@dnsid-ai/sdk 0.20.1

package/dist/index.d.cts

@@ -0,0 +1,210 @@
+import { VerificationError, KeyProvider, DnsIdJWK, IdentityManagerDependencies, DnsidConfig, IdentityManager } from '@dnsid-ai/protocol';
+export * from '@dnsid-ai/protocol';
+export { ArgumentError, DNSID_VERSION, DNSSECMode, DNSSECState, DnsIdTxtRecord, DomainLog, DomainSnapshot, IdentityManager, InMemoryIdentityCache, JWKS, JWKS_MAX_RESPONSE_BYTES, LogRegistry, NoopLogReader, ParseError, SIGNING_ALGS, STATUS_MAX_RESPONSE_BYTES, ValidationError, VerificationCode, VerificationError, VerifiedDomain, activeStatusDocument, fromBase64Url, isDomainName, isTransientVerificationError, jwkSignatureAlg, jwkThumbprint, normalizeFQDN, parseKaDuration, parseKeyId, retryTransientVerification, toArrayBuffer, toBase64Url, validateAgentStatus, verifyWithKey } from '@dnsid-ai/protocol';
+import * as jose from '@dnsid-ai/jose';
+export { jose };
+export { JoseProfile, createJoseProfile } from '@dnsid-ai/jose';
+import * as httpSignatures from '@dnsid-ai/http-signatures';
+export { httpSignatures };
+export { HttpSignaturesProfile, createHttpSignaturesProfile } from '@dnsid-ai/http-signatures';
+import { SubmissionResult, KeyRotationPreparationRequest, PreparedRegistryEvent } from '@dnsid-ai/registry';
+import * as registry from '@dnsid-ai/registry';
+export { registry };
+export { DEFAULT_REGISTRY_URL, PreparedEventSubmissionError, RegistryClient, RegistryWorkflowError, awaitRegistryManagedPublication, publishClientControlledRecord, publishToRegistry } from '@dnsid-ai/registry';
+import * as webBotAuth from '@dnsid-ai/web-bot-auth';
+export { webBotAuth };
+export { WebBotAuthProfile, createWebBotAuthProfile } from '@dnsid-ai/web-bot-auth';
+
+interface ManagedKeyRotationRegistry {
+    prepareKeyRotation(domain: string, request: KeyRotationPreparationRequest, idempotencyKey: string): Promise<PreparedRegistryEvent>;
+    submitPreparedEvent(domain: string, entryBytes: Uint8Array, idempotencyKey: string): Promise<SubmissionResult>;
+}
+interface RotateManagedOperationalKeyOptions {
+    domain: string;
+    /** Exact unindexed c2sp-tlog reference configured for this identity. */
+    logReference: string;
+    keyProvider: KeyProvider;
+    registryClient: ManagedKeyRotationRegistry;
+    idempotencyKey: string;
+    /** Durably persists exact bytes and every subsequent reconciliation state. */
+    persistRotation: (rotation: ManagedKeyRotationResult) => Promise<void>;
+    /** Pauses application signing before submission and resumes it only after durable activation. */
+    setApplicationSigningPaused: (paused: boolean) => Promise<void>;
+}
+interface ManagedKeyRotationResult {
+    readonly domain: string;
+    readonly logReference: string;
+    readonly previousKid: string;
+    readonly newKid: string;
+    /**
+     * Persist these exact bytes with idempotencyKey while activated is false.
+     * Callers must pause new application signing until this rotation is accepted.
+     */
+    readonly entryBytes: Uint8Array;
+    readonly idempotencyKey: string;
+    readonly submission?: SubmissionResult;
+    readonly activated: boolean;
+    readonly applicationSigningPaused: boolean;
+}
+interface ResumeManagedOperationalKeyRotationOptions {
+    keyProvider: KeyProvider;
+    registryClient: Pick<ManagedKeyRotationRegistry, 'submitPreparedEvent'>;
+    rotation: ManagedKeyRotationResult;
+    persistRotation: (rotation: ManagedKeyRotationResult) => Promise<void>;
+    setApplicationSigningPaused: (paused: boolean) => Promise<void>;
+}
+/** Submission failed after the completed entry bytes were fixed. */
+declare class ManagedKeyRotationSubmissionError extends VerificationError {
+    readonly rotation: ManagedKeyRotationResult;
+    readonly retryWithSameBytes: boolean;
+    constructor(message: string, rotation: ManagedKeyRotationResult, retryWithSameBytes: boolean, cause?: unknown);
+}
+/** Registry acceptance succeeded, but local key-state reconciliation did not. */
+declare class ManagedKeyRotationActivationError extends VerificationError {
+    readonly rotation: ManagedKeyRotationResult;
+    constructor(message: string, rotation: ManagedKeyRotationResult, cause?: unknown);
+}
+/**
+ * Runs C2SP registry-managed rotation. The registry owns managed ku publication
+ * and append reconciliation; local activation happens only after an accepted
+ * result for the exact, durably persisted bytes while application signing is paused.
