRule: (doc: PolicyDocument, rule: PolicyRule) => PolicyDocument;", "documentation": "Append a rule to a policy, returning a new document.", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 160 }, { "name": "createPolicyRequest", "signature": "export declare const createPolicyRequest: (agentId: string, tenantId: string, requestedScope: string) => PolicyRequest;", "documentation": "Create a new policy request with current timestamp.", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 182 }, { "name": "decisionIsAllowed", "signature": "export declare const decisionIsAllowed: (d: PolicyDecision) => boolean;", "documentation": "Returns true if the decision allows the action.", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 203 }, { "name": "decisionIsDenied", "signature": "export declare const decisionIsDenied: (d: PolicyDecision) => boolean;", "documentation": "Returns true if the decision denies the action.", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 208 }, { "name": "MAX_CONDITION_DEPTH", "signature": "export declare const MAX_CONDITION_DEPTH: 16;", "documentation": "Maximum recursion depth for nested And/Or/Not conditions.", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 17 }, { "name": "PolicyId", "signature": "export declare class PolicyId {\n parse(id: string): PolicyId;\n generate(): PolicyId;\n asString(): string;\n toString(): string;\n toJSON(): string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 19 }, { "name": "PolicyEffect", "signature": "export declare const PolicyEffect: { readonly Allow: \"allow\"; readonly Deny: \"deny\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 53 }, { "name": "PolicyEffectValue", "signature": "export type PolicyEffectValue = (typeof PolicyEffect)[keyof typeof PolicyEffect];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 58 }, { "name": "ConditionOperator", "signature": "export declare const ConditionOperator: { readonly Equals: \"equals\"; readonly NotEquals: \"not_equals\"; readonly Contains: \"contains\"; readonly StartsWith: \"starts_with\"; readonly EndsWith: \"ends_with\"; readonly Matches: \"matches\"; readonly In: \"in\"; readonly NotIn: \"not_in\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 60 }, { "name": "ConditionOperatorValue", "signature": "export type ConditionOperatorValue = (typeof ConditionOperator)[keyof typeof ConditionOperator];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 71 }, { "name": "PolicyCondition", "signature": "export type PolicyCondition = {\n type: \"agent_id\";\n operator: ConditionOperatorValue;\n value: string;\n} | {\n type: \"tenant_id\";\n operator: ConditionOperatorValue;\n value: string;\n} | {\n type: \"scope\";\n operator: ConditionOperatorValue;\n value: string;\n} | {\n type: \"environment\";\n operator: ConditionOperatorValue;\n value: string;\n} | {\n type: \"time_of_day\";\n allowed_hours: readonly number[];\n} | {\n type: \"day_of_week\";\n allowed_days: readonly number[];\n} | {\n type: \"ip_address\";\n allowed_cidrs: readonly string[];\n} | {\n type: \"attribute\";\n key: string;\n operator: ConditionOperatorValue;\n value: string;\n} | {\n type: \"and\";\n conditions: readonly PolicyCondition[];\n} | {\n type: \"or\";\n conditions: readonly PolicyCondition[];\n} | {\n type: \"not\";\n condition: PolicyCondition;\n};", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 74 }, { "name": "PolicyRule", "signature": "export interface PolicyRule {\n id: string;\n description?: string;\n effect: PolicyEffectValue;\n conditions: readonly PolicyCondition[];\n scopes?: ScopeSet;\n constraints?: Constraints;\n rate_limits?: RateLimits;\n budget?: UsageBudget;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 92 }, { "name": "PolicySignature", "signature": "export interface PolicySignature {\n bytes: Uint8Array;\n algorithm: string;\n key_id: string;\n signed_at: string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 112 }, { "name": "PolicyDocument", "signature": "export interface PolicyDocument {\n id: string;\n version: number;\n tenant_id: string;\n name: string;\n description?: string;\n rules: readonly PolicyRule[];\n default_effect: PolicyEffectValue;\n is_active: boolean;\n priority: number;\n created_at: string;\n updated_at: string;\n signature?: PolicySignature;\n labels: Readonly>;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 119 }, { "name": "PolicyRequest", "signature": "export interface PolicyRequest {\n agent_id: string;\n tenant_id: string;\n requested_scope: string;\n timestamp: Date;\n environment?: string;\n client_ip?: string;\n attributes: Readonly>;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 171 }, { "name": "PolicyDecision", "signature": "export interface PolicyDecision {\n effect: PolicyEffectValue;\n matched_rule?: string;\n reason?: string;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/policy.ts", "line": 196 }, { "name": "denyDelegation", "signature": "export declare const denyDelegation: () => DelegationConstraints;", "documentation": "Default: delegation denied.", "source": "arsenal/sdks/typescript/src/core/delegation.ts", "line": 29 }, { "name": "allowDelegation", "signature": "export declare const allowDelegation: (depth: number) => DelegationConstraints;", "documentation": "Allow up to `depth` levels of delegation to any agent.", "source": "arsenal/sdks/typescript/src/core/delegation.ts", "line": 41 }, { "name": "canDelegateTo", "signature": "export declare const canDelegateTo: (constraints: DelegationConstraints, agentId: string) => boolean;", "documentation": "Check whether a delegation to the given agent id is permitted.", "source": "arsenal/sdks/typescript/src/core/delegation.ts", "line": 53 }, { "name": "validateDelegationDepth", "signature": "export declare const validateDelegationDepth: (depth: number) => void;", "documentation": "Validate a delegation chain length and scope non-amplification rule.", "source": "arsenal/sdks/typescript/src/core/delegation.ts", "line": 63 }, { "name": "MAX_DELEGATION_DEPTH", "signature": "export declare const MAX_DELEGATION_DEPTH: 5;", "documentation": "Maximum absolute delegation depth allowed anywhere in the system.", "source": "arsenal/sdks/typescript/src/core/delegation.ts", "line": 12 }, { "name": "MAX_CHAIN_LENGTH", "signature": "export declare const MAX_CHAIN_LENGTH: 10;", "documentation": "Maximum number of tokens in a delegation chain.", "source": "arsenal/sdks/typescript/src/core/delegation.ts", "line": 15 }, { "name": "DelegationConstraints", "signature": "export interface DelegationConstraints {\n allow_delegation: boolean;\n max_depth: number;\n delegatable_scopes?: ScopeSet;\n allowed_delegates: readonly string[];\n allow_any_delegate: boolean;\n /** Minimum TTL reduction (seconds) between parent and child token. */\n min_ttl_reduction: number;\n require_approval: boolean;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/delegation.ts", "line": 17 }, { "name": "sessionStateCanUseTools", "signature": "export declare const sessionStateCanUseTools: (state: SessionStateValue) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 55 }, { "name": "sessionStateCanRequestCapabilities", "signature": "export declare const sessionStateCanRequestCapabilities: (state: SessionStateValue) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 59 }, { "name": "sessionStateIsTerminal", "signature": "export declare const sessionStateIsTerminal: (state: SessionStateValue) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 67 }, { "name": "sessionStateIsActive", "signature": "export declare const sessionStateIsActive: (state: SessionStateValue) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 71 }, { "name": "validSessionStateTransitions", "signature": "export declare const validSessionStateTransitions: (state: SessionStateValue) => readonly SessionStateValue[];", "documentation": "Returns the set of valid transitions from a given state.", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 76 }, { "name": "canTransitionTo", "signature": "export declare const canTransitionTo: (from: SessionStateValue, to: SessionStateValue) => boolean;", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 107 }, { "name": "SessionId", "signature": "export declare class SessionId {\n generate(): SessionId;\n fromString(s: string): SessionId;\n asString(): string;\n toString(): string;\n toJSON(): string;\n}", "documentation": "Session identifier (UUID v7 in Rust; UUID v4 is acceptable here).", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 10 }, { "name": "SessionState", "signature": "export declare const SessionState: { readonly AgentBootstrapped: \"agent_bootstrapped\"; readonly SessionStarted: \"session_started\"; readonly CapabilitiesGranted: \"capabilities_granted\"; readonly ToolUse: \"tool_use\"; readonly Renewal: \"renewal\"; readonly Escalation: \"escalation\"; readonly SessionEnded: \"session_ended\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 43 }, { "name": "SessionStateValue", "signature": "export type SessionStateValue = (typeof SessionState)[keyof typeof SessionState];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 53 }, { "name": "SessionEndReason", "signature": "export declare const SessionEndReason: { readonly Completed: \"completed\"; readonly Logout: \"logout\"; readonly Timeout: \"timeout\"; readonly TokenExpired: \"token_expired\"; readonly Revoked: \"revoked\"; readonly SecurityViolation: \"security_violation\"; readonly PolicyViolation: \"policy_violation\"; readonly SystemShutdown: \"system_shutdown\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 114 }, { "name": "SessionEndReasonValue", "signature": "export type SessionEndReasonValue = (typeof SessionEndReason)[keyof typeof SessionEndReason] | {\n error: string;\n};", "documentation": "", "source": "arsenal/sdks/typescript/src/core/session.ts", "line": 125 }, { "name": "createAuditEvent", "signature": "export declare const createAuditEvent: (opts: { kind: AuditEventKindValue; tenant_id: string; severity?: AuditSeverityValue; outcome?: AuditOutcomeValue; description?: string; metadata?: Record; agent_id?: string; session_id?: string; token_id?: string; client_ip?: string; user_agent?: string; request_id?: string; }) => AuditEvent;", "documentation": "Create a new audit event.", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 88 }, { "name": "hashAuditEvent", "signature": "export declare const hashAuditEvent: (event: AuditEvent) => Promise;", "documentation": "Compute a BLAKE3 hash of an audit event. The hash is used for chain\nlinkage and tamper detection. The result is a 32-byte `Uint8Array`.", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 125 }, { "name": "AuditSeverity", "signature": "export declare const AuditSeverity: { readonly Info: \"info\"; readonly Warning: \"warning\"; readonly Error: \"error\"; readonly Critical: \"critical\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 11 }, { "name": "AuditSeverityValue", "signature": "export type AuditSeverityValue = (typeof AuditSeverity)[keyof typeof AuditSeverity];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 18 }, { "name": "AuditOutcome", "signature": "export declare const AuditOutcome: { readonly Success: \"success\"; readonly Failure: \"failure\"; readonly Partial: \"partial\"; readonly Pending: \"pending\"; };", "documentation": "", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 20 }, { "name": "AuditOutcomeValue", "signature": "export type AuditOutcomeValue = (typeof AuditOutcome)[keyof typeof AuditOutcome];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 27 }, { "name": "AuditEventKind", "signature": "export declare const AuditEventKind: { readonly AgentAuthenticated: \"agent_authenticated\"; readonly AuthenticationFailed: \"authentication_failed\"; readonly SessionStarted: \"session_started\"; readonly SessionEnded: \"session_ended\"; readonly CapabilityRequested: \"capability_requested\"; readonly CapabilityGranted: \"capability_granted\"; readonly CapabilityDenied: \"capability_denied\"; readonly TokenRevoked: \"token_revoked\"; readonly SecretRead: \"secret_read\"; readonly SecretRotated: \"secret_rotated\"; readonly ProxyRequest: \"proxy_request\"; readonly ProxyDenied: \"proxy_denied\"; readonly ConsentRequested: \"consent_requested\"; readonly ConsentApproved: \"consent_approved\"; readonly ConsentDenied: \"consent_denied\"; readonly ConsentRevoked: \"consent_revoked\"; readonly PolicyEvaluated: \"policy_evaluated\"; readonly PolicyViolation: \"policy_violation\"; readonly ConfigChanged: \"config_changed\"; readonly KeyRotated: \"key_rotated\"; };", "documentation": "Kind of audit event.", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 30 }, { "name": "AuditEventKindValue", "signature": "export type AuditEventKindValue = (typeof AuditEventKind)[keyof typeof AuditEventKind];", "documentation": "", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 66 }, { "name": "AuditEvent", "signature": "export interface AuditEvent {\n id: string;\n timestamp: string;\n kind: AuditEventKindValue;\n severity: AuditSeverityValue;\n tenant_id: string;\n agent_id?: string;\n session_id?: string;\n token_id?: string;\n outcome: AuditOutcomeValue;\n description: string;\n metadata: Readonly>;\n client_ip?: string;\n user_agent?: string;\n request_id?: string;\n previous_hash?: Uint8Array;\n event_hash?: Uint8Array;\n}", "documentation": "", "source": "arsenal/sdks/typescript/src/core/audit.ts", "line": 68 }, { "name": "base64Encode", "signature": "export declare const base64Encode: (bytes: Uint8Array) => string;", "documentation": "Encode bytes to base64 (standard alphabet, no padding).", "source": "arsenal/sdks/typescript/src/core/codec.ts", "line": 11 }, { "name": "base64UrlEncode", "signature": "export declare const base64UrlEncode: (bytes: Uint8Array) => string;", "documentation": "Encode bytes to base64url (URL-safe alphabet, no padding).", "source": "arsenal/sdks/typescript/src/core/codec.ts", "line": 16 }, { "name": "base64Decode", "signature": "export declare const base64Decode: (s: string) => Uint8Array;", "documentation": "Decode a base64 string (standard or URL alphabet, with or without padding).", "source": "arsenal/sdks/typescript/src/core/codec.ts", "line": 21 }, { "name": "base64UrlDecode", "signature": "export declare const base64UrlDecode: (s: string) => Uint8Array;", "documentation": "Decode a base64url string. Same as `base64Decode` for convenience.", "source": "arsenal/sdks/typescript/src/core/codec.ts", "line": 26 }, { "name": "hexEncode", "signature": "export declare const hexEncode: (bytes: Uint8Array) => string;", "documentation": "Encode bytes as lowercase hex.", "source": "arsenal/sdks/typescript/src/core/codec.ts", "line": 114 }, { "name": "hexDecode", "signature": "export declare const hexDecode: (s: string) => Uint8Array;", "documentation": "Decode a hex string into bytes. Throws on invalid input.", "source": "arsenal/sdks/typescript/src/core/codec.ts", "line": 123 }, { "name": "zeroize", "signature": "export declare const zeroize: (bytes: Uint8Array) => void;", "documentation": "Zeroize a `Uint8Array` in place. Use in `finally` blocks for secret buffers.", "source": "arsenal/sdks/typescript/src/core/codec.ts", "line": 135 }, { "name": "encodeCbor", "signature": "export declare const encodeCbor: (value: unknown) => Uint8Array;", "documentation": "Encode a value to deterministic CBOR bytes.", "source": "arsenal/sdks/typescript/src/core/cbor.ts", "line": 94 }, { "name": "decodeCbor", "signature": "export declare const decodeCbor: (bytes: Uint8Array) => unknown;", "documentation": "Decode a CBOR byte string into a plain JS value.", "source": "arsenal/sdks/typescript/src/core/cbor.ts", "line": 236 }, { "name": "evaluatePolicy", "signature": "export declare const evaluatePolicy: (policy: PolicyDocument, request: PolicyRequest) => PolicyDecision;", "documentation": "Evaluate a single policy against a request. Returns the first matching\nrule's decision or the policy's default effect.", "source": "arsenal/sdks/typescript/src/policy/engine.ts", "line": 80 }, { "name": "compareOperator", "signature": "export declare const compareOperator: (operator: ConditionOperatorValue, actual: string, expected: string) => boolean;", "documentation": "Compare two strings using a condition operator.", "source": "arsenal/sdks/typescript/src/policy/engine.ts", "line": 152 }, { "name": "policyAllows", "signature": "export declare const policyAllows: (decision: PolicyDecision) => boolean;", "documentation": "Convenience alias: true if the policy decision allows the request.", "source": "arsenal/sdks/typescript/src/policy/engine.ts", "line": 197 }, { "name": "denyWith", "signature": "export declare const denyWith: (reason: string) => PolicyDecision;", "documentation": "Build a deny decision with a reason string.", "source": "arsenal/sdks/typescript/src/policy/engine.ts", "line": 202 }, { "name": "PolicyEngine", "signature": "export declare class PolicyEngine {\n addPolicy(policy: PolicyDocument): void;\n removePolicy(policyId: string): PolicyDocument | undefined;\n getPolicy(policyId: string): PolicyDocument | undefined;\n policyIds(): readonly string[];\n size(): number;\n evaluate(request: PolicyRequest): PolicyDecision;\n}", "documentation": "A policy engine evaluates multiple policies in priority order.\n\nPolicies are added via `addPolicy` and removed via `removePolicy`. On\neach `evaluate(request)` call, policies are sorted by descending\npriority and the first matching rule's decision is returned. When no\nrule matches, the default effect of the first policy (ordered by\npriority) is used, and if there are no policies the engine returns\n`Deny`.", "source": "arsenal/sdks/typescript/src/policy/engine.ts", "line": 34 }, { "name": "BrokerClientOptions", "signature": "/** Configuration for the broker client. */\nexport interface BrokerClientOptions {\n /** Base URL of the broker (e.g. `https://broker.example.com`). */\n baseUrl: string;\n /** Per-request timeout in milliseconds. Default: 30_000. */\n timeoutMs?: number;\n /** Extra headers applied to every outbound request. */\n defaultHeaders?: Record;\n /** Custom `fetch` implementation (defaults to `globalThis.fetch`). */\n fetch?: typeof globalThis.fetch;\n}", "documentation": "Configuration for the broker client.", "source": "arsenal/sdks/typescript/src/broker/client.ts", "line": 43 }, { "name": "BrokerClient", "signature": "export declare class BrokerClient {\n constructor(opts: BrokerClientOptions): BrokerClient;\n health(): Promise;\n requestCapability(payload: CapabilityRequestPayload): Promise;\n requestSecret(payload: SecretRequestPayload): Promise;\n revokeToken(tokenId: string, reason?: string): Promise;\n verifyToken(token: string): Promise;\n proxyRequest(req: ProxyRequest, opts?: { fingerprintHex?: string; }): Promise;\n approveConsent(payload: ConsentApprovalPayload): Promise;\n denyConsent(payload: ConsentDenialPayload): Promise;\n revokeConsent(payload: ConsentRevocationPayload): Promise;\n listConsents(agentDid: string): Promise;\n decodeCapabilityToken(response: CapabilityResponsePayload): AgentCapabilityToken;\n}", "documentation": "Broker HTTP client.\n\nAll methods throw `ArsenalError` on failure. Response bodies are\nvalidated with Zod schemas at the boundary.", "source": "arsenal/sdks/typescript/src/broker/client.ts", "line": 62 }, { "name": "ConstraintsPayloadSchema", "signature": "export declare const ConstraintsPayloadSchema: z.ZodObject<{ require_pop: z.ZodBoolean; allowed_origins: z.ZodOptional>; device_id: z.ZodOptional; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 12 }, { "name": "ConstraintsPayload", "signature": "export type ConstraintsPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 20 }, { "name": "CapabilityRequestPayloadSchema", "signature": "export declare const CapabilityRequestPayloadSchema: z.ZodObject<{ scopes: z.ZodArray; ttl_seconds: z.ZodOptional; audience: z.ZodString; constraints: z.ZodOptional>; device_id: z.ZodOptional; }, z.core.$strict>>; pop_key_fingerprint: z.ZodOptional; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 22 }, { "name": "CapabilityRequestPayload", "signature": "export type CapabilityRequestPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 32 }, { "name": "CapabilityResponsePayloadSchema", "signature": "export declare const CapabilityResponsePayloadSchema: z.ZodObject<{ token_id: z.ZodString; token: z.ZodString; expires_at: z.ZodString; granted_scopes: z.ZodArray; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 34 }, { "name": "CapabilityResponsePayload", "signature": "export type CapabilityResponsePayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 43 }, { "name": "SecretRequestPayloadSchema", "signature": "export declare const SecretRequestPayloadSchema: z.ZodObject<{ secret_id: z.ZodString; version: z.ZodOptional; capability_token: z.ZodString; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 47 }, { "name": "SecretRequestPayload", "signature": "export type SecretRequestPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 55 }, { "name": "SecretResponsePayloadSchema", "signature": "export declare const SecretResponsePayloadSchema: z.ZodObject<{ secret_id: z.ZodString; version: z.ZodNumber; wrapped_value: z.ZodString; wrap_key_id: z.ZodString; ephemeral_public_key: z.ZodString; expires_at: z.ZodString; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 57 }, { "name": "SecretResponsePayload", "signature": "export type SecretResponsePayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 68 }, { "name": "RevokeTokenPayloadSchema", "signature": "export declare const RevokeTokenPayloadSchema: z.ZodObject<{ token_id: z.ZodString; reason: z.ZodOptional; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 72 }, { "name": "RevokeTokenPayload", "signature": "export type RevokeTokenPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 79 }, { "name": "RevokeTokenResponseSchema", "signature": "export declare const RevokeTokenResponseSchema: z.ZodObject<{ success: z.ZodBoolean; message: z.ZodString; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 81 }, { "name": "RevokeTokenResponse", "signature": "export type RevokeTokenResponse = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 88 }, { "name": "VerifyTokenPayloadSchema", "signature": "export declare const VerifyTokenPayloadSchema: z.ZodObject<{ token: z.ZodString; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 90 }, { "name": "VerifyTokenPayload", "signature": "export type VerifyTokenPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 96 }, { "name": "VerifyTokenResponseSchema", "signature": "export declare const VerifyTokenResponseSchema: z.ZodObject<{ valid: z.ZodBoolean; token_id: z.ZodOptional; subject: z.ZodOptional; audience: z.ZodOptional; expires_at: z.ZodOptional; scopes: z.ZodOptional>; error: z.ZodOptional; }, z.core.$loose>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 98 }, { "name": "VerifyTokenResponse", "signature": "export type VerifyTokenResponse = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 110 }, { "name": "ProxyRequestPayloadSchema", "signature": "export declare const ProxyRequestPayloadSchema: z.ZodObject<{ method: z.ZodString; url: z.ZodString; headers: z.ZodOptional>; body: z.ZodOptional; capability_token: z.ZodString; timeout_ms: z.ZodOptional; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 114 }, { "name": "ProxyRequestPayload", "signature": "export type ProxyRequestPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 125 }, { "name": "ProxyMetadataPayloadSchema", "signature": "export declare const ProxyMetadataPayloadSchema: z.ZodObject<{ variables_resolved: z.ZodArray; destination_verified: z.ZodBoolean; fingerprint_verified: z.ZodBoolean; consent_status: z.ZodString; latency_ms: z.ZodNumber; request_id: z.ZodOptional; }, z.core.$loose>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 127 }, { "name": "ProxyMetadataPayload", "signature": "export type ProxyMetadataPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 138 }, { "name": "ProxyResponsePayloadSchema", "signature": "export declare const ProxyResponsePayloadSchema: z.ZodObject<{ status: z.ZodNumber; headers: z.ZodRecord; body: z.ZodString; proxy_metadata: z.ZodObject<{ variables_resolved: z.ZodArray; destination_verified: z.ZodBoolean; fingerprint_verified: z.ZodBoolean; consent_status: z.ZodString; latency_ms: z.ZodNumber; request_id: z.ZodOptional; }, z.core.$loose>; }, z.core.$loose>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 140 }, { "name": "ProxyResponsePayload", "signature": "export type ProxyResponsePayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 149 }, { "name": "ConsentApprovalPayloadSchema", "signature": "export declare const ConsentApprovalPayloadSchema: z.ZodObject<{ agent_did: z.ZodString; human_root_did: z.ZodString; variables: z.ZodArray; destination_domains: z.ZodArray; scopes: z.ZodArray; granted_by: z.ZodString; expires_in_seconds: z.ZodOptional; signature: z.ZodString; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 153 }, { "name": "ConsentApprovalPayload", "signature": "export type ConsentApprovalPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 166 }, { "name": "ConsentRecordPayloadSchema", "signature": "export declare const ConsentRecordPayloadSchema: z.ZodObject<{ consent_id: z.ZodString; agent_did: z.ZodString; human_root_did: z.ZodOptional; variables: z.ZodArray; destination_domains: z.ZodOptional>; scopes: z.ZodOptional>; granted_by: z.ZodOptional; granted_at: z.ZodString; expires_at: z.ZodString; revoked: z.ZodOptional; }, z.core.