Skip to Content

Types

Complete TypeScript type definitions exported by the @credat/sdk package.


Agent

AgentConfig

Configuration object for creating a new agent identity.

interface AgentConfig { domain: string; path?: string; algorithm?: Algorithm; storage?: StorageAdapter; }
FieldTypeRequiredDescription
domainstringYesDomain to host the DID Document
pathstringNoSub-path for multiple agents on the same domain
algorithmAlgorithmNoSigning algorithm ("ES256" or "EdDSA")
storageStorageAdapterNoStorage adapter for persisting the identity

AgentIdentity

The resolved identity of an agent, returned by createAgent and loadAgent.

interface AgentIdentity { did: string; didDocument: DIDDocument; keyPair: KeyPair; domain: string; path?: string; }
FieldTypeDescription
didstringThe agent’s DID, e.g. did:web:acme.com
didDocumentDIDDocumentThe DID Document containing the public key
keyPairKeyPairThe cryptographic key pair
domainstringThe domain
pathstring | undefinedThe sub-path, if any

Delegation

DelegateOptions

Options for issuing a delegation credential from an owner to an agent.

interface DelegateOptions { agent: string; owner: string; ownerKeyPair: KeyPair; scopes: string[]; constraints?: DelegationConstraints; validFrom?: string; validUntil?: string; statusList?: { url: string; index: number }; parentDelegation?: { token: string; parentOwnerPublicKey: Uint8Array; }; maxChainDepth?: number; }
FieldTypeRequiredDescription
agentstringYesDID of the agent receiving the delegation
ownerstringYesDID of the owner granting it
ownerKeyPairKeyPairYesOwner’s signing key pair
scopesstring[]YesPermissions to grant (min 1)
constraintsDelegationConstraintsNoAdditional limits on the delegation
validFromstringNoISO 8601 start time
validUntilstringNoISO 8601 expiration time
statusList{ url: string; index: number }NoStatus list entry for revocation support
parentDelegation{ token: string; parentOwnerPublicKey: Uint8Array }NoParent delegation for chaining
maxChainDepthnumberNoMaximum allowed chain depth (default: 3)

DelegationCredential

The issued delegation credential, containing both the signed token and decoded claims.

interface DelegationCredential { token: string; claims: DelegationClaims; }
FieldTypeDescription
tokenstringThe signed SD-JWT VC token (send this to services)
claimsDelegationClaimsThe decoded claims for local use

DelegationClaims

The decoded payload of a delegation credential.

interface DelegationClaims { agent: string; owner: string; scopes: string[]; constraints?: DelegationConstraints; validFrom?: string; validUntil?: string; }
FieldTypeDescription
agentstringAgent DID
ownerstringOwner DID
scopesstring[]Granted scopes
constraintsDelegationConstraints | undefinedConstraints, if set
validFromstring | undefinedStart time
validUntilstring | undefinedExpiration time

DelegationConstraints

Optional limits on what a delegated agent can do.

interface DelegationConstraints { maxTransactionValue?: number; validUntil?: string; allowedDomains?: string[]; rateLimit?: number; [key: string]: unknown; }
FieldTypeDescription
maxTransactionValuenumberMaximum value per operation
validUntilstringISO 8601 expiration
allowedDomainsstring[]Permitted domains
rateLimitnumberMax operations per time window
[key: string]unknownAny custom constraint

DelegationResult

The return type of verifyDelegation --- a discriminated union on the valid field.

type DelegationResult = | { valid: true; agent: string; owner: string; scopes: string[]; constraints?: DelegationConstraints; validFrom?: string; validUntil?: string; errors: []; } | { valid: false; agent?: string; owner?: string; scopes?: string[]; constraints?: DelegationConstraints; validFrom?: string; validUntil?: string; errors: VerificationError[]; };

This is a discriminated union: the valid field determines which branch you’re in. When result.valid is true, agent, owner, and scopes are guaranteed to be present and errors is always an empty array. When result.valid is false, those fields are optional (verification may have failed before parsing them) and errors contains at least one VerificationError.