+ */
+declare function rotateManagedOperationalKey(options: RotateManagedOperationalKeyOptions): Promise<ManagedKeyRotationResult>;
+/** Retries only the persisted completed bytes and activates on acceptance. */
+declare function resumeManagedOperationalKeyRotation(options: ResumeManagedOperationalKeyRotationOptions): Promise<ManagedKeyRotationResult>;
+
+interface ManagedIssuanceRegistry {
+    prepareIssuance(domain: string, idempotencyKey: string): Promise<PreparedRegistryEvent>;
+    submitPreparedEvent(domain: string, entryBytes: Uint8Array, idempotencyKey: string): Promise<SubmissionResult>;
+}
+interface ManagedIssuanceState {
+    readonly domain: string;
+    readonly governanceId: string;
+    readonly idempotencyKey: string;
+    readonly entityKid: string;
+    readonly entityThumbprint: string;
+    readonly operationalKid: string;
+    readonly operationalThumbprint: string;
+    /** Undefined only while the durable intent precedes remote preparation. */
+    readonly logReference?: string;
+    /** Exact completed canonical bytes. Undefined only for an intent. */
+    readonly entryBytes?: Uint8Array;
+    /** SHA-256 of entryBytes, persisted before the first submission. */
+    readonly entryHash?: string;
+    readonly submission?: ManagedIssuanceSubmission;
+    readonly terminalFailure?: {
+        readonly stage: 'preparation' | 'submission';
+        readonly errorCode?: string;
+    };
+    readonly activated: boolean;
+}
+type ManagedIssuanceSubmission = SubmissionResult | {
+    readonly state: 'indeterminate';
+    readonly entryHash: string;
+    readonly errorCode?: string;
+};
+interface ManagedIssuanceCoordination {
+    /** Loads the one durable setup operation, if it exists. */
+    loadIssuance: () => Promise<ManagedIssuanceState | undefined>;
+    /** Atomically creates the intent; returns the existing operation if the create lost a race. */
+    createIssuance: (intent: ManagedIssuanceState) => Promise<ManagedIssuanceState | undefined>;
+    /** Atomically persists the intent, exact bytes, and every reconciliation transition. */
+    persistIssuance: (issuance: ManagedIssuanceState) => Promise<void>;
+    /**
+     * Publishes/converges status only after exact-byte log acceptance is durably bound.
+     * Must be idempotent because a crash can replay it before `activated` is persisted.
+     */
+    activateAcceptedIssuance: (issuance: ManagedIssuanceState) => Promise<void>;
+}
+interface IssueManagedIdentityOptions extends ManagedIssuanceCoordination {
+    domain: string;
+    governanceId: string;
+    /** Trusted accountable-entity public key whose existing `sigs.ae` is required. */
+    entityKey: DnsIdJWK;
+    operationalKeyProvider: KeyProvider;
+    registryClient: ManagedIssuanceRegistry;
+    idempotencyKey: string;
+    /** Optional configured reference; a registry response must match it exactly. */
+    logReference?: string;
+}
+interface ResumeManagedIssuanceOptions extends ManagedIssuanceCoordination {
+    entityKey: DnsIdJWK;
+    operationalKeyProvider: KeyProvider;
+    registryClient: ManagedIssuanceRegistry;
+}
+declare class ManagedIssuanceSubmissionError extends VerificationError {
+    readonly issuance: ManagedIssuanceState;
+    readonly retryWithSameBytes: boolean;
+    constructor(message: string, issuance: ManagedIssuanceState, retryWithSameBytes: boolean, transient: boolean, cause?: unknown);
+}
+declare class ManagedIssuanceActivationError extends VerificationError {
+    readonly issuance: ManagedIssuanceState;
+    constructor(issuance: ManagedIssuanceState, cause: unknown);
+}
+/** Starts one durable managed setup operation, or resumes the already persisted one. */
+declare function issueManagedIdentity(options: IssueManagedIdentityOptions): Promise<ManagedIssuanceState>;
+/** Resumes only the durable operation, reusing its preparation key or exact completed bytes. */
+declare function resumeManagedIssuance(options: ResumeManagedIssuanceOptions): Promise<ManagedIssuanceState>;
+
+/** Immutable protocol-facing conformance metadata for this SDK release. */
+interface SDKConformance {
+    readonly publishProfile: string;
+    readonly verificationProfiles: Readonly<Record<string, string>>;
+    readonly specificationStatus: 'internet-draft' | 'rfc';
+    readonly logBindings: Readonly<Record<string, string>>;
+    readonly knownDeviations: readonly string[];
+}
+/** Exact DNSid profile and log-binding behavior implemented by this SDK release. */
+declare const SDK_CONFORMANCE: SDKConformance;
+
+/**
+ * Runtime-neutral SDK entry point for DNSid.
