@dnsid-ai/sdk 0.20.1

package/dist/index.cjs

@@ -0,0 +1,657 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ArgumentError: () => import_protocol5.ArgumentError,
+  DEFAULT_REGISTRY_URL: () => import_registry.DEFAULT_REGISTRY_URL,
+  DNSID_VERSION: () => import_protocol5.DNSID_VERSION,
+  DNSSECMode: () => import_protocol5.DNSSECMode,
+  DNSSECState: () => import_protocol5.DNSSECState,
+  DnsIdTxtRecord: () => import_protocol5.DnsIdTxtRecord,
+  DomainLog: () => import_protocol5.DomainLog,
+  DomainSnapshot: () => import_protocol5.DomainSnapshot,
+  HttpSignaturesProfile: () => import_http_signatures.HttpSignaturesProfile,
+  IdentityManager: () => import_protocol5.IdentityManager,
+  InMemoryIdentityCache: () => import_protocol5.InMemoryIdentityCache,
+  JWKS: () => import_protocol5.JWKS,
+  JWKS_MAX_RESPONSE_BYTES: () => import_protocol5.JWKS_MAX_RESPONSE_BYTES,
+  JoseProfile: () => import_jose.JoseProfile,
+  LogRegistry: () => import_protocol5.LogRegistry,
+  ManagedIssuanceActivationError: () => ManagedIssuanceActivationError,
+  ManagedIssuanceSubmissionError: () => ManagedIssuanceSubmissionError,
+  ManagedKeyRotationActivationError: () => ManagedKeyRotationActivationError,
+  ManagedKeyRotationSubmissionError: () => ManagedKeyRotationSubmissionError,
+  NoopLogReader: () => import_protocol5.NoopLogReader,
+  ParseError: () => import_protocol5.ParseError,
+  PreparedEventSubmissionError: () => import_registry.PreparedEventSubmissionError,
+  RegistryClient: () => import_registry.RegistryClient,
+  RegistryWorkflowError: () => import_registry.RegistryWorkflowError,
+  SDK_CONFORMANCE: () => SDK_CONFORMANCE,
+  SIGNING_ALGS: () => import_protocol5.SIGNING_ALGS,
+  STATUS_MAX_RESPONSE_BYTES: () => import_protocol5.STATUS_MAX_RESPONSE_BYTES,
+  ValidationError: () => import_protocol5.ValidationError,
+  VerificationCode: () => import_protocol5.VerificationCode,
+  VerificationError: () => import_protocol5.VerificationError,
+  VerifiedDomain: () => import_protocol5.VerifiedDomain,
+  WebBotAuthProfile: () => import_web_bot_auth.WebBotAuthProfile,
+  activeStatusDocument: () => import_protocol5.activeStatusDocument,
+  awaitRegistryManagedPublication: () => import_registry.awaitRegistryManagedPublication,
+  createHttpSignaturesProfile: () => import_http_signatures.createHttpSignaturesProfile,
+  createIdentityManager: () => createIdentityManager,
+  createIdentityVerifier: () => createIdentityVerifier,
+  createJoseProfile: () => import_jose.createJoseProfile,
+  createWebBotAuthProfile: () => import_web_bot_auth.createWebBotAuthProfile,
+  fromBase64Url: () => import_protocol5.fromBase64Url,
+  httpSignatures: () => httpSignatures,
+  isDomainName: () => import_protocol5.isDomainName,
+  isTransientVerificationError: () => import_protocol5.isTransientVerificationError,
+  issueManagedIdentity: () => issueManagedIdentity,
+  jose: () => jose,
+  jwkSignatureAlg: () => import_protocol5.jwkSignatureAlg,
+  jwkThumbprint: () => import_protocol5.jwkThumbprint,
+  normalizeFQDN: () => import_protocol5.normalizeFQDN,
+  parseKaDuration: () => import_protocol5.parseKaDuration,
+  parseKeyId: () => import_protocol5.parseKeyId,
+  publishClientControlledRecord: () => import_registry.publishClientControlledRecord,
+  publishToRegistry: () => import_registry.publishToRegistry,
+  registry: () => registry,
+  resumeManagedIssuance: () => resumeManagedIssuance,
+  resumeManagedOperationalKeyRotation: () => resumeManagedOperationalKeyRotation,
+  retryTransientVerification: () => import_protocol5.retryTransientVerification,
+  rotateManagedOperationalKey: () => rotateManagedOperationalKey,
