@auths-dev/sdk &para;

SignArtifactBytesOptions

Returns¶

ArtifactService

Methods¶

sign()¶

sign(opts): ArtifactResult;

Signs a file at the given path.

Parameters¶

opts¶

SignArtifactOptions

Signing options.

Returns¶

ArtifactResult

The artifact attestation with digest and metadata.

Throws¶

CryptoError if signing fails.

Example¶

const result = auths.artifacts.sign({
  filePath: './build/app.wasm',
  identityDid: identity.did,
  expiresInDays: 365,
})

signBytes()¶

signBytes(opts): ArtifactResult;

Signs raw bytes (e.g. an in-memory buffer).

Parameters¶

opts¶

Signing options.

Returns¶

ArtifactResult

The artifact attestation with digest and metadata.

Throws¶

CryptoError if signing fails.

Example¶

const result = auths.artifacts.signBytes({
  data: Buffer.from('binary content'),
  identityDid: identity.did,
})

AttestationService¶

Queries attestations stored in the local registry.

Access via Auths.attestations.

Example¶

const atts = auths.attestations.list()
const latest = auths.attestations.getLatest(device.did)

Constructors¶

Constructor¶

new AttestationService(client): AttestationService;

Parameters¶

client¶

Returns¶

AttestationService

Methods¶

getLatest()¶

getLatest(deviceDid): AttestationInfo | null;

Retrieves the latest attestation for a device.

Parameters¶

deviceDid¶

string

DID of the device.

Returns¶

AttestationInfo | null

The latest attestation, or null if none found.

Throws¶

StorageError if the operation fails.

list()¶

list(): AttestationInfo[];

Lists all attestations in the local registry.

Returns¶

AttestationInfo[]

Array of attestation records.

Throws¶

StorageError if the operation fails.

listByDevice()¶

listByDevice(deviceDid): AttestationInfo[];

Lists attestations for a specific device.

Parameters¶

deviceDid¶

string

DID of the device to filter by.

Returns¶

AttestationInfo[]

Array of attestation records for the device.

Throws¶

StorageError if the operation fails.

AuditService¶

Audits Git repositories for commit signature compliance.

Access via Auths.audit.

Example¶

const report = auths.audit.report({ targetRepoPath: '/path/to/repo' })
console.log(report.summary.unsigned_commits)

Constructors¶

Constructor¶

new AuditService(client): AuditService;

Parameters¶

client¶

Returns¶

AuditService

Methods¶

isCompliant()¶

isCompliant(opts): boolean;

Checks whether all commits in a repository are signed.

Parameters¶

opts¶

AuditComplianceOptions

Compliance check options.

Returns¶

boolean

true if every commit is signed, false otherwise.

Example¶

if (auths.audit.isCompliant({ targetRepoPath: '/path/to/repo' })) {
  console.log('All commits signed')
}

report()¶

report(opts): AuditReport;

Generates an audit report for a Git repository's commit signatures.

Parameters¶

opts¶

AuditReportOptions

Audit options.

Returns¶

AuditReport

The audit report with per-commit details and summary statistics.

Throws¶

VerificationError if the audit fails.

Example¶

const report = auths.audit.report({ targetRepoPath: '/path/to/repo' })
console.log(report.summary.total_commits)

Auths¶

Primary entry point for all Auths SDK operations.

Provides access to identity management, device authorization, signing, verification, policy evaluation, organizations, and more through service properties.

Example¶

import { Auths } from '@auths-dev/node'

const auths = new Auths()

// Create an identity
const identity = auths.identities.create({ label: 'laptop' })

// Sign a message
const sig = auths.signAs({
  message: Buffer.from('hello world'),
  identityDid: identity.did,
})
console.log(sig.signature) // hex-encoded Ed25519 signature

Constructors¶

Constructor¶

new Auths(config?): Auths;

Creates a new Auths client.

Parameters¶

config?¶

ClientConfig = {}

Client configuration.

Returns¶

SignActionAsIdentityOptions

Example¶

// Auto-discover (~/.auths)
const auths = new Auths()

// Explicit configuration
const auths = new Auths({
  repoPath: '/path/to/identity-repo',
  passphrase: 'my-secret',
})

Properties¶

artifacts¶

readonly artifacts: ArtifactService;

Artifact signing.

attestations¶

readonly attestations: AttestationService;

Attestation queries.

audit¶

readonly audit: AuditService;

Repository audit reports.

commits¶

readonly commits: CommitService;

Git commit signing.

devices¶

readonly devices: DeviceService;

Device authorization (link, revoke, extend).

identities¶

readonly identities: IdentityService;

Identity management (create, rotate, delegate agents).

orgs¶

readonly orgs: OrgService;

Organization management.

pairing¶

readonly pairing: PairingService;

Cross-device pairing.

passphrase¶

readonly passphrase: string | undefined;

Passphrase for key operations, if set.

repoPath¶

readonly repoPath: string;

Path to the Auths Git registry.

signing¶

readonly signing: SigningService;

Message and action signing.

trust¶

readonly trust: TrustService;

Trust store for pinned identities.

witnesses¶

readonly witnesses: WitnessService;

Witness node management.

