@dnsid-ai/sdk 0.20.1

package/dist/node.js

@@ -0,0 +1,518 @@
+// src/node.ts
+import * as fs3 from "fs/promises";
+import * as os2 from "os";
+import * as path2 from "path";
+import { IdentityManager, ArgumentError as ArgumentError2, normalizeFQDN as normalizeFQDN2, validateDnsidConfig } from "@dnsid-ai/protocol";
+import { DEFAULT_REGISTRY_URL as DEFAULT_REGISTRY_URL2 } from "@dnsid-ai/registry";
+
+// src/local-key-provider.ts
+import * as fs2 from "fs/promises";
+import * as os from "os";
+import * as path from "path";
+import { createPrivateKey } from "crypto";
+import { ArgumentError, jwkSignatureAlg, jwkThumbprint, normalizeFQDN, verifyWithKey } from "@dnsid-ai/protocol";
+
+// src/node-fs.ts
+import * as fs from "fs/promises";
+async function readJson(filePath) {
+  const raw = await fs.readFile(filePath, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw new Error(`${filePath}: ${e.message}`);
+  }
+}
+
+// src/local-key-provider.ts
+var LocalKeyProvider = class _LocalKeyProvider {
+  store;
+  filePath;
+  // ponytail: per-instance queue; use a cross-process lock and reload before writes if shared writers are needed.
+  mutations = Promise.resolve();
+  constructor(store, filePath) {
+    this.store = store;
+    this.filePath = filePath;
+  }
+  static async load(filePath, createIfMissing = false, algorithm = "EdDSA") {
+    filePath = path.resolve(filePath);
+    let store;
+    try {
+      filePath = await fs2.realpath(filePath);
+      store = await readJson(filePath);
+    } catch (e) {
+      if (e.code !== "ENOENT" || !createIfMissing) throw e;
+      store = await buildInitialStore(algorithm);
+      const createdDirectory = await fs2.mkdir(path.dirname(filePath), { recursive: true });
+      try {
+        await writeStore(filePath, store, void 0, true);
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+        store = await readJson(filePath);
+      }
+      if (createdDirectory) {
+        const parent = path.dirname(createdDirectory);
+        for (let dir = path.dirname(filePath); ; dir = path.dirname(dir)) {
+          await syncDirectory(dir);
+          if (dir === parent) break;
+        }
+      }
+    }
+    return new _LocalKeyProvider(store, filePath);
+  }
+  static async fromEnvironment(env, options = {}) {
+    return _LocalKeyProvider.load(keyStorePathFromEnvironment(env, options.defaultPath), options.createIfMissing, options.algorithm);
+  }
+  static async generate(algorithm = "EdDSA") {
+    return new _LocalKeyProvider(await buildInitialStore(algorithm), null);
+  }
+  static async fromDirectory(dir) {
+    const jwkPath = path.join(dir, "private.jwk");
+    let key;
+    let keyPath = jwkPath;
+    try {
+      key = await readJson(jwkPath);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+      keyPath = path.join(dir, "private.pem");
+      const pem = await fs2.readFile(keyPath);
+      key = createPrivateKey(pem).export({ format: "jwk" });
+    }
+    const active = await validateAndNormalizePrivateJwk(key, keyPath);
+    return new _LocalKeyProvider({ active, retained: [], pending: [] }, null);
+  }
+  /** Loads a single private JWK file, including DNSid CLI `entity_key_path` files. */
+  static async fromFile(filePath) {
+    const key = await readJson(filePath);
+    const active = await validateAndNormalizePrivateJwk(key, filePath);
+    return new _LocalKeyProvider({ active, retained: [], pending: [] }, null);
+  }
+  static async fromDomain(domain, dnsidDir = path.join(os.homedir(), ".dnsid")) {
+    return _LocalKeyProvider.fromDirectory(path.join(dnsidDir, normalizeFQDN(domain, true)));
+  }
+  async signingKey() {
+    return toPublicJwk(this.store.active);
+  }
+  async jwk(kid) {
+    if (this.store.active.kid === kid) return toPublicJwk(this.store.active);
+    const retained = this.store.retained.find((k) => k.kid === kid);
+    if (retained) return toPublicJwk(retained);
+    const pending = this.store.pending.find((k) => k.kid === kid);