+  toArrayBuffer: () => import_protocol5.toArrayBuffer,
+  toBase64Url: () => import_protocol5.toBase64Url,
+  validateAgentStatus: () => import_protocol5.validateAgentStatus,
+  verifyWithKey: () => import_protocol5.verifyWithKey,
+  webBotAuth: () => webBotAuth
+});
+module.exports = __toCommonJS(index_exports);
+var import_protocol4 = require("@dnsid-ai/protocol");
+__reExport(index_exports, require("@dnsid-ai/protocol"), module.exports);
+var import_protocol5 = require("@dnsid-ai/protocol");
+var jose = __toESM(require("@dnsid-ai/jose"), 1);
+var httpSignatures = __toESM(require("@dnsid-ai/http-signatures"), 1);
+var registry = __toESM(require("@dnsid-ai/registry"), 1);
+var webBotAuth = __toESM(require("@dnsid-ai/web-bot-auth"), 1);
+var import_jose = require("@dnsid-ai/jose");
+var import_http_signatures = require("@dnsid-ai/http-signatures");
+var import_registry = require("@dnsid-ai/registry");
+
+// src/managed-key-rotation.ts
+var import_protocol = require("@dnsid-ai/protocol");
+var import_writer = require("@dnsid-ai/log-c2sp-tlog/writer");
+var ManagedKeyRotationSubmissionError = class extends import_protocol.VerificationError {
+  rotation;
+  retryWithSameBytes;
+  constructor(message, rotation, retryWithSameBytes2, cause) {
+    super(message, { code: import_protocol.VerificationCode.LogError, transient: retryWithSameBytes2, cause });
+    this.name = "ManagedKeyRotationSubmissionError";
+    this.rotation = rotation;
+    this.retryWithSameBytes = retryWithSameBytes2;
+  }
+};
+var ManagedKeyRotationActivationError = class extends import_protocol.VerificationError {
+  rotation;
+  constructor(message, rotation, cause) {
+    super(message, { code: import_protocol.VerificationCode.LogError, transient: true, cause });
+    this.name = "ManagedKeyRotationActivationError";
+    this.rotation = rotation;
+  }
+};
+async function rotateManagedOperationalKey(options) {
+  const previousKey = await options.keyProvider.signingKey();
+  new import_protocol.JWKS([previousKey]).validateOperational();
+  const previousThumbprint = await (0, import_protocol.jwkThumbprint)(previousKey);
+  const newKid = await options.keyProvider.generateKey();
+  const newKey = await options.keyProvider.jwk(newKid);
+  new import_protocol.JWKS([newKey]).validateOperational();
+  if (await (0, import_protocol.jwkThumbprint)(newKey) === previousThumbprint) {
+    throw permanentRotationError("managed KEY_ROTATION requires a distinct pending operational key");
+  }
+  let raw;
+  try {
+    raw = await options.registryClient.prepareKeyRotation(options.domain, {
+      previousKeyId: previousThumbprint,
+      publicKey: newKey
+    }, options.idempotencyKey);
+  } catch (cause) {
+    throw new import_protocol.VerificationError("managed key rotation preparation is unavailable", {
+      code: import_protocol.VerificationCode.LogError,
+      transient: true,
+      cause
+    });
+  }
+  if (raw.logReference !== options.logReference) {
+    throw permanentRotationError(`registry preparation returned unexpected log reference ${raw.logReference}`);
+  }
+  const context = { expectedFqdn: options.domain, previousOperationalKey: previousKey };
+  let prepared = await (0, import_writer.parsePreparedC2spTlogEvent)(raw.entryBytes, raw.logReference, context);
+  if (prepared.envelope.type !== "KEY_ROTATION") {
+    throw permanentRotationError(`registry preparation returned ${String(prepared.envelope.type)} instead of KEY_ROTATION`);
+  }
+  if (prepared.envelope.fqdn !== options.domain) {
+    throw permanentRotationError("registry KEY_ROTATION fqdn does not match the expected identity");
+  }
