@openagentid/claude-agent/policy

All packages · Runnable examples · Start an agent

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Exports

• AllowListSkillsPolicy
• CompositeSkillsPolicy
• DenyUnlessScopedSkillsPolicy
• SKILL_SCOPE_PREFIX
• skillScope
• StaticCapabilityChecker
• TOOL_SCOPE_PREFIX
• toolScope

AllowListSkillsPolicy

Allow-listed skills policy: only the named skills are permitted, and the agent must additionally hold the right scope.

declare class AllowListSkillsPolicy implements SkillsPolicy {
    constructor(allowedSkills: Iterable<string>, inner?: SkillsPolicy);
    evaluate(skillName: string, ctx: SkillEvaluationContext): Promise<SkillDecision>;
}

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:52.

CompositeSkillsPolicy

Compose multiple policies — a skill is allowed only if every policy allows it. Useful for stacking allow-list + scope + custom policies.

declare class CompositeSkillsPolicy implements SkillsPolicy {
    constructor(policies: readonly SkillsPolicy[]);
    evaluate(skillName: string, ctx: SkillEvaluationContext): Promise<SkillDecision>;
}

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:62.

DenyUnlessScopedSkillsPolicy

Deny-unless-scoped skills policy.

For a skill named foo, requires the agent to hold skills:invoke:foo (or a wildcard that subsumes it). This is the default policy when the caller passes audit: true without supplying their own.

declare class DenyUnlessScopedSkillsPolicy implements SkillsPolicy {
    evaluate(skillName: string, ctx: SkillEvaluationContext): Promise<SkillDecision>;
}

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:45.

SKILL_SCOPE_PREFIX

Scope grammar for skill invocations.

declare const SKILL_SCOPE_PREFIX = "skills:invoke:";

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:18.

skillScope

Build the canonical scope string for a skill name.

declare function skillScope(name: string): string;

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:22.

StaticCapabilityChecker

Capability checker backed by a fixed allowlist. Supports literal scopes and one wildcard form: prefix:* matches anything starting with prefix:.

Example: tools:invoke:* allows every tool, skills:invoke:web.* allows every skill whose name starts with web..

declare class StaticCapabilityChecker implements CapabilityChecker {
    constructor(scopes: Iterable<string>);
    check(scope: string): ScopeDecision;
}

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:32.

TOOL_SCOPE_PREFIX

Scope grammar for tool invocations.

declare const TOOL_SCOPE_PREFIX = "tools:invoke:";

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:20.

toolScope

Build the canonical scope string for a tool name.

declare function toolScope(name: string): string;

Source: @openagentid/claude-agent@0.1.1, dist/policy.d.ts:24.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

CapabilityChecker

Anything implementing this can authorise tool / skill invocations.

Type-only declaration; it is not a runtime value.

interface CapabilityChecker {
    check(scope: string): Promise<ScopeDecision> | ScopeDecision;
}

Source: @openagentid/claude-agent@0.1.1, dist/types-BH6j5Zy9.d.ts:41.

OpenAgentIdentity

A verified OpenAgent identity, anchored on a did:oas:* string.

Type-only declaration; it is not a runtime value.

interface OpenAgentIdentity {
    did: string;
    kind: string;
    displayName?: string;
    publicKey: string;
    sign(payload: Uint8Array): Promise<Uint8Array> | Uint8Array;
    lineage?: readonly string[];
}

Source: @openagentid/claude-agent@0.1.1, dist/types-BH6j5Zy9.d.ts:12.

ScopeDecision

Result of a credential / scope check.

Type-only declaration; it is not a runtime value.

interface ScopeDecision {
    allowed: boolean;
    matchedScope?: string;
    reason?: string;
}

Source: @openagentid/claude-agent@0.1.1, dist/types-BH6j5Zy9.d.ts:32.

SkillDecision

Result of a skills policy evaluation.

Type-only declaration; it is not a runtime value.

interface SkillDecision {
    allowed: boolean;
    reason?: string;
    matchedScope?: string;
}

Source: @openagentid/claude-agent@0.1.1, dist/types-BH6j5Zy9.d.ts:113.

SkillEvaluationContext

Context passed to a skills policy evaluation.

Type-only declaration; it is not a runtime value.

interface SkillEvaluationContext {
    identity: OpenAgentIdentity;
    capabilities: CapabilityChecker;
    metadata?: Record<string, unknown>;
}

Source: @openagentid/claude-agent@0.1.1, dist/types-BH6j5Zy9.d.ts:104.

SkillsPolicy

Skills policy: decides whether a SKILLS.md skill may be invoked.

Type-only declaration; it is not a runtime value.

interface SkillsPolicy {
    evaluate(skillName: string, ctx: SkillEvaluationContext): Promise<SkillDecision> | SkillDecision;
}

Source: @openagentid/claude-agent@0.1.1, dist/types-BH6j5Zy9.d.ts:94.

Package requirements

Peer dependencies

Archive verification

Pinned integrity:

sha512-kUX3T6aS6PYr0GqQmLG7t2DLeOquNBVAoDkXN1yk09ffh6S5TIuHQgA2jptxjgLetu4n3XXP0AmEFb+jgQ1Dow==

Machine-readable API manifest · Coverage