TypeScript SDK: verify, present and sign mandates
The @mandact/sdk serves both sides: agents present their mandate (OID4VP) and sign HTTP requests (Web Bot Auth); verifiers check mandates offline — signature, disclosures, validity and Token Status List. No third-party dependencies, Node 20 or later.
Verify offline, without an account
verifyMandateCredentialOffline fetches the JWKS or DID document and the status list, checks the SD-JWT VC and returns an authority view. It deliberately makes no decision (decision is always null): only POST /v1/verify or the OID4VP flow decides bindingly — with limits, escalation and a receipt.
Present and sign
presentMandateOid4vp builds the response to an OID4VP request with selective disclosure; withWebBotAuth wraps fetch and signs every request per RFC 9421, optionally with the mandate token attached.
In sync with the service
A contract test in the main repository keeps SDK and API together. Previously consume() sent neither action_type nor counterparty — both of which the API checks fail-closed. Such drift now surfaces in the build, not at the customer.
import { verifyMandateCredentialOffline } from "@mandact/sdk";
const r = await verifyMandateCredentialOffline({
credential,
issuerBase: "https://mandact.com",
action: { type: "purchase.goods", amount: { value: 120, currency: "CHF" } },
});
r.credential_valid; // signature, disclosures, validity, status
r.decision; // null — binding only via /v1/verifyStatus
In the repository (folder sdk/, version 0.60.0). Not yet published on npm.