+    if (pending) return toPublicJwk(pending);
+    throw new ArgumentError(`key not found: ${kid}`);
+  }
+  async listKeyIds() {
+    return [this.store.active.kid, ...this.store.retained.map((k) => k.kid)];
+  }
+  async sign(payload) {
+    return this.signKey(this.store.active.kid, payload);
+  }
+  async signKey(kid, payload) {
+    const key = kid === this.store.active.kid ? this.store.active : this.store.pending.find((candidate) => candidate.kid === kid);
+    if (!key) throw new ArgumentError(`key is not active or pending for signing: ${kid}`);
+    const cryptoKey = await importPrivateKey(key);
+    const sig = await crypto.subtle.sign(signAlgorithm(key), cryptoKey, toArrayBuffer(payload));
+    return new Uint8Array(sig);
+  }
+  async generateKey() {
+    return this.mutate(async (next) => {
+      const key = await generateStoredKey(localKeyAlgorithm(next.active));
+      next.pending.push(key);
+      return key.kid;
+    });
+  }
+  async activate(kid) {
+    await this.mutate((next) => {
+      const idx = next.pending.findIndex((k) => k.kid === kid);
+      if (idx === -1) throw new ArgumentError(`no pending key with kid "${kid}"`);
+      const [incoming] = next.pending.splice(idx, 1);
+      next.retained.push(next.active);
+      next.active = incoming;
+    });
+  }
+  async supersede(kid) {
+    await this.mutate((next) => {
+      if (next.active.kid === kid) {
+        throw new ArgumentError("cannot supersede the active key; activate a replacement first");
+      }
+      const idx = next.retained.findIndex((k) => k.kid === kid);
+      if (idx === -1) throw new ArgumentError(`no retained key with kid "${kid}"`);
+      next.retained.splice(idx, 1);
+    });
+  }
+  /** @deprecated Use supersede(). */
+  async purge(kid) {
+    await this.supersede(kid);
+  }
+  mutate(change) {
+    const operation = this.mutations.then(async () => {
+      const next = structuredClone(this.store);
+      const result = await change(next);
+      if (this.filePath) {
+        await writeStore(`${this.filePath}.bak`, this.store);
+        await writeStore(this.filePath, next, () => {
+          this.store = next;
+        });
+      } else {
+        this.store = next;
+      }
+      return result;
+    });
+    this.mutations = operation.catch(() => {
+    });
+    return operation;
+  }
+};
+async function writeStore(filePath, store, committed, exclusive = false) {
+  const tempPath = `${filePath}.${crypto.randomUUID()}.tmp`;
+  const file = await fs2.open(tempPath, "wx", 384);
+  try {
+    try {
+      await file.writeFile(JSON.stringify(store, null, 2), "utf-8");
+      await file.sync();
+    } finally {
+      await file.close();
+    }
+    if (exclusive) await fs2.link(tempPath, filePath);
+    else await fs2.rename(tempPath, filePath);
+    committed?.();
+    await syncDirectory(path.dirname(filePath));
+  } finally {
+    await fs2.rm(tempPath, { force: true });
+  }
+}
+async function syncDirectory(dir) {
+  const directory = await fs2.open(dir, "r");
+  try {
+    await directory.sync();
+  } finally {
+    await directory.close();
+  }
+}
+function keyStorePathFromEnvironment(env = process.env, defaultPath = ".dnsid/keys.json") {
+  return env["DNSID_KEY_STORE"] || env["DNSID_KEY_STORE_PATH"] || env["DNSID_KEYSTORE_PATH"] || defaultPath;
+}
+function toPublicJwk(key) {
+  const { d: _d, ...pub } = key;
+  return pub;
+}
+async function validateAndNormalizePrivateJwk(key, filePath) {
+  const isEd25519 = key.kty === "OKP" && key.crv === "Ed25519" && typeof key.x === "string";
+  const isP256 = key.kty === "EC" && key.crv === "P-256" && typeof key.x === "string" && typeof key.y === "string";
+  if (!isEd25519 && !isP256 || typeof key.d !== "string") {
+    throw new Error(`${filePath} must include Ed25519 or ECDSA P-256 private key material`);
+  }
+  const pub = {
+    kty: key.kty,
+    crv: key.crv,
+    x: key.x,
+    ...isP256 ? { y: key.y } : {},
