OpenAgentIDDocumentation
API referencenpm packages@openagentid/arsenal-sdk
OpenAgentIDAPI reference

@openagentid/arsenal-sdk/broker

API contract shipped by @openagentid/arsenal-sdk 0.1.1. Exact exports, signatures, dependencies and availability.

Use these docs with your agent ↗

All packages · Runnable examples · Start an agent

ContractValue
Package@openagentid/arsenal-sdk@0.1.1
Entry point@openagentid/arsenal-sdk/broker
AvailabilityPublished package
Reference sourcePublished TypeScript declarations
Package enginesnode >=20

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

ConditionPublished file
types./dist/broker/index.d.ts
import./dist/broker/index.js
require./dist/broker/index.cjs

Exports

ApiErrorResponse

Type-only declaration; it is not a runtime value.

Signature
type ApiErrorResponse = z.infer<typeof ApiErrorResponseSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:427.

ApiErrorResponseSchema

Signature
declare const ApiErrorResponseSchema: z.ZodObject<{
    code: z.ZodNumber;
    message: z.ZodString;
    correlation_id: z.ZodOptional<z.ZodString>;
    retry_after: z.ZodOptional<z.ZodNumber>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    code: z.ZodNumber;
    message: z.ZodString;
    correlation_id: z.ZodOptional<z.ZodString>;
    retry_after: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    code: z.ZodNumber;
    message: z.ZodString;
    correlation_id: z.ZodOptional<z.ZodString>;
    retry_after: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:411.

BrokerClient

Broker HTTP client.

All methods throw ArsenalError on failure. Response bodies are validated with Zod schemas at the boundary.

Signature
declare class BrokerClient {
    constructor(opts: BrokerClientOptions);
    health(): Promise<HealthResponse>;
    requestCapability(payload: CapabilityRequestPayload): Promise<CapabilityResponsePayload>;
    requestSecret(payload: SecretRequestPayload): Promise<SecretResponsePayload>;
    revokeToken(tokenId: string, reason?: string): Promise<RevokeTokenResponse>;
    verifyToken(token: string): Promise<VerifyTokenResponse>;
    proxyRequest(req: ProxyRequest, opts?: {
        fingerprintHex?: string;
    }): Promise<ProxyResponse>;
    approveConsent(payload: ConsentApprovalPayload): Promise<ConsentRecordPayload>;
    denyConsent(payload: ConsentDenialPayload): Promise<void>;
    revokeConsent(payload: ConsentRevocationPayload): Promise<void>;
    listConsents(agentDid: string): Promise<readonly ConsentRecordPayload[]>;
    static decodeCapabilityToken(response: CapabilityResponsePayload): AgentCapabilityToken;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:453.

BrokerClientOptions

Configuration for the broker client.

Type-only declaration; it is not a runtime value.

Signature
interface BrokerClientOptions {
    baseUrl: string;
    timeoutMs?: number;
    defaultHeaders?: Record<string, string>;
    fetch?: typeof globalThis.fetch;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:437.

CapabilityRequestPayload

Type-only declaration; it is not a runtime value.

Signature
type CapabilityRequestPayload = z.infer<typeof CapabilityRequestPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:65.

CapabilityRequestPayloadSchema

Signature
declare const CapabilityRequestPayloadSchema: z.ZodObject<{
    scopes: z.ZodArray<z.ZodString, "many">;
    ttl_seconds: z.ZodOptional<z.ZodNumber>;
    audience: z.ZodString;
    constraints: z.ZodOptional<z.ZodObject<{
        require_pop: z.ZodBoolean;
        allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        device_id: z.ZodOptional<z.ZodString>;
    }, "strict", z.ZodTypeAny, {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    }, {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    }>>;
    pop_key_fingerprint: z.ZodOptional<z.ZodString>;
}, "strict", z.ZodTypeAny, {
    scopes: string[];
    audience: string;
    ttl_seconds?: number | undefined;
    constraints?: {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    } | undefined;
    pop_key_fingerprint?: string | undefined;
}, {
    scopes: string[];
    audience: string;
    ttl_seconds?: number | undefined;
    constraints?: {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    } | undefined;
    pop_key_fingerprint?: string | undefined;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:26.