+ *
+ * `@dnsid-ai/sdk` aggregates the DNSid TypeScript packages: it re-exports
+ * the full protocol core (`@dnsid-ai/protocol`), the registry client and
+ * publishing helpers, the JOSE, HTTP message signatures, and web bot auth
+ * profiles, and managed operational key rotation workflows.
+ *
+ * This root entry point makes no runtime assumptions: callers inject DNS resolution,
+ * JSON fetching, key-provider, cache, and log implementations (see
+ * {@link createIdentityManager}). Node conveniences — LocalKeyProvider, environment
+ * config loading, and Node identity manager factories — live behind the
+ * `@dnsid-ai/sdk/node` subpath. OIDC support deliberately lives in
+ * `@dnsid-ai/oidc` (Node-bound transport) and is not re-exported here.
+ *
+ * @packageDocumentation
+ */
+
+/** Runtime-neutral dependencies: DNS and JSON fetching must be injected. */
+type CreateIdentityManagerDependencies = IdentityManagerDependencies & Required<Pick<IdentityManagerDependencies, 'dnsResolver' | 'fetchJson'>>;
+/**
+ * Creates a DNSid IdentityManager from explicitly injected runtime dependencies.
+ *
+ * The root `@dnsid-ai/sdk` entrypoint is runtime-neutral: callers provide DNS, HTTPS/JSON
+ * fetching, key storage/signing, cache, and log implementations appropriate for Node,
+ * browsers, workers, wallets, HSMs, or application backends. Omit `config.identity` for a
+ * verification-only manager (see {@link createIdentityVerifier}).
+ *
+ * @example
+ * ```ts
+ * import { createIdentityManager } from '@dnsid-ai/sdk';
+ *
+ * const idm = createIdentityManager({ identity, verification }, {
+ *   keyProvider,       // operational key
+ *   entityKeyProvider, // entity key
+ *   dnsResolver,       // DNSSEC-aware resolver
+ *   fetchJson,
+ * });
+ * const verified = await idm.verifyDomain('agent.example.com');
+ * ```
+ */
+declare function createIdentityManager(config: DnsidConfig, deps: CreateIdentityManagerDependencies): IdentityManager;
+/**
+ * Creates a verification-only IdentityManager: same constructor, `config.identity` omitted.
+ *
+ * The returned manager supports identity verification, verified log loading, and cache
+ * eviction. Local signing, publication, and lifecycle mutation methods throw ArgumentError.