+  if (prepared.envelope.prev_thumb !== previousThumbprint) {
+    throw permanentRotationError("registry KEY_ROTATION previous thumbprint does not match the active operational key");
+  }
+  await assertPreparedRotationKey(prepared.envelope.new_ku, prepared.envelope.new_thumb, newKey);
+  prepared = await (0, import_writer.signPreparedC2spTlogEvent)(prepared, "PreviousOperational", options.keyProvider, context);
+  prepared = await (0, import_writer.signPreparedC2spTlogEvent)(prepared, "NewOperational", options.keyProvider, context);
+  const entryBytes = await (0, import_writer.c2spTlogEntryBytes)(prepared, context);
+  const rotation = {
+    domain: options.domain,
+    logReference: options.logReference,
+    previousKid: previousKey.kid,
+    newKid,
+    entryBytes: entryBytes.slice(),
+    idempotencyKey: options.idempotencyKey,
+    activated: false,
+    applicationSigningPaused: true
+  };
+  await options.persistRotation(rotation);
+  await options.setApplicationSigningPaused(true);
+  return submitManagedRotation(options.keyProvider, options.registryClient, rotation, options.persistRotation, options.setApplicationSigningPaused);
+}
+async function resumeManagedOperationalKeyRotation(options) {
+  if (options.rotation.activated) {
+    if (!options.rotation.applicationSigningPaused) return options.rotation;
+    await options.setApplicationSigningPaused(false);
+    const completed = { ...options.rotation, applicationSigningPaused: false };
+    await options.persistRotation(completed);
+    return completed;
+  }
+  if (options.rotation.submission?.state === "rejected") {
+    throw permanentRotationError("cannot resume a rejected managed key rotation");
+  }
+  await options.setApplicationSigningPaused(true);
+  return submitManagedRotation(options.keyProvider, options.registryClient, options.rotation, options.persistRotation, options.setApplicationSigningPaused);
+}
+async function submitManagedRotation(keyProvider, registryClient, rotation, persistRotation, setApplicationSigningPaused) {
+  let submission;
+  try {
+    submission = await registryClient.submitPreparedEvent(rotation.domain, rotation.entryBytes, rotation.idempotencyKey);
+  } catch (cause) {
+    const retryWithSameBytes2 = structuredRetryWithSameBytes(cause);
+    throw new ManagedKeyRotationSubmissionError(
+      retryWithSameBytes2 ? "managed key rotation submission is unresolved; retry the same bytes and idempotency key" : "managed key rotation submission failed terminally",
+      rotation,
+      retryWithSameBytes2,
+      cause
+    );
+  }
+  await assertSubmissionMatchesRotation(rotation, submission);
+  const next = { ...rotation, submission };
+  await persistRotation(next);
+  if (submission.state === "rejected") {
+    throw new ManagedKeyRotationSubmissionError(
+      `registry rejected the prepared KEY_ROTATION: ${submission.errorCode ?? "unknown error"}`,
+      next,
+      false
+    );
+  }
+  if (submission.state !== "accepted") return next;
+  let recoverable = next;
+  try {
+    await reconcileAcceptedRotation(keyProvider, rotation);
+    const activated = { ...next, activated: true };
+    await persistRotation(activated);
+    recoverable = activated;
+    await setApplicationSigningPaused(false);
+    const completed = { ...activated, applicationSigningPaused: false };
+    await persistRotation(completed);
+    return completed;
+  } catch (cause) {
+    throw new ManagedKeyRotationActivationError(
+      "managed key rotation was accepted, but local key activation is incomplete; resume with this rotation state",
+      recoverable,
+      cause
+    );
+  }
+}
+async function reconcileAcceptedRotation(keyProvider, rotation) {