$loose>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 168 }, { "name": "ConsentRecordPayload", "signature": "export type ConsentRecordPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 183 }, { "name": "ConsentDenialPayloadSchema", "signature": "export declare const ConsentDenialPayloadSchema: z.ZodObject<{ agent_did: z.ZodString; human_root_did: z.ZodString; variables: z.ZodArray; destination_domains: z.ZodArray; scopes: z.ZodArray; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 185 }, { "name": "ConsentDenialPayload", "signature": "export type ConsentDenialPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 195 }, { "name": "ConsentRevocationPayloadSchema", "signature": "export declare const ConsentRevocationPayloadSchema: z.ZodObject<{ consent_id: z.ZodString; }, z.core.$strict>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 197 }, { "name": "ConsentRevocationPayload", "signature": "export type ConsentRevocationPayload = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 203 }, { "name": "HealthResponseSchema", "signature": "export declare const HealthResponseSchema: z.ZodObject<{ status: z.ZodString; version: z.ZodString; registered_agents: z.ZodOptional; revoked_tokens: z.ZodOptional; }, z.core.$loose>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 207 }, { "name": "HealthResponse", "signature": "export type HealthResponse = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 216 }, { "name": "ApiErrorResponseSchema", "signature": "export declare const ApiErrorResponseSchema: z.ZodObject<{ code: z.ZodNumber; message: z.ZodString; correlation_id: z.ZodOptional; retry_after: z.ZodOptional; }, z.core.$loose>;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 218 }, { "name": "ApiErrorResponse", "signature": "export type ApiErrorResponse = z.infer;", "documentation": "", "source": "arsenal/sdks/typescript/src/broker/wire.ts", "line": 227 }, { "name": "ArsenalClientConfig", "signature": "/** Configuration for the Arsenal client. */\nexport interface ArsenalClientConfig {\n /** Agent identity (public key fingerprint + metadata). */\n identity: AgentIdentity;\n /** Broker client options. Required for any server-backed operation. */\n broker?: BrokerClientOptions;\n /** Session configuration. Default: 24-hour session, 30s renewal threshold. */\n sessionConfig?: SessionConfig;\n /** Auto-renew capability tokens when they are close to expiry. Default: true. */\n autoRenew?: boolean;\n /** Token issuer label. Default: \"arsenal\". */\n issuer?: string;\n /** Default audience (service) for broker-issued tokens. Default: \"default\". */\n defaultAudience?: string;\n}", "documentation": "Configuration for the Arsenal client.", "source": "arsenal/sdks/typescript/src/sdk/client.ts", "line": 33 }, { "name": "ArsenalClient", "signature": "export declare class ArsenalClient {\n create(opts: ArsenalClientConfig): ArsenalClient;\n identity(): AgentIdentity;\n broker(): BrokerClient | undefined;\n startSession(): Promise;\n endSession(): Promise;\n revokeSession(): Promise;\n hasActiveSession(): boolean;\n sessionStats(): SessionStats;\n currentToken(): AgentCapabilityToken | undefined;\n requestCapability(request: CapabilityRequest): Promise;\n requestCapabilityForScopes(scopes: readonly string[], ttlSeconds: number): Promise;\n renewCurrentCapability(): Promise;\n proxyHttp(request: ProxyRequest): Promise;\n callToolSimple(_toolId: string, _method: string, params: unknown, opts?: { scopes?: readonly string[]; ttlSeconds?: number; }): Promise;\n approveConsent(payload: ConsentApprovalPayload): Promise;\n denyConsent(payload: ConsentDenialPayload): Promise;\n revokeConsent(payload: ConsentRevocationPayload): Promise;\n listConsents(): Promise;\n requestSecret(secretId: string, capabilityToken: string, version?: number): Promise;\n verifyToken(tokenBase64: string): Promise<{ valid: boolean; subject?: string; audience?: string; scopes?: string[]; }>;\n revokeToken(tokenId: string, reason?: string): Promise;\n}", "documentation": "High-level ARSENAL client. Combines session management, capability\nrequests, proxy calls, and consent operations.\n\nConstruct with `ArsenalClient.create({...})` and then:\n 1. `await client.startSession()`\n 2. `await client.requestCapabilityForScopes([...], 300)`\n 3. `await client.proxyHttp({...})` or other proxy calls\n 4. `await client.endSession()` when done", "source": "arsenal/sdks/typescript/src/sdk/client.ts", "line": 58 }, { "name": "CapabilityRequest", "signature": "export declare class CapabilityRequest {\n create(): CapabilityRequest;\n scope(scope: string): CapabilityRequest;\n scopes(scopes: readonly string[]): CapabilityRequest;\n ttlSeconds(ttl: number): CapabilityRequest;\n audience(audience: string): CapabilityRequest;\n constraints(constraints: Constraints): CapabilityRequest;\n getScopes(): ScopeSet;\n getTtl(): number;\n getAudience(): string;\n getConstraints(): Constraints | undefined;\n}", "documentation": "Builder for capability requests.", "source": "arsenal/sdks/typescript/src/sdk/capability.ts", "line": 12 }, { "name": "CapabilityHandle", "signature": "export declare class CapabilityHandle {\n constructor(token: AgentCapabilityToken): CapabilityHandle;\n tokenId(): string;\n audience(): string;\n scopes(): ScopeSet;\n isExpired(now?: Date): boolean;\n remainingTtlMs(now?: Date): number;\n encode(): string;\n}", "documentation": "Handle wrapping an issued capability token. Provides convenient\ninspection methods — the token itself is immutable.", "source": "arsenal/sdks/typescript/src/sdk/capability.ts", "line": 93 }, { "name": "defaultSessionConfig", "signature": "export declare const defaultSessionConfig: () => SessionConfig;", "documentation": "", "source": "arsenal/sdks/typescript/src/sdk/session.ts", "line": 27 }, { "name": "SessionConfig", "signature": "/** Configuration for session lifecycle. */\nexport interface SessionConfig {\n /** Session TTL in seconds. Default: 24 hours. */\n sessionTtlSeconds: number;\n /**\n * Renew tokens when their remaining lifetime drops below this many\n * seconds. Default: 30.\n */\n renewalThresholdSeconds: number;\n}", "documentation": "Configuration for session lifecycle.", "source": "arsenal/sdks/typescript/src/sdk/session.ts", "line": 17 }, { "name": "SessionStats", "signature": "/** Aggregate session statistics. */\nexport interface SessionStats {\n state: SessionStateValue;\n created_at: string | null;\n last_activity_at: string | null;\n has_active_token: boolean;\n}", "documentation": "Aggregate session statistics.", "source": "arsenal/sdks/typescript/src/sdk/session.ts", "line": 35 }, { "name": "SessionManager", "signature": "export declare class SessionManager {\n constructor(config?: SessionConfig): SessionManager;\n startSession(): Promise;\n sessionIdOrThrow(): SessionId;\n hasActiveSession(): boolean;\n stats(): SessionStats;\n setCurrentToken(token: AgentCapabilityToken): void;\n currentToken(): AgentCapabilityToken | undefined;\n recordActivity(): void;\n needsTokenRenewal(now?: Date): boolean;\n endSession(): Promise;\n revokeSession(): Promise;\n}", "documentation": "In-memory session manager. Not thread-safe in the shared-memory sense,\nbut JavaScript is single-threaded so method calls cannot interleave.", "source": "arsenal/sdks/typescript/src/sdk/session.ts", "line": 46 } ] }, { "package": "@openagentid/anchor-eas", "url": "/reference/typescript/openagent-sdk-adapters-eas-typescript", "exports": [ { "name": "didRecipient", "signature": "export declare const didRecipient: (did: string) => string;", "documentation": "Derive the deterministic recipient address for a subject DID.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 57 }, { "name": "encodeAnchorData", "signature": "export declare const encodeAnchorData: (data: AnchorData) => Uint8Array;", "documentation": "ABI-encode the anchor data (same layout as the Rust adapter).", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 75 }, { "name": "SCHEMA_STRING", "signature": "export declare const SCHEMA_STRING: \"string did,string kind,string status,string metadataCommitment,uint64 anchoredAtBlock\";", "documentation": "The OAS lineage-root attestation schema registered on EAS.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 30 }, { "name": "AnchorData", "signature": "/** The attestation's decoded data fields. */\nexport interface AnchorData {\n did: string;\n kind: string;\n status: string;\n metadataCommitment: string;\n anchoredAtBlock: bigint;\n}", "documentation": "The attestation's decoded data fields.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 34 }, { "name": "AnchorRecord", "signature": "/** The anchor record an anchor backend reports for a root. */\nexport interface AnchorRecord {\n did: string;\n status: string;\n anchoredAtBlock: number;\n metadataCommitment: string;\n}", "documentation": "The anchor record an anchor backend reports for a root.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 43 }, { "name": "RevocationStatus", "signature": "/** The revocation status of a subject. */\nexport interface RevocationStatus {\n revoked: boolean;\n reasonCommitment?: string;\n}", "documentation": "The revocation status of a subject.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 51 }, { "name": "EasResolverConfig", "signature": "/** Configuration for the resolver. */\nexport interface EasResolverConfig {\n /** The OAS lineage schema UID on this chain. */\n schemaUid: string;\n /** EAS GraphQL endpoint. */\n graphqlUrl: string;\n /** Chain JSON-RPC endpoint (for eth_blockNumber). */\n rpcUrl: string;\n /** Confirmations subtracted from the head to define \"finalized\". Default: 64. */\n confirmationDepth?: number;\n /** Injected fetch (tests and non-Node runtimes). Default: globalThis.fetch. */\n fetch?: typeof fetch;\n}", "documentation": "Configuration for the resolver.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 92 }, { "name": "EasAnchorResolver", "signature": "export declare class EasAnchorResolver {\n constructor(config: EasResolverConfig): EasAnchorResolver;\n checkRevocation(did: string): Promise;\n getRoot(did: string, kind: \"hmr\" | \"mhr\" | \"enr\"): Promise;\n currentFinalizedBlock(): Promise;\n}", "documentation": "The EAS resolver: reads lineage authority from attestations.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 112 }, { "name": "EasPublisherConfig", "signature": "/** Signer shape the publisher needs: a viem-compatible account plus provider. */\nexport interface EasPublisherConfig {\n /** The OAS lineage schema UID on this chain. */\n schemaUid: string;\n /** The EAS contract address on this chain. */\n easContractAddress: string;\n /** A viem-compatible signer (any object the EAS SDK accepts). */\n signer: unknown;\n}", "documentation": "Signer shape the publisher needs: a viem-compatible account plus provider.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 210 }, { "name": "EasAnchorPublisher", "signature": "export declare class EasAnchorPublisher {\n constructor(config: EasPublisherConfig): EasAnchorPublisher;\n publishAnchor(data: AnchorData): Promise;\n revoke(uid: string): Promise;\n}", "documentation": "The EAS publisher: writes anchors as attestations via the maintained SDK.", "source": "openagent-sdk/adapters/eas/typescript/src/index.ts", "line": 220 } ] }, { "package": "@openagentid/http", "url": "/reference/typescript/openagent-sdk-adapters-http-typescript", "exports": [ { "name": "OPENAGENT_AUTH_SCHEME", "signature": "export declare const OPENAGENT_AUTH_SCHEME: \"OpenAgent\";", "documentation": "The canonical authorization scheme for OpenAgent-authenticated requests.", "source": "openagent-sdk/adapters/http/typescript/src/headers.ts", "line": 6 }, { "name": "HEADER_OPENAGENT_DID", "signature": "export declare const HEADER_OPENAGENT_DID: \"x-openagent-did\";", "documentation": "Header carrying the authenticated agent's DID.", "source": "openagent-sdk/adapters/http/typescript/src/headers.ts", "line": 9 }, { "name": "HEADER_OPENAGENT_SESSION", "signature": "export declare const HEADER_OPENAGENT_SESSION: \"x-openagent-session\";", "documentation": "Header carrying the session token (alternative to Authorization).", "source": "openagent-sdk/adapters/http/typescript/src/headers.ts", "line": 12 }, { "name": "CONTENT_TYPE_JSON", "signature": "export declare const CONTENT_TYPE_JSON: \"application/json\";", "documentation": "Content-Type for all Core Protocol JSON payloads.", "source": "openagent-sdk/adapters/http/typescript/src/headers.ts", "line": 15 }, { "name": "extractOpenAgentToken", "signature": "export declare const extractOpenAgentToken: (authorization: string) => string | undefined;", "documentation": "Extract the session token from an `Authorization: OpenAgent `\nheader. Returns `undefined` if the header is missing, malformed, or uses a\ndifferent scheme.", "source": "openagent-sdk/adapters/http/typescript/src/headers.ts", "line": 22 }, { "name": "buildOpenAgentHeader", "signature": "export declare const buildOpenAgentHeader: (token: string) => string;", "documentation": "Build an `Authorization: OpenAgent ` header value.", "source": "openagent-sdk/adapters/http/typescript/src/headers.ts", "line": 31 }, { "name": "HttpTransport", "signature": "export declare class HttpTransport {\n constructor(config?: HttpTransportConfig): HttpTransport;\n fetchChallenge(endpoint: string): Promise;\n prove(endpoint: string, proof: IdentityProof): Promise;\n}", "documentation": "HTTP transport carrying the identity flow over REST.", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 129 }, { "name": "TransportError", "signature": "export declare class TransportError {\n statusCode: number | undefined;\n responseBody: string | undefined;\n constructor(message: string, statusCode?: number, responseBody?: string): TransportError;\n}", "documentation": "Transport error with HTTP context.", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 107 }, { "name": "CHALLENGE_TYPE", "signature": "export declare const CHALLENGE_TYPE: \"openagent-challenge-v1\";", "documentation": "The literal `type` value of an identity challenge (Section 15.2).", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 13 }, { "name": "canonicalChallengeBytes", "signature": "export declare const canonicalChallengeBytes: (challenge: IdentityChallenge) => Uint8Array;", "documentation": "The JCS-canonical (RFC 8785) UTF-8 bytes of a challenge object.\n\nScoped to the challenge shape: a flat object whose values are strings (or\nabsent). JCS for that shape is lexicographic key order, no whitespace, and\nJSON string escaping — which is exactly what this produces. Do not reuse\nfor nested or numeric payloads; pull in a full JCS implementation there.", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 91 }, { "name": "identityChallengeSchema", "signature": "export declare const identityChallengeSchema: z.ZodObject<{ type: z.ZodLiteral<\"openagent-challenge-v1\">; nonce: z.ZodString; timestamp: z.ZodString; origin: z.ZodString; realm: z.ZodOptional; }, z.core.$strict>;", "documentation": "Zod schema for challenge validation (agents MUST validate before signing).", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 56 }, { "name": "identityVerifiedSchema", "signature": "export declare const identityVerifiedSchema: z.ZodObject<{ did: z.ZodString; trust_tier: z.ZodEnum<{ anonymous: \"anonymous\"; identified: \"identified\"; sovereign: \"sovereign\"; }>; session_token: z.ZodString; session_expires: z.ZodString; capabilities: z.ZodOptional>; }, z.core.$strip>;", "documentation": "Zod schema for the verified session message.", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 75 }, { "name": "IdentityChallenge", "signature": "/** Server → Agent: a cryptographic challenge (Section 15.2). */\nexport interface IdentityChallenge {\n type: string;\n /** 64-character lowercase hex string (32 CSPRNG bytes). */\n nonce: string;\n /** ISO 8601 UTC, Z suffix, seconds precision. */\n timestamp: string;\n /** `scheme://host[:port]`. */\n origin: string;\n /** Optional protection-space identifier. */\n realm?: string;\n}", "documentation": "Server → Agent: a cryptographic challenge (Section 15.2).", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 16 }, { "name": "IdentityProof", "signature": "/** Agent → Server: the cryptographic proof of identity (Section 15.3). */\nexport interface IdentityProof {\n /** Base64url (no padding) signature over the JCS-canonical challenge bytes. */\n signature: string;\n /** Base64url (no padding) raw public key. */\n public_key: string;\n key_type: KeyType;\n /** The nonce from the challenge, echoed. */\n nonce: string;\n}", "documentation": "Agent → Server: the cryptographic proof of identity (Section 15.3).", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 32 }, { "name": "IdentityVerified", "signature": "/** Server → Agent: identity confirmed; session issued (Section 15.4). */\nexport interface IdentityVerified {\n did: string;\n trust_tier: TrustTier;\n session_token: string;\n /** ISO 8601 UTC timestamp of session expiry. */\n session_expires: string;\n capabilities?: string[];\n}", "documentation": "Server → Agent: identity confirmed; session issued (Section 15.4).", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 46 }, { "name": "KeyType", "signature": "/** Signature scheme for a proof (Section 15.3). */\nexport type KeyType = 'ed25519' | 'secp256k1';", "documentation": "Signature scheme for a proof (Section 15.3).", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 29 }, { "name": "TrustTier", "signature": "/** The resolution tier the server assigns (Section 15.4). */\nexport type TrustTier = 'anonymous' | 'identified' | 'sovereign';", "documentation": "The resolution tier the server assigns (Section 15.4).", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 43 }, { "name": "HttpTransportConfig", "signature": "/** Configuration for the HTTP transport. */\nexport interface HttpTransportConfig {\n /** Request timeout in milliseconds. Default: 30000. */\n timeoutMs?: number;\n /** Custom headers to include in all requests. */\n headers?: Record;\n}", "documentation": "Configuration for the HTTP transport.", "source": "openagent-sdk/adapters/http/typescript/src/transport.ts", "line": 121 }, { "name": "ConformanceLevel", "signature": "/** Conformance level enum values. */\nexport type ConformanceLevel = 'L0' | 'L1' | 'L2';", "documentation": "Conformance level enum values.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 13 }, { "name": "DiscoveryDocument", "signature": "/** Discovery document returned by the server. */\nexport interface DiscoveryDocument {\n auth_endpoint: string;\n supported_versions: number[];\n server_did: string;\n required_conformance_level: ConformanceLevel;\n}", "documentation": "Discovery document returned by the server.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 16 }, { "name": "discoveryDocumentSchema", "signature": "export declare const discoveryDocumentSchema: z.ZodObject<{ auth_endpoint: z.ZodString; supported_versions: z.ZodArray; server_did: z.ZodString; required_conformance_level: z.ZodEnum<{ L0: \"L0\"; L1: \"L1\"; L2: \"L2\"; }>; }, z.core.$strip>;", "documentation": "Zod schema for DiscoveryDocument.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 24 }, { "name": "WELL_KNOWN_PATH", "signature": "export declare const WELL_KNOWN_PATH: \"/.well-known/openagent\";", "documentation": "Default well-known path.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 32 }, { "name": "AUTH_ENDPOINT_PATH", "signature": "export declare const AUTH_ENDPOINT_PATH: \"/.well-known/openagent/auth\";", "documentation": "Default auth endpoint path.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 35 }, { "name": "PROVE_ENDPOINT_PATH", "signature": "export declare const PROVE_ENDPOINT_PATH: \"/.well-known/openagent/auth/prove\";", "documentation": "Default prove endpoint path.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 38 }, { "name": "fetchDiscovery", "signature": "export declare const fetchDiscovery: (baseUrl: string, timeoutMs?: number) => Promise;", "documentation": "Fetch the discovery document from a server.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 46 }, { "name": "resolveAuthEndpoint", "signature": "export declare const resolveAuthEndpoint: (baseUrl: string, doc: DiscoveryDocument) => string;", "documentation": "Resolve the full auth endpoint URL from a base URL and discovery document.", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 78 }, { "name": "resolveProveEndpoint", "signature": "export declare const resolveProveEndpoint: (baseUrl: string, doc: DiscoveryDocument) => string;", "documentation": "Resolve the prove endpoint URL (auth endpoint + `/prove`).", "source": "openagent-sdk/adapters/http/typescript/src/discovery.ts", "line": 85 }, { "name": "DEFAULT_SESSION_TTL_SECS", "signature": "export declare const DEFAULT_SESSION_TTL_SECS: 300;", "documentation": "Default session TTL in seconds.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 29 }, { "name": "DEFAULT_CHALLENGE_TTL_SECS", "signature": "export declare const DEFAULT_CHALLENGE_TTL_SECS: 60;", "documentation": "Default challenge TTL in seconds (Section 7: default 30s, max 300s).", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 32 }, { "name": "ServerConfig", "signature": "/** Server configuration for the HTTP endpoints. */\nexport interface ServerConfig {\n /** The server's origin per RFC 6454 (`scheme://host[:port]`). Bound into every challenge. */\n origin: string;\n /** Optional protection-space identifier. */\n realm?: string;\n /** The trust tier assigned to verified agents. Default: anonymous. */\n trustTier?: TrustTier;\n /** Session TTL in seconds. */\n sessionTtlSecs?: number;\n /** Challenge TTL in seconds. */\n challengeTtlSecs?: number;\n /** Conformance level advertised in discovery. */\n requiredConformance?: ConformanceLevel;\n}", "documentation": "Server configuration for the HTTP endpoints.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 35 }, { "name": "SessionState", "signature": "/** Session states. */\nexport type SessionState = 'awaiting_proof' | 'established' | 'closed';", "documentation": "Session states.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 63 }, { "name": "StoredSession", "signature": "/** A stored session. */\nexport interface StoredSession {\n id: string;\n state: SessionState;\n initiatorDid: string;\n responderDid: string;\n nonce: string;\n /** The exact challenge timestamp (spec format); needed to reconstruct the signed payload. */\n challengeTimestamp: string;\n createdAt: number;\n expiresAt: number;\n capabilities: string[];\n}", "documentation": "A stored session.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 66 }, { "name": "SessionStore", "signature": "/** Session store interface. */\nexport interface SessionStore {\n put(session: StoredSession): Promise;\n get(sessionId: string): Promise;\n remove(sessionId: string): Promise;\n}", "documentation": "Session store interface.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 80 }, { "name": "VerifySignatureFn", "signature": "/**\n * Signature verifier function. The caller provides this (crypto-wasm,\n * libsodium, noble-ed25519, a KMS call) since Ed25519 verification is not in\n * every runtime's Web Crypto.\n */\nexport type VerifySignatureFn = (params: {\n publicKeyBase64Url: string;\n payload: Uint8Array;\n signatureBase64Url: string;\n}) => Promise;", "documentation": "Signature verifier function. The caller provides this (crypto-wasm,\nlibsodium, noble-ed25519, a KMS call) since Ed25519 verification is not in\nevery runtime's Web Crypto.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 187 }, { "name": "AuthResult", "signature": "/** Result of authenticating an incoming request. */\nexport interface AuthResult {\n authenticated: boolean;\n peerDid?: string;\n sessionToken?: string;\n error?: string;\n}", "documentation": "Result of authenticating an incoming request.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 276 }, { "name": "InMemorySessionStore", "signature": "export declare class InMemorySessionStore {\n put(session: StoredSession): Promise;\n get(sessionId: string): Promise;\n remove(sessionId: string): Promise;\n}", "documentation": "In-memory session store for development and testing.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 87 }, { "name": "CoreAuthError", "signature": "export declare class CoreAuthError {\n statusCode: number;\n constructor(message: string, statusCode: number): CoreAuthError;\n}", "documentation": "Error returned by server handlers, carrying the HTTP status to render.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 104 }, { "name": "createServerConfig", "signature": "export declare const createServerConfig: (origin: string, overrides?: Partial) => Required> & ServerConfig;", "documentation": "Create a server config with sensible defaults.