@dnsid-ai/sdk 0.20.1

package/dist/index.js

@@ -0,0 +1,625 @@
+// src/index.ts
+import { IdentityManager } from "@dnsid-ai/protocol";
+export * from "@dnsid-ai/protocol";
+import {
+  IdentityManager as IdentityManager2,
+  JWKS_MAX_RESPONSE_BYTES,
+  STATUS_MAX_RESPONSE_BYTES,
+  isTransientVerificationError,
+  retryTransientVerification,
+  DNSID_VERSION as DNSID_VERSION2,
+  DnsIdTxtRecord,
+  JWKS as JWKS3,
+  jwkThumbprint as jwkThumbprint3,
+  jwkSignatureAlg,
+  SIGNING_ALGS,
+  VerifiedDomain,
+  DomainLog,
+  DomainSnapshot,
+  LogRegistry as LogRegistry2,
+  NoopLogReader,
+  InMemoryIdentityCache,
+  validateAgentStatus,
+  activeStatusDocument,
+  ParseError,
+  ValidationError,
+  VerificationError as VerificationError3,
+  VerificationCode as VerificationCode3,
+  ArgumentError,
+  normalizeFQDN as normalizeFQDN2,
+  isDomainName,
+  parseKeyId,
+  toBase64Url,
+  fromBase64Url,
+  toArrayBuffer,
+  parseKaDuration,
+  verifyWithKey,
+  DNSSECState,
+  DNSSECMode
+} from "@dnsid-ai/protocol";
+import * as jose from "@dnsid-ai/jose";
+import * as httpSignatures from "@dnsid-ai/http-signatures";
+import * as registry from "@dnsid-ai/registry";
+import * as webBotAuth from "@dnsid-ai/web-bot-auth";
+import { JoseProfile, createJoseProfile } from "@dnsid-ai/jose";
+import { HttpSignaturesProfile, createHttpSignaturesProfile } from "@dnsid-ai/http-signatures";
+import {
+  RegistryClient,
+  PreparedEventSubmissionError,
+  RegistryWorkflowError,
+  awaitRegistryManagedPublication,
+  publishClientControlledRecord,
+  publishToRegistry,
+  DEFAULT_REGISTRY_URL
+} from "@dnsid-ai/registry";
+
+// src/managed-key-rotation.ts
+import {
+  JWKS,
+  VerificationCode,
+  VerificationError,
+  jwkThumbprint
+} from "@dnsid-ai/protocol";
+import {
+  c2spTlogEntryBytes,
+  parsePreparedC2spTlogEvent,
+  signPreparedC2spTlogEvent
+} from "@dnsid-ai/log-c2sp-tlog/writer";
+var ManagedKeyRotationSubmissionError = class extends VerificationError {
+  rotation;
+  retryWithSameBytes;
+  constructor(message, rotation, retryWithSameBytes2, cause) {
+    super(message, { code: VerificationCode.LogError, transient: retryWithSameBytes2, cause });
+    this.name = "ManagedKeyRotationSubmissionError";
+    this.rotation = rotation;
+    this.retryWithSameBytes = retryWithSameBytes2;
+  }
+};
+var ManagedKeyRotationActivationError = class extends VerificationError {
+  rotation;
+  constructor(message, rotation, cause) {
+    super(message, { code: VerificationCode.LogError, transient: true, cause });
+    this.name = "ManagedKeyRotationActivationError";
+    this.rotation = rotation;
+  }
+};
+async function rotateManagedOperationalKey(options) {
+  const previousKey = await options.keyProvider.signingKey();
+  new JWKS([previousKey]).validateOperational();
+  const previousThumbprint = await jwkThumbprint(previousKey);
+  const newKid = await options.keyProvider.generateKey();
+  const newKey = await options.keyProvider.jwk(newKid);
+  new JWKS([newKey]).validateOperational();
+  if (await jwkThumbprint(newKey) === previousThumbprint) {
+    throw permanentRotationError("managed KEY_ROTATION requires a distinct pending operational key");
+  }
+  let raw;
+  try {
+    raw = await options.registryClient.prepareKeyRotation(options.domain, {
+      previousKeyId: previousThumbprint,
+      publicKey: newKey
+    }, options.idempotencyKey);
+  } catch (cause) {
+    throw new VerificationError("managed key rotation preparation is unavailable", {
+      code: VerificationCode.LogError,
+      transient: true,
+      cause
+    });
+  }
+  if (raw.logReference !== options.logReference) {
+    throw permanentRotationError(`registry preparation returned unexpected log reference ${raw.logReference}`);