+  const activeKid = (await keyProvider.signingKey()).kid;
+  if (activeKid === rotation.previousKid) {
+    await keyProvider.activate(rotation.newKid);
+  } else if (activeKid !== rotation.newKid) {
+    throw permanentRotationError(`unexpected active key ${activeKid} while reconciling managed key rotation`);
+  }
+  if ((await keyProvider.listKeyIds()).includes(rotation.previousKid)) {
+    await keyProvider.supersede(rotation.previousKid);
+  }
+}
+async function assertPreparedRotationKey(value, thumbprint, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw permanentRotationError("registry KEY_ROTATION is missing new_ku");
+  const actual = value;
+  const actualThumbprint = await (0, import_protocol.jwkThumbprint)(actual);
+  const expectedThumbprint = await (0, import_protocol.jwkThumbprint)(expected);
+  if (actual.kid !== expected.kid || actual.alg !== expected.alg || actualThumbprint !== expectedThumbprint) {
+    throw permanentRotationError("registry KEY_ROTATION new key does not match the generated pending key");
+  }
+  if (thumbprint !== expectedThumbprint) throw permanentRotationError("registry KEY_ROTATION new thumbprint does not match the generated pending key");
+}
+async function assertSubmissionMatchesRotation(rotation, submission) {
+  if (rotation.submission?.entryHash && submission.entryHash && rotation.submission.entryHash !== submission.entryHash) {
+    throw permanentRotationError("registry reconciled a different entry hash for this managed key rotation");
+  }
+  if (submission.state !== "accepted") return;
+  const expectedHash = await sha256Hex(rotation.entryBytes);
+  if (submission.entryHash !== expectedHash) {
+    throw permanentRotationError("accepted submission entry hash does not match the exact managed key rotation bytes");
+  }
+  if (submission.keyId !== void 0 && submission.keyId !== rotation.newKid) {
+    throw permanentRotationError("accepted submission key_id does not match the generated pending key");
+  }
+}
+function structuredRetryWithSameBytes(cause) {
+  if (cause && typeof cause === "object" && "retryWithSameBytes" in cause && typeof cause.retryWithSameBytes === "boolean") {
+    return cause.retryWithSameBytes;
+  }
+  return true;
+}
+function permanentRotationError(message, cause) {
+  return new import_protocol.VerificationError(message, { code: import_protocol.VerificationCode.LogError, transient: false, cause });
+}
+async function sha256Hex(value) {
+  const bytes = value.slice();
+  const digest = await crypto.subtle.digest("SHA-256", bytes.buffer);
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/managed-issuance.ts
+var import_protocol2 = require("@dnsid-ai/protocol");
+var import_writer2 = require("@dnsid-ai/log-c2sp-tlog/writer");
+var ManagedIssuanceSubmissionError = class extends import_protocol2.VerificationError {
+  issuance;
+  retryWithSameBytes;
+  constructor(message, issuance, retryWithSameBytes2, transient, cause) {
+    super(message, { code: import_protocol2.VerificationCode.LogError, transient, cause });
+    this.name = "ManagedIssuanceSubmissionError";
+    this.issuance = issuance;
+    this.retryWithSameBytes = retryWithSameBytes2;
+  }
+};
+var ManagedIssuanceActivationError = class extends import_protocol2.VerificationError {
+  issuance;
+  constructor(issuance, cause) {
+    super("managed ISSUANCE was accepted, but publication or activation is incomplete; resume this issuance", {
+      code: import_protocol2.VerificationCode.LogError,
+      transient: true,
+      cause
+    });
+    this.name = "ManagedIssuanceActivationError";
+    this.issuance = issuance;
+  }
+};
