DEV Community

Cover image for Asqav TypeScript SDK is live
João André Gomes Marques
João André Gomes Marques

Posted on • Originally published at asqav.com

Asqav TypeScript SDK is live

#security #ai #typescript #opensource

If your AI agents run on TypeScript, you have probably noticed every governance and observability tool in the space treats Python as the default and JavaScript as an afterthought. We did the same thing for a while. Today we ship the fix.

npm install @asqav/sdk
Enter fullscreen mode Exit fullscreen mode

Same REST API as the Python SDK, same ML-DSA-65 signatures generated server-side, same audit trail. The npm package is a thin client that hits api.asqav.com - all crypto stays on our infrastructure. Public surface mirrors Python one-for-one so you can write the same code in either language and get the same behaviour.

Thirty-second example 

import { init, Agent } from "@asqav/sdk";

init({ apiKey: process.env.ASQAV_API_KEY });

const agent = await Agent.create({ name: "support-bot" });
await agent.startSession();

const sig = await agent.sign({
  actionType: "stripe.refund",
  context: { amount: 1500, reason: "customer dispute" }
});

console.log(sig.verificationUrl);
// https://asqav.com/verify/sig_abc123
await agent.endSession({ status: "completed" });
Enter fullscreen mode Exit fullscreen mode

That signature is real ML-DSA-65 (FIPS 204), anchored to Bitcoin via OpenTimestamps, retrievable from any compliance auditor without needing your infrastructure online. Same guarantees as the Python flow.

What this unlocks

The interesting frameworks for agents in TypeScript right now are Vercel AI SDK, LangChain.js, and Mastra. Each one gives you a tool-calling loop where the model picks an action, you execute it, and the result feeds back. None of them give you a tamper-evident record of what the agent actually did.

With the npm SDK, wrapping a Vercel AI SDK tool to sign every call is six lines:

import { tool } from "ai";
import { Agent } from "@asqav/sdk";

const agent = await Agent.create({ name: "support-bot" });

const refund = tool({
  description: "Issue a refund",
  parameters: z.object({ amount: z.number(), customer: z.string() }),
  execute: async (args) => {
    await agent.sign({ actionType: "stripe.refund", context: args });
    return await stripe.refunds.create(args);
  }
});
Enter fullscreen mode Exit fullscreen mode

Every refund the model decides to issue now has a signature on the way out. Replace the wrapper at the framework level and every tool gets governance for free.

Why we waited

Honest answer: shipping a second SDK doubles the surface to maintain. We held off until the Python SDK API stabilised so the TypeScript port could mirror it cleanly instead of forking immediately. The two are now version-locked at the API level - what works in one works in the other. Releases are independent (py-v0.2.22, ts-v0.1.0) so we can patch one without touching the other.

Install matrix

Both languages, same brand, same backend:

# Python
pip install asqav

# TypeScript / Node / Deno / Bun
npm install @asqav/sdk
Enter fullscreen mode Exit fullscreen mode

Source: github.com/jagmarques/asqav-sdk (monorepo with python/ and typescript/ side by side, MIT). Docs and dashboard: asqav.com/docs. Get an API key at asqav.com and sign your first action in under a minute.

If you are wiring this into Vercel AI SDK or LangChain.js right now and hit a rough edge, open an issue on the SDK repo and we will turn it around fast. The TypeScript surface is fresh and we want to harden it against real usage before more frameworks land on top.

Top comments (0)