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 51 }, { "name": "handleDiscovery", "signature": "export declare const handleDiscovery: (config: ServerConfig & { requiredConformance?: ConformanceLevel; }) => DiscoveryDocument;", "documentation": "Handle `GET /.well-known/openagent` - returns the discovery document.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 134 }, { "name": "handleChallenge", "signature": "export declare const handleChallenge: (config: ServerConfig & { requiredConformance?: ConformanceLevel; }, store: SessionStore) => Promise;", "documentation": "Handle the challenge step - issue an IdentityChallenge.\n\nRecords a pending session keyed by the nonce: the proof carries exactly\nthat correlation, and single-use-ness is enforced by removal.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 149 }, { "name": "handleProve", "signature": "export declare const handleProve: (config: ServerConfig & { requiredConformance?: ConformanceLevel; }, store: SessionStore, body: unknown, verifySignature: VerifySignatureFn) => Promise;", "documentation": "Handle the prove step - verify an IdentityProof and issue a session.\n\nVerification is normative-ordered: pending challenge first (present,\nunexpired), then shape checks (nonce echo), then the signature over the\nJCS-canonical challenge bytes. The nonce is consumed on success *and* on\nfailure - a failed answer must not be retryable, or a verifier becomes an\noracle.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 202 }, { "name": "authenticateRequest", "signature": "export declare const authenticateRequest: (request: Request, store: SessionStore) => Promise;", "documentation": "Authenticate an incoming request by checking the session token.", "source": "openagent-sdk/adapters/http/typescript/src/server.ts", "line": 284 }, { "name": "MiddlewareOptions", "signature": "/** Options for creating OAAP middleware. */\nexport interface MiddlewareOptions {\n /** Server DID. */\n serverDid: string;\n /** Session store (default: in-memory). */\n store?: SessionStore;\n /** Required conformance level (default: L2). */\n requiredConformance?: 'L0' | 'L1' | 'L2';\n /** Session TTL in seconds (default: 300). */\n sessionTtlSecs?: number;\n /** Challenge TTL in seconds (default: 60). */\n challengeTtlSecs?: number;\n /** Signature verification function. */\n verifySignature: VerifySignatureFn;\n /** Paths to exclude from authentication (well-known paths are always excluded). */\n excludePaths?: string[];\n}", "documentation": "Options for creating OAAP middleware.", "source": "openagent-sdk/adapters/http/typescript/src/middleware.ts", "line": 21 }, { "name": "createOpenAgentHandler", "signature": "export declare const createOpenAgentHandler: (options: MiddlewareOptions) => { config: ServerConfig; store: SessionStore; handle: (request: Request) => Promise; };", "documentation": "Create a generic OAAP middleware using the standard fetch Request/Response API.\n\nReturns a function that:\n- Handles OAAP well-known endpoints\n- Validates authenticated requests\n- Returns `undefined` for well-known routes (caller should send the JSON response)\n\nWorks with Hono, Cloudflare Workers, Deno, Bun, and any fetch-based framework.", "source": "openagent-sdk/adapters/http/typescript/src/middleware.ts", "line": 55 }, { "name": "createOpenAgentMiddleware", "signature": "export declare const createOpenAgentMiddleware: (options: MiddlewareOptions) => (req: { url?: string; method?: string; headers: Record; path?: string; }, res: { status: (code: number) => { json: (body: unknown) => void; end: () => void; }; }, next: () => void) => Promise;", "documentation": "Create Express-compatible middleware.\n\nUsage:\n```ts\napp.use(createOpenAgentMiddleware({\n serverDid: 'did:oas:l1fe:service:api',\n verifySignature: async (did, payload, sig) => { ... },\n}));\n```", "source": "openagent-sdk/adapters/http/typescript/src/middleware.ts", "line": 155 }, { "name": "ClientConfig", "signature": "/** Client configuration. */\nexport interface ClientConfig {\n /**\n * The agent's DID. Reported to the server for audit and, where the\n * deployment resolves DIDs, for trust-tier assignment. The agent proves\n * possession of the key - lineage evaluation is the server's job.\n */\n did: string;\n /** The signature scheme the `sign` function implements. */\n keyType?: KeyType;\n /** Request timeout in milliseconds. Default: 30000. */\n timeoutMs?: number;\n}", "documentation": "Client configuration.", "source": "openagent-sdk/adapters/http/typescript/src/client.ts", "line": 18 }, { "name": "SignFn", "signature": "/**\n * Function that signs a payload and returns a base64url (no padding)\n * encoded signature.\n *\n * The caller provides this — it may use @openagentid/crypto-wasm, Web Crypto,\n * or any Ed25519 implementation.\n */\nexport type SignFn = (payload: Uint8Array) => Promise;", "documentation": "Function that signs a payload and returns a base64url (no padding)\nencoded signature.\n\nThe caller provides this — it may use", "source": "openagent-sdk/adapters/http/typescript/src/client.ts", "line": 38 }, { "name": "HttpAuthClient", "signature": "export declare class HttpAuthClient {\n constructor(params: { config: ClientConfig; sign: SignFn; publicKey: () => Promise; transport?: HttpTransport; }): HttpAuthClient;\n authenticate(baseUrl: string): Promise;\n}", "documentation": "HTTP client that performs the Core Protocol identity flow.\n\nUsage:\n```ts\nconst client = new HttpAuthClient({\n config: { did: 'did:oas:l1fe:agent:my-bot' },\n sign: async (payload) => base64url(ed25519Sign(privateKey, payload)),\n publicKey: async () => base64url(ed25519PublicKey(privateKey)),\n});\nconst session = await client.authenticate('https://api.example.com');\nconst resp = await session.get('/api/tools');\n```", "source": "openagent-sdk/adapters/http/typescript/src/client.ts", "line": 54 }, { "name": "AuthenticatedSession", "signature": "export declare class AuthenticatedSession {\n constructor(params: { baseUrl: string; sessionId: string; peerDid: string; sessionToken: string; expiresAt: number; }): AuthenticatedSession;\n isExpired(): boolean;\n getSessionId(): string;\n getPeerDid(): string;\n getBaseUrl(): string;\n fetch(path: string, init?: RequestInit): Promise;\n get(path: string): Promise;\n post(path: string, body: unknown): Promise;\n put(path: string, body: unknown): Promise;\n delete(path: string): Promise;\n}", "documentation": "An authenticated HTTP session obtained after a successful Core Protocol identity flow.", "source": "openagent-sdk/adapters/http/typescript/src/session.ts", "line": 12 }, { "name": "VERSION", "signature": "export declare const VERSION: \"0.1.1\";", "documentation": "SDK version — kept in sync with `package.json`.", "source": "openagent-sdk/adapters/http/typescript/src/index.ts", "line": 86 } ] }, { "package": "@openagentid/oidc", "url": "/reference/typescript/openagent-sdk-bridges-oidc-typescript", "exports": [ { "name": "OidcBridge", "signature": "export declare class OidcBridge {\n constructor(input: OidcConfig | SingleProviderInput): OidcBridge;\n getConfig(): Readonly;\n deriveAgentFromJwt(token: string, agentName: string): Promise;\n actToJwt(claims: ActJwtClaims, signingKey: jose.KeyLike | Uint8Array, algorithm: string, kid?: string): Promise;\n wrapActAsJwt(opts: { agentDid: string; bridgeIssuer: string; audience?: string; scopes: readonly string[]; lineageDepth: number; parentHmr: string; actB64: string; signingKey: jose.KeyLike | Uint8Array; algorithm: string; kid?: string; }): Promise;\n exchangeToken(humanJwt: string, requestedScopes: readonly string[], signingKey?: jose.KeyLike | Uint8Array, algorithm?: string, bridgeIssuer?: string): Promise;\n executeExchange(request: TokenExchangeRequest, signingKey: jose.KeyLike | Uint8Array | undefined, algorithm: string, bridgeIssuer: string): Promise;\n validateJwt(token: string): Promise;\n refreshAllJwks(): Promise;\n}", "documentation": "The OIDC bridge -- maps between human OIDC tokens and OAS agent identities.", "source": "openagent-sdk/bridges/oidc/typescript/src/bridge.ts", "line": 67 }, { "name": "ProviderConfig", "signature": "export type ProviderConfig = z.infer;", "documentation": "", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 26 }, { "name": "OidcConfig", "signature": "export type OidcConfig = z.infer;", "documentation": "", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 42 }, { "name": "SingleProviderInput", "signature": "/** Shorthand input for single-provider setup. */\nexport interface SingleProviderInput {\n /** Provider name. */\n name?: string;\n /** OIDC issuer URL. */\n issuer: string;\n /** Expected audience. */\n audience?: string;\n /** JWKS URL override. */\n jwksUrl?: string;\n /** HMR claim name. */\n hmrClaim?: string;\n /** Scope mapping. */\n scopeMapping?: Record;\n /** OAS namespace. */\n namespace?: string;\n /** JWT TTL seconds. */\n jwtTtlSeconds?: number;\n /** HTTP timeout ms. */\n httpTimeoutMs?: number;\n /** Custom fetch. */\n fetch?: typeof globalThis.fetch;\n}", "documentation": "Shorthand input for single-provider setup.", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 45 }, { "name": "providerConfigSchema", "signature": "export declare const providerConfigSchema: z.ZodObject<{ name: z.ZodString; issuer: z.ZodString; audience: z.ZodOptional; jwksUrl: z.ZodOptional; hmrClaim: z.ZodDefault; scopeMapping: z.ZodDefault>>; }, z.core.$strip>;", "documentation": "Configuration for a single OIDC provider.", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 11 }, { "name": "oidcConfigSchema", "signature": "export declare const oidcConfigSchema: z.ZodObject<{ providers: z.ZodArray; jwksUrl: z.ZodOptional; hmrClaim: z.ZodDefault; scopeMapping: z.ZodDefault>>; }, z.core.$strip>>; namespace: z.ZodDefault; jwtTtlSeconds: z.ZodDefault; httpTimeoutMs: z.ZodDefault; fetch: z.ZodOptional>; }, z.core.$strip>;", "documentation": "Top-level OIDC bridge configuration.", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 29 }, { "name": "singleProviderConfig", "signature": "export declare const singleProviderConfig: (input: SingleProviderInput) => OidcConfig;", "documentation": "Build an OidcConfig from a single-provider shorthand input.", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 69 }, { "name": "findProvider", "signature": "export declare const findProvider: (config: OidcConfig, issuer: string) => ProviderConfig | undefined;", "documentation": "Find the provider config whose issuer matches the given string.", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 89 }, { "name": "resolveFetch", "signature": "export declare const resolveFetch: (config: OidcConfig) => typeof globalThis.fetch;", "documentation": "Resolve the fetch implementation from config or globalThis.", "source": "openagent-sdk/bridges/oidc/typescript/src/config.ts", "line": 97 }, { "name": "DiscoveryDocument", "signature": "export type DiscoveryDocument = z.infer;", "documentation": "", "source": "openagent-sdk/bridges/oidc/typescript/src/discovery.ts", "line": 23 }, { "name": "DiscoveryClient", "signature": "export declare class DiscoveryClient {\n constructor(fetchImpl: typeof globalThis.fetch, timeoutMs?: number, cacheTtlMs?: number): DiscoveryClient;\n discover(issuer: string): Promise;\n invalidate(issuer: string): void;\n invalidateAll(): void;\n}", "documentation": "OIDC discovery client with per-issuer caching.", "source": "openagent-sdk/bridges/oidc/typescript/src/discovery.ts", "line": 40 }, { "name": "discoveryDocumentSchema", "signature": "export declare const discoveryDocumentSchema: z.ZodObject<{ issuer: z.ZodString; authorization_endpoint: z.ZodDefault; token_endpoint: z.ZodDefault; jwks_uri: z.ZodString; response_types_supported: z.ZodDefault>; subject_types_supported: z.ZodDefault>; id_token_signing_alg_values_supported: z.ZodDefault>; scopes_supported: z.ZodDefault>; token_exchange_endpoint: z.ZodOptional; }, z.core.$strip>;", "documentation": "Subset of the OpenID Connect Discovery document we need.", "source": "openagent-sdk/bridges/oidc/typescript/src/discovery.ts", "line": 11 }, { "name": "wellKnownUrl", "signature": "export declare const wellKnownUrl: (issuer: string) => string;", "documentation": "Build the `.well-known/openid-configuration` URL from an issuer.", "source": "openagent-sdk/bridges/oidc/typescript/src/discovery.ts", "line": 31 }, { "name": "OidcBridgeError", "signature": "export declare class OidcBridgeError {\n code: OidcErrorCode;\n constructor(code: OidcErrorCode, message: string): OidcBridgeError;\n config(message: string): OidcBridgeError;\n discovery(message: string): OidcBridgeError;\n jwks(message: string): OidcBridgeError;\n jwtValidation(message: string): OidcBridgeError;\n unknownIssuer(issuer: string): OidcBridgeError;\n mapping(message: string): OidcBridgeError;\n exchange(message: string): OidcBridgeError;\n signing(message: string): OidcBridgeError;\n transport(message: string): OidcBridgeError;\n}", "documentation": "Base error class for all OIDC bridge errors.", "source": "openagent-sdk/bridges/oidc/typescript/src/errors.ts", "line": 18 }, { "name": "OidcErrorCode", "signature": "/**\n * Error types for the OIDC bridge.\n */\n/** Error codes for OIDC bridge errors. */\nexport type OidcErrorCode = 'DISCOVERY_ERROR' | 'JWKS_ERROR' | 'JWT_VALIDATION_ERROR' | 'UNKNOWN_ISSUER' | 'MAPPING_ERROR' | 'EXCHANGE_ERROR' | 'SIGNING_ERROR' | 'CONFIG_ERROR' | 'TRANSPORT_ERROR';", "documentation": "Error codes for OIDC bridge errors.", "source": "openagent-sdk/bridges/oidc/typescript/src/errors.ts", "line": 6 }, { "name": "TokenExchangeRequest", "signature": "export type TokenExchangeRequest = z.infer;", "documentation": "", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 41 }, { "name": "TokenExchangeResponse", "signature": "/** Token exchange response (RFC 8693 Section 2.2). */\nexport interface TokenExchangeResponse {\n readonly accessToken: string;\n readonly issuedTokenType: string;\n readonly tokenType: 'Bearer';\n readonly expiresIn: number;\n readonly scope?: string;\n}", "documentation": "Token exchange response (RFC 8693 Section 2.2).", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 44 }, { "name": "TokenExchangeError", "signature": "/** RFC 8693 error response. */\nexport interface TokenExchangeError {\n readonly error: string;\n readonly errorDescription?: string;\n}", "documentation": "RFC 8693 error response.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 53 }, { "name": "tokenExchangeRequestSchema", "signature": "export declare const tokenExchangeRequestSchema: z.ZodObject<{ grantType: z.ZodLiteral<\"urn:ietf:params:oauth:grant-type:token-exchange\">; subjectToken: z.ZodString; subjectTokenType: z.ZodEnum<{ \"urn:ietf:params:oauth:token-type:jwt\": \"urn:ietf:params:oauth:token-type:jwt\"; \"urn:ietf:params:oauth:token-type:access_token\": \"urn:ietf:params:oauth:token-type:access_token\"; }>; requestedTokenType: z.ZodOptional>; scope: z.ZodOptional; audience: z.ZodOptional; resource: z.ZodOptional; actorToken: z.ZodOptional; actorTokenType: z.ZodOptional; }, z.core.$strip>;", "documentation": "Token exchange request (RFC 8693 Section 2.1).", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 29 }, { "name": "GRANT_TYPE_TOKEN_EXCHANGE", "signature": "export declare const GRANT_TYPE_TOKEN_EXCHANGE: \"urn:ietf:params:oauth:grant-type:token-exchange\";", "documentation": "Standard grant type for RFC 8693 Token Exchange.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 12 }, { "name": "TOKEN_TYPE_JWT", "signature": "export declare const TOKEN_TYPE_JWT: \"urn:ietf:params:oauth:token-type:jwt\";", "documentation": "Standard token type for JWT subject tokens.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 16 }, { "name": "TOKEN_TYPE_ACT", "signature": "export declare const TOKEN_TYPE_ACT: \"urn:openagent:token-type:act\";", "documentation": "Custom token type for OpenAgent ACTs.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 19 }, { "name": "TOKEN_TYPE_ACCESS", "signature": "export declare const TOKEN_TYPE_ACCESS: \"urn:ietf:params:oauth:token-type:access_token\";", "documentation": "Standard token type for access tokens.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 22 }, { "name": "createJwtToActRequest", "signature": "export declare const createJwtToActRequest: (subjectToken: string, scopes?: readonly string[]) => TokenExchangeRequest;", "documentation": "Create a token exchange request for JWT -> ACT exchange.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 59 }, { "name": "validateExchangeRequest", "signature": "export declare const validateExchangeRequest: (request: TokenExchangeRequest) => void;", "documentation": "Validate a token exchange request.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 73 }, { "name": "parseScopes", "signature": "export declare const parseScopes: (scope: string | undefined) => string[];", "documentation": "Parse scopes from a space-delimited string.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 83 }, { "name": "successResponse", "signature": "export declare const successResponse: (accessToken: string, issuedTokenType: string, expiresIn: number, scope?: string) => TokenExchangeResponse;", "documentation": "Build a successful token exchange response.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 89 }, { "name": "exchangeErrors", "signature": "export declare const exchangeErrors: { readonly invalidRequest: (desc: string) => TokenExchangeError; readonly invalidGrant: (desc: string) => TokenExchangeError; readonly unsupportedTokenType: (desc: string) => TokenExchangeError; readonly invalidTarget: (desc: string) => TokenExchangeError; };", "documentation": "Create standard OAuth2 error responses.", "source": "openagent-sdk/bridges/oidc/typescript/src/exchange.ts", "line": 105 }, { "name": "JwksClient", "signature": "export declare class JwksClient {\n constructor(fetchImpl: typeof globalThis.fetch, timeoutMs?: number, cacheTtlMs?: number): JwksClient;\n fetchJwks(jwksUri: string): Promise;\n refresh(jwksUri: string): Promise;\n selectKey(jwks: jose.JSONWebKeySet, kid: string | undefined, alg: string | undefined): jose.JWK;\n invalidate(jwksUri: string): void;\n}", "documentation": "JWKS client with per-URI caching and rotation-aware refresh.", "source": "openagent-sdk/bridges/oidc/typescript/src/jwks.ts", "line": 17 }, { "name": "ValidatedClaims", "signature": "/** Claims extracted from a validated human JWT. */\nexport interface ValidatedClaims {\n /** Issuer (`iss` claim). */\n readonly issuer: string;\n /** Subject (`sub` claim). */\n readonly subject: string;\n /** Audience (`aud` claim). */\n readonly audience: readonly string[];\n /** Expiration (epoch seconds). */\n readonly exp: number;\n /** Issued-at (epoch seconds). */\n readonly iat: number;\n /** The claim value that maps to the HMR. */\n readonly hmrValue: string;\n /** OIDC scopes extracted from the token. */\n readonly scopes: readonly string[];\n /** All original claims. */\n readonly rawClaims: Readonly>;\n}", "documentation": "Claims extracted from a validated human JWT.", "source": "openagent-sdk/bridges/oidc/typescript/src/jwt.ts", "line": 12 }, { "name": "ActJwtClaims", "signature": "/** Claims for an outbound JWT wrapping an Arsenal ACT (Flow 2). */\nexport interface ActJwtClaims {\n /** Subject: the agent's DID. */\n readonly sub: string;\n /** Issuer: the bridge's own issuer identifier. */\n readonly iss: string;\n /** Audience. */\n readonly aud?: string;\n /** Expiration (epoch seconds). */\n readonly exp: number;\n /** Issued-at (epoch seconds). */\n readonly iat: number;\n /** JWT ID. */\n readonly jti: string;\n /** Arsenal scope strings. */\n readonly scope: string;\n /** Lineage depth (hops from HMR root). */\n readonly lineage_depth: number;\n /** Parent HMR DID. */\n readonly parent_hmr: string;\n /** Serialized ACT (base64url). */\n readonly act: string;\n}", "documentation": "Claims for an outbound JWT wrapping an Arsenal ACT (Flow 2).", "source": "openagent-sdk/bridges/oidc/typescript/src/jwt.ts", "line": 32 }, { "name": "decodeJwtHeader", "signature": "export declare const decodeJwtHeader: (token: string) => { kid?: string; alg?: string; };", "documentation": "Decode the JWT header without verification (to get kid/alg).", "source": "openagent-sdk/bridges/oidc/typescript/src/jwt.ts", "line": 56 }, { "name": "extractUnverifiedIssuer", "signature": "export declare const extractUnverifiedIssuer: (token: string) => string;", "documentation": "Extract the unverified `iss` claim from a JWT.", "source": "openagent-sdk/bridges/oidc/typescript/src/jwt.ts", "line": 62 }, { "name": "validateJwt", "signature": "export declare const validateJwt: (token: string, jwk: jose.JWK, provider: ProviderConfig) => Promise;", "documentation": "Validate and decode a JWT using the given JWK.\n\nPerforms standard OIDC validation: issuer, audience, expiry, signature.", "source": "openagent-sdk/bridges/oidc/typescript/src/jwt.ts", "line": 75 }, { "name": "buildActClaims", "signature": "export declare const buildActClaims: (opts: { agentDid: string; bridgeIssuer: string; audience?: string; scopes: readonly string[]; lineageDepth: number; parentHmr: string; actB64: string; ttlSeconds: number; }) => ActJwtClaims;", "documentation": "Build ACT JWT claims.", "source": "openagent-sdk/bridges/oidc/typescript/src/jwt.ts", "line": 128 }, { "name": "signActJwt", "signature": "export declare const signActJwt: (claims: ActJwtClaims, signingKey: jose.KeyLike | Uint8Array, algorithm: string, kid?: string) => Promise;", "documentation": "Sign a JWT wrapping an Arsenal ACT for OAuth2-only services.", "source": "openagent-sdk/bridges/oidc/typescript/src/jwt.ts", "line": 154 }, { "name": "DerivedAgent", "signature": "/** Result of deriving an agent DID from a human JWT. */\nexport interface DerivedAgent {\n /** Agent DID (did:oas::agent:). */\n readonly agentDid: string;\n /** Agent keypair (Ed25519 public + private key bytes). */\n readonly agentKeypair: {\n readonly publicKey: Uint8Array;\n readonly privateKey: Uint8Array;\n };\n /** Lineage proof (JSON structure). */\n readonly lineageProof: Record | null;\n /** Parent HMR DID. */\n readonly parentHmrDid: string;\n /** Lineage depth (0 for HMR, 1 for direct child). */\n readonly lineageDepth: number;\n}", "documentation": "Result of deriving an agent DID from a human JWT.", "source": "openagent-sdk/bridges/oidc/typescript/src/mapping.ts", "line": 12 }, { "name": "deriveAgentFromClaims", "signature": "export declare const deriveAgentFromClaims: (namespace: string, claims: ValidatedClaims, agentName: string) => DerivedAgent;", "documentation": "Derive an agent DID from validated OIDC claims.\n\nThis is the core of Flow 1: Human JWT -> Agent DID.\n\nIn a production deployment, this would use the OAS SDK's `create_hmr`\nand `derive_child` functions (available via the WASM crypto module).\nHere we produce the correct DID format and structure, with placeholder\nkeypairs that would be replaced by the real OAS SDK integration.", "source": "openagent-sdk/bridges/oidc/typescript/src/mapping.ts", "line": 52 }, { "name": "hmrIdentifierFromClaims", "signature": "export declare const hmrIdentifierFromClaims: (issuer: string, hmrValue: string) => string;", "documentation": "Deterministic identifier for an HMR derived from an OIDC subject.\n\nUses issuer + subject to produce a stable, collision-resistant\nidentifier that doesn't leak PII.", "source": "openagent-sdk/bridges/oidc/typescript/src/mapping.ts", "line": 34 }, { "name": "mapScopes", "signature": "export declare const mapScopes: (oidcScopes: readonly string[], scopeMapping: Readonly>) => string[];", "documentation": "Map OIDC scopes/roles to Arsenal capability scopes.\n\nUnmapped scopes are passed through as-is.", "source": "openagent-sdk/bridges/oidc/typescript/src/mapping.ts", "line": 101 }, { "name": "VERSION", "signature": "export declare const VERSION: \"0.1.1\";", "documentation": "SDK version.", "source": "openagent-sdk/bridges/oidc/typescript/src/index.ts", "line": 98 } ] }, { "package": "@openagentid/scim", "url": "/reference/typescript/openagent-sdk-bridges-scim-typescript", "exports": [ { "name": "createScimRouter", "signature": "export declare const createScimRouter: (routerConfig?: ScimRouterConfig) => ScimRouter;", "documentation": "Create a SCIM 2.0 router with the given configuration.", "source": "openagent-sdk/bridges/scim/typescript/src/server.ts", "line": 52 }, { "name": "ScimRouter", "signature": "export interface ScimRouter {\n /** Handle a WHATWG Request and return a WHATWG Response. */\n handle(request: Request): Promise;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/server.ts", "line": 44 }, { "name": "ScimRouterConfig", "signature": "// ── Router configuration ──────────────────────────────────────────────────\nexport interface ScimRouterConfig extends ScimBridgeConfig {\n /** Custom agent store. Defaults to in-memory. */\n readonly store?: AgentStore;\n /** Audit event sink. */\n readonly auditSink?: AuditSink;\n /** DID revocation hook (production: OAS SDK). */\n readonly revokeDidDocument?: DidRevoker;\n /** Delegation cascade revocation hook (production: AEGIS SDK). */\n readonly cascadeRevokeDelegations?: DelegationCascadeRevoker;\n /** Arsenal session invalidation hook (production: Arsenal SDK). */\n readonly invalidateArsenalSessions?: ArsenalSessionInvalidator;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/server.ts", "line": 31 }, { "name": "ScimBridgeConfig", "signature": "/** Configuration for the SCIM provisioning bridge. */\nexport interface ScimBridgeConfig {\n /**\n * OAS namespace for generated DIDs. Defaults to `l1fe`.