@openagentid/crypto-wasm

All packages · Runnable examples · Start an agent

Entry points

• @openagentid/crypto-wasm/package.json

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Exports

• act_decode_unverified
• act_verify
• aes256gcm_decrypt
• aes256gcm_encrypt
• argon2id_hash_password
• argon2id_verify_password
• blake3_derive_key
• blake3_hash_bytes
• blake3_keyed_hash
• ct_eq
• ed25519_generate_keypair
• ed25519_public_from_private
• ed25519_sign
• ed25519_verify
• frost_aggregate
• frost_sign_round1
• frost_sign_round2
• frost_trusted_keygen
• frost_verify
• hkdf_sha256_derive
• hkdf_sha256_expand
• hkdf_sha256_extract
• jcs_canonicalize
• multibase_base58btc_decode
• multibase_base58btc_encode
• random_bytes
• sha256
• sha512
• version
• WasmKeypair
• WasmX25519Keypair
• x25519_diffie_hellman
• x25519_generate_keypair
• xchacha20poly1305_decrypt
• xchacha20poly1305_encrypt

act_decode_unverified

Decodes an ACT envelope's claims WITHOUT verifying the signature, for diagnostics and tooling. The returned string is prefixed so callers cannot accidentally treat the contents as verified.

Never use this for authorization: unverified claims are attacker controlled. Authorization decisions go through [act_verify].

export function act_decode_unverified(token_bytes: Uint8Array): string;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:47.

act_verify

Verifies an ACT envelope against the trusted key set and policy, and returns the claims as a JSON string.

This is the full normative procedure from agent-capability-token, not a re-implementation: envelope decode, version/algorithm checks, Ed25519 signature verification (checked before any claim, so an attacker cannot plant unauthenticated claim content), temporal checks with leeway, and issuer/audience/scope policy.

Arguments:

• token_bytes: the ACT envelope bytes (CBOR).
• trusted_keys: concatenated raw 32-byte Ed25519 public keys (exactly 32 bytes each, any count > 0). Keys are tried in order; kid is a hint for audit, never authoritative for selection.
• expected_issuer / expected_audience: the policy bindings. Both are required, deliberately: a verifier that does not bind the token's intended audience accepts tokens meant for someone else.
• required_scopes: each entry a service:resource:action scope string the token must grant; wildcards in the GRANT expand, in the REQUEST are literal.
• leeway_seconds: symmetric clock-skew allowance on temporal checks.
• now_unix_seconds: 0 for the system clock, or a pinned time for tests and for replaying a decision at a known instant.

Errors (thrown on the JS side) are the canonical ActError reasons, so a forged token reports distinctly from an expired one and an unimplemented format version distinctly from both.

export function act_verify(token_bytes: Uint8Array, trusted_keys: Uint8Array, expected_issuer: string, expected_audience: string, required_scopes: string[], leeway_seconds: bigint, now_unix_seconds: bigint): string;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:78.

aes256gcm_decrypt

AES-256-GCM decryption.

export function aes256gcm_decrypt(key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:83.

aes256gcm_encrypt

AES-256-GCM encryption. Returns ciphertext || tag.

export function aes256gcm_encrypt(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:88.

argon2id_hash_password

Hashes password with Argon2id, returning a PHC-format string.

export function argon2id_hash_password(password: Uint8Array): string;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:93.

argon2id_verify_password

Verifies a password against a PHC-format Argon2id hash.

export function argon2id_verify_password(password: Uint8Array, encoded_hash: string): boolean;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:98.

blake3_derive_key

BLAKE3 KDF mode: derive_key(context, key_material).

export function blake3_derive_key(context: string, key_material: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:103.

blake3_hash_bytes

BLAKE3 hash of data.

export function blake3_hash_bytes(data: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:108.

blake3_keyed_hash

BLAKE3 keyed hash.

export function blake3_keyed_hash(key: Uint8Array, data: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:113.

ct_eq

Constant-time byte equality. Returns false for slices of differing length.

export function ct_eq(a: Uint8Array, b: Uint8Array): boolean;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:118.

ed25519_generate_keypair

Generates a fresh Ed25519 keypair using the host CSPRNG.

export function ed25519_generate_keypair(): WasmKeypair;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:123.

ed25519_public_from_private

Derives the Ed25519 verifying key from a signing key.

export function ed25519_public_from_private(signing_key: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:128.

ed25519_sign

Signs message with the supplied 32-byte Ed25519 signing key.