+ */
+declare function createIdentityVerifier(config: Omit<DnsidConfig, 'identity'>, deps: Omit<CreateIdentityManagerDependencies, 'keyProvider' | 'entityKeyProvider'>): IdentityManager;
+
+export { type CreateIdentityManagerDependencies, type IssueManagedIdentityOptions, ManagedIssuanceActivationError, type ManagedIssuanceCoordination, type ManagedIssuanceRegistry, type ManagedIssuanceState, type ManagedIssuanceSubmission, ManagedIssuanceSubmissionError, ManagedKeyRotationActivationError, type ManagedKeyRotationRegistry, type ManagedKeyRotationResult, ManagedKeyRotationSubmissionError, type ResumeManagedIssuanceOptions, type ResumeManagedOperationalKeyRotationOptions, type RotateManagedOperationalKeyOptions, type SDKConformance, SDK_CONFORMANCE, createIdentityManager, createIdentityVerifier, issueManagedIdentity, resumeManagedIssuance, resumeManagedOperationalKeyRotation, rotateManagedOperationalKey };

package/dist/index.d.ts

@@ -0,0 +1,210 @@
+import { VerificationError, KeyProvider, DnsIdJWK, IdentityManagerDependencies, DnsidConfig, IdentityManager } from '@dnsid-ai/protocol';
+export * from '@dnsid-ai/protocol';
+export { ArgumentError, DNSID_VERSION, DNSSECMode, DNSSECState, DnsIdTxtRecord, DomainLog, DomainSnapshot, IdentityManager, InMemoryIdentityCache, JWKS, JWKS_MAX_RESPONSE_BYTES, LogRegistry, NoopLogReader, ParseError, SIGNING_ALGS, STATUS_MAX_RESPONSE_BYTES, ValidationError, VerificationCode, VerificationError, VerifiedDomain, activeStatusDocument, fromBase64Url, isDomainName, isTransientVerificationError, jwkSignatureAlg, jwkThumbprint, normalizeFQDN, parseKaDuration, parseKeyId, retryTransientVerification, toArrayBuffer, toBase64Url, validateAgentStatus, verifyWithKey } from '@dnsid-ai/protocol';
+import * as jose from '@dnsid-ai/jose';
+export { jose };
+export { JoseProfile, createJoseProfile } from '@dnsid-ai/jose';
+import * as httpSignatures from '@dnsid-ai/http-signatures';
+export { httpSignatures };
+export { HttpSignaturesProfile, createHttpSignaturesProfile } from '@dnsid-ai/http-signatures';
+import { SubmissionResult, KeyRotationPreparationRequest, PreparedRegistryEvent } from '@dnsid-ai/registry';
+import * as registry from '@dnsid-ai/registry';
+export { registry };
+export { DEFAULT_REGISTRY_URL, PreparedEventSubmissionError, RegistryClient, RegistryWorkflowError, awaitRegistryManagedPublication, publishClientControlledRecord, publishToRegistry } from '@dnsid-ai/registry';
+import * as webBotAuth from '@dnsid-ai/web-bot-auth';
+export { webBotAuth };
+export { WebBotAuthProfile, createWebBotAuthProfile } from '@dnsid-ai/web-bot-auth';
+
+interface ManagedKeyRotationRegistry {
+    prepareKeyRotation(domain: string, request: KeyRotationPreparationRequest, idempotencyKey: string): Promise<PreparedRegistryEvent>;
+    submitPreparedEvent(domain: string, entryBytes: Uint8Array, idempotencyKey: string): Promise<SubmissionResult>;
+}
+interface RotateManagedOperationalKeyOptions {
+    domain: string;
+    /** Exact unindexed c2sp-tlog reference configured for this identity. */
+    logReference: string;
+    keyProvider: KeyProvider;
+    registryClient: ManagedKeyRotationRegistry;
+    idempotencyKey: string;
+    /** Durably persists exact bytes and every subsequent reconciliation state. */
+    persistRotation: (rotation: ManagedKeyRotationResult) => Promise<void>;
+    /** Pauses application signing before submission and resumes it only after durable activation. */
+    setApplicationSigningPaused: (paused: boolean) => Promise<void>;
+}
+interface ManagedKeyRotationResult {
+    readonly domain: string;
+    readonly logReference: string;
+    readonly previousKid: string;
+    readonly newKid: string;
+    /**
+     * Persist these exact bytes with idempotencyKey while activated is false.
+     * Callers must pause new application signing until this rotation is accepted.
+     */
+    readonly entryBytes: Uint8Array;
+    readonly idempotencyKey: string;
+    readonly submission?: SubmissionResult;
+    readonly activated: boolean;
+    readonly applicationSigningPaused: boolean;
+}
+interface ResumeManagedOperationalKeyRotationOptions {
+    keyProvider: KeyProvider;
+    registryClient: Pick<ManagedKeyRotationRegistry, 'submitPreparedEvent'>;
+    rotation: ManagedKeyRotationResult;
+    persistRotation: (rotation: ManagedKeyRotationResult) => Promise<void>;
+    setApplicationSigningPaused: (paused: boolean) => Promise<void>;
+}
+/** Submission failed after the completed entry bytes were fixed. */
+declare class ManagedKeyRotationSubmissionError extends VerificationError {
+    readonly rotation: ManagedKeyRotationResult;
+    readonly retryWithSameBytes: boolean;
+    constructor(message: string, rotation: ManagedKeyRotationResult, retryWithSameBytes: boolean, cause?: unknown);
+}
+/** Registry acceptance succeeded, but local key-state reconciliation did not. */
+declare class ManagedKeyRotationActivationError extends VerificationError {
+    readonly rotation: ManagedKeyRotationResult;
+    constructor(message: string, rotation: ManagedKeyRotationResult, cause?: unknown);
+}
+/**
+ * Runs C2SP registry-managed rotation. The registry owns managed ku publication
+ * and append reconciliation; local activation happens only after an accepted
+ * result for the exact, durably persisted bytes while application signing is paused.