Methods¶

doctor()¶

doctor(): string;

Runs diagnostics on the Auths installation and returns a report.

Returns¶

string

A human-readable diagnostics string.

getPublicKey()¶

getPublicKey(opts): string;

Convenience method to get an identity's public key.

Parameters¶

opts¶

GetPublicKeyOptions

Lookup options.

Returns¶

string

Hex-encoded Ed25519 public key.

Throws¶

CryptoError if the key cannot be found.

signActionAs()¶

signActionAs(opts): ActionEnvelope;

Convenience method to sign an action as an identity.

Parameters¶

opts¶

Action signing options.

Returns¶

SignActionAsAgentOptions

The signed action envelope.

Throws¶

CryptoError if signing fails.

signActionAsAgent()¶

signActionAsAgent(opts): ActionEnvelope;

Convenience method to sign an action as an agent.

Parameters¶

opts¶

Agent action signing options.

Returns¶

The signed action envelope.

Throws¶

CryptoError if signing fails.

signAs()¶

signAs(opts): SignResult;

Convenience method to sign a message as an identity.

Parameters¶

opts¶

SignAsIdentityOptions

Signing options.

Returns¶

The signature and signer DID.

Throws¶

CryptoError if signing fails.

Example¶

const result = auths.signAs({
  message: Buffer.from('hello world'),
  identityDid: identity.did,
})

signAsAgent()¶

signAsAgent(opts): SignResult;

Convenience method to sign a message as an agent.

Parameters¶

opts¶

SignAsAgentOptions

Agent signing options.

Returns¶

The signature and signer DID.

Throws¶

CryptoError if signing fails.

verify()¶

verify(opts): Promise<VerificationResult>;

Verifies a single attestation with optional capability and time constraints.

Parameters¶

opts¶

VerifyOptions

Verification options.

Returns¶

Promise\<VerificationResult>

The verification result.

Throws¶

VerificationError if verification encounters an error.

Example¶

const result = await auths.verify({
  attestationJson: json,
  issuerKey: publicKeyHex,
})
console.log(result.valid)

verifyChain()¶

verifyChain(opts): Promise<VerificationReport>;

Verifies an attestation chain with optional capability and witness constraints.

Parameters¶

opts¶

VerifyChainOptions

Chain verification options.

Returns¶

Promise\<VerificationReport>

The verification report.

Throws¶

VerificationError if verification encounters an error.

AuthsError¶

Base error for all Auths SDK operations.

All errors thrown by the SDK inherit from this class, carrying a machine-readable code and human-readable message.

Example¶

import { Auths, AuthsError } from '@auths-dev/node'

try {
  auths.signAs({ message: data, identityDid: did })
} catch (e) {
  if (e instanceof AuthsError) {
    console.log(e.code, e.message)
  }
}

Extends¶

Error

Constructors¶

Constructor¶

new AuthsError(message, code): AuthsError;

Parameters¶

message¶

string

code¶

string

Returns¶

AuthsError

Overrides¶

Error.constructor

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

Error.cause

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

message¶

message: string;

Inherited from¶

Error.message

name¶

name: string;

Inherited from¶

Error.name

stack?¶

optional stack: string;

Inherited from¶

Error.stack

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Error.stackTraceLimit

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

Error.captureStackTrace

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

Error.prepareStackTrace

CommitService¶

Signs Git commits using Auths identities.

Access via Auths.commits.

Example¶

const result = auths.commits.sign({
  data: commitBuffer,
  identityDid: identity.did,
})
console.log(result.signaturePem) // PEM-encoded signature

Constructors¶

Constructor¶

new CommitService(client): CommitService;

Parameters¶

client¶

Returns¶

CommitService

Methods¶

sign()¶

sign(opts): CommitSignResult;

Signs raw Git commit data, producing a PEM-encoded signature.

Parameters¶

opts¶

SignCommitOptions

Signing options.

Returns¶

CommitSignResult

The commit signature with method and namespace metadata.

Throws¶

CryptoError if the key is missing or signing fails.

