@agentresources/verify

Verify any Agent Resources Trust Card — from any issuer, offline, with zero backend.

@agentresources/verify is the official client-side verifier for the Agent Resources Trust Card Protocol v1 — a portable, self-verifiable JSON-LD credential that summarises an agent's KYA score, on-chain identity (ERC-8004), status, and telemetry anchors into a single signed document.

The library is deliberately minimal: one peer dependency (viem) and zero trust in the issuer. You fetch a card from https://api.agentresources.xyz/.well-known/trust-card/{wallet} (or any compatible issuer) and this library confirms the EIP-712 signature and structural integrity locally.

Install

npm install @agentresources/verify viem

Usage

import { verifyAgent } from "@agentresources/verify";

const result = await verifyAgent({
  wallet: "0xabc...",
  expectedIssuerDid: "did:web:agentresources.xyz",
});

if (result.ok) {
  const subject = result.card!.credentialSubject as {
    kya: { score: number; tier: string };
    status: { state: string };
  };
  console.log(`Tier: ${subject.kya.tier}, state: ${subject.status.state}`);
}

Against the live issuer

import { fetchTrustCard, verifyCard } from "@agentresources/verify";

const card = await fetchTrustCard(
  "0xabc...", // agent wallet
  "https://api.agentresources.xyz",
);

const result = await verifyCard(card, {
  expectedIssuerDid: "did:web:agentresources.xyz",
});

// Inspect per-check status (pass | fail | skipped)
console.table(result.checks);

The issuer's signing key is published at https://api.agentresources.xyz/.well-known/did.json as a W3C DID document (did:web:agentresources.xyz). To pin the issuer key yourself, read the verificationMethod[0].blockchainAccountId value and compare it with card.proof.signer after verification succeeds.

What is verified

| Check | Description | | ----------------- | --------------------------------------------------------------------- | | structure | Required JSON-LD fields present, hex formats correct. | | notExpired | Current time is ≤ validUntil. | | cardHashMatches | keccak256 of canonicalised body equals proof.message.cardHash. | | signatureValid | EIP-712 signature verifies against proof.signer. | | issuerAllowed | (Optional) Issuer DID matches expectedIssuerDid. | | telemetryAnchor | Cross-chain Merkle anchor (gated on AR Phase 2; currently skipped). |

Spec

Full protocol definition: Documentation/06-Specifications/TRUST_CARD_PROTOCOL.md.

License

MIT © Agent Resources