CapabilityResponsePayload

Type-only declaration; it is not a runtime value.

Signature
type CapabilityResponsePayload = z.infer<typeof CapabilityResponsePayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:82.

CapabilityResponsePayloadSchema

Signature
declare const CapabilityResponsePayloadSchema: z.ZodObject<{
    token_id: z.ZodString;
    token: z.ZodString;
    expires_at: z.ZodString;
    granted_scopes: z.ZodArray<z.ZodString, "many">;
}, "strict", z.ZodTypeAny, {
    token: string;
    token_id: string;
    expires_at: string;
    granted_scopes: string[];
}, {
    token: string;
    token_id: string;
    expires_at: string;
    granted_scopes: string[];
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:66.

ConsentApprovalPayload

Type-only declaration; it is not a runtime value.

Signature
type ConsentApprovalPayload = z.infer<typeof ConsentApprovalPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:330.

ConsentApprovalPayloadSchema

Signature
declare const ConsentApprovalPayloadSchema: z.ZodObject<{
    agent_did: z.ZodString;
    human_root_did: z.ZodString;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodArray<z.ZodString, "many">;
    scopes: z.ZodArray<z.ZodString, "many">;
    granted_by: z.ZodString;
    expires_in_seconds: z.ZodOptional<z.ZodNumber>;
    signature: z.ZodString;
}, "strict", z.ZodTypeAny, {
    signature: string;
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
    granted_by: string;
    expires_in_seconds?: number | undefined;
}, {
    signature: string;
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
    granted_by: string;
    expires_in_seconds?: number | undefined;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:302.

ConsentDenialPayload

Type-only declaration; it is not a runtime value.

Signature
type ConsentDenialPayload = z.infer<typeof ConsentDenialPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:385.

ConsentDenialPayloadSchema

Signature
declare const ConsentDenialPayloadSchema: z.ZodObject<{
    agent_did: z.ZodString;
    human_root_did: z.ZodString;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodArray<z.ZodString, "many">;
    scopes: z.ZodArray<z.ZodString, "many">;
}, "strict", z.ZodTypeAny, {
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
}, {
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:366.

ConsentRecordPayload

Type-only declaration; it is not a runtime value.

Signature
type ConsentRecordPayload = z.infer<typeof ConsentRecordPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:365.

ConsentRecordPayloadSchema

Signature
declare const ConsentRecordPayloadSchema: z.ZodObject<{
    consent_id: z.ZodString;
    agent_did: z.ZodString;
    human_root_did: z.ZodOptional<z.ZodString>;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    granted_by: z.ZodOptional<z.ZodString>;
    granted_at: z.ZodString;
    expires_at: z.ZodString;
    revoked: z.ZodOptional<z.ZodBoolean>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    consent_id: z.ZodString;
    agent_did: z.ZodString;
    human_root_did: z.ZodOptional<z.ZodString>;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    granted_by: z.ZodOptional<z.ZodString>;
    granted_at: z.ZodString;
    expires_at: z.ZodString;
    revoked: z.ZodOptional<z.ZodBoolean>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    consent_id: z.ZodString;
    agent_did: z.ZodString;
    human_root_did: z.ZodOptional<z.ZodString>;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    granted_by: z.ZodOptional<z.ZodString>;
    granted_at: z.ZodString;
    expires_at: z.ZodString;
    revoked: z.ZodOptional<z.ZodBoolean>;
}, z.ZodTypeAny, "passthrough">>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:331.

ConsentRevocationPayload

Type-only declaration; it is not a runtime value.

Signature
type ConsentRevocationPayload = z.infer<typeof ConsentRevocationPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:393.

ConsentRevocationPayloadSchema

Signature
declare const ConsentRevocationPayloadSchema: z.ZodObject<{
    consent_id: z.ZodString;
}, "strict", z.ZodTypeAny, {
    consent_id: string;
}, {
    consent_id: string;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:386.

ConstraintsPayload

Type-only declaration; it is not a runtime value.