Example¶

const result = auths.commits.sign({
  data: Buffer.from(commitContent),
  identityDid: identity.did,
})

CryptoError¶

Raised when a cryptographic operation fails.

Common codes: 'invalid_key', 'key_not_found', 'signing_failed'.

Example¶

import { Auths, CryptoError } from '@auths-dev/node'

try {
  auths.signAs({ message: data, identityDid: did })
} catch (e) {
  if (e instanceof CryptoError && e.code === 'key_not_found') {
    console.log('Identity key not in keychain')
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new CryptoError(message, code): CryptoError;

Parameters¶

message¶

string

code¶

string

Returns¶

CryptoError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

DeviceService¶

Manages device authorization lifecycle: link, revoke, and extend.

Access via Auths.devices.

Example¶

const device = auths.devices.link({
  identityDid: identity.did,
  capabilities: ['sign'],
  expiresInDays: 90,
})

Constructors¶

Constructor¶

new DeviceService(client): DeviceService;

Parameters¶

client¶

Returns¶

DeviceService

Methods¶

extend()¶

extend(opts): DeviceExtension;

Extends a device's authorization period.

Parameters¶

opts¶

ExtendDeviceOptions

Extension options.

Returns¶

DeviceExtension

The extension result with new and previous expiration times.

Throws¶

IdentityError if extension fails.

Example¶

const ext = auths.devices.extend({
  deviceDid: device.did,
  identityDid: identity.did,
  days: 60,
})
console.log(ext.newExpiresAt) // RFC 3339 timestamp

link()¶

link(opts): Device;

Links a new device to an identity with scoped capabilities.

Parameters¶

opts¶

LinkDeviceOptions

Link options.

Returns¶

Device

The linked device with its DID and attestation ID.

Throws¶

IdentityError if linking fails.

Example¶

const device = auths.devices.link({
  identityDid: identity.did,
  capabilities: ['sign'],
  expiresInDays: 90,
})
console.log(device.did) // did:key:z...

revoke()¶

revoke(opts): void;

Revokes a device's authorization under an identity.

Parameters¶

opts¶

RevokeDeviceOptions

Revocation options.

Returns¶

void

Throws¶

IdentityError if revocation fails.

Example¶

auths.devices.revoke({
  deviceDid: device.did,
  identityDid: identity.did,
  note: 'replaced',
})

IdentityError¶

Raised when an identity or device operation fails.

Common codes: 'identity_not_found', 'unknown'.

Example¶

import { Auths, IdentityError } from '@auths-dev/node'

try {
  auths.devices.link({ identityDid: did, capabilities: ['sign'] })
} catch (e) {
  if (e instanceof IdentityError) {
    console.log('Identity error:', e.code)
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new IdentityError(message, code): IdentityError;

Parameters¶

message¶

string

code¶

string

Returns¶

IdentityError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

IdentityService¶

Manages cryptographic identities, agents, and key rotation.

Access via Auths.identities.

Example¶

const auths = new Auths()
const identity = auths.identities.create({ label: 'laptop' })
console.log(identity.did) // did:keri:EBfd...

Constructors¶

Constructor¶

new IdentityService(client): IdentityService;

Parameters¶

client¶

Returns¶

IdentityService

Methods¶

create()¶

create(opts?): Identity;

Creates a new cryptographic identity backed by an Ed25519 keypair.

Parameters¶

opts?¶

CreateIdentityOptions = {}

Creation options.

Returns¶

Identity

The newly created identity.

Throws¶

IdentityError if the identity cannot be created.

Example¶

const identity = auths.identities.create({ label: 'laptop' })
console.log(identity.did)       // did:keri:EBfd...
console.log(identity.publicKey) // hex-encoded Ed25519 key

createAgent()¶

createAgent(opts): AgentIdentity;

Creates a standalone agent identity with a self-signed attestation.

Parameters¶

opts¶

CreateAgentOptions

Agent creation options.

Returns¶

AgentIdentity

The agent identity with its attestation.

Throws¶

IdentityError if the agent cannot be created.

Example¶

const agent = auths.identities.createAgent({
  name: 'ci-bot',
  capabilities: ['sign'],
})
console.log(agent.did) // did:keri:...

delegateAgent()¶

delegateAgent(opts): DelegatedAgent;

Delegates an agent under an existing identity with scoped capabilities.

Parameters¶

opts¶

DelegateAgentOptions

Delegation options.

Returns¶

DelegatedAgent

The delegated agent with its signed attestation.

Throws¶

IdentityError if delegation fails.