+async function issueManagedIdentity(options) {
+  const domain = (0, import_protocol2.normalizeFQDN)(options.domain, true);
+  const governanceId = (0, import_protocol2.normalizeFQDN)(options.governanceId, true);
+  if (!options.idempotencyKey || options.idempotencyKey.trim() !== options.idempotencyKey || options.idempotencyKey.length > 200) {
+    throw permanentLogError("managed ISSUANCE idempotencyKey must contain 1 to 200 characters without surrounding whitespace");
+  }
+  const existing = await options.loadIssuance();
+  const { entityKey, operationalKey } = await trustedKeys(options.entityKey, options.operationalKeyProvider);
+  if (existing) {
+    assertSameOperation(existing, { ...options, domain, governanceId });
+    return resumeManagedIssuanceState(options, existing, entityKey, operationalKey);
+  }
+  const intent = {
+    domain,
+    governanceId,
+    idempotencyKey: options.idempotencyKey,
+    entityKid: entityKey.kid,
+    entityThumbprint: await (0, import_protocol2.jwkThumbprint)(entityKey),
+    operationalKid: operationalKey.kid,
+    operationalThumbprint: await (0, import_protocol2.jwkThumbprint)(operationalKey),
+    activated: false
+  };
+  const raced = await options.createIssuance(intent);
+  if (raced) {
+    assertSameOperation(raced, { ...options, domain, governanceId });
+    return resumeManagedIssuanceState(options, raced, entityKey, operationalKey);
+  }
+  return prepareAndSubmit(options, intent, entityKey, operationalKey);
+}
+async function resumeManagedIssuance(options) {
+  const issuance = await options.loadIssuance();
+  if (!issuance) throw permanentLogError("no durable managed ISSUANCE operation exists");
+  const { entityKey, operationalKey } = await trustedKeys(options.entityKey, options.operationalKeyProvider);
+  return resumeManagedIssuanceState(options, issuance, entityKey, operationalKey);
+}
+async function resumeManagedIssuanceState(options, issuance, entityKey, operationalKey) {
+  await assertPersistedKeys(issuance, entityKey, operationalKey);
+  if (issuance.activated) return issuance;
+  if (issuance.terminalFailure || issuance.submission?.state === "rejected") {
+    throw permanentLogError("cannot resume a terminally failed managed ISSUANCE");
+  }
+  if (issuance.submission?.state === "accepted") {
+    await verifyPersistedCompletedIssuance(issuance, entityKey, operationalKey);
+    await assertAcceptedBinding(issuance, issuance.submission);
+    return activate(options, issuance);
+  }
+  if (!issuance.entryBytes || !issuance.logReference) {
+    return prepareAndSubmit(options, issuance, entityKey, operationalKey);
+  }
+  return submit(options, issuance);
+}
+async function prepareAndSubmit(options, intent, entityKey, operationalKey) {
+  let raw;
+  try {
+    raw = await options.registryClient.prepareIssuance(intent.domain, intent.idempotencyKey);
+  } catch (cause) {
+    if (isTerminalFailure(cause)) {
+      const terminal = {
+        ...intent,
+        terminalFailure: { stage: "preparation", errorCode: structuredErrorCode(cause) }
+      };
+      await options.persistIssuance(terminal);
+      throw new ManagedIssuanceSubmissionError("managed ISSUANCE preparation failed terminally", terminal, false, false, cause);
+    }
+    throw new ManagedIssuanceSubmissionError("managed ISSUANCE preparation is unavailable; resume the durable intent", intent, false, true, cause);
+  }
+  const context = {
+    expectedFqdn: intent.domain,
+    expectedGovernanceId: intent.governanceId,
+    entityKey,
+    operationalKey
+  };
+  let prepared;
+  try {
+    if (options.logReference && raw.logReference !== options.logReference) {
