@openagentid/oas-sdk

All packages · Runnable examples · Start an agent

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Exports

• AgentLineageProof
• AgentLineageProofData — type
• AttestationError
• AttestationErrorCode
• AttestationType
• AttestationTypeValue — type
• AuthorityOrgRoot — type
• AuthorityPathKind
• AuthorityPathKindValue — type
• AuthorityRevocationStatus — type
• AuthorityRootAnchor — type
• base64urlDecode
• base64urlEncode
• blake3Hash
• blake3HashHex
• CachingResolver
• compareConformanceLevel
• ConformanceLevel
• CreatedIdentity — type
• createHmr
• createMhr
• createRootWithKeypair
• createVerificationMethod
• CredentialBuilder
• CredentialProof — type
• CryptoError
• CryptoErrorCode
• defaultContext
• defaultVerifyConfig
• deriveChild
• deriveChildEntity
• deriveChildKeypair
• DerivedChild — type
• DerivedIdentity — type
• deriveKeyMaterial
• DID_CONTEXT
• DidError
• DidErrorCode
• DocumentBuilder
• DocumentError
• DocumentErrorCode
• DocumentProof — type
• DocumentProvider — type
• documentWithoutProof
• ED25519_CONTEXT
• EntityKind
• entityKindComponentCount
• entityKindFromString
• entityKindToString
• extractKeyId
• FallbackResolver
• findVerificationMethod
• generateDocumentProof
• InMemoryProvider
• InMemoryResolver
• isReservedNamespace
• isRevoked
• isRootDocument
• isRootKind
• jcsCanonicalize
• jcsCanonicalizeToString
• LifecycleStatus
• LineageAuthorityRecord — type
• LineageAuthorityRequest — type
• LineageAuthorityResolver — type
• LineageAuthoritySource — type
• LineageAuthorityVerification — type
• LineageError
• LineageErrorCode
• LineageSection — type
• meetsConformanceLevel
• multibaseDecode
• multibaseEncode
• OAS_ATTESTATION_CONTEXT
• OAS_CONTEXT
• OAS_VERSION
• OasCredential — type
• OasDid
• OasDocument — type
• OasError
• OasErrorCode
• OasKeyPair
• primaryPublicKeyMultibase
• PROOF_ALGORITHM
• PROOF_TYPE
• requiredFields
• RESERVED_NAMESPACES
• ResolveError
• ResolveErrorCode
• Resolver — type
• ResolverBackedLineageAuthorityOptions — type
• ResolverBackedLineageAuthoritySource
• ServiceEndpoint — type
• signCredential
• StandardAttestationType — type
• validateIdentifier
• validateNamespace
• validateSubject
• VC_CONTEXT
• VerificationMethod — type
• verifyChain
• VerifyConfig — type
• verifyConfigWithMaxGeneration
• verifyConfigWithTimeouts
• verifyCredential
• verifyCredentialWithTime
• verifyDocumentProof
• verifyLineage
• verifyLineageStructural
• verifyPrivilegedAuthority
• VerifyResult — type

AgentLineageProof

AgentLineageProof provides generation and verification of OAS lineage proofs.

See OAS Specification §9.4 (generation) and §9.5 (verification).

declare const AgentLineageProof: {
    readonly generate: (parentKeypair: OasKeyPair, parentDid: string, childDid: string, derivationPath: string) => Promise<AgentLineageProofData>;
    readonly verify: (proof: AgentLineageProofData) => Promise<boolean>;
    readonly verifyWithKey: (proof: AgentLineageProofData, publicKeyMultibase: string) => Promise<boolean>;
    readonly toJSON: (proof: AgentLineageProofData) => Record<string, string>;
    readonly fromJSON: (obj: Record<string, unknown>) => AgentLineageProofData;
};

Source: @openagentid/oas-crypto@1.0.2, dist/proof.d.ts:61.

AgentLineageProofData

A verifiable proof linking a child entity to its parent in the OAS lineage chain.

AgentLineageProof2025 establishes cryptographic accountability by proving that a parent entity authorized the creation of a child entity at a specific derivation path.

The proof contains:

• The parent and child DIDs
• The derivation path used for HKDF key derivation
• The parent's public key (multibase-encoded)
• An Ed25519 signature over the canonical proof payload

See OAS Specification §9.4, §9.5 for the complete proof format.

Type-only declaration; it is not a runtime value.

export interface AgentLineageProofData {
    readonly proofType: typeof PROOF_TYPE;
    readonly parentDid: string;
    readonly childDid: string;
    readonly derivationPath: string;
    readonly algorithm: typeof PROOF_ALGORITHM;
    readonly publicKeyMultibase: string;
    readonly signature: string;
}

Source: @openagentid/oas-crypto@1.0.2, dist/proof.d.ts:40.

AttestationError

Structured error for attestation operations.

export declare class AttestationError extends Error {
    readonly code: AttestationErrorCode;
    readonly details: Readonly<Record<string, unknown>>;
    constructor(code: AttestationErrorCode, message: string, details?: Record<string, unknown>);
}

Source: @openagentid/oas-attestation@1.0.2, dist/error.d.ts:32.

AttestationErrorCode

Error codes for attestation operations.

declare const AttestationErrorCode: {
    readonly InvalidIssuer: "INVALID_ISSUER";
    readonly InvalidSubject: "INVALID_SUBJECT";
    readonly UnknownAttestationType: "UNKNOWN_ATTESTATION_TYPE";
    readonly MissingProof: "MISSING_PROOF";
    readonly InvalidProofSignature: "INVALID_PROOF_SIGNATURE";
    readonly ProofGenerationFailed: "PROOF_GENERATION_FAILED";
    readonly Expired: "EXPIRED";
    readonly NotYetValid: "NOT_YET_VALID";
    readonly MissingField: "MISSING_FIELD";
    readonly Json: "JSON_ERROR";
    readonly Crypto: "CRYPTO_ERROR";
};

Source: @openagentid/oas-attestation@1.0.2, dist/error.d.ts:4.

export type AttestationErrorCode = (typeof AttestationErrorCode)[keyof typeof AttestationErrorCode];

Source: @openagentid/oas-attestation@1.0.2, dist/error.d.ts:28.

AttestationType

Standard OAS attestation types.

These represent the categories of verifiable claims that can be made about OAS entities.

declare const AttestationType: {
    readonly SecurityAudit: "SecurityAudit";
    readonly BehaviorAttestation: "BehaviorAttestation";
    readonly CapabilityVerification: "CapabilityVerification";
    readonly ComplianceAttestation: "ComplianceAttestation";
    readonly ExpertEndorsement: "ExpertEndorsement";
    readonly CommunityReview: "CommunityReview";
};

Source: @openagentid/oas-attestation@1.0.2, dist/types.d.ts:7.

AttestationTypeValue

Union of standard attestation types and custom strings.

Type-only declaration; it is not a runtime value.

export type AttestationTypeValue = StandardAttestationType | `Custom:${string}`;

Source: @openagentid/oas-attestation@1.0.2, dist/types.d.ts:25.

AuthorityOrgRoot

Org root returned by a resolver/GAL authority backend.

Type-only declaration; it is not a runtime value.

export interface AuthorityOrgRoot {
    readonly orgDid: string;
    readonly commitment: string;
    readonly status: string;
    readonly anchoredAtBlock: number;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:95.