Example¶

const agent = auths.identities.delegateAgent({
  identityDid: identity.did,
  name: 'deploy-bot',
  capabilities: ['sign'],
  expiresInDays: 90,
})

getPublicKey()¶

getPublicKey(opts): string;

Retrieves the hex-encoded Ed25519 public key for an identity.

Parameters¶

opts¶

GetPublicKeyOptions

Lookup options.

Returns¶

string

Hex-encoded public key string (64 characters).

Throws¶

CryptoError if the key cannot be found.

Example¶

const pk = auths.identities.getPublicKey({ identityDid: identity.did })
console.log(pk.length) // 64

rotate()¶

rotate(opts?): RotationResult;

Rotates the signing keys for an identity, advancing the KERI event log.

Parameters¶

opts?¶

RotateKeysOptions = {}

Rotation options.

Returns¶

RotationResult

The rotation result with old and new key fingerprints.

Throws¶

IdentityError if rotation fails.

Example¶

const result = auths.identities.rotate({ identityDid: identity.did })
console.log(result.sequence) // incremented sequence number

KeychainError¶

Raised when the platform keychain is inaccessible or locked.

Common codes: 'keychain_locked'.

Example¶

import { Auths, KeychainError } from '@auths-dev/node'

try {
  auths.identities.create({ label: 'main' })
} catch (e) {
  if (e instanceof KeychainError) {
    console.log('Unlock your keychain or set AUTHS_KEYCHAIN_BACKEND=file')
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new KeychainError(message, code): KeychainError;

Parameters¶

message¶

string

code¶

string

Returns¶

KeychainError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

NetworkError¶

Raised when a network operation fails (e.g. witness communication).

Common codes: 'server_error'.

Example¶

import { NetworkError } from '@auths-dev/node'

try {
  // network operation
} catch (e) {
  if (e instanceof NetworkError && e.shouldRetry) {
    // safe to retry
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new NetworkError(
   message,
   code,
   shouldRetry?): NetworkError;

Parameters¶

message¶

string

code¶

string

shouldRetry?¶

boolean = true

Returns¶

NetworkError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

shouldRetry¶

shouldRetry: boolean;

Whether the operation is safe to retry. Defaults to true.

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

OrgError¶

Raised when an organization operation fails.

Common codes: 'org_error'.

Example¶

import { Auths, OrgError } from '@auths-dev/node'

try {
  auths.orgs.addMember({ orgDid, memberDid, role: 'member' })
} catch (e) {
  if (e instanceof OrgError) {
    console.log('Org error:', e.message)
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new OrgError(message, code): OrgError;

Parameters¶

message¶

string

code¶

string

Returns¶

OrgError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

OrgService¶

Manages organizations and their membership.

Access via Auths.orgs.

Example¶

const org = auths.orgs.create({ label: 'my-team' })
auths.orgs.addMember({
  orgDid: org.orgDid,
  memberDid: dev.did,
  role: 'member',
  memberPublicKeyHex: dev.publicKey,
})

Constructors¶

Constructor¶

new OrgService(client): OrgService;

Parameters¶

client¶

Returns¶

OrgService

Methods¶

addMember()¶

addMember(opts): OrgMember;

Adds a member to an organization.

Parameters¶

opts¶

AddOrgMemberOptions

Member options.

Returns¶

OrgMember

The new member record.

Throws¶

OrgError if the operation fails.

Example¶

const member = auths.orgs.addMember({
  orgDid: org.orgDid,
  memberDid: dev.did,
  role: 'member',
  memberPublicKeyHex: dev.publicKey,
})

create()¶

create(opts): OrgResult;

Creates a new organization.

Parameters¶

opts¶

CreateOrgOptions

Organization options.

Returns¶

OrgResult

The created organization.

Throws¶

OrgError if creation fails.

Example¶

const org = auths.orgs.create({ label: 'engineering' })
console.log(org.orgDid) // did:keri:...

listMembers()¶

listMembers(opts): OrgMember[];

Lists members of an organization.

Parameters¶

opts¶

ListOrgMembersOptions

List options.

Returns¶

OrgMember[]

Array of member records.

Throws¶

OrgError if the operation fails.

Example¶

const members = auths.orgs.listMembers({ orgDid: org.orgDid })
console.log(members.length)

revokeMember()¶

revokeMember(opts): OrgMember;

Revokes a member's access to an organization.

Parameters¶

opts¶

RevokeOrgMemberOptions

Revocation options.

Returns¶

OrgMember

The updated member record with revoked: true.

Throws¶

OrgError if the operation fails.

PairingError¶

Raised when a device pairing operation fails or times out.