+      throw permanentLogError(`registry preparation returned unexpected log reference ${raw.logReference}`);
+    }
+    prepared = await (0, import_writer2.parsePreparedC2spTlogEvent)(raw.entryBytes, raw.logReference, context);
+    if (prepared.envelope.type !== "ISSUANCE") {
+      throw permanentLogError(`registry preparation returned ${String(prepared.envelope.type)} instead of ISSUANCE`);
+    }
+    const existingSignatures = prepared.envelope.sigs;
+    if (!existingSignatures?.ae) throw permanentLogError("registry ISSUANCE preparation is missing the accountable-entity signature");
+  } catch (cause) {
+    const terminal = {
+      ...intent,
+      terminalFailure: { stage: "preparation", errorCode: structuredErrorCode(cause) }
+    };
+    await options.persistIssuance(terminal);
+    throw new ManagedIssuanceSubmissionError("managed ISSUANCE preparation failed trusted validation", terminal, false, false, cause);
+  }
+  prepared = await (0, import_writer2.signPreparedC2spTlogEvent)(prepared, "OperationalCountersignature", options.operationalKeyProvider, context);
+  const entryBytes = await (0, import_writer2.c2spTlogEntryBytes)(prepared, context);
+  const completed = {
+    ...intent,
+    logReference: raw.logReference,
+    entryBytes: entryBytes.slice(),
+    entryHash: await sha256Hex2(entryBytes)
+  };
+  await options.persistIssuance(completed);
+  return submit(options, completed);
+}
+async function submit(options, issuance) {
+  if (!issuance.entryBytes || !issuance.logReference) throw permanentLogError("managed ISSUANCE exact bytes are not persisted");
+  const { entityKey, operationalKey } = await trustedKeys(options.entityKey, options.operationalKeyProvider);
+  await verifyPersistedCompletedIssuance(issuance, entityKey, operationalKey);
+  let submission;
+  try {
+    submission = await options.registryClient.submitPreparedEvent(
+      issuance.domain,
+      issuance.entryBytes.slice(),
+      issuance.idempotencyKey
+    );
+  } catch (cause) {
+    const sameBytes = retryWithSameBytes(cause);
+    let recoverable = issuance;
+    if (sameBytes) {
+      recoverable = {
+        ...issuance,
+        submission: {
+          state: "indeterminate",
+          entryHash: issuance.entryHash,
+          errorCode: structuredErrorCode(cause)
+        }
+      };
+      await options.persistIssuance(recoverable);
+    } else {
+      recoverable = {
+        ...issuance,
+        submission: {
+          state: "rejected",
+          entryHash: issuance.entryHash,
+          errorCode: structuredErrorCode(cause)
+        },
+        terminalFailure: { stage: "submission", errorCode: structuredErrorCode(cause) }
+      };
+      await options.persistIssuance(recoverable);
+    }
+    throw new ManagedIssuanceSubmissionError(
+      sameBytes ? "managed ISSUANCE submission is indeterminate; retry the same bytes and idempotency key" : "managed ISSUANCE submission failed terminally",
+      recoverable,
+      sameBytes,
+      sameBytes,
+      cause
+    );
+  }
+  await assertAcceptedBinding(issuance, submission);
+  const reconciled = { ...issuance, submission };
+  await options.persistIssuance(reconciled);
+  if (submission.state === "rejected") {
+    throw new ManagedIssuanceSubmissionError(
+      `registry rejected the prepared ISSUANCE: ${submission.errorCode ?? "unknown error"}`,
+      reconciled,
+      false,
+      false
+    );
+  }
+  if (submission.state !== "accepted") return reconciled;
+  return activate(options, reconciled);
+}
+async function activate(options, issuance) {
+  try {
+    await options.activateAcceptedIssuance(issuance);
