@openagentid/oidc

All packages · Runnable examples · Start an agent

Contract	Value
Package	@openagentid/oidc@0.2.0
Entry point	@openagentid/oidc
Availability	Current integration path
Reference source	Published TypeScript declarations
Package engines	node >=20.19.0

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Condition	Published file
types	`./dist/index.d.ts`
import	`./dist/index.js`
require	`./dist/index.cjs`

Exports

ActJwtClaims — type
AgentIdentityProof — type
AgentIdentityRoot — type
AgentInteraction — type
AgentOidcProvider
AgentOidcProviderOptions — type
AgentOwner — type
BridgeIdentityHooks — type
buildActClaims
createAgentOidcProvider
createJwtToActRequest
decodeJwtHeader
deriveAgentFromClaims
DerivedAgent — type
DiscoveryClient
DiscoveryDocument — type
discoveryDocumentSchema
exchangeErrors
extractUnverifiedIssuer
findProvider
GRANT_TYPE_TOKEN_EXCHANGE
hmrIdentifierFromClaims
IdentityDeriver — type
JwksClient
LifeIdAgentRoot — type
LifeIdFederation
LifeIdFederationOptions — type
mapScopes
OidcBridge
OidcBridgeError
OidcConfig — type
oidcConfigSchema
OidcErrorCode — type
ownerFromLifeIdClaims
parseScopes
ProviderConfig — type
providerConfigSchema
resolveFetch
SelfAgentRoot — type
signActJwt
singleProviderConfig
SingleProviderInput — type
successResponse
TOKEN_TYPE_ACCESS
TOKEN_TYPE_ACT
TOKEN_TYPE_JWT
TokenExchangeError — type
TokenExchangeRequest — type
tokenExchangeRequestSchema
TokenExchangeResponse — type
ValidatedClaims — type
validateDerivedAgent
validateExchangeRequest
validateJwt
VerifiedAgentIdentity — type
VerifyAgentContext — type
VERSION
wellKnownUrl

ActJwtClaims

Claims for an outbound JWT wrapping an Arsenal ACT (Flow 2).

Type-only declaration; it is not a runtime value.

Signature

interface ActJwtClaims {
    readonly sub: string;
    readonly iss: string;
    readonly aud?: string;
    readonly exp: number;
    readonly iat: number;
    readonly jti: string;
    readonly scope: string;
    readonly lineage_depth: number;
    readonly parent_hmr: string;
    readonly act: string;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:244.

AgentIdentityProof

Type-only declaration; it is not a runtime value.

Signature

interface AgentIdentityProof {
    readonly token: string;
    readonly delegations: readonly string[];
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:562.

AgentIdentityRoot

Type-only declaration; it is not a runtime value.

Signature

type AgentIdentityRoot = LifeIdAgentRoot | SelfAgentRoot;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:581.

AgentInteraction

Type-only declaration; it is not a runtime value.

Signature

interface AgentInteraction {
    readonly nonce: string;
    readonly audience: string;
    readonly clientId: string;
    readonly scopes: readonly string[];
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:641.

AgentOidcProvider

Complete OIDC code-flow provider with a mandatory verified agent login boundary.

Signature

declare class AgentOidcProvider {
    readonly provider: Provider;
    static create(options: AgentOidcProviderOptions): Promise<AgentOidcProvider>;
    callback(): ReturnType<Provider["callback"]>;
    interaction(req: IncomingMessage, res: ServerResponse): Promise<AgentInteraction>;
    completeInteraction(req: IncomingMessage, res: ServerResponse, input: {
        proof: AgentIdentityProof;
        consent: true;
        lifeIdToken?: string;
    }): Promise<void>;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:648.

AgentOidcProviderOptions

Type-only declaration; it is not a runtime value.

Signature

interface AgentOidcProviderOptions {
    readonly issuer: string;
    readonly clients: readonly ClientMetadata[];
    readonly jwks: {
        readonly keys: readonly JWK[];
    };
    readonly cookieKeys: readonly string[];
    readonly adapter: AdapterConstructor;
    readonly persistent: boolean;
    readonly mode?: 'production' | 'test';
    readonly trustProxy?: boolean;
    readonly tokenTtlSeconds?: number;
    readonly verifyAgent: (proof: AgentIdentityProof, context: VerifyAgentContext) => Promise<VerifiedAgentIdentity>;
    readonly resolveIdentity: (did: string) => Promise<VerifiedAgentIdentity>;
    readonly lifeId?: LifeIdFederationOptions;
    readonly requireLifeId?: boolean;
    readonly allowSelfRooted?: boolean;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:617.