Signature
type ConstraintsPayload = z.infer<typeof ConstraintsPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:25.

ConstraintsPayloadSchema

Broker wire types with Zod runtime validation.

These schemas must match the JSON payloads accepted and returned by the Rust arsenal-broker HTTP handlers in crates/arsenal-broker/src/handlers.rs.

Signature
declare const ConstraintsPayloadSchema: z.ZodObject<{
    require_pop: z.ZodBoolean;
    allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    device_id: z.ZodOptional<z.ZodString>;
}, "strict", z.ZodTypeAny, {
    require_pop: boolean;
    device_id?: string | undefined;
    allowed_origins?: string[] | undefined;
}, {
    require_pop: boolean;
    device_id?: string | undefined;
    allowed_origins?: string[] | undefined;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:12.

HealthResponse

Type-only declaration; it is not a runtime value.

Signature
type HealthResponse = z.infer<typeof HealthResponseSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:410.

HealthResponseSchema

Signature
declare const HealthResponseSchema: z.ZodObject<{
    status: z.ZodString;
    version: z.ZodString;
    registered_agents: z.ZodOptional<z.ZodNumber>;
    revoked_tokens: z.ZodOptional<z.ZodNumber>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    status: z.ZodString;
    version: z.ZodString;
    registered_agents: z.ZodOptional<z.ZodNumber>;
    revoked_tokens: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    status: z.ZodString;
    version: z.ZodString;
    registered_agents: z.ZodOptional<z.ZodNumber>;
    revoked_tokens: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:394.

ProxyMetadataPayload

Type-only declaration; it is not a runtime value.

Signature
type ProxyMetadataPayload = z.infer<typeof ProxyMetadataPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:221.

ProxyMetadataPayloadSchema

Signature
declare const ProxyMetadataPayloadSchema: z.ZodObject<{
    variables_resolved: z.ZodArray<z.ZodString, "many">;
    destination_verified: z.ZodBoolean;
    fingerprint_verified: z.ZodBoolean;
    consent_status: z.ZodString;
    latency_ms: z.ZodNumber;
    request_id: z.ZodOptional<z.ZodString>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    variables_resolved: z.ZodArray<z.ZodString, "many">;
    destination_verified: z.ZodBoolean;
    fingerprint_verified: z.ZodBoolean;
    consent_status: z.ZodString;
    latency_ms: z.ZodNumber;
    request_id: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    variables_resolved: z.ZodArray<z.ZodString, "many">;
    destination_verified: z.ZodBoolean;
    fingerprint_verified: z.ZodBoolean;
    consent_status: z.ZodString;
    latency_ms: z.ZodNumber;
    request_id: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:199.

ProxyRequestPayload

Type-only declaration; it is not a runtime value.

Signature
type ProxyRequestPayload = z.infer<typeof ProxyRequestPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:198.

ProxyRequestPayloadSchema

Signature
declare const ProxyRequestPayloadSchema: z.ZodObject<{
    method: z.ZodString;
    url: z.ZodString;
    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    body: z.ZodOptional<z.ZodString>;
    capability_token: z.ZodString;
    timeout_ms: z.ZodOptional<z.ZodNumber>;
}, "strict", z.ZodTypeAny, {
    url: string;
    capability_token: string;
    method: string;
    headers?: Record<string, string> | undefined;
    body?: string | undefined;
    timeout_ms?: number | undefined;
}, {
    url: string;
    capability_token: string;
    method: string;
    headers?: Record<string, string> | undefined;
    body?: string | undefined;
    timeout_ms?: number | undefined;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:176.

ProxyResponsePayload

Type-only declaration; it is not a runtime value.

Signature
type ProxyResponsePayload = z.infer<typeof ProxyResponsePayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:301.

