@openagentid/aegis-sdk

TypeScript SDK for AEGIS — the identity verification and authorization framework built on the Open Agent Specification (OAS).

This package is a faithful port of the Rust reference implementation in aegis-core, aegis-verify, aegis-keys, aegis-auth, aegis-policy, aegis-delegate, aegis-wallet, and aegis-sdk.

What you get

| Layer | Purpose | Spec section | |-------|---------|--------------| | core | Plugin interfaces, types, tagged errors, OAS document shape | §3, §4 | | verify | 7-step verification pipeline + TTL cache | §5 | | keys | Ed25519 keygen, HKDF lineage derivation, rotation, recovery, FROST threshold | §6 | | auth | Challenge-response, sessions, ApiKey + ChallengeResponse providers | §7 | | policy | Spending, temporal, lineage, contract evaluators + composition | §8 | | delegate | Delegation proofs, trees, session keys, scope no-amplification | §9 | | wallet | Multi-chain address derivation, signing ceremonies, 5-step authorization pipeline | §10 | | sdk | AegisClient facade wiring everything together | — |

Targets

• Node 20+, Bun, Deno
• Browsers (modern, ESM)
• Cloudflare Workers (uses native fetch, no Node built-ins in production code)
• TypeScript strict mode, fully typed
• ESM-first; no CommonJS shim
• Zero hard dependency on chain libraries — bech32, base58, RIPEMD-160, and Keccak-256 are all implemented in pure TypeScript inside wallet/address.ts.

Crypto backend

All primitive cryptographic operations (Ed25519, FROST, HKDF, BLAKE3, JCS, AES-256-GCM, SHA, multibase, CSPRNG) are delegated to a single audited Rust implementation compiled to WebAssembly via wasm-pack. The canonical package is @openagentid/crypto-wasm.

import { setCryptoBackend, loadDefaultCryptoBackend } from "@openagentid/aegis-sdk";

// Option 1: auto-load @openagentid/crypto-wasm at startup
await loadDefaultCryptoBackend();

// Option 2: inject a custom backend (e.g. Node-crypto for tests)
import { nodeCryptoBackend } from "./my-node-backend";
setCryptoBackend(nodeCryptoBackend);

If you do not register a backend, every primitive call throws a clear error.

Quick start

import {
  AegisClient,
  PluginRegistry,
  ChallengeResponseProvider,
  SpendingPolicyEvaluator,
  DirectSigner,
  cryptoBackend,
} from "@openagentid/aegis-sdk";

// 1. Build the plugin registry with your DID resolver
const registry = new PluginRegistry();
registry.registerResolver(myDidResolver);
registry.registerAuthProvider(new ChallengeResponseProvider(myDidResolver));

// 2. Construct an AEGIS client
const client = AegisClient.withDefaults(registry);

// 3. Verify an identity (7-step pipeline + cache)
const result = await client.verifyIdentity("did:oas:l1fe:hmr:alice");
console.log(result.conformanceLevel); // 0, 1, or 2

// 4. Authenticate a credential and get a session
const session = await client.authenticate(
  { type: "api_key", key: "sk-..." },
  "agent",
);

// 5. Evaluate spending policy
const decision = SpendingPolicyEvaluator.evaluate(
  {
    maxAmount: "100.0",
    dailyVolume: "500.0",
    assetAllowlist: ["ETH", "USDC"],
    recipientAllowlist: ["0xabc"],
    approvalThreshold: "50.0",
  },
  { asset: "ETH", amount: "10.0", recipient: "0xabc", chain: "ethereum" },
  "0.0",
);

// 6. Sign a transaction (5-step authorization pipeline)
const signer = new DirectSigner(cryptoBackend().ed25519GenerateKeypair().signingKey);
const clientWithSigner = client.withSigner(signer);
const signed = await clientWithSigner.signTransaction(tx, authContext, decision);

Subpath imports

import { VerificationPipeline } from "@openagentid/aegis-sdk/verify";
import { ChallengeResponseProvider } from "@openagentid/aegis-sdk/auth";
import { LineagePolicyEvaluator } from "@openagentid/aegis-sdk/policy";
import { DelegationTree } from "@openagentid/aegis-sdk/delegate";
import { AddressDeriver } from "@openagentid/aegis-sdk/wallet";
import { generateShares, FrostCeremony } from "@openagentid/aegis-sdk/keys";

Pluggable storage

Every layer ships with an in-memory implementation behind an interface suitable for production swap-out:

| Interface | In-memory | Purpose | |-----------|-----------|---------| | SessionStore | InMemorySessionStore | Authentication sessions | | NonceStore | InMemoryNonceStore | Challenge replay protection | | DelegationStore | InMemoryDelegationStore | Delegation persistence | | RevocationStore | InMemoryRevocationStore | Revoked delegation IDs | | KeyStore | InMemoryKeyStore | Encrypted private key storage | | VerificationCacheStore | InMemoryVerificationCacheStore | Verification result cache |

Inject your own implementation via new AegisClient({ registry, config, stores }).

Specification

This SDK implements AEGIS Specification v1.0.0. See the Rust reference implementation in ../../ for full details.

License

Copyright © 2026 L1fe Labs, Inc.

Licensed under either of Apache License 2.0 or MIT license, at your option.