+  }
+  const context = { expectedFqdn: options.domain, previousOperationalKey: previousKey };
+  let prepared = await parsePreparedC2spTlogEvent(raw.entryBytes, raw.logReference, context);
+  if (prepared.envelope.type !== "KEY_ROTATION") {
+    throw permanentRotationError(`registry preparation returned ${String(prepared.envelope.type)} instead of KEY_ROTATION`);
+  }
+  if (prepared.envelope.fqdn !== options.domain) {
+    throw permanentRotationError("registry KEY_ROTATION fqdn does not match the expected identity");
+  }
+  if (prepared.envelope.prev_thumb !== previousThumbprint) {
+    throw permanentRotationError("registry KEY_ROTATION previous thumbprint does not match the active operational key");
+  }
+  await assertPreparedRotationKey(prepared.envelope.new_ku, prepared.envelope.new_thumb, newKey);
+  prepared = await signPreparedC2spTlogEvent(prepared, "PreviousOperational", options.keyProvider, context);
+  prepared = await signPreparedC2spTlogEvent(prepared, "NewOperational", options.keyProvider, context);
+  const entryBytes = await c2spTlogEntryBytes(prepared, context);
+  const rotation = {
+    domain: options.domain,
+    logReference: options.logReference,
+    previousKid: previousKey.kid,
+    newKid,
+    entryBytes: entryBytes.slice(),
+    idempotencyKey: options.idempotencyKey,
+    activated: false,
+    applicationSigningPaused: true
+  };
+  await options.persistRotation(rotation);
+  await options.setApplicationSigningPaused(true);
+  return submitManagedRotation(options.keyProvider, options.registryClient, rotation, options.persistRotation, options.setApplicationSigningPaused);
+}
+async function resumeManagedOperationalKeyRotation(options) {
+  if (options.rotation.activated) {
+    if (!options.rotation.applicationSigningPaused) return options.rotation;
+    await options.setApplicationSigningPaused(false);
+    const completed = { ...options.rotation, applicationSigningPaused: false };
+    await options.persistRotation(completed);
+    return completed;
+  }
+  if (options.rotation.submission?.state === "rejected") {
+    throw permanentRotationError("cannot resume a rejected managed key rotation");
+  }
+  await options.setApplicationSigningPaused(true);
+  return submitManagedRotation(options.keyProvider, options.registryClient, options.rotation, options.persistRotation, options.setApplicationSigningPaused);
+}
+async function submitManagedRotation(keyProvider, registryClient, rotation, persistRotation, setApplicationSigningPaused) {
+  let submission;
+  try {
+    submission = await registryClient.submitPreparedEvent(rotation.domain, rotation.entryBytes, rotation.idempotencyKey);
+  } catch (cause) {
+    const retryWithSameBytes2 = structuredRetryWithSameBytes(cause);
+    throw new ManagedKeyRotationSubmissionError(
+      retryWithSameBytes2 ? "managed key rotation submission is unresolved; retry the same bytes and idempotency key" : "managed key rotation submission failed terminally",
+      rotation,
+      retryWithSameBytes2,
+      cause
+    );
+  }
+  await assertSubmissionMatchesRotation(rotation, submission);
+  const next = { ...rotation, submission };
+  await persistRotation(next);
+  if (submission.state === "rejected") {
+    throw new ManagedKeyRotationSubmissionError(
+      `registry rejected the prepared KEY_ROTATION: ${submission.errorCode ?? "unknown error"}`,
+      next,
+      false
+    );
+  }
+  if (submission.state !== "accepted") return next;
+  let recoverable = next;
+  try {
+    await reconcileAcceptedRotation(keyProvider, rotation);
+    const activated = { ...next, activated: true };
+    await persistRotation(activated);
+    recoverable = activated;