ProxyResponsePayloadSchema

Signature
declare const ProxyResponsePayloadSchema: z.ZodObject<{
    status: z.ZodNumber;
    headers: z.ZodRecord<z.ZodString, z.ZodString>;
    body: z.ZodString;
    proxy_metadata: z.ZodObject<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, z.ZodTypeAny, "passthrough">>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    status: z.ZodNumber;
    headers: z.ZodRecord<z.ZodString, z.ZodString>;
    body: z.ZodString;
    proxy_metadata: z.ZodObject<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, z.ZodTypeAny, "passthrough">>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    status: z.ZodNumber;
    headers: z.ZodRecord<z.ZodString, z.ZodString>;
    body: z.ZodString;
    proxy_metadata: z.ZodObject<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
        variables_resolved: z.ZodArray<z.ZodString, "many">;
        destination_verified: z.ZodBoolean;
        fingerprint_verified: z.ZodBoolean;
        consent_status: z.ZodString;
        latency_ms: z.ZodNumber;
        request_id: z.ZodOptional<z.ZodString>;
    }, z.ZodTypeAny, "passthrough">>;
}, z.ZodTypeAny, "passthrough">>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:222.

RevokeTokenPayload

Type-only declaration; it is not a runtime value.

Signature
type RevokeTokenPayload = z.infer<typeof RevokeTokenPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:130.

RevokeTokenPayloadSchema

Signature
declare const RevokeTokenPayloadSchema: z.ZodObject<{
    token_id: z.ZodString;
    reason: z.ZodOptional<z.ZodString>;
}, "strict", z.ZodTypeAny, {
    token_id: string;
    reason?: string | undefined;
}, {
    token_id: string;
    reason?: string | undefined;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:120.

RevokeTokenResponse

Type-only declaration; it is not a runtime value.

Signature
type RevokeTokenResponse = z.infer<typeof RevokeTokenResponseSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:141.

RevokeTokenResponseSchema

Signature
declare const RevokeTokenResponseSchema: z.ZodObject<{
    success: z.ZodBoolean;
    message: z.ZodString;
}, "strict", z.ZodTypeAny, {
    success: boolean;
    message: string;
}, {
    success: boolean;
    message: string;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:131.

SecretRequestPayload

Type-only declaration; it is not a runtime value.

Signature
type SecretRequestPayload = z.infer<typeof SecretRequestPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:96.

SecretRequestPayloadSchema

Signature
declare const SecretRequestPayloadSchema: z.ZodObject<{
    secret_id: z.ZodString;
    version: z.ZodOptional<z.ZodNumber>;
    capability_token: z.ZodString;
}, "strict", z.ZodTypeAny, {
    secret_id: string;
    capability_token: string;
    version?: number | undefined;
}, {
    secret_id: string;
    capability_token: string;
    version?: number | undefined;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:83.

SecretResponsePayload

Type-only declaration; it is not a runtime value.

Signature
type SecretResponsePayload = z.infer<typeof SecretResponsePayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:119.

SecretResponsePayloadSchema

Signature
declare const SecretResponsePayloadSchema: z.ZodObject<{
    secret_id: z.ZodString;
    version: z.ZodNumber;
    wrapped_value: z.ZodString;
    wrap_key_id: z.ZodString;
    ephemeral_public_key: z.ZodString;
    expires_at: z.ZodString;
}, "strict", z.ZodTypeAny, {
    secret_id: string;
    expires_at: string;
    version: number;
    wrapped_value: string;
    wrap_key_id: string;
    ephemeral_public_key: string;
}, {
    secret_id: string;
    expires_at: string;
    version: number;
    wrapped_value: string;
    wrap_key_id: string;
    ephemeral_public_key: string;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:97.

VerifyTokenPayload

Type-only declaration; it is not a runtime value.

Signature
type VerifyTokenPayload = z.infer<typeof VerifyTokenPayloadSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:149.

VerifyTokenPayloadSchema

Signature
declare const VerifyTokenPayloadSchema: z.ZodObject<{
    token: z.ZodString;
}, "strict", z.ZodTypeAny, {
    token: string;
}, {
    token: string;
}>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:142.

VerifyTokenResponse

Type-only declaration; it is not a runtime value.

Signature
type VerifyTokenResponse = z.infer<typeof VerifyTokenResponseSchema>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:175.

