@openagentid/sdk/oats

All packages · Runnable examples · Start an agent

Contract	Value
Package	@openagentid/sdk@0.7.2
Entry point	@openagentid/sdk/oats
Availability	Current integration path
Reference source	Published TypeScript declarations
Package engines	node >=20

Before integrating

The published VERSION constant is still the literal "0.6.0" in the 0.7.2 archive. Use package metadata or your lockfile to identify the installed release; do not use VERSION as a release check.

When using @openagentid/crypto-wasm 0.1.1 for ACT verification, call the SDK verifier builder .atTime(Math.floor(Date.now() / 1000)) on every verification. The default WASM system-clock path traps in Node. Supply trusted receiver current epoch seconds; never token-supplied time or a timestamp captured once at startup. The complete ACT example covers this requirement.

In SDK 0.7.2, withAct and requireActExpress do not expose a verification-clock option. The raw crypto-wasm 0.1.1 binding alone therefore traps for these wrappers; use the tested fluent .atTime(...) example, or qualify a binding adapter that supplies fresh trusted receiver time on every verification.

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Condition	Published file
types	`./dist/oats.d.ts`
import	`./dist/oats.js`
require	`./dist/oats.cjs`

createOatsEvidenceVerifier

Concrete OAS Ed25519Signature2020 verifier. It verifies upstream JCS signing bytes, assertion-authorized issuer keys, authoritative owner chains and current attestation revocation. No cryptographic work is delegated to callers.

Signature

declare function createOatsEvidenceVerifier(config: OatsEvidenceVerifierConfig): OatsEvidenceVerifier;

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:99.

OATS_WEIGHTS

Signature

declare const OATS_WEIGHTS: Readonly<{
    SecurityAudit: 0.3;
    BenchmarkResult: 0.25;
    ExpertEndorsement: 0.2;
    PublisherBond: 0.15;
    CommunityReview: 0.1;
}>;

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:4.

OatsComponentScore

Type-only declaration; it is not a runtime value.

Signature

interface OatsComponentScore {
    readonly rawScore: number;
    readonly weight: number;
    readonly evidenceCount: number;
    readonly latestEvidence: string | null;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:76.

OatsCompositeScore

Type-only declaration; it is not a runtime value.

Signature

interface OatsCompositeScore {
    readonly entityDid: string;
    readonly components: Readonly<Record<OatsEvidenceType, OatsComponentScore>>;
    readonly composite: number;
    readonly confidence: number;
    readonly evidenceCount: number;
    readonly computedAt: string;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:82.

OatsCredential

An OAS VC; the adapter verifies its complete signed body and proof.

Type-only declaration; it is not a runtime value.

Signature

interface OatsCredential {
    readonly id: string;
    readonly issuer: string;
    readonly issuanceDate: string;
    readonly expirationDate?: string;
    readonly type: readonly string[];
    readonly oasAttestationType?: OatsEvidenceType;
    readonly credentialSubject: Readonly<Record<string, unknown>> & {
        readonly id: string;
    };
    readonly proof: Readonly<Record<string, unknown>>;
    readonly [extension: string]: unknown;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:13.

OatsError

Signature

declare class OatsError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:90.

OatsEvidenceType

Type-only declaration; it is not a runtime value.

Signature

type OatsEvidenceType = keyof typeof OATS_WEIGHTS;

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:11.

OatsEvidenceVerifier

Resolve keys from an authoritative source, verify the entire credential, and verify current identity roots, signed lineage and revocation for issuer and subject. Never derive trusted keys or owner bindings from the submitted credential itself.

Type-only declaration; it is not a runtime value.

Signature

type OatsEvidenceVerifier = (credential: OatsCredential, context: OatsVerificationContext) => Promise<VerifiedOatsEvidence>;

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:49.

OatsEvidenceVerifierConfig

Type-only declaration; it is not a runtime value.

Signature

interface OatsEvidenceVerifierConfig {
    readonly audience: string;
    readonly identity: IdentityVerifierConfig & {
        resolveDelegations(did: string, audience: string): Promise<readonly string[]>;
    };
    resolveIssuerAssertionMethods(did: string): Promise<OatsIssuerAssertionDocument | null>;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:59.

OatsIssuerAssertionDocument

Keys already authorized for assertionMethod by the authoritative OAS resolver.

Type-only declaration; it is not a runtime value.

Signature

interface OatsIssuerAssertionDocument {
    readonly did: string;
    readonly assertionMethods: readonly {
        readonly id: string;
        readonly controller: string;
        readonly publicKeyJwk: JWK;
    }[];
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:51.

oatsMeetsThreshold

Both verified composite and confidence must meet the bounded thresholds.

Signature

declare function oatsMeetsThreshold(score: OatsCompositeScore, minimumComposite: number, minimumConfidence: number): boolean;

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:109.

OatsScorerOptions

Type-only declaration; it is not a runtime value.

Signature

interface OatsScorerOptions {
    readonly trustedIssuers: readonly string[];
    readonly verifyEvidence: OatsEvidenceVerifier;
    readonly now?: () => Date;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:69.

OatsVerificationContext

Type-only declaration; it is not a runtime value.