\n */\n readonly namespace?: string;\n /**\n * Bearer token(s) that SCIM clients must present.\n * When undefined, authentication is disabled (dev only).\n */\n readonly bearerTokens?: readonly string[];\n /**\n * Base URL for SCIM resource `meta.location` fields.\n * Example: `https://scim.example.com/scim/v2`\n */\n readonly baseUrl?: string;\n /** Maximum page size for list responses. Default: 100. */\n readonly maxPageSize?: number;\n /** Structured logger. */\n readonly logger?: Logger;\n}", "documentation": "Configuration for the SCIM provisioning bridge.", "source": "openagent-sdk/bridges/scim/typescript/src/config.ts", "line": 25 }, { "name": "ResolvedScimConfig", "signature": "export interface ResolvedScimConfig {\n readonly namespace: string;\n readonly bearerTokens: readonly string[];\n readonly baseUrl: string;\n readonly maxPageSize: number;\n readonly logger: Logger;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/config.ts", "line": 59 }, { "name": "Logger", "signature": "/** Logger interface matching the OpenAgent SDK convention. */\nexport interface Logger {\n debug(msg: string, fields?: Record): void;\n info(msg: string, fields?: Record): void;\n warn(msg: string, fields?: Record): void;\n error(msg: string, fields?: Record): void;\n}", "documentation": "Logger interface matching the OpenAgent SDK convention.", "source": "openagent-sdk/bridges/scim/typescript/src/config.ts", "line": 10 }, { "name": "resolveScimConfig", "signature": "export declare const resolveScimConfig: (config?: ScimBridgeConfig) => ResolvedScimConfig;", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/config.ts", "line": 67 }, { "name": "silentLogger", "signature": "export declare const silentLogger: Logger;", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/config.ts", "line": 17 }, { "name": "SCIM_USER_SCHEMA", "signature": "export declare const SCIM_USER_SCHEMA: \"urn:ietf:params:scim:schemas:core:2.0:User\";", "documentation": "SCIM core User schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 9 }, { "name": "OPENAGENT_AGENT_SCHEMA", "signature": "export declare const OPENAGENT_AGENT_SCHEMA: \"urn:openagent:scim:1.0:Agent\";", "documentation": "OpenAgent agent extension schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 12 }, { "name": "SCIM_LIST_RESPONSE_SCHEMA", "signature": "export declare const SCIM_LIST_RESPONSE_SCHEMA: \"urn:ietf:params:scim:api:messages:2.0:ListResponse\";", "documentation": "SCIM List Response schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 15 }, { "name": "SCIM_ERROR_SCHEMA", "signature": "export declare const SCIM_ERROR_SCHEMA: \"urn:ietf:params:scim:api:messages:2.0:Error\";", "documentation": "SCIM Error schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 18 }, { "name": "SCIM_PATCH_OP_SCHEMA", "signature": "export declare const SCIM_PATCH_OP_SCHEMA: \"urn:ietf:params:scim:api:messages:2.0:PatchOp\";", "documentation": "SCIM Patch Operation schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 21 }, { "name": "SCIM_SPC_SCHEMA", "signature": "export declare const SCIM_SPC_SCHEMA: \"urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig\";", "documentation": "SCIM ServiceProviderConfig schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 24 }, { "name": "SCIM_SCHEMA_SCHEMA", "signature": "export declare const SCIM_SCHEMA_SCHEMA: \"urn:ietf:params:scim:schemas:core:2.0:Schema\";", "documentation": "SCIM Schema schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 27 }, { "name": "SCIM_RESOURCE_TYPE_SCHEMA", "signature": "export declare const SCIM_RESOURCE_TYPE_SCHEMA: \"urn:ietf:params:scim:schemas:core:2.0:ResourceType\";", "documentation": "SCIM ResourceType schema URN.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 30 }, { "name": "ConformanceLevel", "signature": "/** Conformance levels for OpenAgent agents. */\nexport type ConformanceLevel = 'L0' | 'L1' | 'L2';", "documentation": "Conformance levels for OpenAgent agents.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 33 }, { "name": "AgentExtension", "signature": "/** The OpenAgent agent extension attribute group. */\nexport interface AgentExtension {\n readonly parentDid: string;\n readonly conformanceLevel: ConformanceLevel;\n readonly scopes: readonly string[];\n readonly lineageDepth: number;\n readonly createdVia: string;\n readonly keypairFingerprint: string;\n}", "documentation": "The OpenAgent agent extension attribute group.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 36 }, { "name": "ScimAgentResource", "signature": "/** Full SCIM User resource with agent extension. */\nexport interface ScimAgentResource {\n readonly schemas: readonly string[];\n readonly id: string;\n readonly externalId?: string;\n readonly userName: string;\n readonly displayName: string;\n readonly active: boolean;\n readonly meta: ScimMeta;\n readonly [OPENAGENT_AGENT_SCHEMA]: AgentExtension;\n}", "documentation": "Full SCIM User resource with agent extension.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 46 }, { "name": "ScimMeta", "signature": "/** SCIM resource metadata. */\nexport interface ScimMeta {\n readonly resourceType: string;\n readonly created: string;\n readonly lastModified: string;\n readonly location: string;\n readonly version: string;\n}", "documentation": "SCIM resource metadata.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 58 }, { "name": "ScimListResponse", "signature": "/** SCIM List Response envelope. */\nexport interface ScimListResponse {\n readonly schemas: readonly string[];\n readonly totalResults: number;\n readonly startIndex: number;\n readonly itemsPerPage: number;\n readonly Resources: readonly T[];\n}", "documentation": "SCIM List Response envelope.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 67 }, { "name": "ScimErrorResponse", "signature": "/** SCIM Error response. */\nexport interface ScimErrorResponse {\n readonly schemas: readonly string[];\n readonly status: string;\n readonly scimType?: string;\n readonly detail: string;\n}", "documentation": "SCIM Error response.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 76 }, { "name": "buildServiceProviderConfig", "signature": "export declare const buildServiceProviderConfig: (baseUrl: string) => Record;", "documentation": "Service Provider Configuration response.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 84 }, { "name": "buildSchemas", "signature": "export declare const buildSchemas: () => readonly Record[];", "documentation": "Schema discovery response for the User + Agent extension.", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 111 }, { "name": "buildResourceTypes", "signature": "export declare const buildResourceTypes: (baseUrl: string) => readonly Record[];", "documentation": "Resource type discovery for User (Agent).", "source": "openagent-sdk/bridges/scim/typescript/src/schemas.ts", "line": 144 }, { "name": "AgentRecord", "signature": "// ── Internal agent record ─────────────────────────────────────────────────\n/** The canonical internal representation of a provisioned agent. */\nexport interface AgentRecord {\n readonly did: string;\n readonly userName: string;\n readonly displayName: string;\n readonly active: boolean;\n readonly parentDid: string;\n readonly conformanceLevel: ConformanceLevel;\n readonly scopes: readonly string[];\n readonly lineageDepth: number;\n readonly createdVia: string;\n readonly keypairFingerprint: string;\n readonly createdAt: string;\n readonly updatedAt: string;\n readonly version: string;\n readonly externalId?: string;\n}", "documentation": "The canonical internal representation of a provisioned agent.", "source": "openagent-sdk/bridges/scim/typescript/src/resources.ts", "line": 22 }, { "name": "CreateAgentFromScimInput", "signature": "export type CreateAgentFromScimInput = z.infer;", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/resources.ts", "line": 65 }, { "name": "ReplaceAgentFromScimInput", "signature": "export type ReplaceAgentFromScimInput = z.infer;", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/resources.ts", "line": 68 }, { "name": "agentToScimResource", "signature": "export declare const agentToScimResource: (agent: AgentRecord, baseUrl: string) => ScimAgentResource;", "documentation": "Convert an internal AgentRecord into a SCIM User resource.", "source": "openagent-sdk/bridges/scim/typescript/src/resources.ts", "line": 73 }, { "name": "parseCreateInput", "signature": "export declare const parseCreateInput: (body: unknown) => CreateAgentFromScimInput;", "documentation": "Parse and validate a SCIM create request body into typed input.", "source": "openagent-sdk/bridges/scim/typescript/src/resources.ts", "line": 107 }, { "name": "parseReplaceInput", "signature": "export declare const parseReplaceInput: (body: unknown) => ReplaceAgentFromScimInput;", "documentation": "Parse and validate a SCIM replace (PUT) request body into typed input.", "source": "openagent-sdk/bridges/scim/typescript/src/resources.ts", "line": 112 }, { "name": "createAgentFromScimSchema", "signature": "export declare const createAgentFromScimSchema: z.ZodObject<{ schemas: z.ZodArray; externalId: z.ZodOptional; userName: z.ZodString; displayName: z.ZodOptional; active: z.ZodDefault; \"urn:openagent:scim:1.0:Agent\": z.ZodObject<{ parentDid: z.ZodString; conformanceLevel: z.ZodDefault>; scopes: z.ZodArray; lineageDepth: z.ZodOptional; createdVia: z.ZodOptional; keypairFingerprint: z.ZodOptional; }, z.core.$strip>; }, z.core.$strip>;", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/resources.ts", "line": 53 }, { "name": "ParsedFilter", "signature": "export type ParsedFilter = AttributeFilter | LogicalFilter;", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/filtering.ts", "line": 34 }, { "name": "AttributeFilter", "signature": "/** A single attribute filter expression. */\nexport interface AttributeFilter {\n readonly type: 'attribute';\n readonly attribute: string;\n readonly op: FilterOp;\n readonly value: string | boolean | number | null;\n}", "documentation": "A single attribute filter expression.", "source": "openagent-sdk/bridges/scim/typescript/src/filtering.ts", "line": 21 }, { "name": "LogicalFilter", "signature": "/** Logical combination of filters. */\nexport interface LogicalFilter {\n readonly type: 'and' | 'or';\n readonly filters: readonly ParsedFilter[];\n}", "documentation": "Logical combination of filters.", "source": "openagent-sdk/bridges/scim/typescript/src/filtering.ts", "line": 29 }, { "name": "FilterOp", "signature": "/** Supported comparison operators. */\nexport type FilterOp = 'eq' | 'ne' | 'co' | 'sw' | 'ew' | 'pr' | 'gt' | 'ge' | 'lt' | 'le';", "documentation": "Supported comparison operators.", "source": "openagent-sdk/bridges/scim/typescript/src/filtering.ts", "line": 18 }, { "name": "parseFilter", "signature": "export declare const parseFilter: (filterStr: string | undefined | null) => ParsedFilter | undefined;", "documentation": "Parse a SCIM filter string into a structured filter tree.\n\nReturns `undefined` for empty/missing filters (match all).\nThrows on malformed filters.", "source": "openagent-sdk/bridges/scim/typescript/src/filtering.ts", "line": 109 }, { "name": "matchesFilter", "signature": "export declare const matchesFilter: (record: AgentRecord, filter: ParsedFilter | undefined) => boolean;", "documentation": "Evaluate a parsed filter against an agent record. Returns true if the record matches.", "source": "openagent-sdk/bridges/scim/typescript/src/filtering.ts", "line": 206 }, { "name": "ScimFilterError", "signature": "export declare class ScimFilterError {\n constructor(message: string): ScimFilterError;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/filtering.ts", "line": 278 }, { "name": "PaginationParams", "signature": "/** Parsed pagination parameters from a SCIM request. */\nexport interface PaginationParams {\n /** 1-based start index. */\n readonly startIndex: number;\n /** Number of results to return. */\n readonly count: number;\n}", "documentation": "Parsed pagination parameters from a SCIM request.", "source": "openagent-sdk/bridges/scim/typescript/src/pagination.ts", "line": 11 }, { "name": "parsePagination", "signature": "export declare const parsePagination: (searchParams: URLSearchParams, maxPageSize: number) => PaginationParams;", "documentation": "Extract pagination parameters from a SCIM request URL search params.\n\nReturns immutable params — never mutates the input.", "source": "openagent-sdk/bridges/scim/typescript/src/pagination.ts", "line": 23 }, { "name": "paginateResults", "signature": "export declare const paginateResults: (items: readonly T[], params: PaginationParams) => ScimListResponse;", "documentation": "Apply pagination to an array of items and return a SCIM ListResponse.\n\nItems are expected to be pre-filtered and pre-sorted. This function\nslices the array according to 1-based SCIM indexing.", "source": "openagent-sdk/bridges/scim/typescript/src/pagination.ts", "line": 43 }, { "name": "PatchOperation", "signature": "/** A single SCIM PATCH operation. */\nexport interface PatchOperation {\n readonly op: 'add' | 'replace' | 'remove';\n readonly path?: string;\n readonly value?: unknown;\n}", "documentation": "A single SCIM PATCH operation.", "source": "openagent-sdk/bridges/scim/typescript/src/operations.ts", "line": 13 }, { "name": "PatchRequest", "signature": "/** SCIM PatchOp request body. */\nexport interface PatchRequest {\n readonly schemas: readonly string[];\n readonly Operations: readonly PatchOperation[];\n}", "documentation": "SCIM PatchOp request body.", "source": "openagent-sdk/bridges/scim/typescript/src/operations.ts", "line": 20 }, { "name": "parsePatchRequest", "signature": "export declare const parsePatchRequest: (body: unknown) => PatchRequest;", "documentation": "Parse and validate a SCIM PATCH request body.", "source": "openagent-sdk/bridges/scim/typescript/src/operations.ts", "line": 40 }, { "name": "applyPatchOperations", "signature": "export declare const applyPatchOperations: (record: AgentRecord, operations: readonly PatchOperation[]) => AgentRecord;", "documentation": "Apply a set of SCIM PATCH operations to an agent record.\n\nReturns a new record with all operations applied. The original is never mutated.\nThrows on invalid paths or unsupported operations.", "source": "openagent-sdk/bridges/scim/typescript/src/operations.ts", "line": 50 }, { "name": "ScimPatchError", "signature": "export declare class ScimPatchError {\n constructor(message: string): ScimPatchError;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/operations.ts", "line": 170 }, { "name": "AgentProvisioner", "signature": "export declare class AgentProvisioner {\n constructor(config: ProvisionerConfig): AgentProvisioner;\n createAgent(params: CreateAgentParams): Promise;\n replaceAgent(did: string, params: CreateAgentParams): Promise;\n updateAgent(did: string, record: AgentRecord): Promise;\n deprovisionAgent(did: string): Promise;\n findByDid(did: string): Promise;\n findByUserName(userName: string): Promise;\n listAgents(): Promise;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 83 }, { "name": "ProvisionerConfig", "signature": "// ── Provisioner configuration ─────────────────────────────────────────────\nexport interface ProvisionerConfig {\n readonly store: AgentStore;\n readonly namespace: string;\n readonly logger: Logger;\n readonly auditSink?: AuditSink;\n readonly revokeDidDocument?: DidRevoker;\n readonly cascadeRevokeDelegations?: DelegationCascadeRevoker;\n readonly invalidateArsenalSessions?: ArsenalSessionInvalidator;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 60 }, { "name": "CreateAgentParams", "signature": "// ── Create ────────────────────────────────────────────────────────────────\nexport interface CreateAgentParams {\n readonly userName: string;\n readonly displayName?: string;\n readonly parentDid: string;\n readonly conformanceLevel: ConformanceLevel;\n readonly scopes: readonly string[];\n readonly externalId?: string;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 72 }, { "name": "AuditEvent", "signature": "// ── Event types ───────────────────────────────────────────────────────────\n/** Audit event emitted during agent lifecycle operations. */\nexport interface AuditEvent {\n readonly type: 'agent.created' | 'agent.updated' | 'agent.deprovisioned';\n readonly did: string;\n readonly timestamp: string;\n readonly details: Record;\n}", "documentation": "Audit event emitted during agent lifecycle operations.", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 20 }, { "name": "AuditSink", "signature": "/** Callback invoked for each lifecycle audit event. */\nexport type AuditSink = (event: AuditEvent) => void | Promise;", "documentation": "Callback invoked for each lifecycle audit event.", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 28 }, { "name": "DidRevoker", "signature": "// ── Deprovisioning hooks ──────────────────────────────────────────────────\n/**\n * Hook invoked during deprovisioning to revoke the agent's DID document.\n *\n * Production: wires to OAS SDK's `revokeIdentity`.\n * Default: no-op (logs a warning).\n */\nexport type DidRevoker = (did: string) => Promise;", "documentation": "Hook invoked during deprovisioning to revoke the agent's DID document.\n\nProduction: wires to OAS SDK's `revokeIdentity`.\nDefault: no-op (logs a warning).", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 38 }, { "name": "DelegationCascadeRevoker", "signature": "/**\n * Hook invoked during deprovisioning to cascade-revoke all delegation\n * proofs issued by (or to) the deprovisioned agent.\n *\n * Production: wires to AEGIS SDK's delegation tree walker.\n * Default: no-op (logs a warning).\n */\nexport type DelegationCascadeRevoker = (did: string) => Promise;", "documentation": "Hook invoked during deprovisioning to cascade-revoke all delegation\nproofs issued by (or to) the deprovisioned agent.\n\nProduction: wires to AEGIS SDK's delegation tree walker.\nDefault: no-op (logs a warning).", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 47 }, { "name": "ArsenalSessionInvalidator", "signature": "/**\n * Hook invoked during deprovisioning to invalidate all active Arsenal\n * sessions for the deprovisioned agent.\n *\n * Production: wires to Arsenal SDK's session invalidation.\n * Default: no-op (logs a warning).\n */\nexport type ArsenalSessionInvalidator = (did: string) => Promise;", "documentation": "Hook invoked during deprovisioning to invalidate all active Arsenal\nsessions for the deprovisioned agent.\n\nProduction: wires to Arsenal SDK's session invalidation.\nDefault: no-op (logs a warning).", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 56 }, { "name": "ProvisionerError", "signature": "export declare class ProvisionerError {\n code: ProvisionerErrorCode;\n constructor(message: string, code: ProvisionerErrorCode): ProvisionerError;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/provisioner.ts", "line": 341 }, { "name": "AgentStore", "signature": "/**\n * Storage interface for agent records.\n *\n * All methods return new objects — implementations must never return\n * mutable references to internal state.\n */\nexport interface AgentStore {\n /** List all agent records. Returns an immutable snapshot. */\n list(): Promise;\n /** Find agent by DID. Returns undefined if not found. */\n findByDid(did: string): Promise;\n /** Find agent by userName. Returns undefined if not found. */\n findByUserName(userName: string): Promise;\n /** Find agent by externalId. Returns undefined if not found. */\n findByExternalId(externalId: string): Promise;\n /** Insert a new agent record. Throws if DID already exists. */\n create(record: AgentRecord): Promise;\n /** Replace an agent record. Throws if DID does not exist. */\n update(did: string, record: AgentRecord): Promise;\n /** Delete an agent record. Throws if DID does not exist. */\n delete(did: string): Promise;\n /** Return the count of all active agents. */\n countActive(): Promise;\n}", "documentation": "Storage interface for agent records.\n\nAll methods return new objects — implementations must never return\nmutable references to internal state.", "source": "openagent-sdk/bridges/scim/typescript/src/store.ts", "line": 17 }, { "name": "InMemoryAgentStore", "signature": "export declare class InMemoryAgentStore {\n list(): Promise;\n findByDid(did: string): Promise;\n findByUserName(userName: string): Promise;\n findByExternalId(externalId: string): Promise;\n create(record: AgentRecord): Promise;\n update(did: string, record: AgentRecord): Promise;\n delete(did: string): Promise;\n countActive(): Promise;\n}", "documentation": "In-memory store for testing and development.", "source": "openagent-sdk/bridges/scim/typescript/src/store.ts", "line": 44 }, { "name": "StoreError", "signature": "export declare class StoreError {\n code: StoreErrorCode;\n constructor(message: string, code: StoreErrorCode): StoreError;\n}", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/store.ts", "line": 106 }, { "name": "StoreErrorCode", "signature": "export type StoreErrorCode = 'NOT_FOUND' | 'CONFLICT' | 'INTERNAL';", "documentation": "", "source": "openagent-sdk/bridges/scim/typescript/src/store.ts", "line": 104 }, { "name": "VERSION", "signature": "export declare const VERSION: \"0.1.1\";", "documentation": "Package version.", "source": "openagent-sdk/bridges/scim/typescript/src/index.ts", "line": 120 } ] }, { "package": "@openagentid/skills-policy", "url": "/reference/typescript/openagent-sdk-crates-openagent-skills-policy-typescript", "exports": [ { "name": "AuditChain", "signature": "export declare class AuditChain {\n length(): number;\n isEmpty(): boolean;\n head(): string;\n get(sequence: number): Receipt | undefined;\n all(): readonly Receipt[];\n verify(): boolean;\n append(skill: string, agent: string, session: string, invokedAt: Date, level: AuditLevel, args: unknown): Receipt;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/audit.ts", "line": 34 }, { "name": "Receipt", "signature": "export interface Receipt {\n sequence: number;\n skill: string;\n agent: string;\n session: string;\n invokedAt: string;\n auditLevel: AuditLevel;\n argumentsHash: string;\n arguments?: unknown;\n previousHash: string;\n receiptHash: string;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/audit.ts", "line": 21 }, { "name": "HASH_LEN", "signature": "export declare const HASH_LEN: 32;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/audit.ts", "line": 17 }, { "name": "Did", "signature": "export declare class Did {\n parse(input: string): Did;\n toString(): string;\n equals(other: Did): boolean;\n asString(): string;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/did.ts", "line": 13 }, { "name": "InvocationContext", "signature": "export declare class InvocationContext {\n agentDid: Did;\n sessionId: string;\n arguments: unknown;\n invokedAt: Date;\n consentGranted: boolean;\n constructor(init: InvocationContextInit): InvocationContext;\n withConsent(): InvocationContext;\n withInvokedAt(invokedAt: Date): InvocationContext;\n}", "documentation": "Context describing a single attempted skill invocation. Immutable;\nbuilder-style helpers return new instances.", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/engine.ts", "line": 52 }, { "name": "SkillsPolicy", "signature": "export declare class SkillsPolicy {\n fromYaml(yaml: string): SkillsPolicy;\n fromFile(path: string): Promise;\n agent(): Did;\n hasRule(skill: string): boolean;\n auditChain(): AuditChain;\n resetRateLimit(skill: string): void;\n canInvoke(skill: string, ctx: InvocationContext): void;\n recordInvocation(skill: string, ctx: InvocationContext): Receipt;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/engine.ts", "line": 88 }, { "name": "ArgumentConstraintError", "signature": "export declare class ArgumentConstraintError {\n name: \"ArgumentConstraintError\";\n skill: string;\n details: string;\n constructor(skill: string, details: string): ArgumentConstraintError;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 63 }, { "name": "ConsentRequiredError", "signature": "export declare class ConsentRequiredError {\n name: \"ConsentRequiredError\";\n skill: string;\n constructor(skill: string): ConsentRequiredError;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 87 }, { "name": "InvalidPolicyError", "signature": "export declare class InvalidPolicyError {\n name: \"InvalidPolicyError\";\n constructor(message: string): InvalidPolicyError;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 17 }, { "name": "InvalidSkillsMarkdownError", "signature": "export declare class InvalidSkillsMarkdownError {\n name: \"InvalidSkillsMarkdownError\";\n constructor(message: string): InvalidSkillsMarkdownError;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 25 }, { "name": "NotAllowedError", "signature": "export declare class NotAllowedError {\n name: \"NotAllowedError\";\n skill: string;\n reason: string;\n constructor(skill: string, reason: string): NotAllowedError;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 33 }, { "name": "OutsideTimeWindowError", "signature": "export declare class OutsideTimeWindowError {\n name: \"OutsideTimeWindowError\";\n skill: string;\n constructor(skill: string): OutsideTimeWindowError;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 75 }, { "name": "RateLimitExceededError", "signature": "export declare class RateLimitExceededError {\n name: \"RateLimitExceededError\";\n skill: string;\n used: number;\n max: number;\n windowSecs: number;\n constructor(skill: string, used: number, max: number, windowSecs: number): RateLimitExceededError;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 45 }, { "name": "SkillsPolicyError", "signature": "export declare class SkillsPolicyError {\n name: string;\n constructor(message: string): SkillsPolicyError;\n}", "documentation": "Typed error hierarchy for the skills policy engine.