VerifyTokenResponseSchema

Signature
declare const VerifyTokenResponseSchema: z.ZodObject<{
    valid: z.ZodBoolean;
    token_id: z.ZodOptional<z.ZodString>;
    subject: z.ZodOptional<z.ZodString>;
    audience: z.ZodOptional<z.ZodString>;
    expires_at: z.ZodOptional<z.ZodString>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    error: z.ZodOptional<z.ZodString>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    valid: z.ZodBoolean;
    token_id: z.ZodOptional<z.ZodString>;
    subject: z.ZodOptional<z.ZodString>;
    audience: z.ZodOptional<z.ZodString>;
    expires_at: z.ZodOptional<z.ZodString>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    error: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    valid: z.ZodBoolean;
    token_id: z.ZodOptional<z.ZodString>;
    subject: z.ZodOptional<z.ZodString>;
    audience: z.ZodOptional<z.ZodString>;
    expires_at: z.ZodOptional<z.ZodString>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    error: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">>;

Source: @openagentid/arsenal-sdk@0.1.1, dist/broker/index.d.ts:150.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

AgentCapabilityToken

Immutable Agent Capability Token. Wraps a set of claims and an optional signature, and provides validation + CBOR (de)serialization.

Signature
declare class AgentCapabilityToken {
    readonly claims: TokenClaims;
    readonly signature: TokenSignature | undefined;
    static fromClaims(claims: TokenClaims): AgentCapabilityToken;
    static fromClaimsAndSignature(claims: TokenClaims, signature: TokenSignature): AgentCapabilityToken;
    get id(): string;
    get subject(): string;
    get audience(): string;
    get scopes(): ScopeSet;
    isExpired(now?: Date): boolean;
    isNotYetValid(now?: Date): boolean;
    isTimeValid(now?: Date): boolean;
    remainingTtlMs(now?: Date): number;
    isSigned(): boolean;
    validateStructure(now?: Date): void;
    toCbor(): Uint8Array;
    claimsToCbor(): Uint8Array;
    toBase64Url(): string;
    static fromCbor(bytes: Uint8Array): AgentCapabilityToken;
    static fromBase64Url(s: string): AgentCapabilityToken;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:75.

BindingType

Constraints that bind ACTs to specific contexts.

Tokens can be restricted to a specific device, session, origin, IP range, time window, or environment. Constraints are evaluated at the broker and at the proxy boundary.

Signature
declare const BindingType: {
    readonly Required: "required";
    readonly Preferred: "preferred";
};

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:8.

BindingTypeValue

Type-only declaration; it is not a runtime value.

Signature
type BindingTypeValue = (typeof BindingType)[keyof typeof BindingType];

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:12.

ConsentStatus

Consent protocol types for human-in-the-loop credential authorization.

Signature
declare const ConsentStatus: {
    readonly PreApproved: "pre_approved";
    readonly Approved: "approved";
    readonly Pending: "pending";
    readonly Denied: "denied";
    readonly Revoked: "revoked";
    readonly NotRequired: "not_required";
};

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:108.

ConsentStatusValue

Type-only declaration; it is not a runtime value.

Signature
type ConsentStatusValue = (typeof ConsentStatus)[keyof typeof ConsentStatus];

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:116.

Constraints

Type-only declaration; it is not a runtime value.

Signature
interface Constraints {
    device_binding?: DeviceBinding;
    session_binding?: SessionBinding;
    origin_binding?: OriginBinding;
    network_constraints?: NetworkConstraints;
    time_constraints?: TimeConstraints;
    environment_constraints?: EnvironmentConstraint;
    require_pop: boolean;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:41.

DeviceBinding

Type-only declaration; it is not a runtime value.

Signature
interface DeviceBinding {
    device_id: string;
    binding_type: BindingTypeValue;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:13.

EnvironmentConstraint

Type-only declaration; it is not a runtime value.

Signature
interface EnvironmentConstraint {
    required_environment?: string;
    required_tags?: ReadonlySet<string>;
    forbidden_tags?: ReadonlySet<string>;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:36.

NetworkConstraints

Type-only declaration; it is not a runtime value.