Signature

interface OatsVerificationContext {
    readonly credentialId: string;
    readonly issuerDid: string;
    readonly subjectDid: string;
    readonly now: string;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:26.

VerifiedOatsEvidence

Return only after the exact credential signature and both identities pass.

Type-only declaration; it is not a runtime value.

Signature

interface VerifiedOatsEvidence {
    readonly credentialId: string;
    readonly issuerDid: string;
    readonly subjectDid: string;
    readonly signatureVerified: true;
    readonly credentialRevocationChecked: true;
    readonly issuer: VerifiedAgentIdentity;
    readonly subject: VerifiedAgentIdentity;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:34.

VerifiedOatsScorer

Signature

declare class VerifiedOatsScorer {
    constructor(options: OatsScorerOptions);
    score(entityDid: string, credentials: readonly unknown[]): Promise<OatsCompositeScore>;
}

Source: @openagentid/sdk@0.7.2, dist/oats.d.ts:100.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

CommonAgentIdentity

Type-only declaration; it is not a runtime value.

Signature

interface CommonAgentIdentity {
    readonly did: string;
    readonly lineage: readonly string[];
    readonly expiresAt: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:8.

IdentityKeyPurpose

DID verification relationships authorized by the authoritative resolver.

Type-only declaration; it is not a runtime value.

Signature

type IdentityKeyPurpose = 'authentication' | 'capabilityDelegation' | 'assertionMethod' | 'capabilityInvocation' | 'keyAgreement';

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:48.

IdentityVerifierConfig

Type-only declaration; it is not a runtime value.

Signature

interface IdentityVerifierConfig {
    resolveDid(did: string): Promise<ResolvedIdentityDocument | null>;
    authorizeOwner(rootDid: string): Promise<VerifiedOwner | null>;
    authorizeSelfRoot?(rootDid: string, options: {
        audience: string;
    }): Promise<SelfRootAuthorization | null>;
    checkRevocation(check: RevocationCheck): Promise<{
        revoked: boolean;
        checkedAt: number;
    }>;
    replay: {
        consume(claim: ReplayClaim): Promise<boolean>;
    };
    resolveDelegations?(did: string, audience: string): Promise<readonly string[]>;
    now?: () => number;
    maxProofAgeSeconds?: number;
    maxDelegationAgeSeconds?: number;
    maxRevocationAgeSeconds?: number;
    maxDepth?: number;
    clockToleranceSeconds?: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:70.

ReplayClaim

Type-only declaration; it is not a runtime value.

Signature

interface ReplayClaim {
    readonly issuer: string;
    readonly tokenId: string;
    readonly audience: string;
    readonly nonce: string;
    readonly expiresAt: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:63.

ResolvedIdentityDocument

Type-only declaration; it is not a runtime value.

Signature

interface ResolvedIdentityDocument {
    readonly did: string;
    readonly verificationMethods: readonly {
        readonly id: string;
        readonly publicKeyJwk: JWK;
        readonly purposes: readonly IdentityKeyPurpose[];
    }[];
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:49.

RevocationCheck

Type-only declaration; it is not a runtime value.

Signature

interface RevocationCheck {
    readonly did: string;
    readonly issuerDid?: string;
    readonly credentialId?: string;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:58.

SelfRootAuthorization

Current, server-authorized self-root registration; never supplied by the proof.

Type-only declaration; it is not a runtime value.

Signature

interface SelfRootAuthorization {
    readonly did: string;
    readonly audience: string;
    readonly authorizationId: string;
    readonly revision: string;
    readonly issuedAt: number;
    readonly notBefore: number;
    readonly expiresAt: number;
    readonly checkedAt: number;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:32.

VerifiedAgentIdentity

Current identity trust. This grants no application scopes or tenant access.

Type-only declaration; it is not a runtime value.

Signature

type VerifiedAgentIdentity = CommonAgentIdentity & ({
    readonly owner: VerifiedOwner;
    readonly root?: {
        readonly kind: 'lifeid';
        readonly did: string;
    };
} | {
    readonly owner: null;
    readonly root: {
        readonly kind: 'self';
        readonly did: string;
        readonly authorizationId: string;
        readonly revision: string;
    };
});

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:16.

VerifiedOwner

Type-only declaration; it is not a runtime value.

Signature

interface VerifiedOwner {
    readonly issuer: string;
    readonly subject: string;
    readonly organizationId?: string;
}

Source: @openagentid/sdk@0.7.2, dist/identity-verification.d.ts:3.

Package requirements

Dependencies

Package	Published range
zod	`^3.23.8`
jose	`^5.10.0`
@noble/hashes	`^1.8.0`
@scure/base	`^1.2.6`

Peer dependencies

Package	Published range	Optional
@openagentid/aegis-sdk	`^0.1.0`	Yes
@openagentid/arsenal-sdk	`^0.1.0`	Yes
@openagentid/crypto-wasm	`^0.1.0`	Yes
@openagentid/oas-sdk	`^1.0.2`	Yes

Archive verification

Pinned integrity:

SHA-512 integrity

sha512-9YlDb02di8sGffhuMOwNAQa/M3oBrhaqPc7t+qBltdoQRCqlxDmYB/nTRSB4eZgwE4lvM4TKzI72nJtJSVm/ww==

Machine-readable API manifest · Coverage

On this page