export function ed25519_sign(signing_key: Uint8Array, message: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:133.

ed25519_verify

Verifies an Ed25519 signature. Throws if verification fails.

export function ed25519_verify(verifying_key: Uint8Array, message: Uint8Array, signature: Uint8Array): void;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:138.

frost_aggregate

FROST aggregation: combine signature shares into a 64-byte Ed25519 signature.

export function frost_aggregate(message: Uint8Array, commitments_json: string, shares_json: string, serialized_public_key_package: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:143.

frost_sign_round1

FROST round 1 for a single participant. Returns JSON of Round1Output.

export function frost_sign_round1(serialized_key_package: Uint8Array): string;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:148.

frost_sign_round2

FROST round 2 for a single participant.

commitments_json is a JSON array of ParticipantCommitments.

export function frost_sign_round2(serialized_key_package: Uint8Array, serialized_nonces: Uint8Array, message: Uint8Array, commitments_json: string): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:156.

frost_trusted_keygen

Generates a t-of-n FROST key share bundle (trusted dealer).

Returns a JSON string of KeyShareBundle.

export function frost_trusted_keygen(min_signers: number, max_signers: number): string;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:163.

frost_verify

Verifies a FROST signature. Throws on failure.

export function frost_verify(message: Uint8Array, signature: Uint8Array, group_public_key: Uint8Array): void;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:168.

hkdf_sha256_derive

Combined extract + expand HKDF-SHA256 derivation.

export function hkdf_sha256_derive(salt: Uint8Array, ikm: Uint8Array, info: Uint8Array, length: number): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:173.

hkdf_sha256_expand

HKDF-Expand(PRK, info, length).

export function hkdf_sha256_expand(prk: Uint8Array, info: Uint8Array, length: number): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:178.

hkdf_sha256_extract

HKDF-Extract(salt, IKM) — returns the 32-byte PRK.

export function hkdf_sha256_extract(salt: Uint8Array, ikm: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:183.

jcs_canonicalize

JCS canonicalization (RFC 8785) of a JSON string.

export function jcs_canonicalize(json: string): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:188.

multibase_base58btc_decode

Multibase base58btc decode.

export function multibase_base58btc_decode(input: string): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:193.

multibase_base58btc_encode

Multibase base58btc encode.

export function multibase_base58btc_encode(bytes: Uint8Array): string;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:198.

random_bytes

Returns n cryptographically random bytes.

export function random_bytes(n: number): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:203.

sha256

SHA-256 hash of data.

export function sha256(data: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:208.

sha512

SHA-512 hash of data.

export function sha512(data: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:213.

version

Returns the crate version string.

export function version(): string;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:218.

WasmKeypair

JS-friendly Ed25519 keypair: { signing_key, verifying_key } as Uint8Array byte arrays. Returned by [ed25519_generate_keypair].

export class WasmKeypair {
    free(): void;
    [Symbol.dispose](): void;
    readonly signing_key: Uint8Array;
    readonly verifying_key: Uint8Array;
}

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:8.

WasmX25519Keypair

JS-friendly X25519 keypair: { secret_key, public_key }.

export class WasmX25519Keypair {
    free(): void;
    [Symbol.dispose](): void;
    readonly public_key: Uint8Array;
    readonly secret_key: Uint8Array;
}

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:25.

x25519_diffie_hellman

Computes the X25519 raw shared secret. Callers MUST run this through HKDF before using it as keying material.

export function x25519_diffie_hellman(secret_key: Uint8Array, peer_public_key: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:224.

x25519_generate_keypair

Generates a fresh X25519 keypair using the host CSPRNG.

export function x25519_generate_keypair(): WasmX25519Keypair;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:229.

xchacha20poly1305_decrypt

XChaCha20-Poly1305 decryption.

export function xchacha20poly1305_decrypt(key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:234.

xchacha20poly1305_encrypt

XChaCha20-Poly1305 encryption.

export function xchacha20poly1305_encrypt(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Uint8Array;

Source: @openagentid/crypto-wasm@0.1.1, openagent_crypto_wasm.d.ts:239.

Package requirements

This version declares no dependencies or peer dependencies.

Archive verification

Pinned integrity:

sha512-pfFVfABbYwfqneeB7EXhd9yPBqguDT2Qt8I67bmbpklsydg0Zb3x4uXU6O70IrjKCT+Jc2P/EC59NKDRZH8ifw==

Machine-readable API manifest · Coverage