+    await setApplicationSigningPaused(false);
+    const completed = { ...activated, applicationSigningPaused: false };
+    await persistRotation(completed);
+    return completed;
+  } catch (cause) {
+    throw new ManagedKeyRotationActivationError(
+      "managed key rotation was accepted, but local key activation is incomplete; resume with this rotation state",
+      recoverable,
+      cause
+    );
+  }
+}
+async function reconcileAcceptedRotation(keyProvider, rotation) {
+  const activeKid = (await keyProvider.signingKey()).kid;
+  if (activeKid === rotation.previousKid) {
+    await keyProvider.activate(rotation.newKid);
+  } else if (activeKid !== rotation.newKid) {
+    throw permanentRotationError(`unexpected active key ${activeKid} while reconciling managed key rotation`);
+  }
+  if ((await keyProvider.listKeyIds()).includes(rotation.previousKid)) {
+    await keyProvider.supersede(rotation.previousKid);
+  }
+}
+async function assertPreparedRotationKey(value, thumbprint, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw permanentRotationError("registry KEY_ROTATION is missing new_ku");
+  const actual = value;
+  const actualThumbprint = await jwkThumbprint(actual);
+  const expectedThumbprint = await jwkThumbprint(expected);
+  if (actual.kid !== expected.kid || actual.alg !== expected.alg || actualThumbprint !== expectedThumbprint) {
+    throw permanentRotationError("registry KEY_ROTATION new key does not match the generated pending key");
+  }
+  if (thumbprint !== expectedThumbprint) throw permanentRotationError("registry KEY_ROTATION new thumbprint does not match the generated pending key");
+}
+async function assertSubmissionMatchesRotation(rotation, submission) {
+  if (rotation.submission?.entryHash && submission.entryHash && rotation.submission.entryHash !== submission.entryHash) {
+    throw permanentRotationError("registry reconciled a different entry hash for this managed key rotation");
+  }
+  if (submission.state !== "accepted") return;
+  const expectedHash = await sha256Hex(rotation.entryBytes);
+  if (submission.entryHash !== expectedHash) {
+    throw permanentRotationError("accepted submission entry hash does not match the exact managed key rotation bytes");
+  }
+  if (submission.keyId !== void 0 && submission.keyId !== rotation.newKid) {
+    throw permanentRotationError("accepted submission key_id does not match the generated pending key");
+  }
+}
+function structuredRetryWithSameBytes(cause) {
+  if (cause && typeof cause === "object" && "retryWithSameBytes" in cause && typeof cause.retryWithSameBytes === "boolean") {
+    return cause.retryWithSameBytes;
+  }
+  return true;
+}
+function permanentRotationError(message, cause) {
+  return new VerificationError(message, { code: VerificationCode.LogError, transient: false, cause });
+}
+async function sha256Hex(value) {
+  const bytes = value.slice();
+  const digest = await crypto.subtle.digest("SHA-256", bytes.buffer);
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/managed-issuance.ts
+import {
+  JWKS as JWKS2,
+  VerificationCode as VerificationCode2,
+  VerificationError as VerificationError2,
+  jwkThumbprint as jwkThumbprint2,
+  normalizeFQDN
+} from "@dnsid-ai/protocol";
+import {
+  c2spTlogEntryBytes as c2spTlogEntryBytes2,
+  parsePreparedC2spTlogEvent as parsePreparedC2spTlogEvent2,
+  signPreparedC2spTlogEvent as signPreparedC2spTlogEvent2
+} from "@dnsid-ai/log-c2sp-tlog/writer";
+var ManagedIssuanceSubmissionError = class extends VerificationError2 {
+  issuance;
+  retryWithSameBytes;
+  constructor(message, issuance, retryWithSameBytes2, transient, cause) {
+    super(message, { code: VerificationCode2.LogError, transient, cause });