AuthorityPathKind

Required privileged authority path shape.

declare const AuthorityPathKind: {
    readonly HumanToAgent: "human_to_agent";
    readonly AgentToOrg: "agent_to_org";
    readonly OrgToAgent: "org_to_agent";
    readonly AgentToHuman: "agent_to_human";
};

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:15.

export type AuthorityPathKind = (typeof AuthorityPathKind)[keyof typeof AuthorityPathKind] | (string & {});

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:21.

AuthorityPathKindValue

Public export AuthorityPathKindValue is an alias of AuthorityPathKind.

Required privileged authority path shape.

Type-only declaration; it is not a runtime value.

declare const AuthorityPathKind: {
    readonly HumanToAgent: "human_to_agent";
    readonly AgentToOrg: "agent_to_org";
    readonly OrgToAgent: "org_to_agent";
    readonly AgentToHuman: "agent_to_human";
};

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:15.

export type AuthorityPathKind = (typeof AuthorityPathKind)[keyof typeof AuthorityPathKind] | (string & {});

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:21.

AuthorityRevocationStatus

Revocation result from a resolver/GAL authority backend.

Type-only declaration; it is not a runtime value.

export interface AuthorityRevocationStatus {
    readonly revoked: boolean;
    readonly reasonCommitment?: string;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:81.

AuthorityRootAnchor

Root anchor returned by a resolver/GAL authority backend.

Type-only declaration; it is not a runtime value.

export interface AuthorityRootAnchor {
    readonly did: string;
    readonly kind: 'hmr' | 'mhr' | 'enr' | string;
    readonly status: string;
    readonly anchoredAtBlock: number;
    readonly source?: string;
    readonly scopes?: readonly string[];
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:86.

base64urlDecode

Decodes a base64url string (RFC 4648 §5, no padding) to bytes.

export declare function base64urlDecode(encoded: string): Uint8Array;

Source: @openagentid/oas-crypto@1.0.2, dist/encoding.d.ts:68.

throws: {

link: CryptoError} with code {@link CryptoErrorCode.Base64DecodeFailed } on failure.

base64urlEncode

Encodes bytes as base64url (RFC 4648 §5, no padding).

export declare function base64urlEncode(bytes: Uint8Array): string;

Source: @openagentid/oas-crypto@1.0.2, dist/encoding.d.ts:51.

blake3Hash

Computes a BLAKE3 hash of the input bytes.

BLAKE3 is the OAS-mandated content hashing algorithm, providing fast, cryptographically secure hashes.

export declare function blake3Hash(data: Uint8Array): Uint8Array;

Source: @openagentid/oas-crypto@1.0.2, dist/hashing.d.ts:18.

blake3HashHex

Computes a BLAKE3 hash and returns it as a lowercase hex string.

export declare function blake3HashHex(data: Uint8Array): string;

Source: @openagentid/oas-crypto@1.0.2, dist/hashing.d.ts:33.

CachingResolver

Caching wrapper for any {@link Resolver}.

Caches resolved documents with a configurable TTL (time-to-live). Cache misses are forwarded to the inner resolver. Expired entries are transparently refreshed.

export declare class CachingResolver implements Resolver {
    constructor(inner: Resolver, ttlMs?: number);
    resolve(did: string): Promise<OasDocument>;
    invalidate(did: string): void;
    clear(): void;
    get size(): number;
    get isEmpty(): boolean;
}

Source: @openagentid/oas-resolve@1.0.2, dist/cache.d.ts:18.

compareConformanceLevel

Compares two conformance levels.

export declare function compareConformanceLevel(a: ConformanceLevel, b: ConformanceLevel): number;

Source: @openagentid/oas-document@1.0.2, dist/conformance.d.ts:35.

ConformanceLevel

OAS conformance levels.

Each level represents a tier of compliance with the OAS specification. Higher levels subsume lower levels: L2 includes all L1 requirements, which includes all L0 requirements.

• L0: Basic identity (DID, verification method, proof)
• L1: L0 + lineage, conformance declaration, lifecycle
• L2: L2 + full attestation chain, WASM compilation

declare const ConformanceLevel: {
    readonly L0: "L0";
    readonly L1: "L1";
    readonly L2: "L2";
};

Source: @openagentid/oas-document@1.0.2, dist/conformance.d.ts:12.

export type ConformanceLevel = (typeof ConformanceLevel)[keyof typeof ConformanceLevel];

Source: @openagentid/oas-document@1.0.2, dist/conformance.d.ts:20.

CreatedIdentity

The result of creating a root identity.

Contains both the signed identity document and the keypair. The keypair is needed for subsequent child derivations.

Type-only declaration; it is not a runtime value.

export interface CreatedIdentity {
    readonly document: OasDocument;
    readonly keypair: OasKeyPair;
}

Source: @openagentid/oas-sdk@1.0.2, dist/identity.d.ts:10.

createHmr

Creates a new Human Root (HMR) identity.

Generates a random Ed25519 keypair, constructs a DID, builds and signs an OAS Identity Document with L0 conformance.

export declare function createHmr(namespace: string, identifier: string, created: string): Promise<CreatedIdentity>;

Source: @openagentid/oas-sdk@1.0.2, dist/identity.d.ts:37.

throws: {

link: OasError} on creation failure.

createMhr

Creates a new Multi-Human Root (MHR) identity.

Same as {@link createHmr} but for multi-human threshold roots.

export declare function createMhr(namespace: string, identifier: string, created: string): Promise<CreatedIdentity>;

Source: @openagentid/oas-sdk@1.0.2, dist/identity.d.ts:57.

throws: {

link: OasError} on creation failure.

createRootWithKeypair

Creates a root identity with an externally provided keypair.

Use this when you have an existing Ed25519 keypair (e.g., from a hardware security module or key management service).

export declare function createRootWithKeypair(namespace: string, kind: typeof EntityKind.Hmr | typeof EntityKind.Mhr, identifier: string, keypair: OasKeyPair, created: string): Promise<CreatedIdentity>;

Source: @openagentid/oas-sdk@1.0.2, dist/identity.d.ts:72.

throws: {

link: OasError} if kind is not a root kind.

createVerificationMethod

Creates a new verification method for a DID.

export declare function createVerificationMethod(did: string, keyNum: number, keypair: OasKeyPair): VerificationMethod;

Source: @openagentid/oas-document@1.0.2, dist/verification-method.d.ts:37.

CredentialBuilder

Fluent builder for constructing OAS Verifiable Credentials.

export declare class CredentialBuilder {
    issuer(did: string): this;
    issuanceDate(date: string): this;
    expirationDate(date: string): this;
    subject(claims: Record<string, unknown>): this;
    attestationType(type: AttestationTypeValue): this;
    build(): OasCredential;
}

Source: @openagentid/oas-attestation@1.0.2, dist/credential.d.ts:69.

CredentialProof

A proof attached to an OAS credential.

Type-only declaration; it is not a runtime value.

export interface CredentialProof {
    readonly type: 'Ed25519Signature2020';
    readonly created: string;
    readonly verificationMethod: string;
    readonly proofPurpose: 'assertionMethod';
    readonly proofValue: string;
}

Source: @openagentid/oas-attestation@1.0.2, dist/credential.d.ts:13.

CryptoError

Structured error for OAS cryptographic operations.