+    const activated = { ...issuance, activated: true };
+    await options.persistIssuance(activated);
+    return activated;
+  } catch (cause) {
+    throw new ManagedIssuanceActivationError(issuance, cause);
+  }
+}
+async function trustedKeys(entityKey, operationalProvider) {
+  const operationalKey = await operationalProvider.signingKey();
+  new import_protocol2.JWKS([entityKey]).validateRecordSigning();
+  new import_protocol2.JWKS([operationalKey]).validateOperational();
+  if (await (0, import_protocol2.jwkThumbprint)(entityKey) === await (0, import_protocol2.jwkThumbprint)(operationalKey)) {
+    throw permanentLogError("managed ISSUANCE requires distinct entity and operational keys");
+  }
+  return { entityKey, operationalKey };
+}
+async function assertPersistedKeys(state, entityKey, operationalKey) {
+  if (state.entityKid !== entityKey.kid || state.entityThumbprint !== await (0, import_protocol2.jwkThumbprint)(entityKey)) {
+    throw permanentLogError("durable managed ISSUANCE entity key does not match the trusted provider");
+  }
+  if (state.operationalKid !== operationalKey.kid || state.operationalThumbprint !== await (0, import_protocol2.jwkThumbprint)(operationalKey)) {
+    throw permanentLogError("durable managed ISSUANCE operational key does not match the trusted provider");
+  }
+}
+async function verifyPersistedCompletedIssuance(state, entityKey, operationalKey) {
+  if (!state.entryBytes || !state.entryHash || !state.logReference) {
+    throw permanentLogError("durable managed ISSUANCE is missing exact bytes, hash, or log reference");
+  }
+  const actualHash = await sha256Hex2(state.entryBytes);
+  if (actualHash !== state.entryHash) throw permanentLogError("durable managed ISSUANCE bytes do not match their persisted hash");
+  const context = {
+    expectedFqdn: state.domain,
+    expectedGovernanceId: state.governanceId,
+    entityKey,
+    operationalKey
+  };
+  const prepared = await (0, import_writer2.parsePreparedC2spTlogEvent)(state.entryBytes, state.logReference, context);
+  const canonical = await (0, import_writer2.c2spTlogEntryBytes)(prepared, context);
+  if (!bytesEqual(canonical, state.entryBytes)) throw permanentLogError("durable managed ISSUANCE bytes are not the canonical completed entry");
+}
+function assertSameOperation(state, options) {
+  if (state.domain !== options.domain || state.governanceId !== options.governanceId || state.idempotencyKey !== options.idempotencyKey) {
+    throw permanentLogError("a different durable managed ISSUANCE operation already exists");
+  }
+}
+async function assertAcceptedBinding(issuance, submission) {
+  if (issuance.submission?.entryHash && submission.entryHash !== issuance.submission.entryHash) {
+    throw permanentLogError("registry reconciled a different entry hash for this managed ISSUANCE");
+  }
+  if (submission.state !== "accepted") return;
+  const expectedHash = await sha256Hex2(issuance.entryBytes);
+  if (submission.entryHash !== expectedHash) throw permanentLogError("accepted entry hash does not match the exact managed ISSUANCE bytes");
+  if (!Number.isSafeInteger(submission.index) || submission.index < 0) throw permanentLogError("accepted managed ISSUANCE is missing a valid index");
+  const expectedReference = `${issuance.logReference}@${submission.index}`;
+  if (submission.logRef !== expectedReference) throw permanentLogError("accepted managed ISSUANCE final log reference does not match its prepared binding");
+}
+function retryWithSameBytes(cause) {
+  return !(cause && typeof cause === "object" && "retryWithSameBytes" in cause && cause.retryWithSameBytes === false);
+}
+function isTerminalFailure(cause) {