+    this.name = "ManagedIssuanceSubmissionError";
+    this.issuance = issuance;
+    this.retryWithSameBytes = retryWithSameBytes2;
+  }
+};
+var ManagedIssuanceActivationError = class extends VerificationError2 {
+  issuance;
+  constructor(issuance, cause) {
+    super("managed ISSUANCE was accepted, but publication or activation is incomplete; resume this issuance", {
+      code: VerificationCode2.LogError,
+      transient: true,
+      cause
+    });
+    this.name = "ManagedIssuanceActivationError";
+    this.issuance = issuance;
+  }
+};
+async function issueManagedIdentity(options) {
+  const domain = normalizeFQDN(options.domain, true);
+  const governanceId = normalizeFQDN(options.governanceId, true);
+  if (!options.idempotencyKey || options.idempotencyKey.trim() !== options.idempotencyKey || options.idempotencyKey.length > 200) {
+    throw permanentLogError("managed ISSUANCE idempotencyKey must contain 1 to 200 characters without surrounding whitespace");
+  }
+  const existing = await options.loadIssuance();
+  const { entityKey, operationalKey } = await trustedKeys(options.entityKey, options.operationalKeyProvider);
+  if (existing) {
+    assertSameOperation(existing, { ...options, domain, governanceId });
+    return resumeManagedIssuanceState(options, existing, entityKey, operationalKey);
+  }
+  const intent = {
+    domain,
+    governanceId,
+    idempotencyKey: options.idempotencyKey,
+    entityKid: entityKey.kid,
+    entityThumbprint: await jwkThumbprint2(entityKey),
+    operationalKid: operationalKey.kid,
+    operationalThumbprint: await jwkThumbprint2(operationalKey),
+    activated: false
+  };
+  const raced = await options.createIssuance(intent);
+  if (raced) {
+    assertSameOperation(raced, { ...options, domain, governanceId });
+    return resumeManagedIssuanceState(options, raced, entityKey, operationalKey);
+  }
+  return prepareAndSubmit(options, intent, entityKey, operationalKey);
+}
+async function resumeManagedIssuance(options) {
+  const issuance = await options.loadIssuance();
+  if (!issuance) throw permanentLogError("no durable managed ISSUANCE operation exists");
+  const { entityKey, operationalKey } = await trustedKeys(options.entityKey, options.operationalKeyProvider);
+  return resumeManagedIssuanceState(options, issuance, entityKey, operationalKey);
+}
+async function resumeManagedIssuanceState(options, issuance, entityKey, operationalKey) {
+  await assertPersistedKeys(issuance, entityKey, operationalKey);
+  if (issuance.activated) return issuance;
+  if (issuance.terminalFailure || issuance.submission?.state === "rejected") {
+    throw permanentLogError("cannot resume a terminally failed managed ISSUANCE");
+  }
+  if (issuance.submission?.state === "accepted") {
+    await verifyPersistedCompletedIssuance(issuance, entityKey, operationalKey);
+    await assertAcceptedBinding(issuance, issuance.submission);
+    return activate(options, issuance);
+  }
+  if (!issuance.entryBytes || !issuance.logReference) {
+    return prepareAndSubmit(options, issuance, entityKey, operationalKey);
+  }
+  return submit(options, issuance);
+}
+async function prepareAndSubmit(options, intent, entityKey, operationalKey) {
+  let raw;
+  try {
+    raw = await options.registryClient.prepareIssuance(intent.domain, intent.idempotencyKey);
+  } catch (cause) {
+    if (isTerminalFailure(cause)) {
+      const terminal = {
+        ...intent,
+        terminalFailure: { stage: "preparation", errorCode: structuredErrorCode(cause) }
+      };
+      await options.persistIssuance(terminal);
+      throw new ManagedIssuanceSubmissionError("managed ISSUANCE preparation failed terminally", terminal, false, false, cause);
+    }