Common codes: 'pairing_error', 'timeout'.

Example¶

import { PairingError } from '@auths-dev/node'

try {
  await auths.pairing.createSession({ bindAddress: '127.0.0.1' })
} catch (e) {
  if (e instanceof PairingError && e.shouldRetry) {
    // safe to retry
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new PairingError(
   message,
   code,
   shouldRetry?): PairingError;

Parameters¶

message¶

string

code¶

string

shouldRetry?¶

boolean = true

Returns¶

PairingError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

shouldRetry¶

shouldRetry: boolean;

Whether the operation is safe to retry. Defaults to true.

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

PairingService¶

Handles device pairing for cross-device identity authorization.

The pairing flow: controller creates a session, device joins with the short code, controller completes pairing to authorize the device.

Access via Auths.pairing.

Example¶

const session = await auths.pairing.createSession({
  bindAddress: '127.0.0.1',
  capabilities: ['sign:commit'],
})
console.log(session.shortCode) // e.g. 'A3F7K2'

// On the device side:
const response = await auths.pairing.join({
  shortCode: 'A3F7K2',
  endpoint: session.endpoint,
  token: session.token,
})

Constructors¶

Constructor¶

new PairingService(client): PairingService;

Parameters¶

client¶

CreatePairingSessionOptions

Returns¶

PairingService

Methods¶

[asyncDispose]()¶

asyncDispose: Promise<void>;

Returns¶

Promise\<void>

[dispose]()¶

dispose: void;

Returns¶

void

complete()¶

complete(opts): Promise<PairingResult>;

Completes pairing by authorizing the connected device.

Parameters¶

opts¶

CompletePairingOptions

Completion options with device identity and capabilities.

Returns¶

Promise\<PairingResult>

The pairing result with the device's authorization attestation.

Throws¶

PairingError if no session is active or completion fails.

createSession()¶

createSession(opts?): Promise<PairingSession>;

Creates a pairing session and starts listening for device connections.

Parameters¶

opts?¶

Session options.

Returns¶

Promise\<PairingSession>

The active pairing session with its short code and endpoint.

Throws¶

PairingError if session creation fails.

Example¶

const session = await auths.pairing.createSession({
  bindAddress: '127.0.0.1',
  enableMdns: false,
})
console.log(session.shortCode) // 6-char code

join()¶

join(opts): Promise<PairingResponse>;

Joins an existing pairing session from the device side.

Parameters¶

opts¶

JoinPairingOptions

Join options with short code and endpoint from the controller.

Returns¶

Promise\<PairingResponse>

The pairing response with device identity information.

Throws¶

PairingError if joining fails.

Example¶

const response = await auths.pairing.join({
  shortCode: 'A3F7K2',
  endpoint: 'http://127.0.0.1:8080',
  token: sessionToken,
})

stop()¶

stop(): Promise<void>;

Stops the active pairing session. Idempotent — safe to call multiple times.

Returns¶

Promise\<void>

Throws¶

PairingError if stopping the session fails.

waitForResponse()¶

waitForResponse(opts?): Promise<PairingResponse>;

Waits for a device to connect to the active pairing session.

Parameters¶

opts?¶

WaitForPairingResponseOptions

Wait options.

Returns¶

Promise\<PairingResponse>

The connecting device's information.

Throws¶

PairingError if no session is active or timeout is reached.

PolicyBuilder¶

Fluent builder for composing authorization policies.

Policies are built by chaining predicates, then compiled and evaluated against an attestation context to produce an allow/deny decision.

Example¶

import { PolicyBuilder } from '@auths-dev/node'

// Quick standard policy
const policy = PolicyBuilder.standard('sign_commit')
const decision = policy.evaluate({
  issuer: 'did:keri:EOrg',
  subject: 'did:key:zDevice',
  capabilities: ['sign_commit'],
})
console.log(decision.allowed) // true

// Complex composed policy
const ciPolicy = new PolicyBuilder()
  .notRevoked()
  .notExpired()
  .requireCapability('sign')
  .requireAgent()
  .requireRepo('org/repo')
  .build()

Constructors¶

Constructor¶

new PolicyBuilder(): PolicyBuilder;

Returns¶

Methods¶

attrEquals()¶

attrEquals(key, value): PolicyBuilder;

Requires an attestation attribute to equal a specific value.

Parameters¶

key¶

string

Attribute key.

value¶

string

Required attribute value.

Returns¶

attrIn()¶

attrIn(key, values): PolicyBuilder;

Requires an attestation attribute to be one of the given values.