+ */
+declare function rotateManagedOperationalKey(options: RotateManagedOperationalKeyOptions): Promise<ManagedKeyRotationResult>;
+/** Retries only the persisted completed bytes and activates on acceptance. */
+declare function resumeManagedOperationalKeyRotation(options: ResumeManagedOperationalKeyRotationOptions): Promise<ManagedKeyRotationResult>;
+
+interface ManagedIssuanceRegistry {
+    prepareIssuance(domain: string, idempotencyKey: string): Promise<PreparedRegistryEvent>;
+    submitPreparedEvent(domain: string, entryBytes: Uint8Array, idempotencyKey: string): Promise<SubmissionResult>;
+}
+interface ManagedIssuanceState {
+    readonly domain: string;
+    readonly governanceId: string;
+    readonly idempotencyKey: string;
+    readonly entityKid: string;
+    readonly entityThumbprint: string;
+    readonly operationalKid: string;
+    readonly operationalThumbprint: string;
+    /** Undefined only while the durable intent precedes remote preparation. */
+    readonly logReference?: string;
+    /** Exact completed canonical bytes. Undefined only for an intent. */
+    readonly entryBytes?: Uint8Array;
+    /** SHA-256 of entryBytes, persisted before the first submission. */
+    readonly entryHash?: string;
+    readonly submission?: ManagedIssuanceSubmission;
+    readonly terminalFailure?: {
+        readonly stage: 'preparation' | 'submission';
+        readonly errorCode?: string;
+    };
+    readonly activated: boolean;
+}
+type ManagedIssuanceSubmission = SubmissionResult | {
+    readonly state: 'indeterminate';
+    readonly entryHash: string;
+    readonly errorCode?: string;
+};
+interface ManagedIssuanceCoordination {
+    /** Loads the one durable setup operation, if it exists. */
+    loadIssuance: () => Promise<ManagedIssuanceState | undefined>;
+    /** Atomically creates the intent; returns the existing operation if the create lost a race. */
+    createIssuance: (intent: ManagedIssuanceState) => Promise<ManagedIssuanceState | undefined>;
+    /** Atomically persists the intent, exact bytes, and every reconciliation transition. */
+    persistIssuance: (issuance: ManagedIssuanceState) => Promise<void>;
+    /**
+     * Publishes/converges status only after exact-byte log acceptance is durably bound.
+     * Must be idempotent because a crash can replay it before `activated` is persisted.
+     */
+    activateAcceptedIssuance: (issuance: ManagedIssuanceState) => Promise<void>;
+}
+interface IssueManagedIdentityOptions extends ManagedIssuanceCoordination {
+    domain: string;
+    governanceId: string;
+    /** Trusted accountable-entity public key whose existing `sigs.ae` is required. */
+    entityKey: DnsIdJWK;
+    operationalKeyProvider: KeyProvider;
+    registryClient: ManagedIssuanceRegistry;
+    idempotencyKey: string;
+    /** Optional configured reference; a registry response must match it exactly. */
+    logReference?: string;
+}
+interface ResumeManagedIssuanceOptions extends ManagedIssuanceCoordination {
+    entityKey: DnsIdJWK;
+    operationalKeyProvider: KeyProvider;
+    registryClient: ManagedIssuanceRegistry;
+}
+declare class ManagedIssuanceSubmissionError extends VerificationError {
+    readonly issuance: ManagedIssuanceState;
+    readonly retryWithSameBytes: boolean;
+    constructor(message: string, issuance: ManagedIssuanceState, retryWithSameBytes: boolean, transient: boolean, cause?: unknown);
+}
+declare class ManagedIssuanceActivationError extends VerificationError {
+    readonly issuance: ManagedIssuanceState;
+    constructor(issuance: ManagedIssuanceState, cause: unknown);
+}
+/** Starts one durable managed setup operation, or resumes the already persisted one. */
+declare function issueManagedIdentity(options: IssueManagedIdentityOptions): Promise<ManagedIssuanceState>;
+/** Resumes only the durable operation, reusing its preparation key or exact completed bytes. */
+declare function resumeManagedIssuance(options: ResumeManagedIssuanceOptions): Promise<ManagedIssuanceState>;
+
+/** Immutable protocol-facing conformance metadata for this SDK release. */
+interface SDKConformance {
+    readonly publishProfile: string;
+    readonly verificationProfiles: Readonly<Record<string, string>>;
+    readonly specificationStatus: 'internet-draft' | 'rfc';
+    readonly logBindings: Readonly<Record<string, string>>;
+    readonly knownDeviations: readonly string[];
+}
+/** Exact DNSid profile and log-binding behavior implemented by this SDK release. */
+declare const SDK_CONFORMANCE: SDKConformance;
+
+/**
+ * Runtime-neutral SDK entry point for DNSid.