+    kid: typeof key.kid === "string" ? key.kid : ""
+  };
+  const alg = jwkSignatureAlg(pub);
+  const normalizedPub = { ...pub, alg, use: "sig", kid: pub.kid || await jwkThumbprint(pub) };
+  const normalized = { ...normalizedPub, d: key.d };
+  const probe = new TextEncoder().encode("dnsid-local-key-provider-self-check");
+  let verified = false;
+  try {
+    const signature = await crypto.subtle.sign(signAlgorithm(normalized), await importPrivateKey(normalized), probe);
+    verified = await verifyWithKey(probe, new Uint8Array(signature), normalizedPub, alg);
+  } catch {
+    verified = false;
+  }
+  if (!verified) throw new Error(`${filePath} has mismatched ${alg === "EdDSA" ? "Ed25519" : "ES256"} public/private key material`);
+  return normalized;
+}
+async function buildInitialStore(algorithm) {
+  return { active: await generateStoredKey(algorithm), retained: [], pending: [] };
+}
+async function generateStoredKey(algorithm) {
+  const generationAlgorithm = algorithm === "EdDSA" ? { name: "Ed25519" } : { name: "ECDSA", namedCurve: "P-256" };
+  const pair = await crypto.subtle.generateKey(generationAlgorithm, true, ["sign", "verify"]);
+  const priv = await crypto.subtle.exportKey("jwk", pair.privateKey);
+  return validateAndNormalizePrivateJwk({ ...priv, kid: "" }, "generated key");
+}
+function toArrayBuffer(bytes) {
+  if (bytes.buffer instanceof ArrayBuffer && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength) {
+    return bytes;
+  }
+  return new Uint8Array(bytes);
+}
+function localKeyAlgorithm(key) {
+  const alg = jwkSignatureAlg(key);
+  if (alg === "EdDSA" || alg === "ES256") return alg;
+  throw new ArgumentError(`unsupported local key algorithm: ${alg}`);
+}
+function signAlgorithm(key) {
+  return localKeyAlgorithm(key) === "EdDSA" ? { name: "Ed25519" } : { name: "ECDSA", hash: "SHA-256" };
+}
+async function importPrivateKey(key) {
+  const alg = localKeyAlgorithm(key);
+  return crypto.subtle.importKey(
+    "jwk",
+    {
+      kty: key.kty,
+      crv: key.crv,
+      x: key.x,
+      ...alg === "ES256" ? { y: key.y } : {},
+      d: key.d,
+      use: "sig"
+    },
+    alg === "EdDSA" ? { name: "Ed25519" } : { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+}
+
+// src/environment.ts
+import { DNSSECMode } from "@dnsid-ai/protocol";
+import { DEFAULT_REGISTRY_URL } from "@dnsid-ai/registry";
+var dnsidEnvironmentVariables = {
+  domain: "DNSID_DOMAIN",
+  governanceId: "DNSID_GOVERNANCE_ID",
+  registryUrl: "DNSID_REGISTRY_URL",
+  apiKey: "DNSID_API_KEY",
+  statusUrl: "DNSID_STATUS_URL",
+  logRef: "DNSID_LOG_REF",
+  ekUrl: "DNSID_EK_URL",
+  kuUrl: "DNSID_KU_URL",
+  dnsServer: "DNSID_DNS_SERVER",
+  caBundlePath: "DNSID_CA_BUNDLE",
+  dnssecMode: "DNSID_DNSSEC_MODE",
+  publicUrl: "DNSID_PUBLIC_URL",
+  keyStorePath: "DNSID_KEY_STORE",
+  agentPort: "DNSID_AGENT_PORT",
+  agentName: "DNSID_AGENT_NAME"
+};
+var environmentSchema = {
+  domain: stringField(dnsidEnvironmentVariables.domain),
+  governanceId: stringField(dnsidEnvironmentVariables.governanceId),
+  registryUrl: stringField(dnsidEnvironmentVariables.registryUrl),
+  apiKey: stringField(dnsidEnvironmentVariables.apiKey),
+  statusUrl: stringField(dnsidEnvironmentVariables.statusUrl),
+  logRef: stringField(dnsidEnvironmentVariables.logRef),
+  ekUrl: stringField(dnsidEnvironmentVariables.ekUrl),
+  kuUrl: stringField(dnsidEnvironmentVariables.kuUrl),
+  dnsServer: stringField(dnsidEnvironmentVariables.dnsServer),
+  caBundlePath: stringField(dnsidEnvironmentVariables.caBundlePath),
+  dnssecMode: dnssecModeField(dnsidEnvironmentVariables.dnssecMode),
+  publicUrl: stringField(dnsidEnvironmentVariables.publicUrl),
+  keyStorePath: stringField(dnsidEnvironmentVariables.keyStorePath),
+  agentPort: positiveIntField(dnsidEnvironmentVariables.agentPort),
+  agentName: stringField(dnsidEnvironmentVariables.agentName)
+};
+function configFromEnvironment(envOrOptions = process.env, options = {}) {