Every instance carries a machine-readable {@link CryptoErrorCode} and a human-readable message with enough context to diagnose the issue without exposing sensitive key material.

export declare class CryptoError extends Error {
    readonly code: CryptoErrorCode;
    readonly details: Readonly<Record<string, unknown>>;
    constructor(code: CryptoErrorCode, message: string, details?: Record<string, unknown>);
}

Source: @openagentid/oas-crypto@1.0.2, dist/error.d.ts:43.

CryptoErrorCode

Error codes for OAS cryptographic operations.

Machine-readable codes for programmatic error matching.

declare const CryptoErrorCode: {
    readonly InvalidSignature: "INVALID_SIGNATURE";
    readonly InvalidKeyLength: "INVALID_KEY_LENGTH";
    readonly DerivationFailed: "DERIVATION_FAILED";
    readonly MultibaseDecodeFailed: "MULTIBASE_DECODE_FAILED";
    readonly Base64DecodeFailed: "BASE64_DECODE_FAILED";
    readonly CanonicalizationFailed: "CANONICALIZATION_FAILED";
    readonly InvalidProofPayload: "INVALID_PROOF_PAYLOAD";
    readonly KeyConstructionFailed: "KEY_CONSTRUCTION_FAILED";
};

Source: @openagentid/oas-crypto@1.0.2, dist/error.d.ts:6.

export type CryptoErrorCode = (typeof CryptoErrorCode)[keyof typeof CryptoErrorCode];

Source: @openagentid/oas-crypto@1.0.2, dist/error.d.ts:24.

defaultContext

Returns the default JSON-LD context array for OAS documents.

export declare function defaultContext(): ReadonlyArray<string>;

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:119.

defaultVerifyConfig

Creates a default verification configuration.

export declare function defaultVerifyConfig(): VerifyConfig;

Source: @openagentid/oas-lineage@1.0.2, dist/config.d.ts:28.

deriveChild

Derives a child identity from a parent.

This is the high-level SDK workflow that:

1. Constructs the child DID
2. Derives a child keypair via HKDF-SHA256
3. Generates a lineage proof
4. Builds and signs the child's identity document

export declare function deriveChild(parentKeypair: OasKeyPair, parentDoc: OasDocument, childNamespace: string, childKind: EntityKind, childIdentifier: string, derivationPath: string, created: string): Promise<DerivedIdentity>;

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:164.

throws: {

link: OasError} on derivation failure.

deriveChildEntity

Derives a child entity from a parent entity's keypair and document.

Performs HKDF-SHA256 key derivation, generates a lineage proof signed by the parent, and constructs the lineage section for the child's identity document.

export declare function deriveChildEntity(parentKeypair: OasKeyPair, parentDoc: OasDocument, childDid: string, derivationPath: string): Promise<DerivedChild>;

Source: @openagentid/oas-lineage@1.0.2, dist/derive.d.ts:44.

throws: {

link: LineageError} on derivation or proof generation failure.

deriveChildKeypair

Derives a child Ed25519 keypair from a parent keypair using HKDF-SHA256.

The derivation uses:

• IKM (Input Keying Material): parent's signing (private) key bytes
• Salt: parent's verifying (public) key bytes
• Info: the derivation path string (UTF-8 encoded)

The output is 32 bytes of derived key material, used as the child's Ed25519 signing key. The child's verifying key is derived from the signing key.

export declare function deriveChildKeypair(parent: OasKeyPair, derivationPath: string): Promise<OasKeyPair>;

Source: @openagentid/oas-crypto@1.0.2, dist/derivation.d.ts:27.

throws: {

link: CryptoError} with code {@link CryptoErrorCode.DerivationFailed } on failure.

DerivedChild

The result of a child entity derivation.

Contains the derived keypair and the lineage section to include in the child's identity document.

Type-only declaration; it is not a runtime value.

export interface DerivedChild {
    readonly keypair: OasKeyPair;
    readonly lineage: LineageSection;
}

Source: @openagentid/oas-lineage@1.0.2, dist/derive.d.ts:9.

DerivedIdentity

The result of deriving a child identity.

Type-only declaration; it is not a runtime value.

export interface DerivedIdentity {
    readonly document: OasDocument;
    readonly keypair: OasKeyPair;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:8.

deriveKeyMaterial

Low-level HKDF-SHA256 key material derivation.

Derives 32 bytes of key material using HKDF-SHA256 (RFC 5869).

export declare function deriveKeyMaterial(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array): Uint8Array;

Source: @openagentid/oas-crypto@1.0.2, dist/derivation.d.ts:39.

throws: {

link: CryptoError} on derivation failure.

DID_CONTEXT

W3C DID Document context.

declare const DID_CONTEXT: "https://www.w3.org/ns/did/v1";

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:21.

DidError

Structured error for DID parsing and validation failures.

Every instance carries a machine-readable {@link DidErrorCode} and a human-readable message with enough context to diagnose the issue.

export declare class DidError extends Error {
    readonly code: DidErrorCode;
    constructor(code: DidErrorCode, message: string);
}

Source: @openagentid/oas-did@1.0.2, dist/error.d.ts:39.

DidErrorCode

Error codes for DID parsing and validation failures.

These string enum codes enable programmatic matching without relying on error message string content.

declare const DidErrorCode: {
    readonly Empty: "EMPTY";
    readonly InvalidPrefix: "INVALID_PREFIX";
    readonly TooFewComponents: "TOO_FEW_COMPONENTS";
    readonly InvalidNamespace: "INVALID_NAMESPACE";
    readonly UnknownEntityKind: "UNKNOWN_ENTITY_KIND";
    readonly InvalidIdentifier: "INVALID_IDENTIFIER";
};

Source: @openagentid/oas-did@1.0.2, dist/error.d.ts:7.

export type DidErrorCode = (typeof DidErrorCode)[keyof typeof DidErrorCode];

Source: @openagentid/oas-did@1.0.2, dist/error.d.ts:21.

DocumentBuilder

Fluent builder for constructing OAS Identity Documents.

The builder enforces required fields and produces a signed, frozen {@link OasDocument} via the {@link DocumentBuilder.buildAndSign} method.

export declare class DocumentBuilder {
    constructor(id: string, kind: EntityKind);
    controller(controller: string | ReadonlyArray<string>): this;
    addVerificationMethod(keypair: OasKeyPair): this;
    conformanceLevel(level: ConformanceLevel): this;
    lifecycleStatus(status: LifecycleStatus): this;
    sequence(seq: number): this;
    name(name: string): this;
    description(description: string): this;
    lineage(lineage: LineageSection): this;
    addService(service: ServiceEndpoint): this;
    metadata(metadata: Record<string, unknown>): this;
    buildAndSign(keypair: OasKeyPair, created: string): Promise<OasDocument>;
}

Source: @openagentid/oas-document@1.0.2, dist/builder.d.ts:28.

DocumentError

Structured error for OAS document operations.

export declare class DocumentError extends Error {
    readonly code: DocumentErrorCode;
    readonly details: Readonly<Record<string, unknown>>;
    constructor(code: DocumentErrorCode, message: string, details?: Record<string, unknown>);
}

Source: @openagentid/oas-document@1.0.2, dist/error.d.ts:40.

