@openagentid/sdk/identity-verification

All packages · Runnable examples · Start an agent

Contract	Value
Package	@openagentid/sdk@0.7.2
Entry point	@openagentid/sdk/identity-verification
Availability	Current integration path
Reference source	Published TypeScript declarations
Package engines	node >=20

Before integrating

The published VERSION constant is still the literal "0.6.0" in the 0.7.2 archive. Use package metadata or your lockfile to identify the installed release; do not use VERSION as a release check.

When using @openagentid/crypto-wasm 0.1.1 for ACT verification, call the SDK verifier builder .atTime(Math.floor(Date.now() / 1000)) on every verification. The default WASM system-clock path traps in Node. Supply trusted receiver current epoch seconds; never token-supplied time or a timestamp captured once at startup. The complete ACT example covers this requirement.

In SDK 0.7.2, withAct and requireActExpress do not expose a verification-clock option. The raw crypto-wasm 0.1.1 binding alone therefore traps for these wrappers; use the tested fluent .atTime(...) example, or qualify a binding adapter that supplies fresh trusted receiver time on every verification.

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Condition	Published file
types	`./dist/identity-verification.d.ts`
import	`./dist/identity-verification.js`
require	`./dist/identity-verification.cjs`

AgentIdentityProof

Type-only declaration; it is not a runtime value.

Signature

interface AgentIdentityProof {
    readonly token: string;
    readonly delegations: readonly string[];
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:42.

assertVerifiedIdentity

Validate an authority verdict's root binding; this does not verify a signature.

Signature

declare function assertVerifiedIdentity(value: unknown, expectedDid?: string, now?: number): asserts value is VerifiedAgentIdentity;

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:109.

IdentityKeyPurpose

DID verification relationships authorized by the authoritative resolver.

Type-only declaration; it is not a runtime value.

Signature

type IdentityKeyPurpose = 'authentication' | 'capabilityDelegation' | 'assertionMethod' | 'capabilityInvocation' | 'keyAgreement';

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:48.

IdentityVerificationError

Signature

declare class IdentityVerificationError extends Error {
    readonly code: IdentityVerificationFailure;
    readonly name = "IdentityVerificationError";
    constructor(code: IdentityVerificationFailure, message: string);
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:103.

IdentityVerificationFailure

Type-only declaration; it is not a runtime value.

Signature

type IdentityVerificationFailure = 'invalid_proof' | 'untrusted_owner' | 'revoked' | 'replayed' | 'authority_unavailable';

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:102.

IdentityVerifier

Signed possession, authorized roots, delegation and live revocation checks.

Signature

declare class IdentityVerifier {
    constructor(config: IdentityVerifierConfig);
    verify(proof: AgentIdentityProof, options: VerifyIdentityOptions): Promise<VerifiedAgentIdentity>;
    verifyLineage(did: string, delegations: readonly string[], options: {
        audience: string;
    }): Promise<VerifiedAgentIdentity>;
    resolve(did: string, options: {
        audience: string;
    }): Promise<VerifiedAgentIdentity>;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:111.

IdentityVerifierConfig

Type-only declaration; it is not a runtime value.

Signature

interface IdentityVerifierConfig {
    resolveDid(did: string): Promise<ResolvedIdentityDocument | null>;
    authorizeOwner(rootDid: string): Promise<VerifiedOwner | null>;
    authorizeSelfRoot?(rootDid: string, options: {
        audience: string;
    }): Promise<SelfRootAuthorization | null>;
    checkRevocation(check: RevocationCheck): Promise<{
        revoked: boolean;
        checkedAt: number;
    }>;
    replay: {
        consume(claim: ReplayClaim): Promise<boolean>;
    };
    resolveDelegations?(did: string, audience: string): Promise<readonly string[]>;
    now?: () => number;
    maxProofAgeSeconds?: number;
    maxDelegationAgeSeconds?: number;
    maxRevocationAgeSeconds?: number;
    maxDepth?: number;
    clockToleranceSeconds?: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:70.

ReplayClaim

Type-only declaration; it is not a runtime value.

Signature

interface ReplayClaim {
    readonly issuer: string;
    readonly tokenId: string;
    readonly audience: string;
    readonly nonce: string;
    readonly expiresAt: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:63.

ResolvedIdentityDocument

Type-only declaration; it is not a runtime value.

Signature

interface ResolvedIdentityDocument {
    readonly did: string;
    readonly verificationMethods: readonly {
        readonly id: string;
        readonly publicKeyJwk: JWK;
        readonly purposes: readonly IdentityKeyPurpose[];
    }[];
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:49.

RevocationCheck

Type-only declaration; it is not a runtime value.

Signature

interface RevocationCheck {
    readonly did: string;
    readonly issuerDid?: string;
    readonly credentialId?: string;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:58.

SelfRootAuthorization

Current, server-authorized self-root registration; never supplied by the proof.

Type-only declaration; it is not a runtime value.

Signature

interface SelfRootAuthorization {
    readonly did: string;
    readonly audience: string;
    readonly authorizationId: string;
    readonly revision: string;
    readonly issuedAt: number;
    readonly notBefore: number;
    readonly expiresAt: number;
    readonly checkedAt: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:32.

VerifiedAgentIdentity

Current identity trust. This grants no application scopes or tenant access.

Type-only declaration; it is not a runtime value.

Signature

type VerifiedAgentIdentity = CommonAgentIdentity & ({
    readonly owner: VerifiedOwner;
    readonly root?: {
        readonly kind: 'lifeid';
        readonly did: string;
    };
} | {
    readonly owner: null;
    readonly root: {
        readonly kind: 'self';
        readonly did: string;
        readonly authorizationId: string;
        readonly revision: string;
    };
});

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:16.

VerifiedOwner

Type-only declaration; it is not a runtime value.

Signature

interface VerifiedOwner {
    readonly issuer: string;
    readonly subject: string;
    readonly organizationId?: string;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:3.

VerifyIdentityOptions

Type-only declaration; it is not a runtime value.

Signature

interface VerifyIdentityOptions {
    readonly audience: string;
    readonly nonce: string;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:97.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

CommonAgentIdentity

Type-only declaration; it is not a runtime value.

Signature

interface CommonAgentIdentity {
    readonly did: string;
    readonly lineage: readonly string[];
    readonly expiresAt: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:8.

Package requirements

Dependencies

Package	Published range
zod	`^3.23.8`
jose	`^5.10.0`
@noble/hashes	`^1.8.0`
@scure/base	`^1.2.6`

Peer dependencies

Package	Published range	Optional
@openagentid/aegis-sdk	`^0.1.0`	Yes
@openagentid/arsenal-sdk	`^0.1.0`	Yes
@openagentid/crypto-wasm	`^0.1.0`	Yes
@openagentid/oas-sdk	`^1.0.2`	Yes

Archive verification

Pinned integrity:

SHA-512 integrity

sha512-9YlDb02di8sGffhuMOwNAQa/M3oBrhaqPc7t+qBltdoQRCqlxDmYB/nTRSB4eZgwE4lvM4TKzI72nJtJSVm/ww==

Machine-readable API manifest · Coverage

On this page