+  const receivedOptions = isConfigFromEnvironmentOptions(envOrOptions);
+  const env = receivedOptions ? process.env : envOrOptions ?? process.env;
+  const resolvedOptions = receivedOptions ? envOrOptions : options;
+  const parsed = parseEnvironment(env);
+  requireFields(parsed, ["domain", "governanceId", ...resolvedOptions.require ?? []]);
+  const registryUrl = parsed.registryUrl ?? DEFAULT_REGISTRY_URL;
+  const statusUrl = parsed.statusUrl ?? protocolStatusUrl(registryUrl, parsed.domain);
+  const config = {
+    identity: defined({
+      domain: parsed.domain,
+      governanceId: parsed.governanceId,
+      logRef: parsed.logRef ?? "noop:0",
+      statusUrl,
+      ekUrl: parsed.ekUrl,
+      kuUrl: parsed.kuUrl
+    }),
+    verification: defined({ dnssecMode: parsed.dnssecMode }),
+    transport: defined({ dnsServer: parsed.dnsServer, caBundlePath: parsed.caBundlePath })
+  };
+  return {
+    config,
+    registryUrl,
+    apiKey: parsed.apiKey,
+    publicUrl: parsed.publicUrl,
+    keyStorePath: parsed.keyStorePath,
+    agentName: parsed.agentName,
+    agentPort: parsed.agentPort
+  };
+}
+function registryClientOptionsFromEnvironment(env = process.env) {
+  const parsed = parseEnvironment(env);
+  return defined({ baseUrl: parsed.registryUrl ?? DEFAULT_REGISTRY_URL, token: parsed.apiKey });
+}
+function defined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+function isConfigFromEnvironmentOptions(value) {
+  if (value === void 0) return false;
+  const keys = Object.keys(value);
+  if (keys.length === 0) return true;
+  return keys.every((key) => key === "require") && Array.isArray(value.require);
+}
+function parseEnvironment(env) {
+  const parsed = {};
+  for (const fieldName of Object.keys(environmentSchema)) {
+    const value = readEnvironmentField(env, fieldName);
+    if (value !== void 0) parsed[fieldName] = value;
+  }
+  return parsed;
+}
+function readEnvironmentField(env, fieldName) {
+  const field = environmentSchema[fieldName];
+  const raw = env[field.variable];
+  if (raw === void 0 || raw === "") return void 0;
+  return field.parse(raw, field.variable);
+}
+function requireFields(parsed, fields) {
+  for (const field of fields) {
+    if (parsed[field] === void 0) throw new Error(`${environmentSchema[field].variable} is required`);
+  }
+}
+function stringField(variable) {
+  return { variable, parse: (value) => value };
+}
+function positiveIntField(variable) {
+  return {
+    variable,
+    parse(value, name) {
+      const parsed = Number(value);
+      if (!Number.isInteger(parsed) || parsed <= 0) {
+        throw new Error(`${name} must be a positive integer`);
+      }
+      return parsed;
+    }
+  };
+}
+function dnssecModeField(variable) {
+  return {
+    variable,
+    parse(value, name) {
+      if (!Object.values(DNSSECMode).includes(value)) {
+        throw new Error(`invalid ${name} "${value}"; expected one of: ${Object.values(DNSSECMode).join(", ")}`);
+      }
+      return value;
+    }
+  };
+}
+function protocolStatusUrl(registryUrl, domain) {
+  return `${registryUrl.replace(/\/$/, "")}/v1/status/${encodeURIComponent(domain)}`;
+}
+
+// src/node.ts
+async function createNodeIdentityManager(config, deps = {}) {
+  const { transport, ...core } = validateDnsidConfig(config);
+  const { dnsServer, caBundlePath, allowedUnsafeHosts } = transport;
+  if (dnsServer !== void 0 && deps.dnsResolver && deps.fetchJson) {
+    throw new ArgumentError2("config.transport.dnsServer has no SDK-managed consumer when both dnsResolver and fetchJson are injected");
+  }
+  if (caBundlePath !== void 0 && deps.fetchJson) {
+    throw new ArgumentError2("config.transport.caBundlePath has no SDK-managed consumer when fetchJson is injected");
+  }
+  if (allowedUnsafeHosts !== void 0 && deps.fetchJson) {
+    throw new ArgumentError2("config.transport.allowedUnsafeHosts has no SDK-managed consumer when fetchJson is injected");