\n\nEach failing dimension has its own subclass so callers can pattern-match\nwith `instanceof` rather than parsing error messages.", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/errors.ts", "line": 8 }, { "name": "RateLimiter", "signature": "export declare class RateLimiter {\n checkAndRecord(skill: string, limit: RateLimit, nowSecs: number): RateLimitDecision;\n reset(skill: string): void;\n snapshot(): Array<[string, number]>;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/rate.ts", "line": 16 }, { "name": "RateLimitDecision", "signature": "export type RateLimitDecision = {\n kind: \"allowed\";\n} | {\n kind: \"denied\";\n used: number;\n};", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/rate.ts", "line": 12 }, { "name": "AuditLevel", "signature": "export type AuditLevel = z.infer;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 15 }, { "name": "CURRENT_VERSION", "signature": "export declare const CURRENT_VERSION: 1;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 11 }, { "name": "DefaultRule", "signature": "export type DefaultRule = z.infer;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 50 }, { "name": "MAX_SKILL_RULES", "signature": "export declare const MAX_SKILL_RULES: 256;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 12 }, { "name": "RateLimit", "signature": "export type RateLimit = z.infer;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 21 }, { "name": "SkillRule", "signature": "export type SkillRule = z.infer;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 42 }, { "name": "SkillsPolicyDoc", "signature": "export type SkillsPolicyDoc = z.infer;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 69 }, { "name": "TimeWindow", "signature": "export type TimeWindow = z.infer;", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/schema.ts", "line": 28 }, { "name": "SkillEntry", "signature": "export interface SkillEntry {\n readonly name: string;\n readonly description: string;\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/skillsMd.ts", "line": 14 }, { "name": "SkillsManifest", "signature": "export declare class SkillsManifest {\n skills: readonly SkillEntry[];\n fromMarkdown(input: string): SkillsManifest;\n fromFile(path: string): Promise;\n length(): number;\n isEmpty(): boolean;\n get(name: string): SkillEntry | undefined;\n names(): string[];\n}", "documentation": "", "source": "openagent-sdk/crates/openagent-skills-policy/typescript/src/skillsMd.ts", "line": 19 } ] }, { "package": "@openagentid/claude-agent", "url": "/reference/typescript/openagent-sdk-integrations-claude-agent-sdk-typescript", "exports": [ { "name": "openAgentPlugin", "signature": "export declare const openAgentPlugin: (opts: OpenAgentPluginOptions) => OpenAgentPlugin;", "documentation": "Build a Claude Agent SDK plugin that wires OpenAgent identity,\ncapability control, and tamper-evident audit logging into the agent\nlifecycle.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/plugin.ts", "line": 135 }, { "name": "OpenAgentPlugin", "signature": "/** Shape returned by {@link openAgentPlugin}. */\nexport interface OpenAgentPlugin {\n /** Stable plugin identifier. */\n readonly name: '@openagentid/claude-agent';\n /** Plugin schema version. */\n readonly version: string;\n /** Bound hook handlers — wired to the Claude Agent SDK lifecycle. */\n readonly hooks: PluginHooks;\n /**\n * Inspect the in-memory audit buffer (only populated when `audit: true`\n * with the default sink). Returns an empty array otherwise.\n */\n inspectAudit(): readonly import('./types.js').AuditRecord[];\n}", "documentation": "Shape returned by {@link openAgentPlugin}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/plugin.ts", "line": 86 }, { "name": "OpenAgentPluginOptions", "signature": "/** Configuration accepted by {@link openAgentPlugin}. */\nexport interface OpenAgentPluginOptions {\n /** Verified OpenAgent identity to attach to the session. Required. */\n agent: OpenAgentIdentity;\n /** Capability checker — Arsenal-backed in production. Required. */\n capabilities: CapabilityChecker;\n /** Skills policy. Defaults to {@link DenyUnlessScopedSkillsPolicy}. */\n skillsPolicy?: SkillsPolicy;\n /**\n * Audit configuration:\n * - `false` → no audit (records are dropped)\n * - `true` → in-memory + stdout console sink\n * - {@link AuditSink} → custom sink\n */\n audit?: boolean | AuditSink;\n /**\n * Sign every outbound message with the agent's Ed25519 key. Defaults\n * to `false` because most agent flows don't need it.\n */\n signMessages?: boolean;\n /**\n * Behaviour on a denied tool / skill:\n * - `'throw'` (default) — throws {@link ToolDeniedError} or {@link SkillDeniedError}\n * - `'block'` — returns a blocking decision object the SDK can interpret\n */\n denyMode?: 'throw' | 'block';\n}", "documentation": "Configuration accepted by {@link openAgentPlugin}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/plugin.ts", "line": 58 }, { "name": "PluginHooks", "signature": "/**\n * Bound hook handlers. Each method receives the SDK's hook input plus the\n * SDK-managed context object and returns a plain JS object the SDK can\n * route. The shapes below are the documented Claude Agent SDK hook\n * signatures; if Anthropic adds a new lifecycle stage we add a new method\n * here without breaking existing wiring.\n */\nexport interface PluginHooks {\n onSessionStart(input: SessionStartInput): Promise<{\n allow: true;\n }>;\n preToolUse(input: ToolUseInput): Promise;\n postToolUse(input: PostToolUseInput): Promise<{\n ok: true;\n }>;\n onMessage(input: MessageInput): Promise<{\n allow: true;\n signature?: string;\n }>;\n onSkillInvoke(input: SkillInvokeInput): Promise;\n onSessionEnd(): Promise<{\n ok: true;\n }>;\n}", "documentation": "Bound hook handlers. Each method receives the SDK's hook input plus the\nSDK-managed context object and returns a plain JS object the SDK can\nroute. The shapes below are the documented Claude Agent SDK hook\nsignatures; if Anthropic adds a new lifecycle stage we add a new method\nhere without breaking existing wiring.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/plugin.ts", "line": 107 }, { "name": "HookDecision", "signature": "/** Decision object returned by gating hooks (preToolUse, onSkillInvoke). */\nexport interface HookDecision {\n allow: boolean;\n reason?: string;\n /**\n * Hash of the canonicalised tool input (preToolUse only) — thread it into\n * the matching postToolUse call so the audit chain links preflight to\n * completion.\n */\n inputHash?: string;\n}", "documentation": "Decision object returned by gating hooks (preToolUse, onSkillInvoke).", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/plugin.ts", "line": 117 }, { "name": "AuditChain", "signature": "export declare class AuditChain {\n constructor(opts: { sessionId: string; agentDid: string; sink: AuditSink; }): AuditChain;\n append(input: { kind: AuditKind; name?: string; outcome: AuditRecord[\"outcome\"]; inputHash?: string; outputHash?: string; context?: Record; }): Promise;\n head(): string;\n}", "documentation": "Builds and signs (hash-chains) audit records. The chain is owned by a\nsingle session — callers should construct one chain per session.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/audit.ts", "line": 26 }, { "name": "ConsoleAuditSink", "signature": "export declare class ConsoleAuditSink {\n append(record: AuditRecord): void;\n}", "documentation": "Audit sink that writes structured JSON to stdout — handy for dev.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/audit.ts", "line": 119 }, { "name": "FanOutAuditSink", "signature": "export declare class FanOutAuditSink {\n constructor(sinks: readonly AuditSink[]): FanOutAuditSink;\n append(record: AuditRecord): Promise;\n}", "documentation": "Compose multiple sinks (records are dispatched to all in order).", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/audit.ts", "line": 127 }, { "name": "GENESIS_PREV_HASH", "signature": "export declare const GENESIS_PREV_HASH: string;", "documentation": "Sentinel for the head of the chain.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/audit.ts", "line": 20 }, { "name": "InMemoryAuditSink", "signature": "export declare class InMemoryAuditSink {\n records: AuditRecord[];\n append(record: AuditRecord): void;\n clear(): void;\n}", "documentation": "In-memory audit sink (handy for tests + dry runs).", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/audit.ts", "line": 105 }, { "name": "hashRecord", "signature": "export declare const hashRecord: (record: AuditRecord) => string;", "documentation": "Compute the hash of a record (excludes the hash field itself).", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/audit.ts", "line": 80 }, { "name": "verifyChain", "signature": "export declare const verifyChain: (records: readonly AuditRecord[]) => { valid: boolean; brokenAt?: number; };", "documentation": "Verify that a previously emitted chain has not been tampered with.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/audit.ts", "line": 88 }, { "name": "AllowListSkillsPolicy", "signature": "export declare class AllowListSkillsPolicy {\n constructor(allowedSkills: Iterable, inner?: SkillsPolicy): AllowListSkillsPolicy;\n evaluate(skillName: string, ctx: SkillEvaluationContext): Promise;\n}", "documentation": "Allow-listed skills policy: only the named skills are permitted, and the\nagent must additionally hold the right scope.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 106 }, { "name": "CompositeSkillsPolicy", "signature": "export declare class CompositeSkillsPolicy {\n constructor(policies: readonly SkillsPolicy[]): CompositeSkillsPolicy;\n evaluate(skillName: string, ctx: SkillEvaluationContext): Promise;\n}", "documentation": "Compose multiple policies — a skill is allowed only if every policy\nallows it. Useful for stacking allow-list + scope + custom policies.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 130 }, { "name": "DenyUnlessScopedSkillsPolicy", "signature": "export declare class DenyUnlessScopedSkillsPolicy {\n evaluate(skillName: string, ctx: SkillEvaluationContext): Promise;\n}", "documentation": "Deny-unless-scoped skills policy.\n\nFor a skill named `foo`, requires the agent to hold `skills:invoke:foo`\n(or a wildcard that subsumes it). This is the default policy when the\ncaller passes `audit: true` without supplying their own.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 81 }, { "name": "SKILL_SCOPE_PREFIX", "signature": "export declare const SKILL_SCOPE_PREFIX: \"skills:invoke:\";", "documentation": "Scope grammar for skill invocations.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 24 }, { "name": "StaticCapabilityChecker", "signature": "export declare class StaticCapabilityChecker {\n constructor(scopes: Iterable): StaticCapabilityChecker;\n check(scope: string): ScopeDecision;\n}", "documentation": "Capability checker backed by a fixed allowlist. Supports literal scopes\nand one wildcard form: `prefix:*` matches anything starting with `prefix:`.\n\nExample: `tools:invoke:*` allows every tool, `skills:invoke:web.*`\nallows every skill whose name starts with `web.`.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 46 }, { "name": "TOOL_SCOPE_PREFIX", "signature": "export declare const TOOL_SCOPE_PREFIX: \"tools:invoke:\";", "documentation": "Scope grammar for tool invocations.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 27 }, { "name": "skillScope", "signature": "export declare const skillScope: (name: string) => string;", "documentation": "Build the canonical scope string for a skill name.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 30 }, { "name": "toolScope", "signature": "export declare const toolScope: (name: string) => string;", "documentation": "Build the canonical scope string for a tool name.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/policy.ts", "line": 35 }, { "name": "onMessage", "signature": "export declare const onMessage: (input: MessageInput, ctx: HookContext) => Promise;", "documentation": "Sign an outbound message with the agent's Ed25519 key (if signing is\nenabled) and append an audit record.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 226 }, { "name": "onSessionEnd", "signature": "export declare const onSessionEnd: (ctx: HookContext) => Promise;", "documentation": "Emit a closing record at session end.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 320 }, { "name": "onSessionStart", "signature": "export declare const onSessionStart: (input: SessionStartInput, ctx: Omit & { sink: AuditSink; }) => Promise;", "documentation": "Initialise the per-session hook context and emit the opening audit\nrecord. Call this once when the Claude Agent SDK fires the session\nstart hook.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 57 }, { "name": "onSkillInvoke", "signature": "export declare const onSkillInvoke: (input: SkillInvokeInput, ctx: HookContext) => Promise;", "documentation": "Consult the OpenAgent skills policy before a SKILLS.md skill runs.\n\nThe Claude Agent SDK loads skills from SKILLS.md files; we hook the\ninvocation point and refuse anything the policy denies. Default\npolicy is `DenyUnlessScopedSkillsPolicy`.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 278 }, { "name": "onSkillInvokeOrThrow", "signature": "export declare const onSkillInvokeOrThrow: (input: SkillInvokeInput, ctx: HookContext) => Promise;", "documentation": "Throw-on-deny variant of {@link onSkillInvoke}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 308 }, { "name": "postToolUse", "signature": "export declare const postToolUse: (input: PostToolUseInput, ctx: HookContext) => Promise;", "documentation": "Emit a post-tool-use audit record with input + output hashes.\n\nThe record's hash chain prevents post-hoc tampering: a verifier can\nreplay {@link import ('./audit.js').verifyChain} over an exported chain\nto detect any modification.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 190 }, { "name": "preToolUse", "signature": "export declare const preToolUse: (input: ToolUseInput, ctx: HookContext) => Promise;", "documentation": "Verify a tool call against Arsenal scopes and emit a preflight audit\nrecord.\n\nReturns `{ allow: false }` rather than throwing so the caller can\ndecide whether to short-circuit the SDK or surface an error to the\nmodel. The plugin's hook adapter throws {@link ToolDeniedError} when\nthe SDK requires an exception-based deny.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 117 }, { "name": "preToolUseOrThrow", "signature": "export declare const preToolUseOrThrow: (input: ToolUseInput, ctx: HookContext) => Promise;", "documentation": "Throw-on-deny variant of {@link preToolUse}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 159 }, { "name": "HookContext", "signature": "/**\n * Per-session state that the hooks share. Constructed once when the\n * session starts and disposed when it ends.\n */\nexport interface HookContext {\n readonly identity: OpenAgentIdentity;\n readonly capabilities: CapabilityChecker;\n readonly skillsPolicy: SkillsPolicy;\n readonly chain: AuditChain;\n readonly signMessages: boolean;\n}", "documentation": "Per-session state that the hooks share. Constructed once when the\nsession starts and disposed when it ends.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 31 }, { "name": "MessageInput", "signature": "/** Input shape for {@link onMessage}. */\nexport interface MessageInput {\n /** Plain-text or already-serialised message body. */\n body: string | Uint8Array;\n /** Direction of the message — used for the audit context only. */\n direction: 'in' | 'out';\n}", "documentation": "Input shape for {@link onMessage}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 207 }, { "name": "OnMessageResult", "signature": "/** Result of {@link onMessage}. */\nexport interface OnMessageResult {\n /** Hex-encoded Ed25519 signature, when message signing is enabled. */\n signature?: string;\n /** Audit record emitted for this message. */\n record: AuditRecord;\n}", "documentation": "Result of {@link onMessage}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 215 }, { "name": "PostToolUseInput", "signature": "/** Input shape for {@link postToolUse}. */\nexport interface PostToolUseInput {\n toolName: string;\n /** Tool result (any shape). */\n result: unknown;\n /** Was the underlying call successful? */\n ok: boolean;\n /** Optional error description if the call failed. */\n error?: string;\n /** Hash of the original input — typically threaded from preToolUse. */\n inputHash?: string;\n}", "documentation": "Input shape for {@link postToolUse}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 171 }, { "name": "PreToolUseResult", "signature": "/** Result of a pre-tool-use evaluation. */\nexport interface PreToolUseResult {\n /** Whether the tool call may proceed. */\n allow: boolean;\n /** Reason on deny. */\n reason?: string;\n /** The audit record emitted (preflight). */\n record: AuditRecord;\n /** Hash of the canonicalised input — reused by post hook. */\n inputHash: string;\n}", "documentation": "Result of a pre-tool-use evaluation.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 97 }, { "name": "SessionStartInput", "signature": "/** Input shape for {@link onSessionStart}. */\nexport interface SessionStartInput {\n sessionId: string;\n}", "documentation": "Input shape for {@link onSessionStart}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 40 }, { "name": "SessionStartResult", "signature": "/** Result of {@link onSessionStart}. */\nexport interface SessionStartResult {\n /** The audit record emitted for the session start. */\n record: AuditRecord;\n /** The hook context to be threaded through subsequent hooks. */\n context: HookContext;\n}", "documentation": "Result of {@link onSessionStart}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 45 }, { "name": "SkillInvokeInput", "signature": "/** Input shape for {@link onSkillInvoke}. */\nexport interface SkillInvokeInput {\n skillName: string;\n args?: unknown;\n metadata?: Record;\n}", "documentation": "Input shape for {@link onSkillInvoke}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 259 }, { "name": "SkillInvokeResult", "signature": "/** Result of {@link onSkillInvoke}. */\nexport interface SkillInvokeResult {\n decision: SkillDecision;\n record: AuditRecord;\n}", "documentation": "Result of {@link onSkillInvoke}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 266 }, { "name": "ToolUseInput", "signature": "/** Input shape for {@link preToolUse}. */\nexport interface ToolUseInput {\n /** Tool name as advertised by the Claude Agent SDK. */\n toolName: string;\n /** The arguments the agent intends to pass to the tool. */\n args: unknown;\n}", "documentation": "Input shape for {@link preToolUse}.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hooks.ts", "line": 89 }, { "name": "ConfigError", "signature": "export declare class ConfigError {\n constructor(message: string, context?: Record): ConfigError;\n}", "documentation": "Configuration was invalid at plugin construction time.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/errors.ts", "line": 79 }, { "name": "PluginError", "signature": "export declare class PluginError {\n code: PluginErrorCodeValue;\n context: Record;\n cause: unknown;\n constructor(message: string, code: PluginErrorCodeValue, options?: { context?: Record; cause?: unknown; }): PluginError;\n toJSON(): Record;\n}", "documentation": "Base error for the plugin.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/errors.ts", "line": 22 }, { "name": "PluginErrorCode", "signature": "export declare const PluginErrorCode: { readonly CONFIG_INVALID: \"openagent/claude-agent/config-invalid\"; readonly IDENTITY_MISSING: \"openagent/claude-agent/identity-missing\"; readonly TOOL_DENIED: \"openagent/claude-agent/tool-denied\"; readonly SKILL_DENIED: \"openagent/claude-agent/skill-denied\"; readonly AUDIT_FAILED: \"openagent/claude-agent/audit-failed\"; readonly HOOK_INTERNAL: \"openagent/claude-agent/hook-internal\"; readonly SIGN_FAILED: \"openagent/claude-agent/sign-failed\"; };", "documentation": "Stable, machine-readable error codes.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/errors.ts", "line": 9 }, { "name": "PluginErrorCodeValue", "signature": "export type PluginErrorCodeValue = (typeof PluginErrorCode)[keyof typeof PluginErrorCode];", "documentation": "", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/errors.ts", "line": 19 }, { "name": "SkillDeniedError", "signature": "export declare class SkillDeniedError {\n skill: string;\n constructor(skill: string, reason?: string, context?: Record): SkillDeniedError;\n}", "documentation": "A skill invocation was rejected by the skills policy.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/errors.ts", "line": 65 }, { "name": "ToolDeniedError", "signature": "export declare class ToolDeniedError {\n tool: string;\n constructor(tool: string, reason?: string, context?: Record): ToolDeniedError;\n}", "documentation": "A tool call was rejected because the agent lacks the required scope.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/errors.ts", "line": 51 }, { "name": "AuditKind", "signature": "/** Categories of audit events. */\nexport type AuditKind = 'session.start' | 'session.stop' | 'tool.preflight' | 'tool.complete' | 'skill.preflight' | 'skill.complete' | 'message.signed' | 'policy.deny';", "documentation": "Categories of audit events.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 89 }, { "name": "AuditRecord", "signature": "/** A single tamper-evident audit record. */\nexport interface AuditRecord {\n /** Monotonic sequence number within a session. */\n seq: number;\n /** ISO-8601 timestamp the record was emitted. */\n timestamp: string;\n /** Session id this record belongs to. */\n sessionId: string;\n /** Agent DID that performed the action. */\n agentDid: string;\n /** What kind of event this is. */\n kind: AuditKind;\n /** Tool or skill name (when applicable). */\n name?: string;\n /** Allow / deny outcome. */\n outcome: 'allow' | 'deny' | 'ok' | 'error';\n /** Hash of the request payload (BLAKE3 hex, lowercase). */\n inputHash?: string;\n /** Hash of the response payload (BLAKE3 hex, lowercase). */\n outputHash?: string;\n /** Hash chain pointer to the previous record. */\n prevHash: string;\n /** This record's hash. */\n hash: string;\n /** Free-form context (matched scope, error message, etc.). */\n context?: Record;\n}", "documentation": "A single tamper-evident audit record.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 61 }, { "name": "AuditSink", "signature": "/** Audit sink — receives one record per tool / skill invocation. */\nexport interface AuditSink {\n /** Append an audit record. MUST be best-effort and non-throwing. */\n append(record: AuditRecord): Promise | void;\n}", "documentation": "Audit sink — receives one record per tool / skill invocation.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 55 }, { "name": "CapabilityChecker", "signature": "/** Anything implementing this can authorise tool / skill invocations. */\nexport interface CapabilityChecker {\n /**\n * Check whether the agent currently holds the requested scope.\n *\n * Implementations should be deterministic and side-effect free —\n * Arsenal-backed checkers may cache, but MUST NOT mutate.\n */\n check(scope: string): Promise | ScopeDecision;\n}", "documentation": "Anything implementing this can authorise tool / skill invocations.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 44 }, { "name": "OpenAgentIdentity", "signature": "/**\n * Shared types for the OpenAgent x Claude Agent SDK plugin.\n *\n * These mirror the public surface of `@openagentid/sdk` but are duplicated\n * here so the plugin can run in environments where the SDK is not yet\n * resolved (e.g., bun's optional peer dep handling, dev installs).\n *\n * When `@openagentid/sdk` is present, the runtime objects passed by the\n * caller are structurally compatible with the interfaces below.