Parameters¶

key¶

string

Attribute key.

values¶

string[]

Acceptable attribute values.

Returns¶

build()¶

build(): string;

Compiles the policy for evaluation using the native policy engine.

Returns¶

string

Compiled policy JSON string.

Throws¶

AuthsError if compilation fails.

Throws¶

Error if the policy has no predicates.

evaluate()¶

evaluate(context): PolicyDecision;

Builds and evaluates the policy against a context in one step.

Parameters¶

context¶

EvalContextOpts

The evaluation context.

Returns¶

PolicyDecision

The policy decision.

Throws¶

AuthsError if compilation or evaluation fails.

Example¶

const decision = PolicyBuilder.standard('sign').evaluate({
  issuer: 'did:keri:EOrg',
  subject: 'did:key:zDevice',
  capabilities: ['sign'],
})
console.log(decision.allowed) // true

expiresAfter()¶

expiresAfter(seconds): PolicyBuilder;

Requires the attestation to expire after the given number of seconds from now.

Parameters¶

seconds¶

number

Minimum remaining lifetime in seconds.

Returns¶

issuedWithin()¶

issuedWithin(seconds): PolicyBuilder;

Requires the attestation to have been issued within the given time window.

Parameters¶

seconds¶

number

Maximum age in seconds.

Returns¶

maxChainDepth()¶

maxChainDepth(depth): PolicyBuilder;

Limits the maximum attestation chain depth.

Parameters¶

depth¶

number

Maximum allowed chain depth.

Returns¶

negate()¶

negate(): PolicyBuilder;

Negates this policy — passes when the original would deny, and vice versa.

Returns¶

A new negated builder.

notExpired()¶

notExpired(): PolicyBuilder;

Requires the attestation to not be expired.

Returns¶

notRevoked()¶

notRevoked(): PolicyBuilder;

Requires the attestation to not be revoked.

Returns¶

orPolicy()¶

orPolicy(other): PolicyBuilder;

Combines this policy with another using OR logic.

Parameters¶

other¶

The other policy builder.

Returns¶

A new builder that passes if either policy passes.

pathAllowed()¶

pathAllowed(patterns): PolicyBuilder;

Restricts allowed file paths.

Parameters¶

patterns¶

string[]

Glob patterns for allowed paths.

Returns¶

refMatches()¶

refMatches(pattern): PolicyBuilder;

Requires the Git ref to match a pattern.

Parameters¶

pattern¶

string

Ref pattern (e.g. 'refs/heads/main').

Returns¶

requireAgent()¶

requireAgent(): PolicyBuilder;

Requires the signer to be an agent.

Returns¶

requireAllCapabilities()¶

requireAllCapabilities(caps): PolicyBuilder;

Requires the subject to hold all of the given capabilities.

Parameters¶

caps¶

string[]

Array of required capability strings.

Returns¶

requireAnyCapability()¶

requireAnyCapability(caps): PolicyBuilder;

Requires the subject to hold at least one of the given capabilities.

Parameters¶

caps¶

string[]

Array of acceptable capability strings.

Returns¶

requireCapability()¶

requireCapability(cap): PolicyBuilder;

Requires the subject to hold a specific capability.

Parameters¶

cap¶

string

Capability string (e.g. 'sign', 'sign_commit').

Returns¶

requireDelegatedBy()¶

requireDelegatedBy(did): PolicyBuilder;

Requires the attestation to have been delegated by a specific identity.

Parameters¶

did¶

string

DID of the required delegator.

Returns¶

requireEnv()¶

requireEnv(env): PolicyBuilder;

Requires a specific deployment environment.

Parameters¶

env¶

string

Environment name (e.g. 'production').

Returns¶

requireEnvIn()¶

requireEnvIn(envs): PolicyBuilder;

Requires one of the given deployment environments.

Parameters¶

envs¶

string[]

Acceptable environment names.

Returns¶

requireHuman()¶

requireHuman(): PolicyBuilder;

Requires the signer to be a human.

Returns¶

requireIssuer()¶

requireIssuer(did): PolicyBuilder;

Requires the issuer to match a specific DID.

Parameters¶

did¶

string

Required issuer DID.

Returns¶

requireIssuerIn()¶

requireIssuerIn(dids): PolicyBuilder;

Requires the issuer to be one of the given DIDs.

Parameters¶

dids¶

string[]

Acceptable issuer DIDs.

Returns¶

requireRepo()¶

requireRepo(repo): PolicyBuilder;

Requires the operation to target a specific repository.

Parameters¶

repo¶

string

Repository identifier (e.g. 'org/repo').