Signature
interface NetworkConstraints {
    allowed_ips?: ReadonlySet<string>;
    denied_ips?: ReadonlySet<string>;
    allowed_cidrs?: readonly string[];
    allowed_asns?: ReadonlySet<number>;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:24.

OriginBinding

Type-only declaration; it is not a runtime value.

Signature
interface OriginBinding {
    allowed_origins: ReadonlySet<string>;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:21.

ProofOfPossession

Type-only declaration; it is not a runtime value.

Signature
interface ProofOfPossession {
    key_fingerprint: string;
    alg: string;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:23.

ProxyMetadata

Metadata about proxy processing (never includes resolved values).

Type-only declaration; it is not a runtime value.

Signature
interface ProxyMetadata {
    variables_resolved: readonly string[];
    destination_verified: boolean;
    fingerprint_verified: boolean;
    consent_status: ConsentStatusValue;
    latency_ms: number;
    request_id: string;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:251.

ProxyRequest

Proxy request envelope sent to the broker.

Type-only declaration; it is not a runtime value.

Signature
interface ProxyRequest {
    method: string;
    url: string;
    headers?: Readonly<Record<string, string>>;
    body?: Uint8Array;
    capability_token: string;
    timeout_ms?: number;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:229.

ProxyResponse

Response from a proxy request.

Type-only declaration; it is not a runtime value.

Signature
interface ProxyResponse {
    status: number;
    headers: Readonly<Record<string, string>>;
    body: Uint8Array;
    proxy_metadata: ProxyMetadata;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:244.

RateLimits

Rate limits, usage budgets, and runtime tracking primitives.

Type-only declaration; it is not a runtime value.

Signature
interface RateLimits {
    requests_per_second?: number;
    requests_per_minute?: number;
    requests_per_hour?: number;
    max_concurrent?: number;
    max_request_size?: number;
    max_response_size?: number;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:86.

Scope

A single permission scope.

Signature
declare class Scope {
    static parse(scope: string): Scope;
    static wildcard(): Scope;
    static readOnly(service: string): Scope;
    static fullAccess(service: string): Scope;
    get service(): string;
    get resource(): string;
    get action(): string;
    isWildcard(): boolean;
    implies(other: Scope): boolean;
    asString(): string;
    toString(): string;
    toJSON(): string;
    equals(other: Scope): boolean;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:200.

ScopeSet

A set of scopes, maintained as a sorted list for deterministic encoding.

Signature
declare class ScopeSet {
    static empty(): ScopeSet;
    static single(scope: Scope): ScopeSet;
    static fromStrings(scopes: readonly string[]): ScopeSet;
    static fromScopes(scopes: readonly Scope[]): ScopeSet;
    add(scope: Scope): ScopeSet;
    remove(scope: Scope): ScopeSet;
    contains(scope: Scope): boolean;
    allows(requested: Scope): boolean;
    isSupersetOf(other: ScopeSet): boolean;
    intersection(other: ScopeSet): ScopeSet;
    union(other: ScopeSet): ScopeSet;
    get length(): number;
    isEmpty(): boolean;
    toArray(): readonly Scope[];
    toStrings(): readonly string[];
    [Symbol.iterator](): Iterator<Scope>;
    toJSON(): readonly string[];
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:228.

SessionBinding

Type-only declaration; it is not a runtime value.

Signature
interface SessionBinding {
    session_id: string;
    session_key_hash?: Uint8Array;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:17.

SignatureAlgorithm

Agent Capability Token (ACT) — the core credential type.

ACTs are short-lived (30s–24h), scoped, cryptographically-signed tokens that grant an agent specific capabilities. They are encoded as CBOR on the wire for deterministic signing, and base64url-encoded when sent over HTTP.

Signature
declare const SignatureAlgorithm: {
    readonly Ed25519: "ED25519";
    readonly Es256: "ES256";
    readonly Es384: "ES384";
};

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:12.

SignatureAlgorithmValue

Type-only declaration; it is not a runtime value.

Signature
type SignatureAlgorithmValue = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:17.

TimeConstraints

Type-only declaration; it is not a runtime value.

