@openagentid/http/middleware

All packages · Runnable examples · Start an agent

Contract	Value
Package	@openagentid/http@0.1.1
Entry point	@openagentid/http/middleware
Availability	Known integration limitations
Reference source	Published TypeScript declarations
Package engines	node >=20

Before integrating

Declares an optional peer on @openagentid/auth-protocol ^0.1.0; the registry returns 404 for that peer package.

Published adapter has not qualified for the current production path. Use current SDK identity verification and explicit receiver policy.

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Condition	Published file
types	`./dist/middleware.d.ts`
import	`./dist/middleware.js`
require	`./dist/middleware.cjs`

createOpenAgentHandler

Create a generic OAAP middleware using the standard fetch Request/Response API.

Returns a function that:

Handles OAAP well-known endpoints
Validates authenticated requests
Returns undefined for well-known routes (caller should send the JSON response)

Works with Hono, Cloudflare Workers, Deno, Bun, and any fetch-based framework.

Signature

declare function createOpenAgentHandler(options: MiddlewareOptions): {
    config: ServerConfig;
    store: SessionStore;
    handle: (request: Request) => Promise<Response | AuthResult>;
};

Source: @openagentid/http@0.1.1, dist/middleware.d.ts:40.

createOpenAgentMiddleware

Create Express-compatible middleware.

Usage:

Signature

declare function createOpenAgentMiddleware(options: MiddlewareOptions): (req: {
    url?: string;
    method?: string;
    headers: Record<string, string | string[] | undefined>;
    path?: string;
}, res: {
    status: (code: number) => {
        json: (body: unknown) => void;
        end: () => void;
    };
}, next: () => void) => Promise<void>;

Source: @openagentid/http@0.1.1, dist/middleware.d.ts:62.

MiddlewareOptions

Options for creating OAAP middleware.

Type-only declaration; it is not a runtime value.

Signature

interface MiddlewareOptions {
    serverDid: string;
    store?: SessionStore;
    requiredConformance?: 'L0' | 'L1' | 'L2';
    sessionTtlSecs?: number;
    challengeTtlSecs?: number;
    verifySignature: VerifySignatureFn;
    excludePaths?: string[];
}

Source: @openagentid/http@0.1.1, dist/middleware.d.ts:14.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

AuthResult

Result of authenticating an incoming request.

Type-only declaration; it is not a runtime value.

Signature

interface AuthResult {
    authenticated: boolean;
    peerDid?: string;
    sessionToken?: string;
    error?: string;
}

Source: @openagentid/http@0.1.1, dist/server.d.ts:110.

ConformanceLevel

Conformance level enum values.

Type-only declaration; it is not a runtime value.

Signature

type ConformanceLevel = 'L0' | 'L1' | 'L2';

Source: @openagentid/http@0.1.1, dist/discovery.d.ts:12.

ServerConfig

Server configuration for the HTTP endpoints.

Type-only declaration; it is not a runtime value.

Signature

interface ServerConfig {
    origin: string;
    realm?: string;
    trustTier?: TrustTier;
    sessionTtlSecs?: number;
    challengeTtlSecs?: number;
    requiredConformance?: ConformanceLevel;
}

Source: @openagentid/http@0.1.1, dist/server.d.ts:25.

SessionState

Session states.

Type-only declaration; it is not a runtime value.

Signature

type SessionState = 'awaiting_proof' | 'established' | 'closed';

Source: @openagentid/http@0.1.1, dist/server.d.ts:42.

SessionStore

Session store interface.

Type-only declaration; it is not a runtime value.

Signature

interface SessionStore {
    put(session: StoredSession): Promise<void>;
    get(sessionId: string): Promise<StoredSession | undefined>;
    remove(sessionId: string): Promise<void>;
}

Source: @openagentid/http@0.1.1, dist/server.d.ts:57.

StoredSession

A stored session.

Type-only declaration; it is not a runtime value.

Signature

interface StoredSession {
    id: string;
    state: SessionState;
    initiatorDid: string;
    responderDid: string;
    nonce: string;
    challengeTimestamp: string;
    createdAt: number;
    expiresAt: number;
    capabilities: string[];
}

Source: @openagentid/http@0.1.1, dist/server.d.ts:44.

TrustTier

The resolution tier the server assigns (Section 15.4).

Type-only declaration; it is not a runtime value.

Signature

type TrustTier = 'anonymous' | 'identified' | 'sovereign';

Source: @openagentid/http@0.1.1, dist/transport.d.ts:38.

VerifySignatureFn

Signature verifier function. The caller provides this (crypto-wasm, libsodium, noble-ed25519, a KMS call) since Ed25519 verification is not in every runtime's Web Crypto.

Type-only declaration; it is not a runtime value.

Signature

type VerifySignatureFn = (params: {
    publicKeyBase64Url: string;
    payload: Uint8Array;
    signatureBase64Url: string;
}) => Promise<boolean>;

Source: @openagentid/http@0.1.1, dist/server.d.ts:92.

Package requirements

Dependencies

Package	Published range
zod	`^3.23.8`

Peer dependencies

Package	Published range	Optional
@openagentid/auth-protocol	`^0.1.0`	Yes

Archive verification

Pinned integrity:

SHA-512 integrity

sha512-Ecd1WkgKIlAusRSIeeyRuTXIMUka8QwTiWh8JRoxwA5i2MrT4xuza1kNXe4w+O0PTWMousqpc/Val2cNXKoNQQ==

Machine-readable API manifest · Coverage

On this page