DocumentErrorCode

Error codes for OAS document operations.

declare const DocumentErrorCode: {
    readonly MissingField: "MISSING_FIELD";
    readonly InvalidField: "INVALID_FIELD";
    readonly ProofVerificationFailed: "PROOF_VERIFICATION_FAILED";
    readonly ProofGenerationFailed: "PROOF_GENERATION_FAILED";
    readonly ConformanceNotMet: "CONFORMANCE_NOT_MET";
    readonly Json: "JSON_ERROR";
    readonly Did: "DID_ERROR";
    readonly Crypto: "CRYPTO_ERROR";
    readonly InvalidLifecycleTransition: "INVALID_LIFECYCLE_TRANSITION";
    readonly InvalidSequence: "INVALID_SEQUENCE";
};

Source: @openagentid/oas-document@1.0.2, dist/error.d.ts:4.

export type DocumentErrorCode = (typeof DocumentErrorCode)[keyof typeof DocumentErrorCode];

Source: @openagentid/oas-document@1.0.2, dist/error.d.ts:26.

DocumentProof

A document proof (Ed25519Signature2020) attached to an OAS Identity Document.

The proof authenticates the document content by signing the JCS-canonicalized document (excluding the proof itself) with the entity's Ed25519 key.

Type-only declaration; it is not a runtime value.

export interface DocumentProof {
    readonly type: 'Ed25519Signature2020';
    readonly created: string;
    readonly verificationMethod: string;
    readonly proofPurpose: 'assertionMethod';
    readonly proofValue: string;
}

Source: @openagentid/oas-document@1.0.2, dist/proof-format.d.ts:8.

DocumentProvider

Interface for resolving OAS Identity Documents by DID.

Implementations provide documents from different sources: in-memory maps, network resolution, caching layers, etc. The lineage verifier uses this interface to walk the chain.

Type-only declaration; it is not a runtime value.

export interface DocumentProvider {
    resolve(did: string): Promise<OasDocument | undefined>;
}

Source: @openagentid/oas-lineage@1.0.2, dist/provider.d.ts:18.

documentWithoutProof

Creates a plain JSON object from an OasDocument, suitable for JCS canonicalization or serialization.

Strips the proof field to produce the unsigned document payload.

export declare function documentWithoutProof(doc: OasDocument): Record<string, unknown>;

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:157.

ED25519_CONTEXT

Ed25519 Verification Key 2020 context.

declare const ED25519_CONTEXT: "https://w3id.org/security/suites/ed25519-2020/v1";

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:25.

EntityKind

The set of recognized OAS entity kinds.

Each entity kind represents a category of autonomous entity in the OAS identity system. Root kinds ({@link EntityKind.Hmr}, {@link EntityKind.Mhr}, {@link EntityKind.Enr}) are the trust anchors from which all other entities derive their lineage.

declare const EntityKind: {
    readonly Hmr: "hmr";
    readonly Mhr: "mhr";
    readonly Enr: "enr";
    readonly Ao: "ao";
    readonly Agent: "agent";
    readonly AgentInstance: "agent:instance";
    readonly Tool: "tool";
    readonly Skill: "skill";
    readonly Workflow: "workflow";
    readonly Model: "model";
    readonly Dataset: "dataset";
    readonly Service: "service";
};

Source: @openagentid/oas-did@1.0.2, dist/kind.d.ts:18.

export type EntityKind = (typeof EntityKind)[keyof typeof EntityKind];

Source: @openagentid/oas-did@1.0.2, dist/kind.d.ts:44.

entityKindComponentCount

Returns the number of colon-separated components in the kind string.

Simple kinds (e.g., "agent") have 1 component. Compound kinds (e.g., "agent:instance") have 2 components.

export declare function entityKindComponentCount(kind: EntityKind): number;

Source: @openagentid/oas-did@1.0.2, dist/kind.d.ts:101.

entityKindFromString

Parses a string into an {@link EntityKind}.

Handles the compound agent:instance kind by accepting both the full string and the two-part colon-separated form.

export declare function entityKindFromString(s: string): EntityKind | undefined;

Source: @openagentid/oas-did@1.0.2, dist/kind.d.ts:65.

entityKindToString

Returns the string representation of an entity kind.

export declare function entityKindToString(kind: EntityKind): string;

Source: @openagentid/oas-did@1.0.2, dist/kind.d.ts:72.

extractKeyId

Extracts the key ID fragment from a verification method ID.

export declare function extractKeyId(vmId: string): string | undefined;

Source: @openagentid/oas-document@1.0.2, dist/verification-method.d.ts:44.

FallbackResolver

Fallback resolver that tries multiple resolvers in priority order.

Returns the result from the first resolver that succeeds. If all resolvers fail, throws an error aggregating all failure reasons.

export declare class FallbackResolver implements Resolver {
    constructor(resolvers: ReadonlyArray<Resolver>);
    resolve(did: string): Promise<OasDocument>;
}

Source: @openagentid/oas-resolve@1.0.2, dist/fallback.d.ts:18.

findVerificationMethod

Finds a verification method by ID.

export declare function findVerificationMethod(doc: OasDocument, vmId: string): VerificationMethod | undefined;

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:147.

generateDocumentProof

Generates a document proof by signing the JCS-canonicalized document.

export declare function generateDocumentProof(documentWithoutProof: Record<string, unknown>, keypair: OasKeyPair, verificationMethodId: string, created: string): Promise<DocumentProof>;

Source: @openagentid/oas-document@1.0.2, dist/proof-format.d.ts:30.

throws: {

link: DocumentError} on signing or canonicalization failure.

InMemoryProvider

In-memory document provider for testing and local verification.

Stores documents in a Map keyed by DID string. Thread-safe for concurrent reads (JavaScript is single-threaded for sync operations, but async operations are correctly sequenced).

export declare class InMemoryProvider implements DocumentProvider {
    register(doc: OasDocument): void;
    remove(did: string): boolean;
    resolve(did: string): Promise<OasDocument | undefined>;
    get size(): number;
    get isEmpty(): boolean;
}

Source: @openagentid/oas-lineage@1.0.2, dist/provider.d.ts:43.

InMemoryResolver

In-memory DID resolver for testing and local usage.

Stores documents in a Map keyed by DID string. This is the standard testing approach across the OAS stack.

export declare class InMemoryResolver implements Resolver {
    register(doc: OasDocument): void;
    remove(did: string): boolean;
    resolve(did: string): Promise<OasDocument>;
    get size(): number;
    get isEmpty(): boolean;
}

Source: @openagentid/oas-resolve@1.0.2, dist/memory.d.ts:18.

isReservedNamespace

Returns true if the namespace is in the reserved list.

Reserved namespaces (oas, test, example) are defined by the OAS specification and cannot be used for production entities.

export declare function isReservedNamespace(namespace: string): boolean;

Source: @openagentid/oas-did@1.0.2, dist/namespace.d.ts:47.

isRevoked

Returns true if the document has been revoked.

export declare function isRevoked(doc: OasDocument): boolean;

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:132.

isRootDocument

Returns true if the document represents a root entity (HMR, MHR, or ENR).

export declare function isRootDocument(doc: OasDocument): boolean;

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:126.

isRootKind

Returns true if the entity kind is a root kind (HMR, MHR, or ENR).

Root kinds are trust anchors — they do not derive from a parent entity. Their lineage chain terminates at themselves.

export declare function isRootKind(kind: EntityKind): boolean;

Source: @openagentid/oas-did@1.0.2, dist/kind.d.ts:91.

jcsCanonicalize

Canonicalizes a JSON value to UTF-8 bytes according to RFC 8785.

export declare function jcsCanonicalize(value: unknown): Uint8Array;

Source: @openagentid/oas-crypto@1.0.2, dist/jcs.d.ts:41.

throws: {

link: CryptoError} with code {@link CryptoErrorCode.CanonicalizationFailed } on failure.

jcsCanonicalizeToString

Canonicalizes a JSON value according to RFC 8785 (JSON Canonicalization Scheme).