+    throw new ManagedIssuanceSubmissionError("managed ISSUANCE preparation is unavailable; resume the durable intent", intent, false, true, cause);
+  }
+  const context = {
+    expectedFqdn: intent.domain,
+    expectedGovernanceId: intent.governanceId,
+    entityKey,
+    operationalKey
+  };
+  let prepared;
+  try {
+    if (options.logReference && raw.logReference !== options.logReference) {
+      throw permanentLogError(`registry preparation returned unexpected log reference ${raw.logReference}`);
+    }
+    prepared = await parsePreparedC2spTlogEvent2(raw.entryBytes, raw.logReference, context);
+    if (prepared.envelope.type !== "ISSUANCE") {
+      throw permanentLogError(`registry preparation returned ${String(prepared.envelope.type)} instead of ISSUANCE`);
+    }
+    const existingSignatures = prepared.envelope.sigs;
+    if (!existingSignatures?.ae) throw permanentLogError("registry ISSUANCE preparation is missing the accountable-entity signature");
+  } catch (cause) {
+    const terminal = {
+      ...intent,
+      terminalFailure: { stage: "preparation", errorCode: structuredErrorCode(cause) }
+    };
+    await options.persistIssuance(terminal);
+    throw new ManagedIssuanceSubmissionError("managed ISSUANCE preparation failed trusted validation", terminal, false, false, cause);
+  }
+  prepared = await signPreparedC2spTlogEvent2(prepared, "OperationalCountersignature", options.operationalKeyProvider, context);
+  const entryBytes = await c2spTlogEntryBytes2(prepared, context);
+  const completed = {
+    ...intent,
+    logReference: raw.logReference,
+    entryBytes: entryBytes.slice(),
+    entryHash: await sha256Hex2(entryBytes)
+  };
+  await options.persistIssuance(completed);
+  return submit(options, completed);
+}
+async function submit(options, issuance) {
+  if (!issuance.entryBytes || !issuance.logReference) throw permanentLogError("managed ISSUANCE exact bytes are not persisted");
+  const { entityKey, operationalKey } = await trustedKeys(options.entityKey, options.operationalKeyProvider);
+  await verifyPersistedCompletedIssuance(issuance, entityKey, operationalKey);
+  let submission;
+  try {
+    submission = await options.registryClient.submitPreparedEvent(
+      issuance.domain,
+      issuance.entryBytes.slice(),
+      issuance.idempotencyKey
+    );
+  } catch (cause) {
+    const sameBytes = retryWithSameBytes(cause);
+    let recoverable = issuance;
+    if (sameBytes) {
+      recoverable = {
+        ...issuance,
+        submission: {
+          state: "indeterminate",
+          entryHash: issuance.entryHash,
+          errorCode: structuredErrorCode(cause)
+        }
+      };
+      await options.persistIssuance(recoverable);
+    } else {
+      recoverable = {
+        ...issuance,
+        submission: {
+          state: "rejected",
+          entryHash: issuance.entryHash,
+          errorCode: structuredErrorCode(cause)
+        },
+        terminalFailure: { stage: "submission", errorCode: structuredErrorCode(cause) }
+      };
+      await options.persistIssuance(recoverable);
+    }
+    throw new ManagedIssuanceSubmissionError(
+      sameBytes ? "managed ISSUANCE submission is indeterminate; retry the same bytes and idempotency key" : "managed ISSUANCE submission failed terminally",
+      recoverable,
+      sameBytes,
+      sameBytes,
+      cause
+    );
+  }
+  await assertAcceptedBinding(issuance, submission);
+  const reconciled = { ...issuance, submission };
+  await options.persistIssuance(reconciled);
+  if (submission.state === "rejected") {
+    throw new ManagedIssuanceSubmissionError(
+      `registry rejected the prepared ISSUANCE: ${submission.errorCode ?? "unknown error"}`,
+      reconciled,