AgentOwner

Structural contract shared with the SDK's IdentityVerifier.

Type-only declaration; it is not a runtime value.

Signature

interface AgentOwner {
    readonly issuer: string;
    readonly subject: string;
    readonly organizationId?: string;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:557.

BridgeIdentityHooks

The OIDC bridge -- maps between human OIDC tokens and OAS agent identities.

Type-only declaration; it is not a runtime value.

Signature

interface BridgeIdentityHooks {
    deriveAgent?: (namespace: string, claims: ValidatedClaims, agentName: string) => DerivedAgent | Promise<DerivedAgent>;
    mintCapability?: (input: {
        agent: DerivedAgent;
        subject: ValidatedClaims;
        scopes: readonly string[];
        request: TokenExchangeRequest;
    }) => Promise<{
        actB64: string;
        scopes: readonly string[];
        expiresIn: number;
    }>;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:365.

buildActClaims

Build ACT JWT claims.

Signature

declare function buildActClaims(opts: {
    agentDid: string;
    bridgeIssuer: string;
    audience?: string;
    scopes: readonly string[];
    lineageDepth: number;
    parentHmr: string;
    actB64: string;
    ttlSeconds: number;
}): ActJwtClaims;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:280.

createAgentOidcProvider

Signature

declare const createAgentOidcProvider: typeof AgentOidcProvider.create;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:665.

createJwtToActRequest

Create a token exchange request for JWT -> ACT exchange.

Signature

declare function createJwtToActRequest(subjectToken: string, scopes?: readonly string[]): TokenExchangeRequest;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:203.

decodeJwtHeader

Decode the JWT header without verification (to get kid/alg).

Signature

declare function decodeJwtHeader(token: string): {
    kid?: string;
    alg?: string;
};

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:267.

deriveAgentFromClaims

No fallback identity is issued when real custody/derivation is unconfigured.

Signature

declare function deriveAgentFromClaims(namespace: string, claims: ValidatedClaims, agentName: string, derive?: IdentityDeriver): DerivedAgent;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:327.

DerivedAgent

Result of deriving an agent DID from a human JWT.

Type-only declaration; it is not a runtime value.

Signature

interface DerivedAgent {
    readonly agentDid: string;
    readonly agentKeypair: {
        readonly publicKey: Uint8Array;
        readonly privateKey: Uint8Array;
    };
    readonly lineageProof: Record<string, unknown> | null;
    readonly parentHmrDid: string;
    readonly lineageDepth: number;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:301.

DiscoveryClient

OIDC discovery client with per-issuer caching.

Signature

declare class DiscoveryClient {
    constructor(fetchImpl: typeof globalThis.fetch, timeoutMs?: number, cacheTtlMs?: number);
    discover(issuer: string): Promise<DiscoveryDocument>;
    invalidate(issuer: string): void;
    invalidateAll(): void;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:488.

DiscoveryDocument

Type-only declaration; it is not a runtime value.

Signature

type DiscoveryDocument = z.infer<typeof discoveryDocumentSchema>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:484.

discoveryDocumentSchema

Subset of the OpenID Connect Discovery document we need.

Signature

declare const discoveryDocumentSchema: z.ZodObject<{
    issuer: z.ZodString;
    authorization_endpoint: z.ZodDefault<z.ZodString>;
    token_endpoint: z.ZodDefault<z.ZodString>;
    jwks_uri: z.ZodString;
    response_types_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    subject_types_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    id_token_signing_alg_values_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    scopes_supported: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    token_exchange_endpoint: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    issuer: string;
    authorization_endpoint: string;
    token_endpoint: string;
    jwks_uri: string;
    response_types_supported: string[];
    subject_types_supported: string[];
    id_token_signing_alg_values_supported: string[];
    scopes_supported: string[];
    token_exchange_endpoint?: string | undefined;
}, {
    issuer: string;
    jwks_uri: string;
    authorization_endpoint?: string | undefined;
    token_endpoint?: string | undefined;
    response_types_supported?: string[] | undefined;
    subject_types_supported?: string[] | undefined;
    id_token_signing_alg_values_supported?: string[] | undefined;
    scopes_supported?: string[] | undefined;
    token_exchange_endpoint?: string | undefined;
}>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:453.

exchangeErrors

Create standard OAuth2 error responses.