Always check result.valid first:

const result = await verifyDelegation(token, options); if (result.valid) { // TypeScript knows: agent, owner, scopes are strings/arrays (not undefined) console.log(result.agent, result.scopes); } else { // TypeScript knows: errors is VerificationError[] with at least one entry for (const err of result.errors) { console.log(err.code, err.message); } }

Handshake

ChallengeMessage

A challenge sent by a verifier to initiate the handshake.

interface ChallengeMessage { type: "credat:challenge"; nonce: string; from: string; timestamp: string; }
FieldTypeDescription
type"credat:challenge"Message type literal
noncestringRandom challenge nonce
fromstringDID of the verifier
timestampstringISO 8601 timestamp

PresentationMessage

The agent’s response to a challenge, presenting its delegation credential.

interface PresentationMessage { type: "credat:presentation"; delegation: string; nonce: string; proof: string; from: string; }
FieldTypeDescription
type"credat:presentation"Message type literal
delegationstringThe signed delegation token
noncestringThe nonce from the challenge
proofstringSigned proof binding the nonce to the agent
fromstringDID of the presenting agent

AckMessage

Acknowledgement from the verifier after validating a presentation.

interface AckMessage { type: "credat:ack"; verified: boolean; scopes?: string[]; counterChallenge?: ChallengeMessage; delegation?: string; proof?: string; from?: string; }
FieldTypeDescription
type"credat:ack"Message type literal
verifiedbooleanWhether the presentation was valid
scopesstring[] | undefinedVerified scopes (present if verified is true)
counterChallengeChallengeMessage | undefinedOptional counter-challenge for mutual auth
delegationstring | undefinedVerifier’s delegation token (mutual auth)
proofstring | undefinedVerifier’s proof (mutual auth)
fromstring | undefinedDID of the verifier

HandshakeMessage

Union type of all handshake message types.

type HandshakeMessage = ChallengeMessage | PresentationMessage | AckMessage;

Discriminate on the type field:

function handle(msg: HandshakeMessage) { switch (msg.type) { case "credat:challenge": // msg is ChallengeMessage break; case "credat:presentation": // msg is PresentationMessage break; case "credat:ack": // msg is AckMessage break; } }

DID

DIDMethod

Supported DID methods.

type DIDMethod = "key" | "web";

DIDDocument

A W3C DID Document.

interface DIDDocument { id: string; verificationMethod?: VerificationMethod[]; authentication?: string[]; assertionMethod?: string[]; service?: ServiceEndpoint[]; }
FieldTypeDescription
idstringThe DID this document describes
verificationMethodVerificationMethod[]Public keys and their metadata
authenticationstring[]References to keys used for authentication
assertionMethodstring[]References to keys used for signing assertions
serviceServiceEndpoint[]Service endpoints associated with the DID

VerificationMethod

A public key entry within a DID Document.

interface VerificationMethod { id: string; type: string; controller: string; publicKeyJwk?: JsonWebKey; publicKeyMultibase?: string; }
FieldTypeDescription
idstringKey identifier (usually did#key-1)
typestringKey type (e.g. JsonWebKey2020, Ed25519VerificationKey2020)
controllerstringDID that controls this key
publicKeyJwkJsonWebKey | undefinedPublic key in JWK format
publicKeyMultibasestring | undefinedPublic key in multibase encoding

ServiceEndpoint

A service endpoint entry within a DID Document.

interface ServiceEndpoint { id: string; type: string; serviceEndpoint: string; }
FieldTypeDescription
idstringEndpoint identifier
typestringService type (e.g. CredatAgent)
serviceEndpointstringURL of the service

DIDResolutionResult

The result of resolving a DID, following the W3C DID Resolution specification.

interface DIDResolutionResult { didDocument: DIDDocument | null; didResolutionMetadata: { error?: string }; didDocumentMetadata: Record<string, unknown>; }
FieldTypeDescription
didDocumentDIDDocument | nullThe resolved document, or null on failure
didResolutionMetadata{ error?: string }Resolution metadata (contains error on failure)
didDocumentMetadataRecord<string, unknown>Additional metadata about the document

Scopes & Constraints

HasScopes

Interface accepted by all scope helper functions. Any object with a scopes array satisfies it, including DelegationResult.

interface HasScopes { scopes: string[]; }

ConstraintContext

Request context passed to validateConstraints for checking delegation constraints.

interface ConstraintContext { transactionValue?: number; domain?: string; rateLimit?: number; [key: string]: unknown; }
FieldTypeDescription
transactionValuenumber | undefinedValue to check against maxTransactionValue
domainstring | undefinedDomain to check against allowedDomains
rateLimitnumber | undefinedCurrent rate to check against rateLimit constraint
[key: string]unknownCustom context fields

ConstraintViolation

A single constraint violation returned by validateConstraints.

interface ConstraintViolation { constraint: string; message: string; }
FieldTypeDescription
constraintstringName of the violated constraint (e.g. "maxTransactionValue")
messagestringHuman-readable description

Credential

CredentialFormat

Supported credential formats.

type CredentialFormat = "sd-jwt-vc";

Currently only SD-JWT VC is supported.