\n */\n/** A verified OpenAgent identity, anchored on a `did:oas:*` string. */\nexport interface OpenAgentIdentity {\n /** Decentralised identifier, e.g. `did:oas:test:agent:refactor-bot`. */\n did: string;\n /** Entity kind: `hmr`, `mhr`, `agent`, `tool`, `skill`, etc. */\n kind: string;\n /** Optional human-readable display name (not authoritative). */\n displayName?: string;\n /** Public Ed25519 verification key, hex-encoded (32 bytes). */\n publicKey: string;\n /**\n * Sign a payload with the agent's Ed25519 secret key.\n *\n * The signing key MUST live behind this function — it is never\n * exposed to plugin code directly.\n */\n sign(payload: Uint8Array): Promise | Uint8Array;\n /** Optional lineage chain (HMR -> ... -> this agent). */\n lineage?: readonly string[];\n}", "documentation": "A verified OpenAgent identity, anchored on a `did:oas:*` string.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 13 }, { "name": "ScopeDecision", "signature": "/** Result of a credential / scope check. */\nexport interface ScopeDecision {\n /** Whether the request is allowed. */\n allowed: boolean;\n /** Matched scope string (e.g. `tools:invoke:bash`), if any. */\n matchedScope?: string;\n /** Human-readable reason for denial. */\n reason?: string;\n}", "documentation": "Result of a credential / scope check.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 34 }, { "name": "SkillDecision", "signature": "/** Result of a skills policy evaluation. */\nexport interface SkillDecision {\n /** Allow / deny. */\n allowed: boolean;\n /** Reason on deny. */\n reason?: string;\n /** The scope that authorised the call. */\n matchedScope?: string;\n}", "documentation": "Result of a skills policy evaluation.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 131 }, { "name": "SkillEvaluationContext", "signature": "/** Context passed to a skills policy evaluation. */\nexport interface SkillEvaluationContext {\n /** The agent's verified identity. */\n identity: OpenAgentIdentity;\n /** Capability checker (Arsenal-backed) for scope lookups. */\n capabilities: CapabilityChecker;\n /** Optional metadata about the call site. */\n metadata?: Record;\n}", "documentation": "Context passed to a skills policy evaluation.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 121 }, { "name": "SkillsManifestEntry", "signature": "/** SKILLS.md entry as parsed from a manifest. */\nexport interface SkillsManifestEntry {\n /** Stable skill identifier (e.g. `web.search`). */\n name: string;\n /** Human description. */\n description?: string;\n /** Required scope to invoke. Defaults to `skills:invoke:`. */\n requiredScope?: string;\n}", "documentation": "SKILLS.md entry as parsed from a manifest.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 100 }, { "name": "SkillsPolicy", "signature": "/** Skills policy: decides whether a SKILLS.md skill may be invoked. */\nexport interface SkillsPolicy {\n /**\n * Check whether the named skill may be invoked by the current agent.\n *\n * Default behaviour for any concrete implementation: deny unless the\n * agent holds `skills:invoke:`.\n */\n evaluate(skillName: string, ctx: SkillEvaluationContext): Promise | SkillDecision;\n}", "documentation": "Skills policy: decides whether a SKILLS.md skill may be invoked.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/types.ts", "line": 110 }, { "name": "canonicalJson", "signature": "export declare const canonicalJson: (value: unknown) => string;", "documentation": "Stable JSON stringify (sorted keys) for deterministic hashing.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hash.ts", "line": 63 }, { "name": "getHashAlgo", "signature": "export declare const getHashAlgo: () => HashAlgo;", "documentation": "Resolve which hash algorithm to use, attempting to load `blake3` once.\nSubsequent calls are cached.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hash.ts", "line": 25 }, { "name": "hashHex", "signature": "export declare const hashHex: (data: string | Uint8Array) => string;", "documentation": "Hash a string or byte buffer and return lowercase hex.", "source": "openagent-sdk/integrations/claude-agent-sdk/typescript/src/hash.ts", "line": 50 } ] }, { "package": "@openagentid/mcp", "url": "/reference/typescript/openagent-sdk-integrations-mcp-typescript", "exports": [ { "name": "withOpenAgent", "signature": "export declare const withOpenAgent: (server: T, config: OpenAgentMcpConfig) => T;", "documentation": "Wrap an MCP server so every tool call is authenticated against an\nOpenAgent identity.", "source": "openagent-sdk/integrations/mcp/typescript/src/server.ts", "line": 92 }, { "name": "ANONYMOUS_IDENTITY", "signature": "export declare const ANONYMOUS_IDENTITY: VerifiedIdentity;", "documentation": "", "source": "openagent-sdk/integrations/mcp/typescript/src/server.ts", "line": 418 }, { "name": "McpServerLike", "signature": "/**\n * Minimal McpServer surface used by the middleware. We avoid importing\n * concrete types from `@modelcontextprotocol/sdk` because peer-dep\n * versions vary across host applications and the SDK's own type exports\n * are subject to change. The shape below is the intersection of every\n * `1.x` McpServer release.\n */\nexport interface McpServerLike {\n tool(...args: unknown[]): unknown;\n registerTool(...args: unknown[]): unknown;\n}", "documentation": "Minimal McpServer surface used by the middleware. We avoid importing\nconcrete types from `@modelcontextprotocol/sdk` because peer-dep\nversions vary across host applications and the SDK's own type exports\nare subject to change. The shape below is the intersection of every\n`1.x` McpServer release.", "source": "openagent-sdk/integrations/mcp/typescript/src/server.ts", "line": 58 }, { "name": "withOpenAgentClient", "signature": "export declare const withOpenAgentClient: (client: T, config: OpenAgentClientConfig) => T;", "documentation": "Wrap an MCP client so every outbound `callTool` carries an OpenAgent\nidentity envelope.", "source": "openagent-sdk/integrations/mcp/typescript/src/client.ts", "line": 70 }, { "name": "buildIdentityMeta", "signature": "export declare const buildIdentityMeta: (identity: { did: string; proof: string; nonce?: string; context?: Record; }) => Record;", "documentation": "Helper for tests and tools that want to construct the identity\nenvelope manually without going through a full Agent. Returns a `_meta`\nobject that can be merged into a CallToolRequest's params.", "source": "openagent-sdk/integrations/mcp/typescript/src/client.ts", "line": 184 }, { "name": "McpClientLike", "signature": "/**\n * Minimal MCP client surface used by the interceptor. Like the server\n * adapter, we describe just the methods we need to keep peer-dep\n * compatibility broad.\n */\nexport interface McpClientLike {\n callTool(params: {\n name: string;\n arguments?: Record;\n _meta?: Record;\n }, ...rest: unknown[]): Promise;\n}", "documentation": "Minimal MCP client surface used by the interceptor. Like the server\nadapter, we describe just the methods we need to keep peer-dep\ncompatibility broad.", "source": "openagent-sdk/integrations/mcp/typescript/src/client.ts", "line": 30 }, { "name": "OpenAgentClientConfig", "signature": "export interface OpenAgentClientConfig {\n /** The agent doing the calling — used to sign each request. */\n agent: Agent;\n /**\n * Optional audience DID. When set, it is passed to\n * {@link Agent.signRequest} so the proof can be bound to a specific\n * server. Most production deployments should set this.\n */\n audience?: string;\n /**\n * Optional hook fired before every outbound call. Use it for client-\n * side metrics or to mutate the params (e.g., add tracing headers).\n * Returning a value replaces the params.\n */\n beforeCall?: (params: {\n name: string;\n arguments?: Record;\n _meta?: Record;\n }) => Promise<{\n name: string;\n arguments?: Record;\n _meta?: Record;\n } | void> | {\n name: string;\n arguments?: Record;\n _meta?: Record;\n } | void;\n}", "documentation": "", "source": "openagent-sdk/integrations/mcp/typescript/src/client.ts", "line": 41 }, { "name": "OpenAgentMcpError", "signature": "export declare class OpenAgentMcpError {\n code: McpErrorCodeValue;\n data: Record;\n constructor(message: string, code: McpErrorCodeValue, data?: Record): OpenAgentMcpError;\n toJsonRpcError(): { code: McpErrorCodeValue; message: string; data?: Record; };\n}", "documentation": "Base class for all middleware errors. Subclasses set a default\n{@link OpenAgentMcpError.code} that maps to a JSON-RPC error code.", "source": "openagent-sdk/integrations/mcp/typescript/src/errors.ts", "line": 37 }, { "name": "MissingIdentityError", "signature": "export declare class MissingIdentityError {\n constructor(toolName: string): MissingIdentityError;\n}", "documentation": "Caller did not present an OpenAgent identity envelope.", "source": "openagent-sdk/integrations/mcp/typescript/src/errors.ts", "line": 71 }, { "name": "IdentityVerificationError", "signature": "export declare class IdentityVerificationError {\n constructor(toolName: string, cause: unknown): IdentityVerificationError;\n}", "documentation": "Identity envelope was present but the verifier rejected it.", "source": "openagent-sdk/integrations/mcp/typescript/src/errors.ts", "line": 83 }, { "name": "AuthorizationDeniedError", "signature": "export declare class AuthorizationDeniedError {\n constructor(toolName: string, requiredScopes: ReadonlyArray, heldScopes: ReadonlyArray): AuthorizationDeniedError;\n}", "documentation": "Caller's verified identity does not hold the required scopes.", "source": "openagent-sdk/integrations/mcp/typescript/src/errors.ts", "line": 95 }, { "name": "SkillsPolicyDeniedError", "signature": "export declare class SkillsPolicyDeniedError {\n constructor(toolName: string, reason: string | undefined): SkillsPolicyDeniedError;\n}", "documentation": "Skills policy hook returned `allow: false`.", "source": "openagent-sdk/integrations/mcp/typescript/src/errors.ts", "line": 115 }, { "name": "McpErrorCode", "signature": "export declare const McpErrorCode: { readonly InvalidRequest: -32600; readonly MethodNotFound: -32601; readonly InvalidParams: -32602; readonly InternalError: -32603; readonly ServerError: -32000; readonly AuthenticationFailed: -32001; readonly AuthorizationDenied: -32002; readonly SkillsPolicyDenied: -32003; };", "documentation": "Standard JSON-RPC + MCP error codes used by the middleware.", "source": "openagent-sdk/integrations/mcp/typescript/src/errors.ts", "line": 11 }, { "name": "McpErrorCodeValue", "signature": "export type McpErrorCodeValue = (typeof McpErrorCode)[keyof typeof McpErrorCode];", "documentation": "", "source": "openagent-sdk/integrations/mcp/typescript/src/errors.ts", "line": 30 }, { "name": "createSkillsPolicy", "signature": "export declare const createSkillsPolicy: (options: CreateSkillsPolicyOptions) => SkillsPolicyHook;", "documentation": "Build a {@link SkillsPolicyHook} from a store and matching options.\n\nThe returned hook always allows tools that are not skill-like; it only\nconsults the store when {@link CreateSkillsPolicyOptions.isSkillTool}\nreturns true.", "source": "openagent-sdk/integrations/mcp/typescript/src/skills.ts", "line": 100 }, { "name": "combineSkillsPolicies", "signature": "export declare const combineSkillsPolicies: (first: SkillsPolicyHook, second: SkillsPolicyHook) => SkillsPolicyHook;", "documentation": "Compose two skills policy hooks. The combined hook denies if either\nunderlying hook denies; allow decisions from `first` are forwarded to\n`second`.", "source": "openagent-sdk/integrations/mcp/typescript/src/skills.ts", "line": 175 }, { "name": "InMemorySkillsPolicyStore", "signature": "export declare class InMemorySkillsPolicyStore {\n constructor(rules?: ReadonlyArray): InMemorySkillsPolicyStore;\n lookup(skillName: string): SkillsRule | null;\n withRule(rule: SkillsRule): InMemorySkillsPolicyStore;\n}", "documentation": "Trivial in-memory store useful in tests and as a starting point for\nproduction stores.", "source": "openagent-sdk/integrations/mcp/typescript/src/skills.ts", "line": 53 }, { "name": "DEFAULT_SKILL_TOOL_NAMES", "signature": "export declare const DEFAULT_SKILL_TOOL_NAMES: readonly string[];", "documentation": "Tool name prefixes that the middleware treats as skill-like by default.\nHost applications can override the matcher entirely via\n{@link createSkillsPolicy}.", "source": "openagent-sdk/integrations/mcp/typescript/src/skills.ts", "line": 20 }, { "name": "SkillsRule", "signature": "/**\n * A single rule describing whether a `(skillName, did)` pair is allowed.\n * `null` for `dids` means \"any verified caller\". An empty array means\n * \"no caller\".\n */\nexport interface SkillsRule {\n skillName: string;\n /** DIDs allowed to invoke this skill, or `null` for any. */\n dids: ReadonlyArray | null;\n /** Optional reason emitted when the rule denies a call. */\n reason?: string;\n}", "documentation": "A single rule describing whether a `(skillName, did)` pair is allowed.\n`null` for `dids` means \"any verified caller\". An empty array means\n\"no caller\".", "source": "openagent-sdk/integrations/mcp/typescript/src/skills.ts", "line": 33 }, { "name": "SkillsPolicyStore", "signature": "/**\n * Policy store interface — implementations may be in-memory, file-backed\n * by `SKILLS.md`, or fetched from a remote service.\n */\nexport interface SkillsPolicyStore {\n lookup(skillName: string): Promise | SkillsRule | null;\n}", "documentation": "Policy store interface — implementations may be in-memory, file-backed\nby `SKILLS.md`, or fetched from a remote service.", "source": "openagent-sdk/integrations/mcp/typescript/src/skills.ts", "line": 45 }, { "name": "CreateSkillsPolicyOptions", "signature": "export interface CreateSkillsPolicyOptions {\n /** The store backing skill lookups. */\n store: SkillsPolicyStore;\n /**\n * Returns true when a tool call should be checked against the skills\n * policy. Defaults to matching the tool name against\n * {@link DEFAULT_SKILL_TOOL_NAMES}.\n */\n isSkillTool?: (toolName: string) => boolean;\n /**\n * Extracts the skill name from the tool's arguments. Defaults to\n * reading `args.skill` or `args.skillName`.\n */\n extractSkillName?: (args: unknown) => string | null;\n /**\n * Default decision when no rule matches. Defaults to `{ allow: true }`\n * to keep non-skill tools unaffected.\n */\n defaultDecision?: SkillsPolicyDecision;\n}", "documentation": "", "source": "openagent-sdk/integrations/mcp/typescript/src/skills.ts", "line": 72 }, { "name": "Agent", "signature": "/**\n * Minimal Agent surface — only the parts of the OpenAgent SDK Agent that\n * the MCP middleware actually needs.\n */\nexport interface Agent {\n did: Did;\n verifier: IdentityVerifier;\n /**\n * Sign an outbound MCP call so the receiving server can verify the\n * caller. Returns the identity envelope to attach as `_meta.openagent`.\n */\n signRequest(toolName: string, audience?: Did): Promise;\n}", "documentation": "Minimal Agent surface — only the parts of the OpenAgent SDK Agent that\nthe MCP middleware actually needs.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 77 }, { "name": "AuditedResultMeta", "signature": "/**\n * Result envelope returned by an authenticated tool call. The `auditId` is\n * pushed into `_meta.openagent.audit_id` on the response, so callers can\n * correlate logs end-to-end.\n */\nexport interface AuditedResultMeta {\n audit_id: string;\n verified_did: Did;\n scopes: ReadonlyArray;\n}", "documentation": "Result envelope returned by an authenticated tool call. The `auditId` is\npushed into `_meta.openagent.audit_id` on the response, so callers can\ncorrelate logs end-to-end.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 95 }, { "name": "Did", "signature": "/**\n * Public types for @openagentid/mcp.\n *\n * These interfaces describe the contract the middleware expects from an\n * OpenAgent {@link Agent} instance and the surrounding configuration. They are\n * defined locally so the package can be installed without `@openagentid/sdk` in\n * tests, in CI, and in environments where the host application brings its own\n * verifier implementation.\n *\n * The real `@openagentid/sdk` exports types that are structurally compatible\n * with these — there is no runtime dependency.\n */\n/**\n * A decentralized identifier following the `did:oas:*` method or any other\n * DID method understood by the configured verifier.\n */\nexport type Did = string;", "documentation": "A decentralized identifier following the `did:oas:*` method or any other\nDID method understood by the configured verifier.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 18 }, { "name": "ErrorHook", "signature": "/**\n * Hook fired when the tool body or any earlier middleware step throws.\n * The middleware re-throws the error after running this hook so MCP\n * clients still observe the original failure mode.\n */\nexport type ErrorHook = (input: {\n toolName: string;\n args: unknown;\n identity: VerifiedIdentity | null;\n error: unknown;\n}) => Promise | void;", "documentation": "Hook fired when the tool body or any earlier middleware step throws.\nThe middleware re-throws the error after running this hook so MCP\nclients still observe the original failure mode.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 151 }, { "name": "IdentityVerifier", "signature": "/**\n * The verifier interface — implemented by `@openagentid/sdk` (production) and\n * by the in-memory test agent shipped here.\n *\n * Implementations MUST be deterministic for a given input and MUST NOT\n * mutate the request identity object.\n */\nexport interface IdentityVerifier {\n verify(identity: OpenAgentRequestIdentity, requiredScopes: ReadonlyArray): Promise;\n}", "documentation": "The verifier interface — implemented by `@openagentid/sdk` (production) and\nby the in-memory test agent shipped here.\n\nImplementations MUST be deterministic for a given input and MUST NOT\nmutate the request identity object.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 66 }, { "name": "OpenAgentMcpConfig", "signature": "/**\n * Configuration for {@link withOpenAgent}.\n */\nexport interface OpenAgentMcpConfig {\n /** The agent that owns this MCP server (used for outbound signing). */\n agent: Agent;\n /**\n * Per-tool required scope set. Defaults to\n * `(toolName) => [`mcp:${toolName}:invoke`]`.\n */\n requireScopes?: ScopeDeriver;\n /**\n * If true (default), tool calls without an `_meta.openagent.identity`\n * envelope are rejected. Set to false to opt-in to permissive mode for\n * local development — the middleware will still run hooks but skip\n * verification.\n */\n requireIdentity?: boolean;\n /** Optional skills policy hook. */\n skillsPolicy?: SkillsPolicyHook;\n /** Optional pre-call hook. */\n preCall?: PreCallHook;\n /** Optional post-call hook for audit/log emission. */\n postCall?: PostCallHook;\n /** Optional error hook. */\n onError?: ErrorHook;\n /**\n * Override the default `mcp::invoke` scope format. Receives the\n * tool name and returns the canonical scope string.\n */\n scopeFormat?: (toolName: string) => string;\n}", "documentation": "Configuration for {@link withOpenAgent }.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 161 }, { "name": "OpenAgentRequestIdentity", "signature": "/**\n * The four pieces of metadata an MCP request carries about the calling\n * agent. Populated by the {@link createClientInterceptor} on the call site\n * and consumed by the server middleware.\n */\nexport interface OpenAgentRequestIdentity {\n /** Caller's DID — typically `did:oas:...`. */\n did: Did;\n /**\n * A signed challenge response or capability token (Arsenal ACT) the\n * server can verify offline. Format is opaque to the middleware.\n */\n proof: string;\n /**\n * Optional bearer-style nonce. Servers may require it for replay\n * protection. Verifiers MUST treat the value as untrusted until\n * verification succeeds.\n */\n nonce?: string;\n /**\n * Free-form context the verifier may use (issuer DID, audience, scopes\n * the caller claims). Always validated against the verifier's policy.\n */\n context?: Record;\n}", "documentation": "The four pieces of metadata an MCP request carries about the calling\nagent. Populated by the {@link createClientInterceptor } on the call site\nand consumed by the server middleware.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 25 }, { "name": "PostCallHook", "signature": "/**\n * Hook fired after a tool body executes successfully. Use it for audit\n * logging, metrics, and trace propagation. Throwing from this hook does\n * NOT roll back the tool call.\n */\nexport type PostCallHook = (input: {\n toolName: string;\n args: unknown;\n identity: VerifiedIdentity;\n durationMs: number;\n result: unknown;\n}) => Promise | void;", "documentation": "Hook fired after a tool body executes successfully. Use it for audit\nlogging, metrics, and trace propagation. Throwing from this hook does\nNOT roll back the tool call.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 138 }, { "name": "PreCallHook", "signature": "/**\n * Hook fired before a tool body executes — after the identity has been\n * verified and the skills policy has approved the call.\n */\nexport type PreCallHook = (input: {\n toolName: string;\n args: unknown;\n identity: VerifiedIdentity;\n}) => Promise | void;", "documentation": "Hook fired before a tool body executes — after the identity has been\nverified and the skills policy has approved the call.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 127 }, { "name": "ScopeDeriver", "signature": "/** Per-tool scope deriver. */\nexport type ScopeDeriver = (toolName: string, args: unknown) => ReadonlyArray;", "documentation": "Per-tool scope deriver.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 102 }, { "name": "SkillsPolicyDecision", "signature": "export interface SkillsPolicyDecision {\n allow: boolean;\n reason?: string;\n}", "documentation": "", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 118 }, { "name": "SkillsPolicyHook", "signature": "/**\n * Hook signature for the skills policy. The hook receives the tool name,\n * the arguments, and the verified identity, and decides whether the call\n * should be allowed.\n */\nexport type SkillsPolicyHook = (input: {\n toolName: string;\n args: unknown;\n identity: VerifiedIdentity;\n}) => Promise | SkillsPolicyDecision;", "documentation": "Hook signature for the skills policy. The hook receives the tool name,\nthe arguments, and the verified identity, and decides whether the call\nshould be allowed.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 112 }, { "name": "VerifiedIdentity", "signature": "/**\n * The result of running the auth pipeline against an incoming MCP request.\n * Available to post-call hooks and audit log emitters.\n */\nexport interface VerifiedIdentity {\n did: Did;\n scopes: ReadonlyArray;\n /** Audit identifier echoed back to the caller in result `_meta`. */\n auditId: string;\n /** Verifier-issued claims about the caller. */\n claims: Readonly>;\n}", "documentation": "The result of running the auth pipeline against an incoming MCP request.\nAvailable to post-call hooks and audit log emitters.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 50 }, { "name": "defaultRequireScopes", "signature": "export declare const defaultRequireScopes: (toolName: string) => ReadonlyArray;", "documentation": "Default scope deriver used when {@link OpenAgentMcpConfig.requireScopes}\nis not supplied.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 202 }, { "name": "defaultScopeFormat", "signature": "export declare const defaultScopeFormat: (toolName: string) => string;", "documentation": "Default scope format used when {@link OpenAgentMcpConfig.scopeFormat} is\nnot supplied.", "source": "openagent-sdk/integrations/mcp/typescript/src/types.ts", "line": 195 } ] }, { "package": "create-openagent", "url": "/reference/typescript/openagent-sdk-packages-create-openagent", "exports": [] }, { "package": "@openagentid/sdk-testing", "url": "/reference/typescript/openagent-sdk-sdks-testing", "exports": [ { "name": "stubArsenalClient", "signature": "export declare const stubArsenalClient: () => ArsenalClient;", "documentation": "In-memory Arsenal client for tests. Echoes a deterministic proxy URL per\nprovider without minting any credential.", "source": "openagent-sdk/sdks/testing/src/index.ts", "line": 115 }, { "name": "createTestingConfig", "signature": "export declare const createTestingConfig: (overrides?: Partial) => OpenAgentConfig;", "documentation": "An {@link OpenAgentConfig } with all three in-memory backends wired in.\n\nThe production SDK requires real protocol clients and fails closed when one\nis missing; tests opt into the fakes explicitly through this helper.", "source": "openagent-sdk/sdks/testing/src/index.ts", "line": 218 }, { "name": "StubIdentityProvider", "signature": "export declare class StubIdentityProvider {\n constructor(namespace?: string): StubIdentityProvider;\n createAgentIdentity(input: CreateAgentInput): Promise;\n resolve(did: Did): Promise;\n signChallenge(did: Did, challenge: Uint8Array): Promise;\n publicKey(did: Did): Promise;\n}", "documentation": "In-memory identity provider for tests.