+      false,
+      false
+    );
+  }
+  if (submission.state !== "accepted") return reconciled;
+  return activate(options, reconciled);
+}
+async function activate(options, issuance) {
+  try {
+    await options.activateAcceptedIssuance(issuance);
+    const activated = { ...issuance, activated: true };
+    await options.persistIssuance(activated);
+    return activated;
+  } catch (cause) {
+    throw new ManagedIssuanceActivationError(issuance, cause);
+  }
+}
+async function trustedKeys(entityKey, operationalProvider) {
+  const operationalKey = await operationalProvider.signingKey();
+  new JWKS2([entityKey]).validateRecordSigning();
+  new JWKS2([operationalKey]).validateOperational();
+  if (await jwkThumbprint2(entityKey) === await jwkThumbprint2(operationalKey)) {
+    throw permanentLogError("managed ISSUANCE requires distinct entity and operational keys");
+  }
+  return { entityKey, operationalKey };
+}
+async function assertPersistedKeys(state, entityKey, operationalKey) {
+  if (state.entityKid !== entityKey.kid || state.entityThumbprint !== await jwkThumbprint2(entityKey)) {
+    throw permanentLogError("durable managed ISSUANCE entity key does not match the trusted provider");
+  }
+  if (state.operationalKid !== operationalKey.kid || state.operationalThumbprint !== await jwkThumbprint2(operationalKey)) {
+    throw permanentLogError("durable managed ISSUANCE operational key does not match the trusted provider");
+  }
+}
+async function verifyPersistedCompletedIssuance(state, entityKey, operationalKey) {
+  if (!state.entryBytes || !state.entryHash || !state.logReference) {
+    throw permanentLogError("durable managed ISSUANCE is missing exact bytes, hash, or log reference");
+  }
+  const actualHash = await sha256Hex2(state.entryBytes);
+  if (actualHash !== state.entryHash) throw permanentLogError("durable managed ISSUANCE bytes do not match their persisted hash");
+  const context = {
+    expectedFqdn: state.domain,
+    expectedGovernanceId: state.governanceId,
+    entityKey,
+    operationalKey
+  };
+  const prepared = await parsePreparedC2spTlogEvent2(state.entryBytes, state.logReference, context);
+  const canonical = await c2spTlogEntryBytes2(prepared, context);
+  if (!bytesEqual(canonical, state.entryBytes)) throw permanentLogError("durable managed ISSUANCE bytes are not the canonical completed entry");
+}
+function assertSameOperation(state, options) {
+  if (state.domain !== options.domain || state.governanceId !== options.governanceId || state.idempotencyKey !== options.idempotencyKey) {
+    throw permanentLogError("a different durable managed ISSUANCE operation already exists");
+  }
+}
+async function assertAcceptedBinding(issuance, submission) {
+  if (issuance.submission?.entryHash && submission.entryHash !== issuance.submission.entryHash) {
+    throw permanentLogError("registry reconciled a different entry hash for this managed ISSUANCE");
+  }
+  if (submission.state !== "accepted") return;
+  const expectedHash = await sha256Hex2(issuance.entryBytes);
+  if (submission.entryHash !== expectedHash) throw permanentLogError("accepted entry hash does not match the exact managed ISSUANCE bytes");
+  if (!Number.isSafeInteger(submission.index) || submission.index < 0) throw permanentLogError("accepted managed ISSUANCE is missing a valid index");
+  const expectedReference = `${issuance.logReference}@${submission.index}`;
+  if (submission.logRef !== expectedReference) throw permanentLogError("accepted managed ISSUANCE final log reference does not match its prepared binding");
+}
+function retryWithSameBytes(cause) {
+  return !(cause && typeof cause === "object" && "retryWithSameBytes" in cause && cause.retryWithSameBytes === false);