+ *
+ * `@dnsid-ai/sdk` aggregates the DNSid TypeScript packages: it re-exports
+ * the full protocol core (`@dnsid-ai/protocol`), the registry client and
+ * publishing helpers, the JOSE, HTTP message signatures, and web bot auth
+ * profiles, and managed operational key rotation workflows.
+ *
+ * This root entry point makes no runtime assumptions: callers inject DNS resolution,
+ * JSON fetching, key-provider, cache, and log implementations (see
+ * {@link createIdentityManager}). Node conveniences — LocalKeyProvider, environment
+ * config loading, and Node identity manager factories — live behind the
+ * `@dnsid-ai/sdk/node` subpath. OIDC support deliberately lives in
+ * `@dnsid-ai/oidc` (Node-bound transport) and is not re-exported here.
+ *
+ * @packageDocumentation
+ */
+
+/** Runtime-neutral dependencies: DNS and JSON fetching must be injected. */
+type CreateIdentityManagerDependencies = IdentityManagerDependencies & Required<Pick<IdentityManagerDependencies, 'dnsResolver' | 'fetchJson'>>;
+/**
+ * Creates a DNSid IdentityManager from explicitly injected runtime dependencies.
+ *
+ * The root `@dnsid-ai/sdk` entrypoint is runtime-neutral: callers provide DNS, HTTPS/JSON
+ * fetching, key storage/signing, cache, and log implementations appropriate for Node,
+ * browsers, workers, wallets, HSMs, or application backends. Omit `config.identity` for a
+ * verification-only manager (see {@link createIdentityVerifier}).
+ *
+ * @example
+ * ```ts
+ * import { createIdentityManager } from '@dnsid-ai/sdk';
+ *
+ * const idm = createIdentityManager({ identity, verification }, {
+ *   keyProvider,       // operational key
+ *   entityKeyProvider, // entity key
+ *   dnsResolver,       // DNSSEC-aware resolver
+ *   fetchJson,
+ * });
+ * const verified = await idm.verifyDomain('agent.example.com');
+ * ```
+ */
+declare function createIdentityManager(config: DnsidConfig, deps: CreateIdentityManagerDependencies): IdentityManager;
+/**
+ * Creates a verification-only IdentityManager: same constructor, `config.identity` omitted.
+ *
+ * The returned manager supports identity verification, verified log loading, and cache
+ * eviction. Local signing, publication, and lifecycle mutation methods throw ArgumentError.
+ */
+declare function createIdentityVerifier(config: Omit<DnsidConfig, 'identity'>, deps: Omit<CreateIdentityManagerDependencies, 'keyProvider' | 'entityKeyProvider'>): IdentityManager;
+
+export { type CreateIdentityManagerDependencies, type IssueManagedIdentityOptions, ManagedIssuanceActivationError, type ManagedIssuanceCoordination, type ManagedIssuanceRegistry, type ManagedIssuanceState, type ManagedIssuanceSubmission, ManagedIssuanceSubmissionError, ManagedKeyRotationActivationError, type ManagedKeyRotationRegistry, type ManagedKeyRotationResult, ManagedKeyRotationSubmissionError, type ResumeManagedIssuanceOptions, type ResumeManagedOperationalKeyRotationOptions, type RotateManagedOperationalKeyOptions, type SDKConformance, SDK_CONFORMANCE, createIdentityManager, createIdentityVerifier, issueManagedIdentity, resumeManagedIssuance, resumeManagedOperationalKeyRotation, rotateManagedOperationalKey };