JCS produces a deterministic, byte-for-byte identical serialization of any JSON value by applying these rules:

• Object keys sorted lexicographically (by UTF-16 code units)
• No whitespace between tokens
• Numbers serialized per ES2015 Number.toString()
• Strings escaped according to JSON spec (minimal escaping)
• null, true, false as literals

export declare function jcsCanonicalizeToString(value: unknown): string;

Source: @openagentid/oas-crypto@1.0.2, dist/jcs.d.ts:25.

throws: {

link: CryptoError} with code {@link CryptoErrorCode.CanonicalizationFailed } if the value cannot be serialized (e.g., contains undefined, functions, or circular references).

LifecycleStatus

OAS entity lifecycle statuses.

Entities progress through these statuses during their lifetime. The lifecycle is largely linear, but suspension and reactivation create branches.

declare const LifecycleStatus: {
    readonly Nascent: "nascent";
    readonly Active: "active";
    readonly Dormant: "dormant";
    readonly Suspended: "suspended";
    readonly Terminated: "terminated";
    readonly Archived: "archived";
};

Source: @openagentid/oas-document@1.0.2, dist/lifecycle.d.ts:8.

export type LifecycleStatus = (typeof LifecycleStatus)[keyof typeof LifecycleStatus];

Source: @openagentid/oas-document@1.0.2, dist/lifecycle.d.ts:22.

LineageAuthorityRecord

Sigil-backed authority record returned by a lineage finality source.

Type-only declaration; it is not a runtime value.

export interface LineageAuthorityRecord {
    readonly subjectDid: string;
    readonly rootDid: string;
    readonly finalizedPath: readonly string[];
    readonly finalizedBlock: number;
    readonly source: string;
    readonly scopes: readonly string[];
    readonly expiresAt?: string;
    readonly pathKind?: AuthorityPathKind;
    readonly rootKind?: 'hmr' | 'mhr' | 'enr' | string;
    readonly generation?: number;
    readonly orgRootCommitment?: string;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:38.

LineageAuthorityRequest

Request passed from OAS into a Sigil-backed lineage authority source.

Type-only declaration; it is not a runtime value.

export interface LineageAuthorityRequest {
    readonly subjectDid: string;
    readonly localRootDid: string;
    readonly localChain: readonly string[];
    readonly pathKind: AuthorityPathKind;
    readonly requiredScopes: readonly string[];
    readonly minFinalizedBlock?: number;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:23.

LineageAuthorityResolver

Resolver-shaped authority backend - the TypeScript mirror of the Rust LineageAnchor trait (oas-resolve/src/anchored.rs).

This intentionally avoids Sigil-specific imports. Any anchor backend (Sigil GAL, an EAS adapter, a transparency log) plugs in through adapters that satisfy this small read-only shape.

Type-only declaration; it is not a runtime value.

export interface LineageAuthorityResolver {
    currentFinalizedBlock(): Promise<number>;
    checkRevocation(did: string): Promise<AuthorityRevocationStatus>;
    getRootAnchor(rootDid: string): Promise<AuthorityRootAnchor | null>;
    getOrgRoot?(orgDid: string): Promise<AuthorityOrgRoot | null>;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:109.

LineageAuthoritySource

Backend that proves privileged lineage authority.

Type-only declaration; it is not a runtime value.

export interface LineageAuthoritySource {
    verifyAuthority(request: LineageAuthorityRequest): Promise<LineageAuthorityRecord>;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:70.

LineageAuthorityVerification

Result of privileged lineage authority verification.

Type-only declaration; it is not a runtime value.

export interface LineageAuthorityVerification {
    readonly portable: VerifyResult;
    readonly authority: LineageAuthorityRecord;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:63.

LineageError

Structured error for lineage operations.

export declare class LineageError extends Error {
    readonly code: LineageErrorCode;
    readonly details: Readonly<Record<string, unknown>>;
    constructor(code: LineageErrorCode, message: string, details?: Record<string, unknown>);
}

Source: @openagentid/oas-lineage@1.0.2, dist/error.d.ts:52.

LineageErrorCode

Error codes for lineage verification and derivation operations.

declare const LineageErrorCode: {
    readonly MissingLineage: "MISSING_LINEAGE";
    readonly EmptyChain: "EMPTY_CHAIN";
    readonly ChainNotTerminatingAtRoot: "CHAIN_NOT_TERMINATING_AT_ROOT";
    readonly GenerationMismatch: "GENERATION_MISMATCH";
    readonly ChainTooDeep: "CHAIN_TOO_DEEP";
    readonly ResolutionFailed: "RESOLUTION_FAILED";
    readonly ParentRevoked: "PARENT_REVOKED";
    readonly ParentSignatureInvalid: "PARENT_SIGNATURE_INVALID";
    readonly UnknownProofType: "UNKNOWN_PROOF_TYPE";
    readonly ProofParentMismatch: "PROOF_PARENT_MISMATCH";
    readonly ProofChildMismatch: "PROOF_CHILD_MISMATCH";
    readonly ProofSignatureInvalid: "PROOF_SIGNATURE_INVALID";
    readonly TotalTimeout: "TOTAL_TIMEOUT";
    readonly MissingDerivationProof: "MISSING_DERIVATION_PROOF";
    readonly ParentKeyNotFound: "PARENT_KEY_NOT_FOUND";
    readonly Crypto: "CRYPTO_ERROR";
};

Source: @openagentid/oas-lineage@1.0.2, dist/error.d.ts:4.

export type LineageErrorCode = (typeof LineageErrorCode)[keyof typeof LineageErrorCode];

Source: @openagentid/oas-lineage@1.0.2, dist/error.d.ts:38.

LineageSection

The lineage section of an OAS Identity Document.

Describes the entity's position in the derivation chain, linking it back to its human root. Root entities (HMR, MHR) do not have a lineage section.

Type-only declaration; it is not a runtime value.

export interface LineageSection {
    readonly humanRootDid: string;
    readonly creatorDid: string;
    readonly generation: number;
    readonly derivationProof?: AgentLineageProofData | undefined;
    readonly humanRootChain: ReadonlyArray<string>;
}

Source: @openagentid/oas-document@1.0.2, dist/lineage-section.d.ts:24.

meetsConformanceLevel

Returns true if level a meets or exceeds the required level b.

export declare function meetsConformanceLevel(actual: ConformanceLevel, required: ConformanceLevel): boolean;

Source: @openagentid/oas-document@1.0.2, dist/conformance.d.ts:43.

multibaseDecode

Decodes a multibase base58btc string (strips z prefix).

export declare function multibaseDecode(encoded: string): Uint8Array;

Source: @openagentid/oas-crypto@1.0.2, dist/encoding.d.ts:36.

throws: {

link: CryptoError} with code {@link CryptoErrorCode.MultibaseDecodeFailed } on failure.

multibaseEncode

Encodes bytes as multibase base58btc (with z prefix).

This is the canonical format for publicKeyMultibase in OAS Identity Documents. The z prefix indicates base58btc encoding per the Multibase specification.

export declare function multibaseEncode(bytes: Uint8Array): string;

Source: @openagentid/oas-crypto@1.0.2, dist/encoding.d.ts:18.