+}
+function isTerminalFailure(cause) {
+  if (!cause || typeof cause !== "object") return false;
+  if ("retryable" in cause && cause.retryable === false) return true;
+  if ("state" in cause && cause.state === "rejected") return true;
+  return "retryWithSameBytes" in cause && cause.retryWithSameBytes === false;
+}
+function structuredErrorCode(cause) {
+  if (cause && typeof cause === "object" && "code" in cause && typeof cause.code === "string") {
+    return cause.code;
+  }
+  return void 0;
+}
+function bytesEqual(left, right) {
+  return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function permanentLogError(message, cause) {
+  return new VerificationError2(message, { code: VerificationCode2.LogError, transient: false, cause });
+}
+async function sha256Hex2(bytes) {
+  const copy = bytes.slice();
+  const digest = await crypto.subtle.digest("SHA-256", copy.buffer);
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/index.ts
+import { WebBotAuthProfile, createWebBotAuthProfile } from "@dnsid-ai/web-bot-auth";
+
+// src/conformance.ts
+import {
+  DEFAULT_PUBLISH_PROFILE,
+  DNSID_DRAFT01_VERSION,
+  DNSID_VERSION
+} from "@dnsid-ai/protocol";
+import { C2SP_TLOG_PROFILE_VERSION, C2SP_TLOG_SPECIFICATIONS, DNSID_C2SP_METHOD_REVISION } from "@dnsid-ai/log-c2sp-tlog/version";
+var c2spTlogConformance = [
+  `profile=${C2SP_TLOG_PROFILE_VERSION}`,
+  ...Object.entries(C2SP_TLOG_SPECIFICATIONS).map(([name, revision]) => `${name}=${revision}`),
+  `dnsid-method=${DNSID_C2SP_METHOD_REVISION}`
+].join(";");
+var SDK_CONFORMANCE = Object.freeze({
+  publishProfile: DEFAULT_PUBLISH_PROFILE,
+  verificationProfiles: Object.freeze({
+    [DNSID_DRAFT01_VERSION]: DNSID_DRAFT01_VERSION,
+    [DNSID_VERSION]: DNSID_DRAFT01_VERSION
+  }),
+  specificationStatus: "internet-draft",
+  logBindings: Object.freeze({
+    "c2sp-tlog": c2spTlogConformance
+  }),
+  knownDeviations: Object.freeze([])
+});
+
+// src/index.ts
+function createIdentityManager(config, deps) {
+  return new IdentityManager(config, deps);
+}
+function createIdentityVerifier(config, deps) {
+  return new IdentityManager(config, deps);
+}
+export {
+  ArgumentError,
+  DEFAULT_REGISTRY_URL,
+  DNSID_VERSION2 as DNSID_VERSION,
+  DNSSECMode,
+  DNSSECState,
+  DnsIdTxtRecord,
+  DomainLog,
+  DomainSnapshot,
+  HttpSignaturesProfile,
+  IdentityManager2 as IdentityManager,
+  InMemoryIdentityCache,
+  JWKS3 as JWKS,
+  JWKS_MAX_RESPONSE_BYTES,
+  JoseProfile,
+  LogRegistry2 as LogRegistry,
+  ManagedIssuanceActivationError,
+  ManagedIssuanceSubmissionError,
+  ManagedKeyRotationActivationError,
+  ManagedKeyRotationSubmissionError,
+  NoopLogReader,
+  ParseError,
+  PreparedEventSubmissionError,
+  RegistryClient,
+  RegistryWorkflowError,
+  SDK_CONFORMANCE,
+  SIGNING_ALGS,
+  STATUS_MAX_RESPONSE_BYTES,
+  ValidationError,
+  VerificationCode3 as VerificationCode,
+  VerificationError3 as VerificationError,
+  VerifiedDomain,
+  WebBotAuthProfile,
+  activeStatusDocument,
+  awaitRegistryManagedPublication,
+  createHttpSignaturesProfile,
+  createIdentityManager,
+  createIdentityVerifier,
+  createJoseProfile,
+  createWebBotAuthProfile,
+  fromBase64Url,
+  httpSignatures,
+  isDomainName,
+  isTransientVerificationError,
+  issueManagedIdentity,
+  jose,
+  jwkSignatureAlg,
+  jwkThumbprint3 as jwkThumbprint,
+  normalizeFQDN2 as normalizeFQDN,
+  parseKaDuration,
+  parseKeyId,
+  publishClientControlledRecord,
+  publishToRegistry,
+  registry,
+  resumeManagedIssuance,
+  resumeManagedOperationalKeyRotation,
+  retryTransientVerification,
+  rotateManagedOperationalKey,
+  toArrayBuffer,
+  toBase64Url,
+  validateAgentStatus,
+  verifyWithKey,
+  webBotAuth
+};