\n\nGenerates deterministic-looking DIDs and public keys. NOT cryptographically\nsound for production - `signChallenge` returns a tagged base64 blob, not an\nEd25519 signature.", "source": "openagent-sdk/sdks/testing/src/index.ts", "line": 51 }, { "name": "StubVerificationClient", "signature": "export declare class StubVerificationClient {\n verifyRequest(req: Request, options?: VerifyRequestOptions): Promise;\n issueChallenge(): Promise<{ challenge: Uint8Array; challengeId: string; }>;\n verifyChallengeResponse(params: { challengeId: string; agentDid: Did; signatureBase64: string; }): Promise;\n}", "documentation": "In-memory verification client for tests.\n\nAccepts any request carrying `Authorization: OpenAgent stub:` or\n`Authorization: Bearer stub:` and returns a synthetic\n{@link AuthContext }. NOT a real verifier: any well-formed stub token passes.", "source": "openagent-sdk/sdks/testing/src/index.ts", "line": 138 } ] }, { "package": "@openagentid/sdk", "url": "/reference/typescript/openagent-sdk-sdks-typescript", "exports": [ { "name": "OpenAgent", "signature": "export declare const OpenAgent: { readonly configure: (config?: OpenAgentConfig) => OpenAgentRuntime; readonly runtime: () => OpenAgentRuntime; readonly createAgent: (input: CreateAgentInput) => Promise; readonly loadAgent: (did: Did, skills?: readonly SkillId[]) => Promise; readonly authenticate: (req: Request, options?: VerifyRequestOptions) => Promise; };", "documentation": "`OpenAgent` — the public namespace. All calls delegate to a singleton\nruntime created lazily on first use. Most apps never need more than this.", "source": "openagent-sdk/sdks/typescript/src/agent.ts", "line": 221 }, { "name": "OpenAgentRuntime", "signature": "export declare class OpenAgentRuntime {\n constructor(config?: OpenAgentConfig): OpenAgentRuntime;\n config(): Readonly;\n identity(): IdentityProvider;\n arsenal(): ArsenalClient;\n verification(): VerificationClient;\n createAgent(input: CreateAgentInput): Promise;\n loadAgent(did: Did, skills?: readonly SkillId[]): Promise;\n authenticate(req: Request, options?: VerifyRequestOptions): Promise;\n}", "documentation": "Global, lazily-initialized OpenAgent runtime.\n\nThe default instance is populated by {@link OpenAgent.configure}. Callers\nwho need multiple runtimes in one process can instantiate `OpenAgentRuntime`\ndirectly.", "source": "openagent-sdk/sdks/typescript/src/agent.ts", "line": 121 }, { "name": "OpenAgentInstance", "signature": "/** A live, fully-authenticated agent handle. */\nexport interface OpenAgentInstance {\n /** The agent's DID. */\n readonly did: Did;\n /** The raw OAS identity document. */\n readonly document: IdentityDocument;\n /** Skills policy bound to this agent. */\n skillsPolicy(): SkillsPolicy;\n /** Replace the agent's skills policy (immutable — returns a new instance). */\n withSkillsPolicy(policy: SkillsPolicy): OpenAgentInstance;\n /** Fetch a credential handle for `provider`. */\n credentialsFor(provider: string, scopes?: readonly string[]): Promise;\n /** Underlying identity provider (escape hatch). */\n identity(): IdentityProvider;\n}", "documentation": "A live, fully-authenticated agent handle.", "source": "openagent-sdk/sdks/typescript/src/agent.ts", "line": 99 }, { "name": "OpenAgentConfig", "signature": "/**\n * Global SDK configuration.\n *\n * All fields are optional; sensible defaults are applied by\n * {@link OpenAgent.configure}. The SDK works with zero configuration for\n * local development and test environments.\n */\nexport interface OpenAgentConfig {\n /** Override the default namespace (`l1fe`). */\n namespace?: string;\n /**\n * Transport endpoints. If omitted, the SDK assumes it is running in-process\n * with the underlying libraries (useful for tests) or that the wrapped\n * SDKs will read their own env vars.\n */\n endpoints?: {\n oasResolver?: string;\n arsenalBroker?: string;\n aegisVerifier?: string;\n };\n /**\n * Inject a custom `fetch`. Defaults to globalThis.fetch (native on Node 20+,\n * Bun, Deno, browsers, Workers).\n */\n fetch?: typeof fetch;\n /** Optional structured logger. */\n logger?: Logger;\n /** Override the abort timeout (ms) for HTTP calls. Default: 30000. */\n requestTimeoutMs?: number;\n /**\n * Pre-constructed subsystem clients (advanced). When provided, the SDK\n * uses them directly instead of constructing its own.\n */\n clients?: OpenAgentClients;\n}", "documentation": "Global SDK configuration.\n\nAll fields are optional; sensible defaults are applied by\n{@link OpenAgent.configure }. The SDK works with zero configuration for\nlocal development and test environments.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 98 }, { "name": "OpenAgentClients", "signature": "/**\n * Forward-declared clients for the three wrapped subsystems.\n *\n * Concrete interfaces live in the per-module files so that this config file\n * does not depend on internal implementation details.\n */\nexport interface OpenAgentClients {\n readonly identity?: unknown;\n readonly credentials?: unknown;\n readonly verification?: unknown;\n}", "documentation": "Forward-declared clients for the three wrapped subsystems.\n\nConcrete interfaces live in the per-module files so that this config file\ndoes not depend on internal implementation details.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 85 }, { "name": "ResolvedOpenAgentConfig", "signature": "/** Resolved configuration with all defaults applied. */\nexport interface ResolvedOpenAgentConfig {\n namespace: string;\n endpoints: {\n oasResolver?: string;\n arsenalBroker?: string;\n aegisVerifier?: string;\n };\n fetch: typeof fetch;\n logger: Logger;\n requestTimeoutMs: number;\n clients: OpenAgentClients;\n}", "documentation": "Resolved configuration with all defaults applied.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 128 }, { "name": "CreateAgentInput", "signature": "export type CreateAgentInput = z.infer;", "documentation": "", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 61 }, { "name": "Logger", "signature": "/** Logger interface — structured, dependency-free. */\nexport interface Logger {\n debug(msg: string, fields?: Record): void;\n info(msg: string, fields?: Record): void;\n warn(msg: string, fields?: Record): void;\n error(msg: string, fields?: Record): void;\n}", "documentation": "Logger interface — structured, dependency-free.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 64 }, { "name": "resolveConfig", "signature": "export declare const resolveConfig: (config?: OpenAgentConfig) => ResolvedOpenAgentConfig;", "documentation": "Merge user config with defaults. Pure function — does not mutate input.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 145 }, { "name": "silentLogger", "signature": "export declare const silentLogger: Logger;", "documentation": "No-op logger used by default.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 72 }, { "name": "createAgentInputSchema", "signature": "export declare const createAgentInputSchema: z.ZodObject<{ parent: z.ZodString; name: z.ZodString; scopes: z.ZodArray; namespace: z.ZodOptional; skills: z.ZodOptional>; metadata: z.ZodOptional>; }, z.core.$strict>;", "documentation": "Parameters accepted by {@link OpenAgent.createAgent }.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 40 }, { "name": "didSchema", "signature": "export declare const didSchema: z.ZodString;", "documentation": "", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 20 }, { "name": "scopeSchema", "signature": "export declare const scopeSchema: z.ZodString;", "documentation": "A parsed OAS scope string such as `openai:chat:completions`.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 23 }, { "name": "providerSchema", "signature": "export declare const providerSchema: z.ZodString;", "documentation": "Provider identifier (e.g. `openai`, `github`, `stripe`).", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 32 }, { "name": "DEFAULT_NAMESPACE", "signature": "export declare const DEFAULT_NAMESPACE: \"l1fe\";", "documentation": "", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 141 }, { "name": "DEFAULT_REQUEST_TIMEOUT_MS", "signature": "export declare const DEFAULT_REQUEST_TIMEOUT_MS: 30000;", "documentation": "", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 142 }, { "name": "DID_REGEX", "signature": "export declare const DID_REGEX: RegExp;", "documentation": "DID regex for `did:oas:::`.\n\nMirrors the OAS v1.1.0 specification. We keep it deliberately permissive\nhere — strict validation belongs in the OAS SDK itself.", "source": "openagent-sdk/sdks/typescript/src/config.ts", "line": 17 }, { "name": "Did", "signature": "/** Fully qualified `did:oas` identifier. */\nexport type Did = string;", "documentation": "Fully qualified `did:oas` identifier.", "source": "openagent-sdk/sdks/typescript/src/identity.ts", "line": 19 }, { "name": "IdentityDocument", "signature": "/** OAS identity document fragment — minimum fields needed by the SDK. */\nexport interface IdentityDocument {\n /** Canonical DID. */\n did: Did;\n /** Parent DID (lineage). */\n parent: Did;\n /** Multibase-encoded Ed25519 public key. */\n publicKeyMultibase: string;\n /** Entity kind — `agent`, `tool`, etc. */\n kind: string;\n /** Granted scopes. */\n scopes: readonly string[];\n /** ISO-8601 creation timestamp. */\n createdAt: string;\n /** Opaque metadata. */\n metadata?: Record;\n}", "documentation": "OAS identity document fragment — minimum fields needed by the SDK.", "source": "openagent-sdk/sdks/typescript/src/identity.ts", "line": 22 }, { "name": "IdentityProvider", "signature": "/**\n * The OAS identity facade. Concrete providers come from `@openagentid/oas-sdk`\n * (production) or from {@link StubIdentityProvider} (test / offline dev).\n */\nexport interface IdentityProvider {\n /** Create a new OAS identity descended from `input.parent`. */\n createAgentIdentity(input: CreateAgentInput): Promise;\n /** Resolve an existing DID to its identity document. */\n resolve(did: Did): Promise;\n /** Sign a challenge (e.g. from AEGIS) with the agent's private key. */\n signChallenge(did: Did, challenge: Uint8Array): Promise;\n /** Return the public key for a DID (multibase). */\n publicKey(did: Did): Promise;\n}", "documentation": "The OAS identity facade. Concrete providers come from `@openagentid/oas-sdk`\n(production) or from {@link StubIdentityProvider } (test / offline dev).", "source": "openagent-sdk/sdks/typescript/src/identity.ts", "line": 57 }, { "name": "SignedAssertion", "signature": "/** Signed credential returned by the identity provider. */\nexport interface SignedAssertion {\n /** JWS / JWT / OAS assertion envelope (base64url). */\n token: string;\n /** Raw signature bytes (base64). */\n signature: string;\n /** DID of the signer. */\n signer: Did;\n /** Unix timestamp when the assertion was minted. */\n issuedAt: number;\n /** Unix timestamp after which the assertion is invalid. */\n expiresAt: number;\n}", "documentation": "Signed credential returned by the identity provider.", "source": "openagent-sdk/sdks/typescript/src/identity.ts", "line": 40 }, { "name": "parseIdentityDocument", "signature": "export declare const parseIdentityDocument: (raw: unknown) => IdentityDocument;", "documentation": "Validate an untrusted identity document. Throws {@link IdentityError} on failure.", "source": "openagent-sdk/sdks/typescript/src/identity.ts", "line": 85 }, { "name": "toIdentityProvider", "signature": "export declare const toIdentityProvider: (client: unknown) => IdentityProvider;", "documentation": "Narrow any unknown value into an {@link IdentityProvider}, or throw.\n\nThis is the integration point where `@openagentid/oas-sdk`'s client is adapted into\nour interface. When that SDK is finalized, replace the duck-typing below\nwith a direct import.", "source": "openagent-sdk/sdks/typescript/src/identity.ts", "line": 107 }, { "name": "identityDocumentSchema", "signature": "export declare const identityDocumentSchema: z.ZodObject<{ did: z.ZodString; parent: z.ZodString; publicKeyMultibase: z.ZodString; kind: z.ZodString; scopes: z.ZodReadonly>; createdAt: z.ZodString; metadata: z.ZodOptional>; }, z.core.$strict>;", "documentation": "Runtime-validated identity document schema.", "source": "openagent-sdk/sdks/typescript/src/identity.ts", "line": 72 }, { "name": "ArsenalClient", "signature": "/**\n * Arsenal broker client facade. The real client lives in `@openagentid/arsenal-sdk`\n * and is injected by the application; see `INTEGRATION_NOTES.md`.\n */\nexport interface ArsenalClient {\n /** Request a scoped credential for `provider` on behalf of `agentDid`. */\n requestCredential(params: {\n agentDid: Did;\n provider: string;\n scopes?: readonly string[];\n }): Promise;\n /** Optionally release / revoke a previously issued credential. */\n release?(credentialProxyUrl: string): Promise;\n}", "documentation": "Arsenal broker client facade. The real client lives in `@openagentid/arsenal-sdk`\nand is injected by the application; see `INTEGRATION_NOTES.md`.", "source": "openagent-sdk/sdks/typescript/src/credentials.ts", "line": 50 }, { "name": "CredentialHandle", "signature": "/**\n * A live, fetch-ready credential bound to an agent DID + provider.\n *\n * The fetch method is a drop-in replacement for `globalThis.fetch`. The\n * underlying credential is refreshed lazily when the caller invokes\n * `refresh()` — auto-rotation stays out of the per-request hot path.\n */\nexport interface CredentialHandle {\n readonly provider: string;\n readonly agentDid: Did;\n readonly expiresAt: number;\n /**\n * Drop-in replacement for the global `fetch`. The `X-Arsenal-Target`\n * header is set to the original URL and the request is routed through\n * the Arsenal credential proxy.\n *\n * Streaming responses (SSE, chunked JSON, transfer-encoding: chunked)\n * are fully supported because the return value is a standard `Response`.\n */\n fetch: typeof fetch;\n /** Mint a fresh credential and return a new handle. */\n refresh(): Promise;\n /** Release the credential (best-effort; safe to call multiple times). */\n release(): Promise;\n}", "documentation": "A live, fetch-ready credential bound to an agent DID + provider.\n\nThe fetch method is a drop-in replacement for `globalThis.fetch`. The\nunderlying credential is refreshed lazily when the caller invokes\n`refresh()` — auto-rotation stays out of the per-request hot path.", "source": "openagent-sdk/sdks/typescript/src/credentials.ts", "line": 69 }, { "name": "IssuedCredential", "signature": "/** A short-lived credential minted by the Arsenal broker. */\nexport interface IssuedCredential {\n /** Provider identifier this credential targets. */\n provider: string;\n /**\n * Credential material location. Arsenal's broker returns pre-signed proxy\n * URLs rather than raw secrets; raw tokens never leave the broker.\n */\n proxyUrl: string;\n /** Unix timestamp after which the credential is invalid. */\n expiresAt: number;\n /** Optional ceiling on how many requests this credential can issue. */\n remainingCalls?: number;\n /** Arbitrary metadata (tenant, project, region). */\n metadata?: Record;\n}", "documentation": "A short-lived credential minted by the Arsenal broker.", "source": "openagent-sdk/sdks/typescript/src/credentials.ts", "line": 30 }, { "name": "createCredentialHandle", "signature": "export declare const createCredentialHandle: (params: CreateCredentialHandleParams) => Promise;", "documentation": "Create a {@link CredentialHandle} backed by an Arsenal client.", "source": "openagent-sdk/sdks/typescript/src/credentials.ts", "line": 102 }, { "name": "AuthContext", "signature": "/** A resolved, authenticated caller identity. */\nexport interface AuthContext {\n /** The calling agent's DID. */\n readonly did: Did;\n /** The root HMR/MHR this agent chains to. */\n readonly root: Did;\n /** Delegation chain from `root` → `did`. Ordered, length ≥ 1. */\n readonly lineage: readonly Did[];\n /** OAS + Sigil authority proof required for privileged access. */\n readonly lineageAuthority?: LineageAuthorityContext;\n /** Scopes granted to this caller for this request. */\n readonly scopes: readonly string[];\n /** Unix timestamp when the underlying assertion expires. */\n readonly expiresAt: number;\n /** Raw bearer the caller presented, for audit logging. */\n readonly presentedToken?: string;\n /** Arbitrary claims passed through from AEGIS. */\n readonly claims?: Readonly>;\n}", "documentation": "A resolved, authenticated caller identity.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 42 }, { "name": "LineageAuthorityContext", "signature": "/** Sigil-backed lineage authority attached by an OAS verifier. */\nexport interface LineageAuthorityContext {\n /** DID whose privileged authority was verified. */\n readonly subject: Did;\n /** Backend/source identifier, normally `sigil_gal`. */\n readonly source: string;\n /** Finalized root DID for the verified path. */\n readonly root: Did;\n /** Reconstructed finalized path, ordered root to caller. */\n readonly path: readonly Did[];\n /** Sigil block height at which this authority was finalized. */\n readonly finalizedBlock: number;\n /** Authority path kind, e.g. `human_to_agent`. */\n readonly pathKind: string;\n /** Scopes proven by this lineage path. */\n readonly scopes: readonly string[];\n /** Generation/depth from root to subject. */\n readonly generation: number;\n /** Accepted root kind for this authority path. */\n readonly rootKind?: string;\n /** Optional org lineage root commitment for org-scoped authority. */\n readonly orgRootCommitment?: string;\n /** Optional expiry timestamp for the authority edge/path. */\n readonly expiresAt?: string;\n}", "documentation": "Sigil-backed lineage authority attached by an OAS verifier.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 16 }, { "name": "PrivilegedAuthorityVerifier", "signature": "/** Runtime hook that turns an authenticated context into OAS/Sigil authority. */\nexport interface PrivilegedAuthorityVerifier {\n verify(ctx: AuthContext, options: VerifyRequestOptions): Promise;\n}", "documentation": "Runtime hook that turns an authenticated context into OAS/Sigil authority.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 96 }, { "name": "VerificationClient", "signature": "/**\n * AEGIS verifier facade. Concrete implementation lives in `@openagentid/aegis-sdk`.\n *\n * The OpenAgent SDK never decodes assertions itself — it delegates to\n * AEGIS for all verification, lineage walking, and policy evaluation.\n */\nexport interface VerificationClient {\n verifyRequest(req: Request, options?: VerifyRequestOptions): Promise;\n /** Issue a short-lived challenge for challenge-response auth. */\n issueChallenge(): Promise<{\n challenge: Uint8Array;\n challengeId: string;\n }>;\n /** Verify a challenge response (typically from a worker/CLI flow). */\n verifyChallengeResponse(params: {\n challengeId: string;\n agentDid: Did;\n signatureBase64: string;\n }): Promise;\n}", "documentation": "AEGIS verifier facade. Concrete implementation lives in `@openagentid/aegis-sdk`.\n\nThe OpenAgent SDK never decodes assertions itself — it delegates to\nAEGIS for all verification, lineage walking, and policy evaluation.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 81 }, { "name": "VerifyRequestOptions", "signature": "/** Options for {@link VerificationClient.verifyRequest}. */\nexport interface VerifyRequestOptions {\n /** Require the caller to hold all of these scopes; otherwise throw. */\n requiredScopes?: readonly string[];\n /** Require the caller's lineage to include (or equal) this DID. */\n requiredAncestor?: Did;\n /** Require a Sigil-backed OAS lineage authority result. */\n requirePrivilegedAuthority?: boolean;\n /** Required authority path kind when privileged authority is required. */\n requiredAuthorityPath?: string;\n /** Extra clock skew tolerance (seconds). Default: 60. */\n clockSkewSeconds?: number;\n}", "documentation": "Options for {@link VerificationClient.verifyRequest}.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 62 }, { "name": "PrivilegedAuthorityVerificationClient", "signature": "export declare class PrivilegedAuthorityVerificationClient {\n constructor(inner: VerificationClient, authorityVerifier: PrivilegedAuthorityVerifier): PrivilegedAuthorityVerificationClient;\n verifyRequest(req: Request, options?: VerifyRequestOptions): Promise;\n issueChallenge(): Promise<{ challenge: Uint8Array; challengeId: string; }>;\n verifyChallengeResponse(params: { challengeId: string; agentDid: Did; signatureBase64: string; }): Promise;\n}", "documentation": "Wraps any verifier and requires OAS/Sigil authority for privileged requests.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 168 }, { "name": "extractBearerToken", "signature": "export declare const extractBearerToken: (req: Request) => string | null;", "documentation": "Extract the bearer token from a `Request` without trusting it.\n\nChecks, in order: `Authorization: OpenAgent ...`,\n`Authorization: Bearer ...`, `X-OpenAgent-Token`, and an `oa_token`\nquery parameter. Returns `null` if absent.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 107 }, { "name": "assertScopes", "signature": "export declare const assertScopes: (ctx: AuthContext, required: readonly string[]) => void;", "documentation": "Assert that `ctx` holds every scope in `required`.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 126 }, { "name": "assertAncestor", "signature": "export declare const assertAncestor: (ctx: AuthContext, ancestor: Did) => void;", "documentation": "Assert that `ctx.lineage` contains `ancestor`.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 138 }, { "name": "toVerificationClient", "signature": "export declare const toVerificationClient: (client: unknown) => VerificationClient;", "documentation": "Narrow any unknown value into a {@link VerificationClient}, or throw.\nDuck-typed for forward compatibility with `@openagentid/aegis-sdk`.", "source": "openagent-sdk/sdks/typescript/src/verification.ts", "line": 151 }, { "name": "SkillId", "signature": "/** A skill identifier such as `frontend-design` or `sql-query`. */\nexport type SkillId = string;", "documentation": "A skill identifier such as `frontend-design` or `sql-query`.", "source": "openagent-sdk/sdks/typescript/src/skills.ts", "line": 17 }, { "name": "SkillsPolicy", "signature": "/** The minimum contract the OpenAgent SDK expects from a skills policy. */\nexport interface SkillsPolicy {\n /** Return true if the agent may invoke `skill`. */\n canInvoke(skill: SkillId): boolean;\n /** Throw a {@link SkillDeniedError} if `skill` is not allowed. */\n assertCanInvoke(skill: SkillId): void;\n /** List all skills the agent is currently permitted to invoke. */\n listAllowed(): readonly SkillId[];\n /** Produce a new policy with an additional skill. */\n grant(skill: SkillId): SkillsPolicy;\n /** Produce a new policy without `skill`. */\n revoke(skill: SkillId): SkillsPolicy;\n}", "documentation": "The minimum contract the OpenAgent SDK expects from a skills policy.", "source": "openagent-sdk/sdks/typescript/src/skills.ts", "line": 20 }, { "name": "InMemorySkillsPolicy", "signature": "export declare class InMemorySkillsPolicy {\n constructor(skills?: readonly SkillId[]): InMemorySkillsPolicy;\n canInvoke(skill: SkillId): boolean;\n assertCanInvoke(skill: SkillId): void;\n listAllowed(): readonly SkillId[];\n grant(skill: SkillId): SkillsPolicy;\n revoke(skill: SkillId): SkillsPolicy;\n}", "documentation": "In-memory, immutable skills policy. Every mutation returns a new instance.