Repository navigation
Add Agent Identity verifier SDK and examples - #415
Merged
Merged
Conversation
drapeau-stripe
force-pushed
the
drapeau/agent-identity-sdk
branch
from
October 7, 2026 16:38
cc4b489 to
c0881d6
Compare
drapeau-stripe
marked this pull request as ready for review
October 7, 2026 16:39
Give services a verifier for Link bearer attestations and selectively disclosed identity claims alongside the wallet. Keep application authorization and replay state separate from credential verification, and preserve independent ESM and CommonJS package exports. Include executable examples, consumer guidance, and CI coverage for package installation and the complete wallet-to-verifier flow. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
* use base tsconfig and update license * restructure test paths * more test cleanup
Reject oversized credentials before parsing and replace backtracking suffix and auth-parameter parsing with linear scans. Invalid issuer and holder JWT shapes must return verification failures so malformed inputs cannot crash HTTP integrations. Add parsing and HTTP recovery regressions, document input limits, and update the package development commands. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Compare complete expected error messages so the tests verify the documentation URL and recovery guidance without URL substring assertions that CodeQL mistakes for security validation. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Keep the original tests while evaluating CodeQL alert triage separately. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Avoid a statement-separating semicolon in the note and use a non-reserved participant identifier for Link. Validate the diagram with Mermaid's parser. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Delegate byte encoding, hashing, RSA key validation and signature verification to Node, and JOSE operations to jose. Retain strict input and key-parameter checks and the SPKI adapter needed to preserve the public CryptoKey type. Keep CommonJS consumers working on Node 22.0 through dynamic jose imports, and exercise the minimum runtime in CI. Add independent native-signature coverage for both supported credential algorithms and preserve the existing SDK and wallet integration tests. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
The identity command gate was removed in #377. Keep setup instructions and recovery guidance accurate after rebasing, and describe the verifier dependency choices consistently. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
drapeau-stripe
force-pushed
the
drapeau/agent-identity-sdk
branch
from
October 7, 2026 19:51
111d7ce to
662e171
Compare
stevekaliski-stripe
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Services receiving Link credentials need a verifier they can integrate alongside the wallet. Add
@stripe/agent-identityto verify Link bearer attestations and holder-signed identity presentations, with ESM/CommonJS exports and Node 22+ support. Use Node built-ins andjosefor byte and cryptography operations, retaining identity-specific validation and a small RSA key encoding adapter.Includes issuer discovery and key caching, test fixtures, integration guides, and a runnable event-registration example: an attestation grants site access, and a verified-email presentation completes registration. The application owns sessions, interaction state, and replay policy. Guidance lives in READMEs and examples; no separate
docs/folder is added.Validation:
pop,present, and event registration with session/retry behavior. Tests use a local synthetic issuer with real signatures.r? @drapeau-stripe
-- Written by Codex