-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsdk.html
More file actions
113 lines (102 loc) · 6.74 KB
/
Copy pathsdk.html
File metadata and controls
113 lines (102 loc) · 6.74 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>SDK — Observer Protocol</title>
<meta name="description" data-shared-copy="offline-scope" content="The Observer Protocol SDK packages are deprecated. Use @observer-protocol/policy-engine to verify a delegation credential offline.">
<link rel="stylesheet" href="shared-styles.css">
<style>
.wrap { max-width: 760px; margin: 0 auto; padding: 3rem 1.5rem 5rem; }
.notice { background: #2a1f0a; border: 1px solid #6b5210; border-radius: 4px; padding: 1.1rem 1.25rem; margin: 1.5rem 0 2.5rem; }
.notice strong { color: #f0c14b; }
.code-block { background: #111; border: 1px solid var(--border); border-radius: 4px; padding: 1rem 1.25rem; font-family: monospace; font-size: 13px; line-height: 1.7; overflow-x: auto; margin: 1rem 0; white-space: pre; }
.dim { color: var(--text-secondary); }
h2 { font-size: 1.15rem; margin: 2.5rem 0 .75rem; }
p { line-height: 1.75; color: var(--text-secondary); font-size: 14px; }
table { width: 100%; border-collapse: collapse; margin: 1rem 0; font-size: 13px; }
th, td { text-align: left; padding: .55rem .6rem; border-bottom: 1px solid var(--border); }
th { color: var(--text-secondary); font-weight: 600; }
code { background: #1a1a1a; padding: .1rem .35rem; border-radius: 3px; font-size: 12.5px; }
</style>
</head>
<body>
<div class="wrap">
<h1>SDK</h1>
<div class="notice">
<strong>⚠ The SDK packages are deprecated and unmaintained.</strong>
<p style="margin:.6rem 0 0;">
<code>@observer-protocol/sdk</code>, <code>@observerprotocol/sdk</code> and the PyPI package
<code>observer-protocol</code> were all last released on 30 April 2026 and are no longer
maintained. The npm packages are marked deprecated. They have not been unpublished, so anything
already pinned to them keeps working — but do not start with them.
</p>
</div>
<h2>What to use instead</h2>
<p>
There is no single client library today. What exists is a verification core and one adapter per
rail, and that is the honest shape of it:
</p>
<table>
<tr><th>If you want to…</th><th>Use</th></tr>
<tr><td>Verify a credential someone gave you</td><td><code>@observer-protocol/policy-engine</code></td></tr>
<tr><td>Enforce policy on x402</td><td><code>@observer-protocol/x402-op-authorize</code></td></tr>
<tr><td>Enforce policy on L402 / Lightning</td><td><code>@observer-protocol/l402-op-authorize</code></td></tr>
<tr><td>Enforce policy on Tether WDK</td><td><code>@observer-protocol/wdk-op-policy</code></td></tr>
<tr><td>Enforce policy on MPP / Tempo</td><td><code>@observer-protocol/mppx-op-account</code></td></tr>
<tr><td>Verify an Open Wallet Standard delegation</td><td><code>@observer-protocol/ows-op-verify</code></td></tr>
</table>
<h2>Verifying a credential</h2>
<p data-shared-copy="offline-scope">No API key, no token, no Observer Protocol API in the path. It fetches the issuer's DID document and the revocation status list over ordinary HTTPS from the origins the credential names; point <code>offline.didDocumentPath</code> at a local copy and it makes no network call at all.</p>
<div class="code-block">npm install @observer-protocol/policy-engine</div>
<div class="code-block">import { verifyCredentialObject } from '@observer-protocol/policy-engine';
const verdict = await verifyCredentialObject(
mandate, <span class="dim">// the signed delegation credential</span>
config, <span class="dim">// VerifierConfig: pinned issuer, schema allowlist</span>
Date.now() <span class="dim">// evaluated at this instant</span>
);</div>
<p>
It checks the issuer, the structure, the validity window, the <code>eddsa-jcs-2022</code> proof
against the issuer's DID document, and revocation. It fails closed.
</p>
<p>
<span class="dim">
Note that <code>verifyCredential(config, nowMs)</code> is a different exported function and does
not take the credential. The published type definitions are the reference — a worked
example does not ship yet, which is a gap we know about.
</span>
</p>
<h2>Everything it checks, you can re-check</h2>
<p data-shared-copy="offline-scope">
The DID document is public and the schema URLs are frozen and immutable, so verification needs no
permission from us: nothing to authenticate to, and nothing we can withhold to make a credential
stop verifying. It is not independent of reachability, though.
<code>onUnreachable: 'cache-then-deny'</code> is the only implemented mode, so a revocation list
that cannot be fetched is served from cache inside the staleness window and <strong>denied</strong>
outside it — and Observer's own clause-zero status list is served by
<code>api.observerprotocol.org</code> rather than as a static file. It fails closed, and it will
refuse us too.
</p>
<ul style="color:var(--text-secondary);font-size:14px;line-height:1.9;">
<li><a href="https://github.com/observer-protocol/op-policy-engine">github.com/observer-protocol/op-policy-engine</a> — source</li>
<li><a href="https://www.npmjs.com/package/@observer-protocol/policy-engine">npmjs.com/package/@observer-protocol/policy-engine</a> — package</li>
<li><a href="/.well-known/did.json">/.well-known/did.json</a> — the issuer DID document</li>
<li><a href="/schemas/delegation/v2.7.json">/schemas/delegation/v2.7.json</a> — the current delegation schema, published 8 August 2026. v2.7 is v2.6 plus <code>requiresDecisionAttestation</code>; schema URLs are immutable, so v2.6 stays served for credentials that declare it</li>
</ul>
<p style="margin-top:2.5rem;">
<span class="dim">
A hosted one-call verifier is also available at
<a href="https://verify.observerprotocol.org/health"><code>verify.observerprotocol.org</code></a>
— <code>POST /v1/verify</code>, open and unauthenticated, rate limited. It returns a
verdict signed with <code>did:web:observerprotocol.org#key-7</code>, so its answer is checkable
against the same DID document as everything else.
<br><br>
<span data-shared-copy="offline-scope"><strong>The offline path above stays the primary instruction.</strong> It needs nothing from us
at the moment of verification and cannot be rate limited, revoked or taken down. The hosted
endpoint is a convenience for getting an answer in one call, not a dependency.
</span>
</p>
<p style="margin-top:2rem;"><a href="./docs.html">← All documentation</a></p>
</div>
</body>
</html>