@openagentid/aegis-sdk/keys

All packages · Runnable examples · Start an agent

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Exports

• derivationPath
• deriveLineageKey
• EncryptedKey
• FrostCeremony
• generateShares
• GuardianAuthorization — type
• InMemoryKeyStore
• isRotationEligible
• KeyGenerator
• KeyRotation
• KeyStore — type
• ManagedKey
• parseIso8601DurationMs
• RecoveryCeremony
• RotationRequest — type
• RotationResult — type
• signWithThreshold
• ThresholdKeyPackages — type
• verifyThresholdSignature

derivationPath

Build a BIP-44 derivation path for a given blockchain chain.

Returns the standard m/44'/coin_type'/account'/0/index path used for HD key derivation across most chains.

declare function derivationPath(chain: Chain, account: number, index: number): string;

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:26.

deriveLineageKey

Derive a lineage key from a parent private key using HKDF-SHA256.

Algorithm: HKDF-SHA256( IKM = parent_private_key (32 bytes), Salt = child_did_utf8, Info = "oas-lineage-v1" || generation_be32, L = 32 )

declare function deriveLineageKey(parentPrivate: Uint8Array, childDid: string, generation: number): Uint8Array;

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:19.

EncryptedKey

An encrypted private key blob.

Uses AES-256-GCM with a random 96-bit nonce. The ciphertext contains the 32-byte Ed25519 signing key material plus a 16-byte authentication tag.

declare class EncryptedKey {
    readonly ciphertext: Uint8Array;
    readonly nonce: Uint8Array;
    static encrypt(signingKeyBytes: Uint8Array, encryptionKey: Uint8Array): EncryptedKey;
    decrypt(encryptionKey: Uint8Array): Uint8Array;
    static fromParts(ciphertext: Uint8Array, nonce: Uint8Array): EncryptedKey;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/storage-BI8577zJ.d.ts:9.

FrostCeremony

State of a distributed FROST signing ceremony, suitable for orchestrating the protocol across multiple machines/processes. Each participant calls the methods in order:

1. addCommitment(id, commitments) — gather round 1 outputs
2. buildSigningPackage(message) — build signing package once all participants have committed
3. addSignatureShare(id, share) — gather round 2 outputs
4. aggregate() — produce the final aggregated signature

The ceremony does NOT hold any participant key material — those remain on the participant's own machine.

declare class FrostCeremony {
    constructor(publicKeyPackage: Uint8Array, threshold: number);
    addCommitment(id: number, commitments: Uint8Array): void;
    hasEnoughCommitments(): boolean;
    buildSigningPackage(message: Uint8Array): Uint8Array;
    addSignatureShare(id: number, share: Uint8Array): void;
    hasEnoughShares(): boolean;
    aggregate(): Uint8Array;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:123.

generateShares

Generate threshold key shares using FROST trusted dealer.

Creates a t-of-n setup: any minSigners of maxSigners participants may cooperate to produce a valid signature. The dealer is trusted to destroy its copy of the master secret after distribution.

declare function generateShares(minSigners: number, maxSigners: number): ThresholdKeyPackages;

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:92.

GuardianAuthorization

Type-only declaration; it is not a runtime value.

interface GuardianAuthorization {
    guardian: Guardian;
    authorizedAt: string;
    signature: string;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:51.

InMemoryKeyStore

declare class InMemoryKeyStore implements KeyStore {
    size(): number;
    isEmpty(): boolean;
    store(key: ManagedKey): Promise<void>;
    load(keyId: string): Promise<ManagedKey>;
    delete(keyId: string): Promise<void>;
    list(role: KeyRole | null, pagination?: Pagination): Promise<string[]>;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/storage-BI8577zJ.d.ts:63.

isRotationEligible

Convenience function: returns true if the role is eligible for standard rotation. Session and Recovery keys are excluded.

declare function isRotationEligible(role: KeyRole): boolean;

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:49.

KeyGenerator

Key generator supporting multiple generation modes (§6.2).

Currently implements direct generation via the WASM backend's CSPRNG. MPC, TEE, and HSM modes are stubs that throw an unsupported error.

declare class KeyGenerator {
    static generateDirect(role: KeyRole, encryptionKey: Uint8Array): ManagedKey;
    static generateKeyId(): string;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/storage-BI8577zJ.d.ts:51.

KeyRotation

declare class KeyRotation {
    static initiate(old: ManagedKey, encryptionKey: Uint8Array): RotationResult;
    static initiateWithGrace(old: ManagedKey, encryptionKey: Uint8Array, gracePeriodMs: number): RotationResult;
    static isGracePeriodExpired(result: RotationResult): boolean;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:39.

KeyStore

Type-only declaration; it is not a runtime value.

interface KeyStore {
    store(key: ManagedKey): Promise<void>;
    load(keyId: string): Promise<ManagedKey>;
    delete(keyId: string): Promise<void>;
    list(role: KeyRole | null, pagination?: Pagination): Promise<string[]>;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/storage-BI8577zJ.d.ts:57.

