Getting started

VACT-P ships official reference SDKs in Python and TypeScript. Both enforce JSON Canonicalization (RFC 8785), Ed25519 signing, envelope validation, and authority-chain evaluation — and both produce byte-identical canonical forms, verified against shared test vectors.

Installation

pip install vact-p-sdk

npm install @vact-p-protocol/sdk

Python usage

Create a signed task envelope and verify it:

from vact_p_sdk import Keypair, sign_object, verify_object, make_envelope

# Initialize controller keypair
controller = Keypair.generate(kid="did:web:example.com#key-1")

# Create task request envelope
env = make_envelope(
    type="vact_p.task.request",
    mode="async",
    sender="did:web:client.example",
    recipients=["did:web:provider.example"],
    payload={"task": "process_report"},
    ttl_seconds=300,
)

# Sign and verify envelope
signed = sign_object(env, controller)             # JCS + Ed25519 (spec §9.2)
assert verify_object(signed, controller.public_key)

TypeScript usage

import { generateKeypair, signObject, verifyObject, makeEnvelope } from "@vact-p-protocol/sdk";

const kp = generateKeypair("did:web:example.com#key-1");
const env = makeEnvelope({
  type: "vact_p.task.request",
  mode: "sync",
  sender: "did:web:client.example",
  recipients: ["did:web:provider.example"],
  payload: { hello: "world" },
  ttlSeconds: 300,
});

const signed = signObject(env, kp);
const isValid = verifyObject(signed, kp.publicKey); // true

LangChain integration

Secure a LangChain tool call by verifying the VACT-P authority chain before it runs:

from langchain_core.tools import tool
from vact_p_sdk import verify_chain, authorize

@tool
def read_vault(document_id: str, envelope_json: str) -> str:
    """Reads from a secure vault if authorized by the VACT-P delegation chain."""
    envelope = json.loads(envelope_json)
    chain = envelope.get("authority_chain", [])

    # Reconstruct effective authority and verify signatures
    effective = verify_chain(chain, RESOLVER)

    # Enforce permission checks
    decision = authorize(effective, action="document.read", resource=document_id)
    decision.enforce()  # fails closed if not allowed

    return fetch_secret(document_id)

Next steps