Signature

declare const exchangeErrors: {
    readonly invalidRequest: (desc: string) => TokenExchangeError;
    readonly invalidGrant: (desc: string) => TokenExchangeError;
    readonly unsupportedTokenType: (desc: string) => TokenExchangeError;
    readonly invalidTarget: (desc: string) => TokenExchangeError;
};

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:211.

extractUnverifiedIssuer

Extract the unverified iss claim from a JWT.

Signature

declare function extractUnverifiedIssuer(token: string): string;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:272.

findProvider

Find the provider config whose issuer matches the given string.

Signature

declare function findProvider(config: OidcConfig, issuer: string): ProviderConfig | undefined;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:137.

GRANT_TYPE_TOKEN_EXCHANGE

Standard grant type for RFC 8693 Token Exchange.

Signature

declare const GRANT_TYPE_TOKEN_EXCHANGE: "urn:ietf:params:oauth:grant-type:token-exchange";

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:149.

hmrIdentifierFromClaims

Deterministic identifier for an HMR derived from an OIDC subject.

Uses issuer + subject to produce a stable, collision-resistant identifier that doesn't leak PII.

Signature

declare function hmrIdentifierFromClaims(issuer: string, hmrValue: string): string;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:322.

IdentityDeriver

Real identity custody/derivation hook. The host must authorize the human owner.

Type-only declaration; it is not a runtime value.

Signature

type IdentityDeriver = (namespace: string, claims: ValidatedClaims, agentName: string) => DerivedAgent;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:324.

JwksClient

JWKS client with per-URI caching and rotation-aware refresh.

Signature

declare class JwksClient {
    constructor(fetchImpl: typeof globalThis.fetch, timeoutMs?: number, cacheTtlMs?: number);
    fetchJwks(jwksUri: string): Promise<jose.JSONWebKeySet>;
    refresh(jwksUri: string): Promise<jose.JSONWebKeySet>;
    static selectKey(jwks: jose.JSONWebKeySet, kid: string | undefined, alg: string | undefined): jose.JWK;
    invalidate(jwksUri: string): void;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:539.

LifeIdAgentRoot

Type-only declaration; it is not a runtime value.

Signature

interface LifeIdAgentRoot {
    readonly kind: 'lifeid';
    readonly did: string;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:571.

LifeIdFederation

Signature

declare class LifeIdFederation {
    constructor(options: LifeIdFederationOptions);
    verifyHumanToken(token: string, expectedOwner: AgentOwner): Promise<AgentOwner>;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:607.

LifeIdFederationOptions

Type-only declaration; it is not a runtime value.

Signature

interface LifeIdFederationOptions {
    readonly issuer: string;
    readonly audience: string;
    readonly jwksUri: string;
    readonly algorithms?: readonly ('RS256' | 'EdDSA')[];
    readonly organizationClaim?: string;
    readonly fetch?: typeof globalThis.fetch;
    readonly test?: boolean;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:594.

mapScopes

Map OIDC scopes/roles to Arsenal capability scopes.

Unmapped scopes are passed through as-is.

Signature

declare function mapScopes(oidcScopes: readonly string[], scopeMapping: Readonly<Record<string, readonly string[]>>): string[];

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:333.

OidcBridge

Signature

declare class OidcBridge {
    constructor(input: OidcConfig | SingleProviderInput, hooks?: BridgeIdentityHooks);
    getConfig(): Readonly<OidcConfig>;
    deriveAgentFromJwt(token: string, agentName: string): Promise<DerivedAgent>;
    actToJwt(claims: ActJwtClaims, signingKey: jose.KeyLike | Uint8Array, algorithm: string, kid?: string): Promise<string>;
    wrapActAsJwt(opts: {
        agentDid: string;
        bridgeIssuer: string;
        audience?: string;
        scopes: readonly string[];
        lineageDepth: number;
        parentHmr: string;
        actB64: string;
        signingKey: jose.KeyLike | Uint8Array;
        algorithm: string;
        kid?: string;
    }): Promise<string>;
    exchangeToken(humanJwt: string, requestedScopes: readonly string[], signingKey?: jose.KeyLike | Uint8Array, algorithm?: string, bridgeIssuer?: string): Promise<TokenExchangeResponse>;
    executeExchange(request: TokenExchangeRequest, signingKey: jose.KeyLike | Uint8Array | undefined, algorithm: string, bridgeIssuer: string): Promise<TokenExchangeResponse>;
    validateJwt(token: string): Promise<ValidatedClaims>;
    refreshAllJwks(): Promise<void>;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:380.

