TypeScript and JavaScript

@openagentid/sdk@0.7.2 is public on npm, with ESM/CommonJS and TypeScript declarations. Node 20+ is required. The default developer path requires no account, private package, hosted identity service or WASM compilation.

npm install @openagentid/sdk@0.7.2

For a complete application, run the starter with create-openagent@0.5.2. For an existing application, follow local identity: real persisted Ed25519 signer, a separate explicitly trusted receiver, receiver-issued nonce and durable replay/revocation.

Local identity, verified OATS and live characters are independently usable. The older OpenAgentRuntime facade connects IdentityProvider, ArsenalClient and VerificationClient supplied by the host; it cannot create those clients from endpoint strings. OpenAgent.createAgent without an identity client fails closed. Key material returned by keys.generate() is not itself an IdentityProvider.

Optional ACT binding

ACT verification is a different signed capability protocol from the local possession JWT. The optional ACT API still requires the actual act_verify cryptographic binding. The public @openagentid/crypto-wasm@0.1.1 package supplies the compiled Node binding. Configure trusted issuer keys, audience and required scopes, and supply the receiver's current epoch seconds with .atTime(...) on every check: the published WASM binding's default system-clock path traps. The host clock must come from trusted application state, not token claims; the complete ACT example signs and verifies a real local token. The public local quickstart does not require that separate package or claim that possession grants an ACT. SDK 0.7.2's withAct and requireActExpress wrappers have no clock configuration and need a qualified host-clock binding adapter before they can use this WASM release; see the middleware limitation.

The published TypeScript reference is generated from the actual 0.7.2 package declarations, including its exported subpaths. Optional facade providers remain separate integrations.