@foundation0/auth

What this package is for

TypeScript SDK for Authorization and Delegation Layer workflows. Use it when you want one root client for capabilities, verification, receipts, services, revocations, pricing, sidecar, batches, release validation, and data-lifecycle helpers.

Install

pnpm add @foundation0/auth

Root import

import { createAuth } from "@foundation0/auth";

const auth = createAuth();
const result = await auth.verify.token({
  capability: process.env["F0_CAP"] ?? "<paste capability token>",
  servicePid: "did:example:svc:reference-ep",
});

console.log(result.ok);

Hero workflows

• issue or delegate a capability through auth.capabilities.*
• verify tokens and bound operations through auth.verify.*
• validate receipts, pricing, and batches through auth.receipts.*, auth.pricing.*, and auth.batches.*
• resolve descriptors and publish revocations through auth.services.* and auth.revocations.*
• call a remote sidecar or validate release/data workflows through auth.sidecar.*, auth.release.*, and auth.data.*

Public Surface

• root client: createAuth(options?)
• stable subpaths:
  • @foundation0/auth/client
  • @foundation0/auth/services
  • @foundation0/auth/errors
  • @foundation0/auth/testing
  • @foundation0/auth/json
  • @foundation0/auth/compat
  • @foundation0/auth/compat/deprecations
  • @foundation0/auth/compat/error-bridge
  • @foundation0/auth/compat/helper-aliases
  • @foundation0/auth/compat/option-normalizers

What The Client Exposes

• auth.capabilities
• auth.verify
• auth.receipts
• auth.services
• auth.revocations
• auth.pricing
• auth.sidecar
• auth.batches
• auth.release
• auth.data

Choose The Right Namespace

| Workflow | Preferred SDK path | | --- | --- | | issue or delegate capability | auth.capabilities.issue(...), auth.capabilities.delegate(...) | | verify a token string | auth.verify.token(...) | | verify a concrete request or operation | auth.verify.call(...) | | verify a signed receipt | auth.receipts.verify(...) | | resolve or publish a service descriptor | auth.services.resolve(...), auth.services.publishDescriptor(...) | | check or publish a revocation | auth.revocations.check(...), auth.revocations.publish(...) | | fetch or verify pricing | auth.pricing.fetch(...), auth.pricing.verify(...) | | call a remote sidecar | auth.sidecar.* | | build or export a receipt batch | auth.batches.build(...), auth.batches.export(...) | | validate a release manifest | auth.release.validate(...) | | erase managed evidence | auth.data.erase(...) |

Docs and examples

• SDK quickstart
• Verification cookbook
• SDK reference
• Auth rename baseline
• Migration guide
• Validated example

Compatibility

Compatibility aliases such as createAdl() and the @foundation0/auth/compat helpers remain available for migration support, but new installs and docs should target createAuth() from @foundation0/auth first.

Troubleshooting and reference

• Troubleshooting index
• SDK reference
• Unified surface migration

Local validation

• pnpm --filter @foundation0/auth typecheck
• pnpm --filter @foundation0/auth build
• pnpm --filter @foundation0/auth type-regression
• pnpm --filter @foundation0/auth api-report
• pnpm docs:sdk-reference
• pnpm docs:sdk-reference:check