OidcBridgeError

Base error class for all OIDC bridge errors.

Signature

declare class OidcBridgeError extends Error {
    readonly code: OidcErrorCode;
    constructor(code: OidcErrorCode, message: string);
    static config(message: string): OidcBridgeError;
    static discovery(message: string): OidcBridgeError;
    static jwks(message: string): OidcBridgeError;
    static jwtValidation(message: string): OidcBridgeError;
    static unknownIssuer(issuer: string): OidcBridgeError;
    static mapping(message: string): OidcBridgeError;
    static exchange(message: string): OidcBridgeError;
    static signing(message: string): OidcBridgeError;
    static transport(message: string): OidcBridgeError;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:508.

OidcConfig

Type-only declaration; it is not a runtime value.

Signature

type OidcConfig = z.infer<typeof oidcConfigSchema>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:110.

oidcConfigSchema

Top-level OIDC bridge configuration.

Signature

declare const oidcConfigSchema: z.ZodObject<{
    providers: z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        issuer: z.ZodString;
        audience: z.ZodOptional<z.ZodString>;
        jwksUrl: z.ZodOptional<z.ZodString>;
        hmrClaim: z.ZodDefault<z.ZodString>;
        scopeMapping: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
    }, "strip", z.ZodTypeAny, {
        name: string;
        issuer: string;
        hmrClaim: string;
        scopeMapping: Record<string, string[]>;
        audience?: string | undefined;
        jwksUrl?: string | undefined;
    }, {
        name: string;
        issuer: string;
        audience?: string | undefined;
        jwksUrl?: string | undefined;
        hmrClaim?: string | undefined;
        scopeMapping?: Record<string, string[]> | undefined;
    }>, "many">;
    namespace: z.ZodDefault<z.ZodString>;
    jwtTtlSeconds: z.ZodDefault<z.ZodNumber>;
    httpTimeoutMs: z.ZodDefault<z.ZodNumber>;
    fetch: z.ZodOptional<z.ZodFunction<z.ZodTuple<[
    ], z.ZodUnknown>, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    providers: {
        name: string;
        issuer: string;
        hmrClaim: string;
        scopeMapping: Record<string, string[]>;
        audience?: string | undefined;
        jwksUrl?: string | undefined;
    }[];
    namespace: string;
    jwtTtlSeconds: number;
    httpTimeoutMs: number;
    fetch?: ((...args: unknown[]) => unknown) | undefined;
}, {
    providers: {
        name: string;
        issuer: string;
        audience?: string | undefined;
        jwksUrl?: string | undefined;
        hmrClaim?: string | undefined;
        scopeMapping?: Record<string, string[]> | undefined;
    }[];
    namespace?: string | undefined;
    jwtTtlSeconds?: number | undefined;
    httpTimeoutMs?: number | undefined;
    fetch?: ((...args: unknown[]) => unknown) | undefined;
}>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:45.

OidcErrorCode

Error codes for OIDC bridge errors.

Type-only declaration; it is not a runtime value.

Signature

type OidcErrorCode = 'DISCOVERY_ERROR' | 'JWKS_ERROR' | 'JWT_VALIDATION_ERROR' | 'UNKNOWN_ISSUER' | 'MAPPING_ERROR' | 'EXCHANGE_ERROR' | 'SIGNING_ERROR' | 'CONFIG_ERROR' | 'TRANSPORT_ERROR';

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:506.

ownerFromLifeIdClaims

Normalize known human owner aliases without inventing an agent principal.

Signature

declare function ownerFromLifeIdClaims(claims: JWTPayload, organizationClaim?: string): AgentOwner;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:606.

parseScopes

Parse scopes from a space-delimited string.

Signature

declare function parseScopes(scope: string | undefined): string[];

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:207.

ProviderConfig

Type-only declaration; it is not a runtime value.

