@openagentid/sdk/verification

All packages · Runnable examples · Start an agent

This reference is generated from the integrity-verified npm archive for this exact version. Signatures describe the public contract; they are not standalone programs. Complete examples are checked separately.

Import conditions

Use the public entry point above. The package resolves it to these shipped files; do not import its internal files directly.

Exports

• assertAncestor
• assertScopes
• AuthContext — type
• extractBearerToken
• LineageAuthorityContext — type
• PrivilegedAuthorityVerificationClient
• PrivilegedAuthorityVerifier — type
• toVerificationClient
• VerificationClient — type
• VerifyRequestOptions — type

assertAncestor

Assert that ctx.lineage contains ancestor.

declare function assertAncestor(ctx: AuthContext, ancestor: Did): void;

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:110.

assertScopes

Assert that ctx holds every scope in required.

declare function assertScopes(ctx: AuthContext, required: readonly string[]): void;

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:108.

AuthContext

A resolved, authenticated caller identity.

Type-only declaration; it is not a runtime value.

interface AuthContext {
    readonly did: Did;
    readonly root: Did;
    readonly lineage: readonly Did[];
    readonly lineageAuthority?: LineageAuthorityContext;
    readonly scopes: readonly string[];
    readonly expiresAt: number;
    readonly presentedToken?: string;
    readonly claims?: Readonly<Record<string, unknown>>;
}

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:44.

extractBearerToken

Extract the bearer token from a Request without trusting it.

Checks, in order: Authorization: OpenAgent ..., Authorization: Bearer ..., X-OpenAgent-Token, and an oa_token query parameter. Returns null if absent.

declare function extractBearerToken(req: Request): string | null;

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:106.

LineageAuthorityContext

Sigil-backed lineage authority attached by an OAS verifier.

Type-only declaration; it is not a runtime value.

interface LineageAuthorityContext {
    readonly subject: Did;
    readonly source: string;
    readonly root: Did;
    readonly path: readonly Did[];
    readonly finalizedBlock: number;
    readonly pathKind: string;
    readonly scopes: readonly string[];
    readonly generation: number;
    readonly rootKind?: string;
    readonly orgRootCommitment?: string;
    readonly expiresAt?: string;
}

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:19.

PrivilegedAuthorityVerificationClient

Wraps any verifier and requires OAS/Sigil authority for privileged requests.

declare class PrivilegedAuthorityVerificationClient implements VerificationClient {
    constructor(inner: VerificationClient, authorityVerifier: PrivilegedAuthorityVerifier);
    verifyRequest(req: Request, options?: VerifyRequestOptions): Promise<AuthContext>;
    issueChallenge(): Promise<{
        challenge: Uint8Array;
        challengeId: string;
    }>;
    verifyChallengeResponse(params: {
        challengeId: string;
        agentDid: Did;
        signatureBase64: string;
    }): Promise<AuthContext>;
}

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:117.

PrivilegedAuthorityVerifier

Runtime hook that turns an authenticated context into OAS/Sigil authority.

Type-only declaration; it is not a runtime value.

interface PrivilegedAuthorityVerifier {
    verify(ctx: AuthContext, options: VerifyRequestOptions): Promise<LineageAuthorityContext>;
}

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:96.

toVerificationClient

Narrow any unknown value into a {@link VerificationClient}, or throw. Duck-typed for forward compatibility with @openagentid/aegis-sdk.

declare function toVerificationClient(client: unknown): VerificationClient;

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:115.

VerificationClient

AEGIS verifier facade. Concrete implementation lives in @openagentid/aegis-sdk.

The OpenAgent SDK never decodes assertions itself — it delegates to AEGIS for all verification, lineage walking, and policy evaluation.

Type-only declaration; it is not a runtime value.

interface VerificationClient {
    verifyRequest(req: Request, options?: VerifyRequestOptions): Promise<AuthContext>;
    issueChallenge(): Promise<{
        challenge: Uint8Array;
        challengeId: string;
    }>;
    verifyChallengeResponse(params: {
        challengeId: string;
        agentDid: Did;
        signatureBase64: string;
    }): Promise<AuthContext>;
}

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:81.

VerifyRequestOptions

Options for {@link VerificationClient.verifyRequest}.

Type-only declaration; it is not a runtime value.

interface VerifyRequestOptions {
    requiredScopes?: readonly string[];
    requiredAncestor?: Did;
    requirePrivilegedAuthority?: boolean;
    requiredAuthorityPath?: string;
    clockSkewSeconds?: number;
}

Source: @openagentid/sdk@0.7.2, dist/verification.d.ts:63.

Supporting declarations

These package-owned declarations are referenced by the exports above. Their presence here does not make them importable from this entry point. Import only the names in Exports.

Did

Fully qualified did:oas identifier.

Type-only declaration; it is not a runtime value.

type Did = string;

Source: @openagentid/sdk@0.7.2, dist/identity.d.ts:7.

Package requirements

Dependencies

Peer dependencies

Archive verification

Pinned integrity:

sha512-9YlDb02di8sGffhuMOwNAQa/M3oBrhaqPc7t+qBltdoQRCqlxDmYB/nTRSB4eZgwE4lvM4TKzI72nJtJSVm/ww==

Machine-readable API manifest · Coverage