OAS_ATTESTATION_CONTEXT

OAS Attestation context.

declare const OAS_ATTESTATION_CONTEXT: "https://openagent.id/ns/attestation/v1";

Source: @openagentid/oas-attestation@1.0.2, dist/credential.d.ts:9.

OAS_CONTEXT

OAS-specific context.

declare const OAS_CONTEXT: "https://openagent.id/ns/oas/v1";

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:29.

OAS_VERSION

Current OAS specification version.

declare const OAS_VERSION: "1.0.0";

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:33.

OasCredential

An OAS Verifiable Credential.

Extends the W3C Verifiable Credentials model with OAS-specific attestation types. Credentials are immutable once signed.

Type-only declaration; it is not a runtime value.

export interface OasCredential {
    readonly '@context': ReadonlyArray<string>;
    readonly type: ReadonlyArray<string>;
    readonly issuer: string;
    readonly issuanceDate: string;
    readonly expirationDate?: string | undefined;
    readonly credentialSubject: Readonly<Record<string, unknown>>;
    readonly oasAttestationType?: AttestationTypeValue | undefined;
    readonly proof?: CredentialProof | undefined;
}

Source: @openagentid/oas-attestation@1.0.2, dist/credential.d.ts:31.

OasDid

A parsed and validated OAS Decentralized Identifier.

OasDid is an immutable value object representing a fully validated did:oas:<namespace>:<kind>:<identifier> string. Once constructed, all components are guaranteed to be valid per the OAS specification.

Construction is via the static {@link OasDid.parse} method or the {@link OasDid.create} factory. Both perform full validation.

export declare class OasDid {
    readonly namespace: string;
    readonly kind: EntityKind;
    readonly identifier: string;
    static create(namespace: string, kind: EntityKind, identifier: string): OasDid;
    static parse(input: string): OasDid;
    get isRoot(): boolean;
    get kindComponentCount(): number;
    toString(): string;
    toJSON(): string;
    equals(other: OasDid): boolean;
}

Source: @openagentid/oas-did@1.0.2, dist/did.d.ts:28.

OasDocument

An OAS Identity Document.

This is the core identity artifact in the OAS ecosystem. It extends the W3C DID Document format with OAS-specific properties for lineage, conformance, lifecycle, and entity classification.

Documents are immutable once created. Use {@link DocumentBuilder } to construct new documents.

Type-only declaration; it is not a runtime value.

export interface OasDocument {
    readonly '@context': ReadonlyArray<string>;
    readonly id: string;
    readonly controller: string | ReadonlyArray<string>;
    readonly verificationMethod: ReadonlyArray<VerificationMethod>;
    readonly authentication: ReadonlyArray<string>;
    readonly assertionMethod: ReadonlyArray<string>;
    readonly capabilityInvocation: ReadonlyArray<string>;
    readonly capabilityDelegation: ReadonlyArray<string>;
    readonly service: ReadonlyArray<ServiceEndpoint>;
    readonly oasVersion: typeof OAS_VERSION;
    readonly kind: EntityKind;
    readonly name?: string | undefined;
    readonly description?: string | undefined;
    readonly lineage?: LineageSection | undefined;
    readonly conformanceLevel: ConformanceLevel;
    readonly lifecycleStatus?: LifecycleStatus | undefined;
    readonly sequence: number;
    readonly metadata: Readonly<Record<string, unknown>>;
    readonly proof?: DocumentProof | undefined;
    readonly revoked?: boolean | undefined;
    readonly revokedAt?: string | undefined;
    readonly profile?: ProfileSection | undefined;
    readonly contact?: ContactSection | undefined;
    readonly calendar?: CalendarSection | undefined;
    readonly operational?: OperationalSection | undefined;
    readonly pricing?: PricingSection | undefined;
    readonly interoperability?: InteroperabilitySection | undefined;
    readonly reputation?: ReputationSection | undefined;
    readonly compliance?: ComplianceSection | undefined;
    readonly relationships?: RelationshipsSection | undefined;
    readonly governance?: GovernanceSection | undefined;
}

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:52.

OasError

Unified error type for the OAS SDK.

Wraps errors from all sub-packages with a unified code system. The original error is available via the cause property.

export declare class OasError extends Error {
    readonly code: OasErrorCode;
    readonly details: Readonly<Record<string, unknown>>;
    constructor(code: OasErrorCode, message: string, details?: Record<string, unknown>);
    static from(error: unknown): OasError;
}

Source: @openagentid/oas-sdk@1.0.2, dist/error.d.ts:29.

OasErrorCode

Error codes for SDK-level operations.

declare const OasErrorCode: {
    readonly Did: "DID_ERROR";
    readonly Crypto: "CRYPTO_ERROR";
    readonly Document: "DOCUMENT_ERROR";
    readonly Lineage: "LINEAGE_ERROR";
    readonly LineageAuthority: "LINEAGE_AUTHORITY_ERROR";
    readonly Resolve: "RESOLVE_ERROR";
    readonly Attestation: "ATTESTATION_ERROR";
    readonly Sdk: "SDK_ERROR";
};

Source: @openagentid/oas-sdk@1.0.2, dist/error.d.ts:4.

export type OasErrorCode = (typeof OasErrorCode)[keyof typeof OasErrorCode];

Source: @openagentid/oas-sdk@1.0.2, dist/error.d.ts:22.

OasKeyPair

An Ed25519 keypair for an OAS entity.

Holds both the signing (private) and verifying (public) keys. The signing key is stored as a Uint8Array and should be zeroed when no longer needed.

Security

• Private key bytes are never exposed via toString() or toJSON()
• All signature operations use constant-time comparison internally via @noble/ed25519
• Callers should zero the signing key bytes when the keypair is no longer needed: keypair.signingKeyBytes.fill(0)

export declare class OasKeyPair {
    static generate(): Promise<OasKeyPair>;
    static fromSigningKeyBytes(bytes: Uint8Array): Promise<OasKeyPair>;
    static verifyingKeyFromBytes(bytes: Uint8Array): Uint8Array;
    sign(message: Uint8Array): Promise<Uint8Array>;
    static verifyWithKey(publicKeyBytes: Uint8Array, message: Uint8Array, signatureBytes: Uint8Array): Promise<boolean>;
    get signingKeyBytes(): Uint8Array;
    get verifyingKeyBytes(): Uint8Array;
    publicKeyMultibase(): string;
    toString(): string;
    toJSON(): {
        verifyingKey: string;
    };
}

Source: @openagentid/oas-crypto@1.0.2, dist/keypair.d.ts:25.

primaryPublicKeyMultibase

Returns the primary public key multibase from the first verification method.

export declare function primaryPublicKeyMultibase(doc: OasDocument): string | undefined;

Source: @openagentid/oas-document@1.0.2, dist/document.d.ts:139.

PROOF_ALGORITHM

The algorithm used for key derivation in lineage proofs.

declare const PROOF_ALGORITHM: "HKDF-SHA256-Ed25519";

Source: @openagentid/oas-crypto@1.0.2, dist/proof.d.ts:9.

PROOF_TYPE

The proof type identifier for OAS lineage proofs.

declare const PROOF_TYPE: "AgentLineageProof2025";

Source: @openagentid/oas-crypto@1.0.2, dist/proof.d.ts:5.

requiredFields

Returns the required fields for a given attestation type.

export declare function requiredFields(type: AttestationTypeValue): ReadonlyArray<string>;

Source: @openagentid/oas-attestation@1.0.2, dist/types.d.ts:32.