Signature

type ProviderConfig = z.infer<typeof providerConfigSchema>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:43.

providerConfigSchema

Configuration for a single OIDC provider.

Signature

declare const providerConfigSchema: z.ZodObject<{
    name: z.ZodString;
    issuer: z.ZodString;
    audience: z.ZodOptional<z.ZodString>;
    jwksUrl: z.ZodOptional<z.ZodString>;
    hmrClaim: z.ZodDefault<z.ZodString>;
    scopeMapping: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
}, "strip", z.ZodTypeAny, {
    name: string;
    issuer: string;
    hmrClaim: string;
    scopeMapping: Record<string, string[]>;
    audience?: string | undefined;
    jwksUrl?: string | undefined;
}, {
    name: string;
    issuer: string;
    audience?: string | undefined;
    jwksUrl?: string | undefined;
    hmrClaim?: string | undefined;
    scopeMapping?: Record<string, string[]> | undefined;
}>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:15.

resolveFetch

Resolve the fetch implementation from config or globalThis.

Signature

declare function resolveFetch(config: OidcConfig): typeof globalThis.fetch;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:139.

SelfAgentRoot

Type-only declaration; it is not a runtime value.

Signature

interface SelfAgentRoot {
    readonly kind: 'self';
    readonly did: string;
    readonly authorizationId: string;
    readonly revision: string;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:575.

signActJwt

Sign a JWT wrapping an Arsenal ACT for OAuth2-only services.

Signature

declare function signActJwt(claims: ActJwtClaims, signingKey: jose.KeyLike | Uint8Array, algorithm: string, kid?: string): Promise<string>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:291.

singleProviderConfig

Build an OidcConfig from a single-provider shorthand input.

Signature

declare function singleProviderConfig(input: SingleProviderInput): OidcConfig;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:135.

SingleProviderInput

Shorthand input for single-provider setup.

Type-only declaration; it is not a runtime value.

Signature

interface SingleProviderInput {
    name?: string;
    issuer: string;
    audience?: string;
    jwksUrl?: string;
    hmrClaim?: string;
    scopeMapping?: Record<string, string[]>;
    namespace?: string;
    jwtTtlSeconds?: number;
    httpTimeoutMs?: number;
    fetch?: typeof globalThis.fetch;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:112.

successResponse

Build a successful token exchange response.

Signature

declare function successResponse(accessToken: string, issuedTokenType: string, expiresIn: number, scope?: string): TokenExchangeResponse;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:209.

TOKEN_TYPE_ACCESS

Standard token type for access tokens.

Signature

declare const TOKEN_TYPE_ACCESS: "urn:ietf:params:oauth:token-type:access_token";

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:155.

TOKEN_TYPE_ACT

Custom token type for OpenAgent ACTs.

Signature

declare const TOKEN_TYPE_ACT: "urn:openagent:token-type:act";

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:153.

TOKEN_TYPE_JWT

Standard token type for JWT subject tokens.

Signature

declare const TOKEN_TYPE_JWT: "urn:ietf:params:oauth:token-type:jwt";

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:151.

TokenExchangeError

RFC 8693 error response.

Type-only declaration; it is not a runtime value.

Signature

interface TokenExchangeError {
    readonly error: string;
    readonly errorDescription?: string;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:198.

TokenExchangeRequest

Type-only declaration; it is not a runtime value.

Signature

type TokenExchangeRequest = z.infer<typeof tokenExchangeRequestSchema>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:188.

tokenExchangeRequestSchema

Token exchange request (RFC 8693 Section 2.1).