Returns¶

requireRepoIn()¶

requireRepoIn(repos): PolicyBuilder;

Requires the operation to target one of the given repositories.

Parameters¶

repos¶

string[]

Acceptable repository identifiers.

Returns¶

requireSubject()¶

requireSubject(did): PolicyBuilder;

Requires the subject to match a specific DID.

Parameters¶

did¶

string

Required subject DID.

Returns¶

requireWorkload()¶

requireWorkload(): PolicyBuilder;

Requires the signer to be a workload identity.

Returns¶

toJson()¶

toJson(): string;

Serializes the policy to JSON without compiling.

Returns¶

string

JSON string representation of the policy expression.

Throws¶

Error if the policy has no predicates.

workloadClaimEquals()¶

workloadClaimEquals(key, value): PolicyBuilder;

Requires a workload attestation claim to equal a specific value.

Parameters¶

key¶

string

Claim key.

value¶

string

Required claim value.

Returns¶

workloadIssuerIs()¶

workloadIssuerIs(did): PolicyBuilder;

Requires the workload attestation issuer to match a specific DID.

Parameters¶

did¶

string

Required workload issuer DID.

Returns¶

anyOf()¶

static anyOf(...builders): PolicyBuilder;

Creates a policy that passes if any of the given policies pass.

Parameters¶

builders¶

...PolicyBuilder[]

Policies to OR together.

Returns¶

A new builder combining the policies.

standard()¶

static standard(capability): PolicyBuilder;

Creates a standard policy requiring not-revoked, not-expired, and a capability.

Parameters¶

capability¶

string

Required capability string.

Returns¶

A new builder with the standard predicates.

Example¶

const policy = PolicyBuilder.standard('sign_commit')

SigningService¶

Signs messages and actions using identity or agent keys.

Access via Auths.signing.

Example¶

const result = auths.signing.signAsIdentity({
  message: Buffer.from('hello world'),
  identityDid: identity.did,
})
console.log(result.signature) // hex-encoded Ed25519 signature

Constructors¶

Constructor¶

new SigningService(client): SigningService;

Parameters¶

client¶

SignActionAsAgentOptions

Returns¶

SigningService

Methods¶

signActionAsAgent()¶

signActionAsAgent(opts): ActionEnvelope;

Signs a structured action as an agent.

Parameters¶

opts¶

Agent action signing options.

Returns¶

SignActionAsIdentityOptions

The signed action envelope.

Throws¶

CryptoError if signing fails.

Example¶

const envelope = auths.signing.signActionAsAgent({
  actionType: 'tool_call',
  payloadJson: '{"tool":"execute"}',
  keyAlias: agent.keyAlias,
  agentDid: agent.did,
})

signActionAsIdentity()¶

signActionAsIdentity(opts): ActionEnvelope;

Signs a structured action as an identity, producing a verifiable envelope.

Parameters¶

opts¶

Action signing options.

Returns¶

The signed action envelope.

Throws¶

CryptoError if signing fails.

Example¶

const envelope = auths.signing.signActionAsIdentity({
  actionType: 'tool_call',
  payloadJson: '{"tool":"read_file"}',
  identityDid: identity.did,
})

signAsAgent()¶

signAsAgent(opts): SignResult;

Signs a message as an agent using its keychain alias.

Parameters¶

opts¶

SignAsAgentOptions

Agent signing options.

Returns¶

The signature and signer DID.

Throws¶

CryptoError if the key is missing or signing fails.

Example¶

const result = auths.signing.signAsAgent({
  message: Buffer.from('payload'),
  keyAlias: agent.keyAlias,
})

signAsIdentity()¶

signAsIdentity(opts): SignResult;

Signs a message as an identity.

Parameters¶

opts¶

SignAsIdentityOptions

Signing options.

Returns¶

The signature and signer DID.

Throws¶

CryptoError if the key is missing or signing fails.

Example¶

const result = auths.signing.signAsIdentity({
  message: Buffer.from('hello'),
  identityDid: identity.did,
})

StorageError¶

Raised when a storage or registry operation fails.

Common codes: 'repo_not_found', 'trust_error', 'witness_error'.

Example¶

import { Auths, StorageError } from '@auths-dev/node'

try {
  auths.trust.pin({ did: 'did:keri:ENOTREAL' })
} catch (e) {
  if (e instanceof StorageError) {
    console.log('Storage error:', e.message)
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new StorageError(message, code): StorageError;

Parameters¶

message¶

string

code¶

string

Returns¶

StorageError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

TrustService¶

Manages the local trust store for pinning and querying trusted identities.

Access via Auths.trust.