\n\nSupports two match modes:\n - Exact: `frontend-design` matches only `frontend-design`\n - Wildcard suffix: `frontend-*` matches `frontend-design`, `frontend-test`, ...", "source": "openagent-sdk/sdks/typescript/src/skills.ts", "line": 44 }, { "name": "denyAllSkills", "signature": "export declare const denyAllSkills: SkillsPolicy;", "documentation": "Empty policy that denies everything.", "source": "openagent-sdk/sdks/typescript/src/skills.ts", "line": 87 }, { "name": "allowAllSkills", "signature": "export declare const allowAllSkills: SkillsPolicy;", "documentation": "Policy that allows any skill (dangerous — use only in tests).", "source": "openagent-sdk/sdks/typescript/src/skills.ts", "line": 90 }, { "name": "act", "signature": "export declare const act: { readonly verify: (token: Uint8Array) => ActVerifierBuilder; readonly setCryptoBinding: (binding: ActVerifyBinding) => void; };", "documentation": "The ACT namespace.", "source": "openagent-sdk/sdks/typescript/src/act.ts", "line": 215 }, { "name": "ActVerifierBuilder", "signature": "export declare class ActVerifierBuilder {\n constructor(token: Uint8Array): ActVerifierBuilder;\n issuer(iss: string): this;\n forAudience(audience: string): this;\n requireScope(scope: string): this;\n requireScopes(scopes: string[]): this;\n trustedKeys(keys: Uint8Array[]): this;\n withLeeway(seconds: number): this;\n atTime(unixSeconds: number): this;\n run(): Promise;\n}", "documentation": "Fluent ACT verifier, built by {@link act.verify}.", "source": "openagent-sdk/sdks/typescript/src/act.ts", "line": 108 }, { "name": "setActCryptoBinding", "signature": "export declare const setActCryptoBinding: (binding: ActVerifyBinding) => void;", "documentation": "Inject the crypto-wasm binding. Called by consumers at startup (and by\ntests with a mock). The binding is the `@openagentid/crypto-wasm` module's\nnodejs or bundler build, already instantiated.", "source": "openagent-sdk/sdks/typescript/src/act.ts", "line": 92 }, { "name": "ActClaims", "signature": "/** The claims of a verified ACT, as returned by the canonical verifier. */\nexport interface ActClaims {\n /** Token identifier. */\n jti: string;\n /** Subject: the OAS DID of the agent the token was issued to. */\n sub: string;\n /** Issuer: the broker instance that minted the token. */\n iss: string;\n /** Audiences this token is valid for. */\n aud: string[];\n /** Issued-at, seconds since the Unix epoch. */\n iat: number;\n /** Not-before, seconds since the Unix epoch. */\n nbf: number;\n /** Expiry, seconds since the Unix epoch. */\n exp: number;\n /** Tenant this token is scoped to. */\n tenant_id: string;\n /** Granted scopes (`service:resource:action`). */\n scope: string[];\n /** Proof-of-possession binding, when present. */\n cnf?: {\n key_fingerprint: string;\n alg: string;\n };\n /** Onward delegation constraints, when present. */\n delegation?: {\n allow_delegation: boolean;\n max_depth: number;\n };\n /** Issuer-defined extension claims (opaque to the format). */\n ext?: Record;\n}", "documentation": "The claims of a verified ACT, as returned by the canonical verifier.", "source": "openagent-sdk/sdks/typescript/src/act.ts", "line": 29 }, { "name": "ActVerifyOptions", "signature": "/** Options accepted by the fluent verifier. */\nexport interface ActVerifyOptions {\n /** The trusted issuer string (required — see {@link ActVerifierBuilder.issuer}). */\n issuer?: string;\n /** The audience this verifier answers for (required). */\n audience?: string;\n /** Scopes the token must grant. Wildcards in the grant expand; literal in the request. */\n scopes?: string[];\n /** Raw 32-byte Ed25519 trusted public keys (required). */\n trustedKeys?: Uint8Array[];\n /** Symmetric clock-skew allowance in seconds. Default: 0. */\n leewaySeconds?: number;\n /** Pinned verification time (tests and decision replay). Default: system clock. */\n nowUnixSeconds?: number;\n}", "documentation": "Options accepted by the fluent verifier.", "source": "openagent-sdk/sdks/typescript/src/act.ts", "line": 57 }, { "name": "withAct", "signature": "export declare const withAct: (config: RequireActConfig, handler: (req: Request, claims: ActClaims) => Promise | Response) => (req: Request) => Promise;", "documentation": "Fetch-standard middleware factory.\n\nReturns a handler that takes `(request, claims)`. A request whose token is\nmissing, malformed, forged, expired, wrong-audience, or under-scoped gets\na 401 with the reason — the handler never runs, and unauthenticated claims\nnever reach the application.", "source": "openagent-sdk/sdks/typescript/src/middleware.ts", "line": 88 }, { "name": "requireActExpress", "signature": "export declare const requireActExpress: (config: RequireActConfig) => (req: { headers: Record; actClaims?: ActClaims; }, res: { status: (code: number) => { json: (body: unknown) => unknown; }; }, next: () => void) => Promise;", "documentation": "Express-compatible middleware factory.\n\nOn success, the verified claims land on `req.actClaims`; on failure the\nrequest is rejected with a 401 and never reaches the route.", "source": "openagent-sdk/sdks/typescript/src/middleware.ts", "line": 126 }, { "name": "RequireActConfig", "signature": "/** Policy for the middleware: the verifier bindings plus optional scopes. */\nexport interface RequireActConfig {\n /** The trusted issuer string. */\n issuer: string;\n /** The audience this service answers for. */\n audience: string;\n /** Scopes every request must carry. Default: none. */\n scopes?: string[];\n /** Trusted Ed25519 public keys (raw 32 bytes each). */\n trustedKeys: Uint8Array[];\n /** Clock-skew allowance in seconds. Default: 0. */\n leewaySeconds?: number;\n /**\n * Extract the ACT envelope bytes from the request. Default: base64url of\n * the `Authorization: Bearer ` header value.\n */\n extractToken?: (req: Request) => Uint8Array | undefined;\n /**\n * Render the 401 response. Default: JSON `{ error }` with a\n * `WWW-Authenticate: OpenAgent` hint.\n */\n onUnauthorized?: (req: Request, reason: string) => Response;\n}", "documentation": "Policy for the middleware: the verifier bindings plus optional scopes.", "source": "openagent-sdk/sdks/typescript/src/middleware.ts", "line": 20 }, { "name": "keys", "signature": "export declare const keys: { readonly generate: () => Promise; readonly fromSeed: (seed: Uint8Array) => AgentKeys; readonly fromSeedHex: (hex: string) => AgentKeys; readonly fromEnv: (envVar: string) => AgentKeys; readonly saveSeed: (keys: AgentKeys, path: string) => Promise; readonly fromSeedFile: (path: string) => Promise; readonly seedToHex: (bytes: Uint8Array) => string; readonly setCryptoBinding: (binding: KeyCryptoBinding) => void; };", "documentation": "The key-custody namespace.", "source": "openagent-sdk/sdks/typescript/src/keys.ts", "line": 123 }, { "name": "setKeyCryptoBinding", "signature": "export declare const setKeyCryptoBinding: (binding: KeyCryptoBinding) => void;", "documentation": "Inject the crypto-wasm binding (same one as {@link setActCryptoBinding }).", "source": "openagent-sdk/sdks/typescript/src/keys.ts", "line": 36 }, { "name": "AgentKeys", "signature": "/** An agent's key material, derived from one seed. */\nexport interface AgentKeys {\n /** The 32-byte seed — the only thing that must be persisted. */\n readonly seed: Uint8Array;\n /** Ed25519 signing (private) key. */\n readonly signingKey: Uint8Array;\n /** Ed25519 verifying (public) key — the agent's identity fingerprint. */\n readonly verifyingKey: Uint8Array;\n /** X25519 encryption secret key (derived from the seed). */\n readonly encryptionSecretKey: Uint8Array;\n /** X25519 encryption public key (derived). */\n readonly encryptionPublicKey: Uint8Array;\n}", "documentation": "An agent's key material, derived from one seed.", "source": "openagent-sdk/sdks/typescript/src/keys.ts", "line": 55 }, { "name": "KeyCryptoBinding", "signature": "/** The crypto-wasm binding shape key custody consumes. */\nexport interface KeyCryptoBinding {\n ed25519_generate_keypair(): {\n signing_key: Uint8Array;\n verifying_key: Uint8Array;\n };\n ed25519_public_from_private(signingKey: Uint8Array): Uint8Array;\n x25519_generate_keypair(): {\n secret_key: Uint8Array;\n public_key: Uint8Array;\n };\n x25519_public_from_secret?(secretKey: Uint8Array): Uint8Array;\n blake3_derive_key(context: string, keyMaterial: Uint8Array): Uint8Array;\n}", "documentation": "The crypto-wasm binding shape key custody consumes.", "source": "openagent-sdk/sdks/typescript/src/keys.ts", "line": 25 }, { "name": "OpenAgentError", "signature": "export declare class OpenAgentError {\n code: ErrorCodeValue;\n cause: unknown;\n context: Record;\n constructor(message: string, details: ErrorDetails): OpenAgentError;\n toJSON(): Record;\n}", "documentation": "Root of the OpenAgent SDK error hierarchy.\n\n```ts\ntry {\n await OpenAgent.createAgent({ ... });\n} catch (err) {\n if (err instanceof OpenAgentError) {\n console.error(err.code, err.message);\n }\n}\n```", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 74 }, { "name": "ConfigError", "signature": "export declare class ConfigError {\n constructor(message: string, context?: Record): ConfigError;\n}", "documentation": "Configuration or usage violation (invalid input, missing dependency).", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 101 }, { "name": "InputValidationError", "signature": "export declare class InputValidationError {\n constructor(message: string, cause?: unknown, context?: Record): InputValidationError;\n}", "documentation": "Runtime input validation failure (Zod, boundary checks).", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 110 }, { "name": "IdentityError", "signature": "export declare class IdentityError {\n constructor(message: string, details: ErrorDetails): IdentityError;\n}", "documentation": "OAS identity subsystem failure.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 119 }, { "name": "CredentialError", "signature": "export declare class CredentialError {\n constructor(message: string, details: ErrorDetails): CredentialError;\n}", "documentation": "Arsenal credentials subsystem failure.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 128 }, { "name": "VerificationError", "signature": "export declare class VerificationError {\n constructor(message: string, details: ErrorDetails): VerificationError;\n}", "documentation": "AEGIS verification subsystem failure.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 137 }, { "name": "SkillDeniedError", "signature": "export declare class SkillDeniedError {\n skill: string;\n constructor(skill: string, reason?: string, context?: Record): SkillDeniedError;\n}", "documentation": "Skills policy denial.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 146 }, { "name": "ErrorCode", "signature": "export declare const ErrorCode: { readonly INVALID_CONFIG: \"openagent/invalid-config\"; readonly INVALID_INPUT: \"openagent/invalid-input\"; readonly NOT_INITIALIZED: \"openagent/not-initialized\"; readonly IDENTITY_CREATE_FAILED: \"openagent/identity/create-failed\"; readonly IDENTITY_RESOLVE_FAILED: \"openagent/identity/resolve-failed\"; readonly IDENTITY_SIGNATURE_INVALID: \"openagent/identity/signature-invalid\"; readonly IDENTITY_LINEAGE_INVALID: \"openagent/identity/lineage-invalid\"; readonly CREDENTIAL_FETCH_FAILED: \"openagent/credentials/fetch-failed\"; readonly CREDENTIAL_SCOPE_DENIED: \"openagent/credentials/scope-denied\"; readonly CREDENTIAL_PROVIDER_UNKNOWN: \"openagent/credentials/provider-unknown\"; readonly CREDENTIAL_EXPIRED: \"openagent/credentials/expired\"; readonly VERIFICATION_FAILED: \"openagent/verification/failed\"; readonly AUTH_REQUIRED: \"openagent/verification/auth-required\"; readonly AUTH_CHALLENGE_INVALID: \"openagent/verification/challenge-invalid\"; readonly SKILL_DENIED: \"openagent/skills/denied\"; readonly SKILL_UNKNOWN: \"openagent/skills/unknown\"; readonly NETWORK_ERROR: \"openagent/network-error\"; readonly SERIALIZATION_ERROR: \"openagent/serialization-error\"; readonly UNKNOWN: \"openagent/unknown\"; };", "documentation": "Stable machine-readable error codes. These are part of the SDK's public\ncontract and MUST stay in sync with the Rust reference implementation.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 16 }, { "name": "ErrorCodeValue", "signature": "export type ErrorCodeValue = (typeof ErrorCode)[keyof typeof ErrorCode];", "documentation": "", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 49 }, { "name": "ErrorDetails", "signature": "/** Structured error metadata attached to every {@link OpenAgentError}. */\nexport interface ErrorDetails {\n /** Stable machine-readable code. */\n code: ErrorCodeValue;\n /** Optional cause (native Error, SDK error, or anything). */\n cause?: unknown;\n /** Arbitrary structured context for logging. */\n context?: Record;\n}", "documentation": "Structured error metadata attached to every {@link OpenAgentError}.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 52 }, { "name": "wrapError", "signature": "export declare const wrapError: (err: unknown, fallbackMessage: string) => OpenAgentError;", "documentation": "Wraps any non-OpenAgentError into the SDK hierarchy without losing the cause.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 161 }, { "name": "getErrorMessage", "signature": "export declare const getErrorMessage: (err: unknown) => string;", "documentation": "Narrow an unknown caught value to a human-readable message.", "source": "openagent-sdk/sdks/typescript/src/errors.ts", "line": 168 }, { "name": "VERSION", "signature": "export declare const VERSION: \"0.1.1\";", "documentation": "SDK version — kept in sync with `package.json`.", "source": "openagent-sdk/sdks/typescript/src/index.ts", "line": 127 } ] }, { "package": "@openagentid/client", "url": "/reference/typescript/openagents-openagent-id-clients-typescript", "exports": [ { "name": "OpenAgentClient", "signature": "export declare class OpenAgentClient {\n constructor(keyPair: KeyPair, options?: OpenAgentClientOptions): OpenAgentClient;\n getKeyPair(): KeyPair;\n getCachedSession(origin: string): string | undefined;\n clearSession(): void;\n fetch(url: string, options?: FetchOptions): Promise;\n logout(): void;\n}", "documentation": "Client for the OpenAgent Core challenge-response protocol.\n\nThe client owns an Ed25519 {@link KeyPair} and a per-origin session cache.\nOn each {@link OpenAgentClient.fetch} call:\n\n 1. If a non-expired cached session token exists for the request origin,\n it is sent as `Authorization: Bearer `. If that returns 401,\n the cache is cleared and the client falls through to a challenge.\n\n 2. Otherwise the client sends the request unauthenticated. If the\n server replies 401 with a `WWW-Authenticate: OpenAgent` header,\n the client decodes the challenge, freshness-checks the timestamp\n and origin, JCS-canonicalizes it (RFC 8785), signs the canonical\n bytes with Ed25519, and re-sends the request with the proof in the\n `Authorization` header.\n\n 3. The new session token from `X-OpenAgent-Session` is cached for\n subsequent calls.", "source": "openagents/openagent.id/clients/typescript/src/client.ts", "line": 72 }, { "name": "OpenAgentClientOptions", "signature": "/**\n * Optional configuration for the {@link OpenAgentClient}.\n */\nexport interface OpenAgentClientOptions {\n /**\n * Custom `fetch` implementation. Defaults to `globalThis.fetch`.\n * Useful for tests, polyfills, or wiring through a proxy.\n */\n fetch?: typeof fetch;\n /**\n * Optional clock used for session expiry checks. Defaults to\n * `() => new Date()`. Allows tests to inject a fake clock.\n */\n now?: () => Date;\n /**\n * Maximum acceptable age of a server-issued challenge before we refuse\n * to sign it. Defaults to 60 seconds (matches the server's default\n * 30-second nonce TTL with margin).\n */\n maxChallengeAgeMs?: number;\n}", "documentation": "Optional configuration for the {@link OpenAgentClient}.", "source": "openagents/openagent.id/clients/typescript/src/client.ts", "line": 33 }, { "name": "KeyPair", "signature": "export declare class KeyPair {\n fromSecretBytes(secretKey: Uint8Array): KeyPair;\n fromSecretBase64Url(secretBase64Url: string): KeyPair;\n generate(): KeyPair;\n publicKeyBytes(): Uint8Array;\n publicKeyBase64Url(): string;\n toDidKey(): string;\n sign(message: Uint8Array): Uint8Array;\n exportSecretBytes(): Uint8Array;\n exportSecretBase64Url(): string;\n}", "documentation": "An Ed25519 signing key. Holds 32 raw secret bytes plus the lazily-derived\npublic key.\n\nInstances are immutable. Callers SHOULD NOT log or serialize the secret\nkey — use {@link KeyPair.publicKeyBytes} for the safe public half.", "source": "openagents/openagent.id/clients/typescript/src/keypair.ts", "line": 31 }, { "name": "encodeDidKey", "signature": "export declare const encodeDidKey: (publicKey: Uint8Array) => string;", "documentation": "Encodes an Ed25519 public key as a `did:key` URI per the W3C\n`did:key` method specification.\n\nMulticodec prefix for Ed25519 public keys: 0xed 0x01 (varint of 0xed).\nMultibase prefix: `z` for base58btc.", "source": "openagents/openagent.id/clients/typescript/src/keypair.ts", "line": 161 }, { "name": "CHALLENGE_TYPE", "signature": "export declare const CHALLENGE_TYPE: \"openagent-challenge-v1\";", "documentation": "", "source": "openagents/openagent.id/clients/typescript/src/challenge.ts", "line": 10 }, { "name": "parseWwwAuthenticate", "signature": "export declare const parseWwwAuthenticate: (headerValue: string) => Challenge;", "documentation": "Parses an OpenAgent challenge from a `WWW-Authenticate` header value.", "source": "openagents/openagent.id/clients/typescript/src/challenge.ts", "line": 42 }, { "name": "validateChallenge", "signature": "export declare const validateChallenge: (value: unknown) => Challenge;", "documentation": "Validates a parsed JSON object against the {@link Challenge} schema and\nreturns it as a typed value.", "source": "openagents/openagent.id/clients/typescript/src/challenge.ts", "line": 92 }, { "name": "canonicalizeChallenge", "signature": "export declare const canonicalizeChallenge: (challenge: Challenge) => Uint8Array;", "documentation": "JCS-canonicalizes a challenge per RFC 8785 and returns the UTF-8 bytes.\n\nThe result MUST byte-equal what the openagent-server produces from\n`serde_jcs::to_string` over the same logical object.", "source": "openagents/openagent.id/clients/typescript/src/challenge.ts", "line": 148 }, { "name": "isChallengeFresh", "signature": "export declare const isChallengeFresh: (challenge: Challenge, options?: { now?: Date; maxAgeMs?: number; }) => boolean;", "documentation": "Optional sanity check on the challenge timestamp.\n\nReturns `true` if the timestamp parses as a date and is within\n`maxAgeMs` of `now`. Implementations SHOULD reject stale challenges\nbefore signing them (per spec §3.3 step 3).", "source": "openagents/openagent.id/clients/typescript/src/challenge.ts", "line": 177 }, { "name": "Challenge", "signature": "/**\n * A challenge issued by an OpenAgent server, decoded from the\n * `WWW-Authenticate: OpenAgent challenge=\"\"` header.\n *\n * Per OPENAGENT-CORE-SPEC.md §4:\n * - `type` MUST equal `\"openagent-challenge-v1\"`\n * - `nonce` MUST be a 64-character hex string (32 random bytes)\n * - `timestamp` MUST be RFC 3339 / ISO 8601 UTC\n * - `origin` MUST be the server origin in `scheme://host[:port]` form\n * - `realm` is optional\n */\nexport interface Challenge {\n type: string;\n nonce: string;\n timestamp: string;\n origin: string;\n realm?: string;\n}", "documentation": "A challenge issued by an OpenAgent server, decoded from the\n`WWW-Authenticate: OpenAgent challenge=\"\"` header.\n\nPer OPENAGENT-CORE-SPEC.md §4:\n- `type` MUST equal `\"openagent-challenge-v1\"`\n- `nonce` MUST be a 64-character hex string (32 random bytes)\n- `timestamp` MUST be RFC 3339 / ISO 8601 UTC\n- `origin` MUST be the server origin in `scheme://host[:port]` form\n- `realm` is optional", "source": "openagents/openagent.id/clients/typescript/src/challenge.ts", "line": 23 }, { "name": "OpenAgentClientError", "signature": "export declare class OpenAgentClientError {\n code: string;\n constructor(code: string, message: string, options?: ErrorOptions): OpenAgentClientError;\n}", "documentation": "Base class for all OpenAgent client errors.\n\nAll thrown errors from `OpenAgentClient` are instances of this class —\ncallers may rely on `instanceof OpenAgentClientError` for control flow.", "source": "openagents/openagent.id/clients/typescript/src/errors.ts", "line": 11 }, { "name": "InvalidUrlError", "signature": "export declare class InvalidUrlError {\n constructor(url: string): InvalidUrlError;\n}", "documentation": "The URL passed to {@link OpenAgentClient.fetch } could not be parsed.", "source": "openagents/openagent.id/clients/typescript/src/errors.ts", "line": 24 }, { "name": "NoChallengeHeaderError", "signature": "export declare class NoChallengeHeaderError {\n constructor(): NoChallengeHeaderError;\n}", "documentation": "The server returned 401 but no `WWW-Authenticate` header was present.\n\nThis indicates a server bug or a non-OpenAgent server returning 401.", "source": "openagents/openagent.id/clients/typescript/src/errors.ts", "line": 36 }, { "name": "MalformedChallengeError", "signature": "export declare class MalformedChallengeError {\n constructor(reason: string): MalformedChallengeError;\n}", "documentation": "The `WWW-Authenticate` header was present but could not be parsed as\nan OpenAgent challenge.", "source": "openagents/openagent.id/clients/typescript/src/errors.ts", "line": 50 }, { "name": "NetworkError", "signature": "export declare class NetworkError {\n constructor(cause: unknown): NetworkError;\n}", "documentation": "Network error during the underlying `fetch` call. The original error is\nexposed as `cause` for inspection.", "source": "openagents/openagent.id/clients/typescript/src/errors.ts", "line": 61 }, { "name": "InvalidKeyError", "signature": "export declare class InvalidKeyError {\n constructor(reason: string): InvalidKeyError;\n}", "documentation": "The signing key is invalid (must be 32 raw bytes for Ed25519).", "source": "openagents/openagent.id/clients/typescript/src/errors.ts", "line": 73 }, { "name": "bodyAsString", "signature": "export declare const bodyAsString: (response: AuthenticatedResponse) => string;", "documentation": "Helper: parses the response body as a UTF-8 string.", "source": "openagents/openagent.id/clients/typescript/src/types.ts", "line": 71 }, { "name": "bodyAsJson", "signature": "export declare const bodyAsJson: (response: AuthenticatedResponse) => T;", "documentation": "Helper: parses the response body as JSON. Throws on parse failure.", "source": "openagents/openagent.id/clients/typescript/src/types.ts", "line": 78 }, { "name": "AuthenticatedResponse", "signature": "// Public types returned by the OpenAgent client API.\n/**\n * Result of an authenticated request through {@link OpenAgentClient.fetch}.\n *\n * Mirrors `AuthenticatedResponse` in the Rust client. Includes both the\n * raw HTTP response (`status`, `headers`, `bodyBytes`) and the OpenAgent\n * principal headers (`did`, `trustTier`, `sessionToken`) extracted from\n * the server's response.\n */\nexport interface AuthenticatedResponse {\n /** HTTP status code. */\n status: number;\n /** All response headers. */\n headers: Headers;\n /** Raw response body bytes. */\n bodyBytes: Uint8Array;\n /**\n * The agent's resolved DID, if the server returned `X-OpenAgent-DID`.\n * Always present after a successful challenge-response round.\n */\n did?: string;\n /**\n * Numeric trust tier (0-4), if the server returned\n * `X-OpenAgent-Trust-Tier` and it parses as a number.\n */\n trustTier?: number;\n /**\n * Session JWT issued by the server in the `X-OpenAgent-Session` header,\n * if present. The client caches this internally and reuses it on\n * subsequent requests until 401.\n */\n sessionToken?: string;\n /**\n * Session expiration timestamp from `X-OpenAgent-Session-Expires`, if\n * present. ISO 8601.\n */\n sessionExpires?: string;\n /**\n * Legacy lineage response metadata retained only for migration and audit.\n * It cannot satisfy an authorization predicate.\n */\n legacyLineageEvidence?: InformationalLineageEvidence;\n}", "documentation": "Result of an authenticated request through {@link OpenAgentClient.fetch }.\n\nMirrors `AuthenticatedResponse` in the Rust client. Includes both the\nraw HTTP response (`status`, `headers`, `bodyBytes`) and the OpenAgent\nprincipal headers (`did`, `trustTier`, `sessionToken`) extracted from\nthe server's response.", "source": "openagents/openagent.id/clients/typescript/src/types.ts", "line": 11 }, { "name": "FetchOptions", "signature": "/**\n * Options for {@link OpenAgentClient.fetch}.\n */\nexport interface FetchOptions {\n /** HTTP method. Defaults to `\"GET\"`, or `\"POST\"` if a body is given. */\n method?: string;\n /**\n * Request body. Strings are sent as `text/plain`, objects are\n * JSON-encoded with `application/json`, Uint8Array goes through as-is.\n */\n body?: string | Uint8Array | Record;\n /** Extra headers to include on the request. */\n headers?: Record;\n /**\n * If true, do NOT consume the cached session token even if one exists\n * for this origin. Forces a fresh challenge-response round.\n *\n * Use sparingly — only for debugging or after a logout.\n */\n forceChallenge?: boolean;\n /**\n * Optional `AbortSignal` for cancellation, propagated to the underlying\n * fetch calls.\n */\n signal?: AbortSignal;\n}", "documentation": "Options for {@link OpenAgentClient.fetch }.", "source": "openagents/openagent.id/clients/typescript/src/types.ts", "line": 86 }, { "name": "InformationalLineageEvidence", "signature": "/** Explicitly informational wrapper for a legacy response header. */\nexport interface InformationalLineageEvidence {\n readonly status: \"informational\";\n readonly profile: \"agent-lineage-proof-2025\";\n readonly evidence: LegacyLineageEvidence;\n}", "documentation": "Explicitly informational wrapper for a legacy response header.", "source": "openagents/openagent.id/clients/typescript/src/types.ts", "line": 62 }, { "name": "LegacyLineageEvidence", "signature": "/** Legacy wire fields. None of these fields confer authority. */\nexport interface LegacyLineageEvidence {\n subject: string;\n root: string;\n path_kind: string;\n source: string;\n path: string[];\n finalized_block: number;\n scopes: string[];\n generation: number;\n root_kind?: string;\n org_root_commitment?: string;\n expires_at?: string;\n}", "documentation": "Legacy wire fields. None of these fields confer authority.", "source": "openagents/openagent.id/clients/typescript/src/types.ts", "line": 47 }, { "name": "base64url", "signature": "export declare const base64url: typeof import(\"openagents/openagent.id/clients/typescript/src/base64url\");", "documentation": "", "source": "openagents/openagent.id/clients/typescript/src/base64url.ts", "line": 6 }, { "name": "hex", "signature": "export declare const hex: typeof import(\"openagents/openagent.id/clients/typescript/src/hex\");", "documentation": "", "source": "openagents/openagent.id/clients/typescript/src/hex.ts", "line": 3 } ] } ] }