ManagedKey

A managed key with metadata. The private key is stored encrypted; access to the raw signing key requires presenting the encryption key.

declare class ManagedKey {
    readonly keyId: string;
    readonly role: KeyRole;
    readonly generationMode: KeyGenerationMode;
    readonly publicKey: Uint8Array;
    readonly encryptedPrivate: EncryptedKey;
    readonly createdAt: string;
    constructor(params: {
        keyId: string;
        role: KeyRole;
        generationMode: KeyGenerationMode;
        publicKey: Uint8Array;
        encryptedPrivate: EncryptedKey;
        createdAt: string;
    });
    publicKeyMultibase(): string;
    decryptPrivate(encryptionKey: Uint8Array): Uint8Array;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/storage-BI8577zJ.d.ts:24.

parseIso8601DurationMs

Parse a simplified ISO 8601 duration into milliseconds.

Supports PT{n}S, PT{n}M, PT{n}H, and P{n}D. Falls back to 24 hours for unrecognized formats.

declare function parseIso8601DurationMs(input: string): number;

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:76.

RecoveryCeremony

declare class RecoveryCeremony {
    readonly ceremonyId: string;
    readonly config: RecoveryConfig;
    readonly authorizations: GuardianAuthorization[];
    readonly initiatedAt: string;
    readonly timelockUntil: string;
    constructor(config: RecoveryConfig);
    addAuthorization(auth: GuardianAuthorization): void;
    isThresholdMet(): boolean;
    isTimelockExpired(): boolean;
    canExecute(): boolean;
    accumulatedWeight(): number;
    authorizationCount(): number;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:56.

RotationRequest

Type-only declaration; it is not a runtime value.

interface RotationRequest {
    keyId: string;
    gracePeriodMs: number;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:28.

RotationResult

Type-only declaration; it is not a runtime value.

interface RotationResult {
    oldKeyId: string;
    newKey: ManagedKey;
    gracePeriodEnds: string;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:33.

signWithThreshold

Run a complete FROST signing round in a single process.

In production, each participant would perform round1 and round2 independently. This helper executes the full 2-round protocol locally for testing, validation, and single-process orchestration scenarios.

declare function signWithThreshold(message: Uint8Array, keyPackages: Map<number, Uint8Array>, publicKeyPackage: Uint8Array): Uint8Array;

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:106.

ThresholdKeyPackages

Result of FROST trusted-dealer key generation.

Type-only declaration; it is not a runtime value.

interface ThresholdKeyPackages {
    keyPackages: Map<number, Uint8Array>;
    publicKeyPackage: Uint8Array;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:79.

verifyThresholdSignature

Verify an aggregated FROST signature against the group public key.

declare function verifyThresholdSignature(message: Uint8Array, signature: Uint8Array, publicKeyPackage: Uint8Array): boolean;

Source: @openagentid/aegis-sdk@0.1.1, dist/keys/index.d.ts:108.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

Chain

Type-only declaration; it is not a runtime value.

type Chain = "ethereum" | "polygon" | "arbitrum" | "optimism" | "base" | "solana" | "bitcoin" | "cosmos" | "osmosis" | "aptos" | "sui" | "starknet";

Source: @openagentid/aegis-sdk@0.1.1, dist/types-Ck8QCcs2.d.ts:177.

Guardian

Type-only declaration; it is not a runtime value.

interface Guardian {
    guardianType: GuardianType;
    identifier: string;
    weight: number;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/types-Ck8QCcs2.d.ts:192.

GuardianType

Type-only declaration; it is not a runtime value.

type GuardianType = "identity" | "email" | "phone" | "hardware";

Source: @openagentid/aegis-sdk@0.1.1, dist/types-Ck8QCcs2.d.ts:191.

KeyGenerationMode

Type-only declaration; it is not a runtime value.

type KeyGenerationMode = "direct" | "mpc" | "tee" | "hsm";

Source: @openagentid/aegis-sdk@0.1.1, dist/types-Ck8QCcs2.d.ts:186.

KeyRole

Type-only declaration; it is not a runtime value.

type KeyRole = "identity" | "authentication" | "assertion" | "delegation" | "session" | "recovery" | "chain";

Source: @openagentid/aegis-sdk@0.1.1, dist/types-Ck8QCcs2.d.ts:185.

Pagination

Type-only declaration; it is not a runtime value.

interface Pagination {
    limit: number;
    offset: number;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/types-Ck8QCcs2.d.ts:204.

RecoveryConfig

Type-only declaration; it is not a runtime value.

interface RecoveryConfig {
    guardians: Guardian[];
    threshold: number;
    timelock: string;
}

Source: @openagentid/aegis-sdk@0.1.1, dist/types-Ck8QCcs2.d.ts:197.

Package requirements

Dependencies

Archive verification

Pinned integrity:

sha512-eKG79P17teM8i+ZQaNdBEPJnL0XT9723i04kDxgVRrOb0VOnNW5rt2doLq8g4mHBZ4rjHdPEuzZmj5LsL4iuVw==

Machine-readable API manifest · Coverage