RESERVED_NAMESPACES

Reserved namespaces that cannot be used for production entities.

These namespaces are reserved by the OAS specification for testing, examples, and internal specification use.

declare const RESERVED_NAMESPACES: ReadonlyArray<string>;

Source: @openagentid/oas-did@1.0.2, dist/namespace.d.ts:7.

ResolveError

Structured error for resolution operations.

Carries a machine-readable code from the OAS §12.5 error code registry and a human-readable message.

export declare class ResolveError extends Error {
    readonly code: ResolveErrorCode;
    readonly details: Readonly<Record<string, unknown>>;
    constructor(code: ResolveErrorCode, message: string, details?: Record<string, unknown>);
}

Source: @openagentid/oas-resolve@1.0.2, dist/error.d.ts:47.

ResolveErrorCode

Error codes for DID resolution operations.

These codes map to the OAS Spec §12.5 error code registry.

declare const ResolveErrorCode: {
    readonly NotFound: "NOT_FOUND";
    readonly InvalidSignature: "INVALID_SIGNATURE";
    readonly Revoked: "REVOKED";
    readonly LineageInvalid: "LINEAGE_INVALID";
    readonly Timeout: "TIMEOUT";
    readonly NetworkError: "NETWORK_ERROR";
    readonly Unsupported: "UNSUPPORTED";
    readonly InternalError: "INTERNAL_ERROR";
    readonly InvalidDid: "INVALID_DID";
    readonly RateLimited: "RATE_LIMITED";
    readonly AllResolversFailed: "ALL_RESOLVERS_FAILED";
};

Source: @openagentid/oas-resolve@1.0.2, dist/error.d.ts:6.

export type ResolveErrorCode = (typeof ResolveErrorCode)[keyof typeof ResolveErrorCode];

Source: @openagentid/oas-resolve@1.0.2, dist/error.d.ts:30.

Resolver

Interface for asynchronous OAS DID resolution.

Implementations resolve did:oas:* strings to their Identity Documents from various backends: in-memory maps, HTTP servers, DHT networks, MARS registries, etc.

The OAS SDK defines this interface; consumers implement it for their infrastructure. This is the agnosticism boundary.

Type-only declaration; it is not a runtime value.

export interface Resolver {
    resolve(did: string): Promise<OasDocument>;
}

Source: @openagentid/oas-resolve@1.0.2, dist/resolver.d.ts:19.

ResolverBackedLineageAuthorityOptions

Options for {@link ResolverBackedLineageAuthoritySource}.

Type-only declaration; it is not a runtime value.

export interface ResolverBackedLineageAuthorityOptions {
    readonly acceptedRootKinds?: readonly string[];
    readonly source?: string;
    readonly expectedOrgRootCommitment?: string;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:116.

ResolverBackedLineageAuthoritySource

LineageAuthoritySource implementation backed by resolver/GAL-shaped reads.

export declare class ResolverBackedLineageAuthoritySource implements LineageAuthoritySource {
    constructor(resolver: LineageAuthorityResolver, options?: ResolverBackedLineageAuthorityOptions);
    verifyAuthority(request: LineageAuthorityRequest): Promise<LineageAuthorityRecord>;
}

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:122.

ServiceEndpoint

A service endpoint declaration in an OAS Identity Document.

Services describe how to interact with the entity — API endpoints, communication channels, discovery mechanisms, etc.

Type-only declaration; it is not a runtime value.

export interface ServiceEndpoint {
    readonly id: string;
    readonly type: string;
    readonly serviceEndpoint: string;
    readonly label?: string;
    readonly description?: string;
    readonly properties?: Readonly<Record<string, string>>;
}

Source: @openagentid/oas-document@1.0.2, dist/service.d.ts:18.

signCredential

Signs an OAS Verifiable Credential with an Ed25519 keypair.

The credential is JCS-canonicalized (without the proof field), signed, and a proof is attached. The attestation type's required fields are validated before signing.

export declare function signCredential(credential: OasCredential, keypair: OasKeyPair, verificationMethodId: string, created: string): Promise<OasCredential>;

Source: @openagentid/oas-attestation@1.0.2, dist/sign.d.ts:44.

throws: {

link: AttestationError} on validation or signing failure.

StandardAttestationType

Type-only declaration; it is not a runtime value.

export type StandardAttestationType = (typeof AttestationType)[keyof typeof AttestationType];

Source: @openagentid/oas-attestation@1.0.2, dist/types.d.ts:21.

validateIdentifier

Validates an identifier string against OAS Spec rules.

A valid identifier:

• Is 1-128 characters long
• Contains only [a-zA-Z0-9._-] characters

export declare function validateIdentifier(identifier: string): void;

Source: @openagentid/oas-did@1.0.2, dist/validation.d.ts:21.

throws: {

link: DidError} with code {@link DidErrorCode.InvalidIdentifier } if validation fails.

validateNamespace

Validates a namespace string against OAS Spec rules.

A valid namespace:

• Is 1-63 characters long
• Contains only lowercase alphanumeric characters and hyphens
• Does not start or end with a hyphen

export declare function validateNamespace(namespace: string): void;

Source: @openagentid/oas-did@1.0.2, dist/namespace.d.ts:29.

throws: {

link: DidError} with code {@link DidErrorCode.InvalidNamespace } if validation fails.

validateSubject

Validates that a credential subject contains all required fields for its type.

export declare function validateSubject(type: AttestationTypeValue, subject: Record<string, unknown>): void;

Source: @openagentid/oas-attestation@1.0.2, dist/types.d.ts:40.

throws: {

link: AttestationError} if required fields are missing.

VC_CONTEXT

W3C Verifiable Credential context.

declare const VC_CONTEXT: "https://www.w3.org/2018/credentials/v1";

Source: @openagentid/oas-attestation@1.0.2, dist/credential.d.ts:5.

VerificationMethod

An Ed25519 verification method in an OAS Identity Document.

Verification methods bind public keys to the DID subject, enabling signature verification on documents, proofs, and attestations.

Type-only declaration; it is not a runtime value.

export interface VerificationMethod {
    readonly id: string;
    readonly type: 'Ed25519VerificationKey2020';
    readonly controller: string;
    readonly publicKeyMultibase: string;
}

Source: @openagentid/oas-document@1.0.2, dist/verification-method.d.ts:19.

verifyChain

Verifies the full lineage chain of an identity document.

Convenience wrapper around @openagentid/oas-lineage's verifyLineage.

export declare function verifyChain(document: OasDocument, provider: DocumentProvider, config?: VerifyConfig): Promise<VerifyResult>;

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:184.

throws: {

link: OasError} on verification failure.

VerifyConfig

Configuration for lineage chain verification.

Controls maximum chain depth, timeouts, and signature verification behavior.

Type-only declaration; it is not a runtime value.

export interface VerifyConfig {
    readonly maxGeneration: number;
    readonly perHopTimeoutMs: number;
    readonly totalTimeoutMs: number;
    readonly verifyDocumentSignatures: boolean;
}

Source: @openagentid/oas-lineage@1.0.2, dist/config.d.ts:13.

verifyConfigWithMaxGeneration

Creates a verification config with a custom max generation.

export declare function verifyConfigWithMaxGeneration(maxGeneration: number): VerifyConfig;

Source: @openagentid/oas-lineage@1.0.2, dist/config.d.ts:35.

verifyConfigWithTimeouts

Creates a verification config with custom timeouts.

export declare function verifyConfigWithTimeouts(perHopTimeoutMs: number, totalTimeoutMs: number): VerifyConfig;

Source: @openagentid/oas-lineage@1.0.2, dist/config.d.ts:43.

verifyCredential

Verifies an OAS Verifiable Credential's proof signature.

export declare function verifyCredential(credential: OasCredential, issuerPublicKeyBytes: Uint8Array): Promise<boolean>;

Source: @openagentid/oas-attestation@1.0.2, dist/verify.d.ts:18.

throws: {

link: AttestationError} if the credential is missing a proof.

verifyCredentialWithTime

Verifies a credential with temporal validation.