Example¶

auths.trust.pin({ did: peer.did, label: 'alice' })
const entries = auths.trust.list()

Constructors¶

Constructor¶

new TrustService(client): TrustService;

Parameters¶

client¶

Returns¶

TrustService

Methods¶

get()¶

get(did): PinnedIdentity | null;

Looks up a specific pinned identity by DID.

Parameters¶

did¶

string

DID to look up.

Returns¶

PinnedIdentity | null

The pinned identity entry, or null if not found.

Throws¶

StorageError if the operation fails.

Example¶

const entry = auths.trust.get('did:keri:EBfd...')
if (entry) console.log(entry.label)

list()¶

list(): PinnedIdentity[];

Lists all pinned identities in the local trust store.

Returns¶

PinnedIdentity[]

Array of pinned identity entries.

Throws¶

StorageError if the operation fails.

pin()¶

pin(opts): PinnedIdentity;

Pins an identity as trusted in the local store.

Parameters¶

opts¶

PinIdentityOptions

Pin options.

Returns¶

PinnedIdentity

The pinned identity entry.

Throws¶

StorageError if the pin operation fails.

Example¶

const entry = auths.trust.pin({ did: identity.did, label: 'my-peer' })
console.log(entry.trustLevel) // 'tofu'

remove()¶

remove(did): void;

Removes a pinned identity from the local trust store.

Parameters¶

did¶

string

DID of the identity to unpin.

Returns¶

void

Throws¶

StorageError if the operation fails.

VerificationError¶

Raised when attestation or chain verification fails.

Common codes: 'invalid_signature', 'expired_attestation', 'revoked_device', 'missing_capability'.

Example¶

import { verifyAttestation, VerificationError } from '@auths-dev/node'

try {
  await verifyAttestation(json, publicKey)
} catch (e) {
  if (e instanceof VerificationError) {
    console.log('Verification failed:', e.code)
  }
}

Extends¶

AuthsError

Constructors¶

Constructor¶

new VerificationError(message, code): VerificationError;

Parameters¶

message¶

string

code¶

string

Returns¶

VerificationError

Overrides¶

Properties¶

cause?¶

optional cause: unknown;

Inherited from¶

code¶

code: string;

Machine-readable error code (e.g. 'key_not_found', 'invalid_signature').

Inherited from¶

message¶

message: string;

Inherited from¶

name¶

name: string;

Inherited from¶

stack?¶

optional stack: string;

Inherited from¶

stackTraceLimit¶

static stackTraceLimit: number;

The Error.stackTraceLimit property specifies the number of stack frames collected by a stack trace (whether generated by new Error().stack or Error.captureStackTrace(obj)).

The default value is 10 but may be set to any valid JavaScript number. Changes will affect any stack trace captured after the value has been changed.

If set to a non-number value, or set to a negative number, stack traces will not capture any frames.

Inherited from¶

Methods¶

captureStackTrace()¶

static captureStackTrace(targetObject, constructorOpt?): void;

Creates a .stack property on targetObject, which when accessed returns a string representing the location in the code at which Error.captureStackTrace() was called.

const myObject = {};
Error.captureStackTrace(myObject);
myObject.stack;  // Similar to `new Error().stack`

The first line of the trace will be prefixed with ${myObject.name}: ${myObject.message}.

The optional constructorOpt argument accepts a function. If given, all frames above constructorOpt, including constructorOpt, will be omitted from the generated stack trace.

The constructorOpt argument is useful for hiding implementation details of error generation from the user. For instance:

function a() {
  b();
}

function b() {
  c();
}

function c() {
  // Create an error without stack trace to avoid calculating the stack trace twice.
  const { stackTraceLimit } = Error;
  Error.stackTraceLimit = 0;
  const error = new Error();
  Error.stackTraceLimit = stackTraceLimit;

  // Capture the stack trace above function b
  Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
  throw error;
}

a();

Parameters¶

targetObject¶

object

constructorOpt?¶

Function

Returns¶

void

Inherited from¶

prepareStackTrace()¶

static prepareStackTrace(err, stackTraces): any;

Parameters¶

err¶

Error

stackTraces¶

CallSite[]

Returns¶

any

See¶

https://v8.dev/docs/stack-trace-api#customizing-stack-traces

Inherited from¶

WitnessService¶

Manages witness nodes for receipt-based verification.

Access via Auths.witnesses.

Example¶

auths.witnesses.add({ url: 'http://witness.example.com:3333' })
const witnesses = auths.witnesses.list()

Constructors¶

Constructor¶

new WitnessService(client): WitnessService;

Parameters¶

client¶