+  if (!cause || typeof cause !== "object") return false;
+  if ("retryable" in cause && cause.retryable === false) return true;
+  if ("state" in cause && cause.state === "rejected") return true;
+  return "retryWithSameBytes" in cause && cause.retryWithSameBytes === false;
+}
+function structuredErrorCode(cause) {
+  if (cause && typeof cause === "object" && "code" in cause && typeof cause.code === "string") {
+    return cause.code;
+  }
+  return void 0;
+}
+function bytesEqual(left, right) {
+  return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function permanentLogError(message, cause) {
+  return new import_protocol2.VerificationError(message, { code: import_protocol2.VerificationCode.LogError, transient: false, cause });
+}
+async function sha256Hex2(bytes) {
+  const copy = bytes.slice();
+  const digest = await crypto.subtle.digest("SHA-256", copy.buffer);
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/index.ts
+var import_web_bot_auth = require("@dnsid-ai/web-bot-auth");
+
+// src/conformance.ts
+var import_protocol3 = require("@dnsid-ai/protocol");
+var import_version = require("@dnsid-ai/log-c2sp-tlog/version");
+var c2spTlogConformance = [
+  `profile=${import_version.C2SP_TLOG_PROFILE_VERSION}`,
+  ...Object.entries(import_version.C2SP_TLOG_SPECIFICATIONS).map(([name, revision]) => `${name}=${revision}`),
+  `dnsid-method=${import_version.DNSID_C2SP_METHOD_REVISION}`
+].join(";");
+var SDK_CONFORMANCE = Object.freeze({
+  publishProfile: import_protocol3.DEFAULT_PUBLISH_PROFILE,
+  verificationProfiles: Object.freeze({
+    [import_protocol3.DNSID_DRAFT01_VERSION]: import_protocol3.DNSID_DRAFT01_VERSION,
+    [import_protocol3.DNSID_VERSION]: import_protocol3.DNSID_DRAFT01_VERSION
+  }),
+  specificationStatus: "internet-draft",
+  logBindings: Object.freeze({
+    "c2sp-tlog": c2spTlogConformance
+  }),
+  knownDeviations: Object.freeze([])
+});
+
+// src/index.ts
+function createIdentityManager(config, deps) {
+  return new import_protocol4.IdentityManager(config, deps);
+}
+function createIdentityVerifier(config, deps) {
+  return new import_protocol4.IdentityManager(config, deps);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ArgumentError,
+  DEFAULT_REGISTRY_URL,
+  DNSID_VERSION,
+  DNSSECMode,
+  DNSSECState,
+  DnsIdTxtRecord,
+  DomainLog,
+  DomainSnapshot,
+  HttpSignaturesProfile,
+  IdentityManager,
+  InMemoryIdentityCache,
+  JWKS,
+  JWKS_MAX_RESPONSE_BYTES,
+  JoseProfile,
+  LogRegistry,
+  ManagedIssuanceActivationError,
+  ManagedIssuanceSubmissionError,
+  ManagedKeyRotationActivationError,
+  ManagedKeyRotationSubmissionError,
+  NoopLogReader,
+  ParseError,
+  PreparedEventSubmissionError,
+  RegistryClient,
+  RegistryWorkflowError,
+  SDK_CONFORMANCE,
+  SIGNING_ALGS,
+  STATUS_MAX_RESPONSE_BYTES,
+  ValidationError,
+  VerificationCode,
+  VerificationError,
+  VerifiedDomain,
+  WebBotAuthProfile,
+  activeStatusDocument,
+  awaitRegistryManagedPublication,
+  createHttpSignaturesProfile,
+  createIdentityManager,
+  createIdentityVerifier,
+  createJoseProfile,
+  createWebBotAuthProfile,
+  fromBase64Url,
+  httpSignatures,
+  isDomainName,
+  isTransientVerificationError,
+  issueManagedIdentity,
+  jose,
+  jwkSignatureAlg,
+  jwkThumbprint,
+  normalizeFQDN,
+  parseKaDuration,
+  parseKeyId,
+  publishClientControlledRecord,
+  publishToRegistry,
+  registry,
+  resumeManagedIssuance,
+  resumeManagedOperationalKeyRotation,
+  retryTransientVerification,
+  rotateManagedOperationalKey,
+  toArrayBuffer,
+  toBase64Url,
+  validateAgentStatus,
+  verifyWithKey,
+  webBotAuth,
+  ...require("@dnsid-ai/protocol")
+});