Signature
interface TimeConstraints {
    not_before?: string;
    not_after?: string;
    allowed_hours?: readonly number[];
    allowed_days?: readonly number[];
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:30.

TokenClaims

Type-only declaration; it is not a runtime value.

Signature
interface TokenClaims {
    jti: string;
    sub: string;
    iss: string;
    aud: string;
    iat: string;
    nbf: string;
    exp: string;
    tenant_id: string;
    scope: readonly string[];
    constraints?: Constraints;
    limits?: RateLimits;
    budget?: UsageBudget;
    trace?: TokenTrace;
    cnf?: ProofOfPossession;
    delegated_variables?: readonly string[];
    max_delegation_depth?: number;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:35.

TokenSignature

Type-only declaration; it is not a runtime value.

Signature
interface TokenSignature {
    bytes: Uint8Array;
    algorithm: SignatureAlgorithmValue;
    key_id?: string;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:18.

TokenTrace

Type-only declaration; it is not a runtime value.

Signature
interface TokenTrace {
    issuance_id: string;
    parent_token_id?: string;
    policy_id?: string;
    delegation_depth: number;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/proxy-DsVj9gLz.d.ts:29.

UsageBudget

Type-only declaration; it is not a runtime value.

Signature
interface UsageBudget {
    max_requests?: number;
    max_bytes?: number;
    max_cost_units?: number;
    max_secret_unwraps?: number;
    max_delegation_depth?: number;
}

Source: @openagentid/arsenal-sdk@0.1.1, dist/scope-CP8MvpbA.d.ts:102.

Package requirements

Dependencies

PackagePublished range
uuid^11.0.3
zod^3.23.8

Peer dependencies

PackagePublished rangeOptional
@openagentid/crypto-wasm*Yes

Archive verification

Pinned integrity:

SHA-512 integrity
sha512-bqdIp1hFYeffqXDaTpq/JMJune81cNwrj23kaUl1OoXjp97Bf8kX47/EaOjCX7oLAbTk69SgD7q2p8nrMNeIeQ==

Machine-readable API manifest · Coverage

@openagentid/arsenal-sdk

API contract shipped by @openagentid/arsenal-sdk 0.1.1. Exact exports, signatures, dependencies and availability.

@openagentid/arsenal-sdk/core

API contract shipped by @openagentid/arsenal-sdk 0.1.1. Exact exports, signatures, dependencies and availability.

On this page

Import conditionsExportsApiErrorResponseApiErrorResponseSchemaBrokerClientBrokerClientOptionsCapabilityRequestPayloadCapabilityRequestPayloadSchemaCapabilityResponsePayloadCapabilityResponsePayloadSchemaConsentApprovalPayloadConsentApprovalPayloadSchemaConsentDenialPayloadConsentDenialPayloadSchemaConsentRecordPayloadConsentRecordPayloadSchemaConsentRevocationPayloadConsentRevocationPayloadSchemaConstraintsPayloadConstraintsPayloadSchemaHealthResponseHealthResponseSchemaProxyMetadataPayloadProxyMetadataPayloadSchemaProxyRequestPayloadProxyRequestPayloadSchemaProxyResponsePayloadProxyResponsePayloadSchemaRevokeTokenPayloadRevokeTokenPayloadSchemaRevokeTokenResponseRevokeTokenResponseSchemaSecretRequestPayloadSecretRequestPayloadSchemaSecretResponsePayloadSecretResponsePayloadSchemaVerifyTokenPayloadVerifyTokenPayloadSchemaVerifyTokenResponseVerifyTokenResponseSchemaSupporting declarationsAgentCapabilityTokenBindingTypeBindingTypeValueConsentStatusConsentStatusValueConstraintsDeviceBindingEnvironmentConstraintNetworkConstraintsOriginBindingProofOfPossessionProxyMetadataProxyRequestProxyResponseRateLimitsScopeScopeSetSessionBindingSignatureAlgorithmSignatureAlgorithmValueTimeConstraintsTokenClaimsTokenSignatureTokenTraceUsageBudgetPackage requirementsDependenciesPeer dependenciesArchive verification