In addition to signature verification, checks:

• The credential is not expired (if expirationDate is set)
• The credential issuance date is not in the future

export declare function verifyCredentialWithTime(credential: OasCredential, issuerPublicKeyBytes: Uint8Array, now: string): Promise<boolean>;

Source: @openagentid/oas-attestation@1.0.2, dist/verify.d.ts:32.

throws: {

link: AttestationError} if temporal checks fail.

verifyDocumentProof

Verifies a document proof against the document content and a public key.

export declare function verifyDocumentProof(documentWithoutProof: Record<string, unknown>, proof: DocumentProof, publicKeyBytes: Uint8Array): Promise<boolean>;

Source: @openagentid/oas-document@1.0.2, dist/proof-format.d.ts:40.

throws: {

link: DocumentError} on decoding or verification errors.

verifyLineage

Verifies the full lineage chain of an OAS Identity Document.

Implements the OAS Spec Appendix C verification algorithm:

1. If the entity is a root, pass immediately
2. Verify lineage section exists for non-root entities
3. Verify chain terminates at a root entity
4. Verify generation number matches chain length
5. Verify chain depth does not exceed max generation
6. Walk the chain, verifying each lineage proof cryptographically
7. Verify root entity is not revoked

export declare function verifyLineage(doc: OasDocument, provider: DocumentProvider, config?: VerifyConfig): Promise<VerifyResult>;

Source: @openagentid/oas-lineage@1.0.2, dist/verify.d.ts:47.

throws: {

link: LineageError} on verification failure.

verifyLineageStructural

Performs structural (non-cryptographic) lineage verification.

Checks shape and consistency of the lineage section without resolving parent documents or verifying cryptographic proofs. Useful for cheap pre-validation before full verification.

export declare function verifyLineageStructural(doc: OasDocument, maxGeneration?: number): VerifyResult;

Source: @openagentid/oas-lineage@1.0.2, dist/verify.d.ts:60.

throws: {

link: LineageError} on structural validation failure.

verifyPrivilegedAuthority

Verifies local lineage and then requires Sigil-backed privileged authority.

Downstream systems should call this before issuing ACTs, credentials, sessions, org membership, wallet authority, or other privileged access. If the authority source is unavailable or rejects the request, this function fails closed.

export declare function verifyPrivilegedAuthority(document: OasDocument, provider: DocumentProvider, authoritySource: LineageAuthoritySource, options: {
    readonly config?: VerifyConfig;
    readonly pathKind: AuthorityPathKind;
    readonly requiredScopes?: readonly string[];
    readonly minFinalizedBlock?: number;
}): Promise<LineageAuthorityVerification>;

Source: @openagentid/oas-sdk@1.0.2, dist/lineage.d.ts:193.

VerifyResult

The result of a successful lineage verification.

Type-only declaration; it is not a runtime value.

export interface VerifyResult {
    readonly chainLength: number;
    readonly humanRootDid: string;
    readonly warnings: ReadonlyArray<string>;
}

Source: @openagentid/oas-lineage@1.0.2, dist/verify.d.ts:7.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

Affiliation

Type-only declaration; it is not a runtime value.

export interface Affiliation {
    readonly did: string;
    readonly relationship: string;
    readonly label?: string;
}

Source: @openagentid/oas-document@1.0.2, dist/relationships.d.ts:1.

ApiSchema

Type-only declaration; it is not a runtime value.

export interface ApiSchema {
    readonly schemaType: string;
    readonly url: string;
    readonly version?: string;
}

Source: @openagentid/oas-document@1.0.2, dist/interop.d.ts:6.

BookingEndpoint

Type-only declaration; it is not a runtime value.

export interface BookingEndpoint {
    readonly id: string;
    readonly url: string;
    readonly label?: string;
    readonly bookingType?: string;
    readonly visibility?: Visibility;
}

Source: @openagentid/oas-document@1.0.2, dist/calendar.d.ts:8.

CalendarSection

Type-only declaration; it is not a runtime value.

export interface CalendarSection {
    readonly bookingEndpoints?: ReadonlyArray<BookingEndpoint>;
    readonly availabilityFeed?: string;
    readonly schedulingProtocol?: string;
    readonly officeHours?: ReadonlyArray<ScheduleWindow>;
    readonly timezone?: string;
}

Source: @openagentid/oas-document@1.0.2, dist/calendar.d.ts:15.

Certification

Type-only declaration; it is not a runtime value.

export interface Certification {
    readonly standard: string;
    readonly issuer?: string;
    readonly validUntil?: string;
    readonly url?: string;
}

Source: @openagentid/oas-document@1.0.2, dist/compliance.d.ts:1.

ComplianceSection

Type-only declaration; it is not a runtime value.

export interface ComplianceSection {
    readonly jurisdictions?: ReadonlyArray<string>;
    readonly certifications?: ReadonlyArray<Certification>;
    readonly termsOfServiceUrl?: string;
    readonly privacyPolicyUrl?: string;
    readonly dataHandlingPolicyUrl?: string;
    readonly dataResidency?: string;
}

Source: @openagentid/oas-document@1.0.2, dist/compliance.d.ts:7.

ContactEntry

Type-only declaration; it is not a runtime value.

export interface ContactEntry {
    readonly id: string;
    readonly entryType: string;
    readonly value: string;
    readonly label?: string;
    readonly platform?: string;
    readonly handle?: string;
    readonly visibility?: Visibility;
    readonly verified?: boolean;
}

Source: @openagentid/oas-document@1.0.2, dist/contact.d.ts:2.

ContactSection

Type-only declaration; it is not a runtime value.

export interface ContactSection {
    readonly entries: ReadonlyArray<ContactEntry>;
}

Source: @openagentid/oas-document@1.0.2, dist/contact.d.ts:12.

CostEntry

Type-only declaration; it is not a runtime value.

export interface CostEntry {
    readonly unit: string;
    readonly amount: string;
    readonly currency: string;
}

Source: @openagentid/oas-document@1.0.2, dist/pricing.d.ts:2.

GovernancePolicy

Policy constraints governing how ENR transitions may occur.

Type-only declaration; it is not a runtime value.

export interface GovernancePolicy {
    readonly transitionRequires: string;
    readonly signingKeyRotationRequires: string;
    readonly maxTransitionsPerDay: number;
    readonly timelockHours: number;
}

Source: @openagentid/oas-document@1.0.2, dist/governance.d.ts:26.

GovernanceSection

Governance section attached to ENR identity documents.

Tracks the governing MHR, monotonic epoch counter, transition history, and governance policy constraints.

Invariants:

• epoch MUST strictly increase (no gaps, no rewinds).
• currentMhr MUST reference a valid, non-revoked MHR DID.
• Each transition's from MUST match the previous transition's to.

Type-only declaration; it is not a runtime value.