CredentialClaimValue

Recursive type for credential claim values.

type CredentialClaimValue = | string | number | boolean | null | CredentialClaimValue[] | { [key: string]: CredentialClaimValue };

CredentialClaims

A map of claim names to claim values.

interface CredentialClaims { [key: string]: CredentialClaimValue; }

VerificationError

An error returned inside verification result objects.

interface VerificationError { code: ErrorCode; message: string; humanMessage?: string; }
FieldTypeDescription
codeErrorCodeMachine-readable error code (e.g. DELEGATION_EXPIRED)
messagestringTechnical error message
humanMessagestring | undefinedOptional plain-language explanation

Status List

StatusListData

Internal representation of a status list for credential revocation.

interface StatusListData { bitstring: Uint8Array; issuer: string; id: string; size: number; }
FieldTypeDescription
bitstringUint8ArrayRaw bitstring of revocation statuses (each bit: 0 = valid, 1 = revoked)
issuerstringDID of the status list issuer
idstringURL identifier of the status list
sizenumberTotal number of entries

StatusListEntry

A reference to a specific index in a status list, embedded in credentials.

interface StatusListEntry { statusListUrl: string; statusListIndex: number; }
FieldTypeDescription
statusListUrlstringURL of the status list
statusListIndexnumberIndex of the credential in the list

RevocationStatus

The revocation status of a credential.

type RevocationStatus = "valid" | "revoked" | "unknown";
ValueMeaning
"valid"Credential is active
"revoked"Credential has been revoked by the issuer
"unknown"Status could not be determined (e.g. status list unreachable)

Crypto

Algorithm

Supported signing algorithms.

type Algorithm = "ES256" | "EdDSA";
ValueCurveDescription
"ES256"P-256 (NIST)ECDSA with SHA-256
"EdDSA"Ed25519Edwards-curve Digital Signature Algorithm

KeyPair

A cryptographic key pair used for signing and verification.

interface KeyPair { algorithm: Algorithm; privateKey: Uint8Array; publicKey: Uint8Array; }
FieldTypeDescription
algorithmAlgorithmThe algorithm this key pair uses
privateKeyUint8Array32-byte private key
publicKeyUint8ArrayCompressed public key (33 bytes for ES256, 32 bytes for EdDSA)

JsonWebKey

A JSON Web Key, used in DID Documents and key encoding helpers.

interface JsonWebKey { kty: string; crv?: string; x?: string; y?: string; d?: string; kid?: string; alg?: string; use?: string; }
FieldTypeDescription
ktystringKey type ("EC" for ES256, "OKP" for EdDSA)
crvstring | undefinedCurve name ("P-256" or "Ed25519")
xstring | undefinedBase64url-encoded x coordinate
ystring | undefinedBase64url-encoded y coordinate (EC keys only)
dstring | undefinedBase64url-encoded private key (only in private JWKs)
kidstring | undefinedKey ID
algstring | undefinedAlgorithm hint
usestring | undefinedKey usage ("sig" for signing)

Storage

StorageAdapter

Interface for pluggable storage backends. Implement this to persist agent identities to any backing store.

interface StorageAdapter { get<T>(collection: string, key: string): Promise<T | null>; set<T>(collection: string, key: string, value: T): Promise<void>; delete(collection: string, key: string): Promise<boolean>; list<T>(collection: string): Promise<Array<{ key: string; value: T }>>; clear(collection?: string): Promise<void>; }
MethodSignatureDescription
getget<T>(collection, key): Promise<T | null>Retrieve a value by collection and key
setset<T>(collection, key, value): Promise<void>Store a value
deletedelete(collection, key): Promise<boolean>Delete a value, returns true if it existed
listlist<T>(collection): Promise<Array<{ key: string; value: T }>>List all entries in a collection
clearclear(collection?): Promise<void>Clear a collection, or all data if no collection is given

Credat ships with MemoryStorage, an in-memory implementation. See the Agent API for details.

Last updated on