Signature

declare const tokenExchangeRequestSchema: z.ZodObject<{
    grantType: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
    subjectToken: z.ZodString;
    subjectTokenType: z.ZodEnum<[
        "urn:ietf:params:oauth:token-type:jwt",
        "urn:ietf:params:oauth:token-type:access_token"
    ]>;
    requestedTokenType: z.ZodOptional<z.ZodEnum<[
        "urn:openagent:token-type:act",
        "urn:ietf:params:oauth:token-type:jwt",
        "urn:ietf:params:oauth:token-type:access_token"
    ]>>;
    scope: z.ZodOptional<z.ZodString>;
    audience: z.ZodOptional<z.ZodString>;
    resource: z.ZodOptional<z.ZodString>;
    actorToken: z.ZodOptional<z.ZodString>;
    actorTokenType: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
    subjectToken: string;
    subjectTokenType: "urn:ietf:params:oauth:token-type:jwt" | "urn:ietf:params:oauth:token-type:access_token";
    audience?: string | undefined;
    requestedTokenType?: "urn:ietf:params:oauth:token-type:jwt" | "urn:openagent:token-type:act" | "urn:ietf:params:oauth:token-type:access_token" | undefined;
    scope?: string | undefined;
    resource?: string | undefined;
    actorToken?: string | undefined;
    actorTokenType?: string | undefined;
}, {
    grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
    subjectToken: string;
    subjectTokenType: "urn:ietf:params:oauth:token-type:jwt" | "urn:ietf:params:oauth:token-type:access_token";
    audience?: string | undefined;
    requestedTokenType?: "urn:ietf:params:oauth:token-type:jwt" | "urn:openagent:token-type:act" | "urn:ietf:params:oauth:token-type:access_token" | undefined;
    scope?: string | undefined;
    resource?: string | undefined;
    actorToken?: string | undefined;
    actorTokenType?: string | undefined;
}>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:157.

TokenExchangeResponse

Token exchange response (RFC 8693 Section 2.2).

Type-only declaration; it is not a runtime value.

Signature

interface TokenExchangeResponse {
    readonly accessToken: string;
    readonly issuedTokenType: string;
    readonly tokenType: 'Bearer';
    readonly expiresIn: number;
    readonly scope?: string;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:190.

ValidatedClaims

Claims extracted from a validated human JWT.

Type-only declaration; it is not a runtime value.

Signature

interface ValidatedClaims {
    readonly issuer: string;
    readonly subject: string;
    readonly audience: readonly string[];
    readonly exp: number;
    readonly iat: number;
    readonly hmrValue: string;
    readonly scopes: readonly string[];
    readonly rawClaims: Readonly<Record<string, unknown>>;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:225.

validateDerivedAgent

Signature

declare function validateDerivedAgent(agent: DerivedAgent): DerivedAgent;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:325.

validateExchangeRequest

Validate a token exchange request.

Signature

declare function validateExchangeRequest(request: TokenExchangeRequest): void;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:205.

validateJwt

Validate and decode a JWT using the given JWK.

Performs standard OIDC validation: issuer, audience, expiry, signature.

Signature

declare function validateJwt(token: string, jwk: jose.JWK, provider: ProviderConfig): Promise<ValidatedClaims>;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:278.

VerifiedAgentIdentity

Type-only declaration; it is not a runtime value.

Signature

type VerifiedAgentIdentity = VerifiedIdentityFields & ({
    readonly owner: AgentOwner;
    readonly root?: LifeIdAgentRoot;
} | {
    readonly owner: null;
    readonly root: SelfAgentRoot;
});

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:582.

VerifyAgentContext

Type-only declaration; it is not a runtime value.

Signature

interface VerifyAgentContext {
    readonly audience: string;
    readonly nonce: string;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:589.

VERSION

SDK version.

Signature

declare const VERSION = "0.2.0";

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:699.

wellKnownUrl

Build the .well-known/openid-configuration URL from an issuer.

Signature

declare function wellKnownUrl(issuer: string): string;

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:486.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

VerifiedIdentityFields

Type-only declaration; it is not a runtime value.

Signature

interface VerifiedIdentityFields {
    readonly did: string;
    readonly lineage: readonly string[];
    readonly expiresAt: number;
}

Source: @openagentid/oidc@0.2.0, dist/index.d.ts:566.

Package requirements

Dependencies

Package	Published range
jose	`^5.10.0`
zod	`^3.23.8`
oidc-provider	`9.12.2`
@types/oidc-provider	`9.12.1`

Peer dependencies

Package	Published range	Optional
@openagentid/arsenal-sdk	`^0.1.0`	Yes
@openagentid/oas-sdk	`^1.0.2`	Yes

Archive verification

Pinned integrity:

SHA-512 integrity

sha512-STeQ3hQ62m52e7uYNuyiDlO7f+MWdLekhZ8G9Yq0Dk6GcFYKBi6Bjwd1BJoKqg1FtJqm5ie3X2Ks7pbFMxTK0w==

Machine-readable API manifest · Coverage

On this page