JavaScript SDK

@openreason/sdk validates and cryptographically verifies OpenReason Protocol documents in Node and the browser. Attestation verification is a faithful port of the Python reference (orp-validator), so a signature produced on one side verifies on the other.

npm install @openreason/sdk

Source-available under Apache-2.0 in the repository (sdk-js/); install from source with git clone https://github.com/openreasonprotocol/openreason.git && cd openreason/sdk-js && npm install && npm run build.

Validate a document

import { validateDocument, checkDocument } from "@openreason/sdk";
import yaml from "js-yaml";
 
const doc = yaml.load(await fs.readFile("decision.yaml", "utf8")) as Record<string, unknown>;
 
const result = validateDocument(doc);   // schema validity + errors
const check  = checkDocument(doc);      // compliance level + which layers are present
 
console.log(result.valid, check.compliance_level);

validateDocument currently bundles the ORP v0.1 and v0.2 schemas. v0.3 profile validation (ORP-Core / Policy / Ads / AI) and trust-tier evaluation live in the Python validator today; v0.3 schema parity in the SDK is tracked in the repository.

Verify an attestation (offline)

A v0.3 document can carry a detached Ed25519 attestation over its RFC 8785 (JCS) canonical bytes. Verification needs no network, only the public key:

import { verifyAttestation, type ResolveKey } from "@openreason/sdk";
 
const resolveKey: ResolveKey = (kid) => {
  if (kid.startsWith("did:key:")) return kid;        // self-describing public key
  return myKeyDirectory[kid];                          // or look it up yourself
};
 
const verdict = await verifyAttestation(doc, resolveKey);
console.log(verdict.valid, verdict.trust_tier, verdict.content_hash);

Key resolution is deliberately the caller’s job: the SDK stays portable and makes no network calls.

Canonicalisation helpers

import { canonicalize, canonicalString, contentHash } from "@openreason/sdk";

These expose the same JCS canonical form and sha256:<hex> content hash the attestation is computed over, so you can produce signing input in your own key-management flow.

Exports

See also

• MCP server — the same capabilities exposed to AI agents
• Python API — the reference implementation
• Attestation — how v0.3 trust tiers are earned