+  }
+  const transportModule = deps.fetchJson && deps.dnsResolver ? null : await loadNodeTransport();
+  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, allowedUnsafeHosts }));
+  const dnsResolver = deps.dnsResolver ?? transportModule.createDefaultDnsResolver({ dnsServer });
+  return new IdentityManager(core, { ...deps, dnsResolver, fetchJson });
+}
+async function createNodeIdentityVerifier(config = {}, deps = {}) {
+  return createNodeIdentityManager(config, deps);
+}
+async function createNodeIdentityManagerFromDnsid(options = {}, deps = {}) {
+  const dnsidDir = options.dnsidDir ?? options.env?.["DNSID_CONFIG_DIR"] ?? process.env["DNSID_CONFIG_DIR"] ?? path2.join(os2.homedir(), ".dnsid");
+  let configPath = path2.join(dnsidDir, "config.json");
+  let raw = await readConfig(configPath);
+  const pointerDomain = stringField2(raw, "domain", "fqdn");
+  if (pointerDomain) {
+    const identityConfigPath = path2.join(dnsidDir, normalizeFQDN2(pointerDomain, true), "config.json");
+    try {
+      raw = await readJson(identityConfigPath);
+      configPath = identityConfigPath;
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  const field = (...keys) => stringField2(raw, ...keys);
+  const loaded = {
+    domain: field("domain", "fqdn"),
+    governanceId: field("governanceId", "governance_id"),
+    logRef: field("logRef", "log_ref"),
+    statusUrl: field("statusUrl", "status_url"),
+    ekUrl: field("ekUrl", "ek_url"),
+    kuUrl: field("kuUrl", "ku_url"),
+    capabilitiesUrl: field("capabilitiesUrl", "capabilities_url"),
+    publishProfile: field("publishProfile", "publish_profile"),
+    maxKeyAge: maxKeyAgeValue(raw.maxKeyAge ?? raw.max_key_age, configPath)
+  };
+  const identity = { ...definedOnly(loaded), ...definedOnly(options.config?.identity ?? {}) };
+  if (!identity.domain) throw new Error(`${configPath} must include domain`);
+  if (!identity.governanceId) throw new Error(`${configPath} must include governanceId or governance_id`);
+  identity.logRef ??= "noop:0";
+  identity.statusUrl ??= protocolStatusUrl2(field("registryUrl", "registry_url", "server_url") ?? DEFAULT_REGISTRY_URL2, identity.domain);
+  const keyProvider = deps.keyProvider ?? await LocalKeyProvider.fromDirectory(await identityKeyDir(dnsidDir, identity.domain));
+  const entityKeyProvider = deps.entityKeyProvider ?? await optionalEntityKeyProvider(
+    path2.dirname(configPath),
+    field("entityKeyPath", "entity_key_path"),
+    field("entityKeyDir", "entity_key_dir")
+  );
+  return createNodeIdentityManager(
+    { identity, verification: options.config?.verification, transport: options.config?.transport },
+    { ...deps, keyProvider, entityKeyProvider }
+  );
+}
+function definedOnly(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+async function readConfig(configPath) {
+  return readJson(configPath).catch((e) => {
+    if (e.code === "ENOENT") {
+      throw new Error(`${configPath} not found; run the DNSid CLI to register your domain first`);
+    }
+    throw e;
+  });
+}
+async function optionalEntityKeyProvider(root, file, legacyDir) {
+  if (file) {
+    return LocalKeyProvider.fromFile(path2.isAbsolute(file) ? file : path2.resolve(root, file));
+  }
+  if (!legacyDir) return void 0;
+  return LocalKeyProvider.fromDirectory(path2.isAbsolute(legacyDir) ? legacyDir : path2.resolve(root, legacyDir));
+}
+async function identityKeyDir(dnsidDir, domain) {
+  for (const filename of ["private.jwk", "private.pem"]) {
+    try {
+      await fs3.access(path2.join(dnsidDir, filename));
+      return dnsidDir;
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  return path2.join(dnsidDir, normalizeFQDN2(domain, true));
+}
+function stringField2(raw, ...keys) {
+  return keys.map((key) => raw[key]).find((value) => typeof value === "string" && value !== "");
+}
+function maxKeyAgeValue(value, configPath) {
+  if (value == null || value === "") return void 0;
+  if (["24h", "7d", "30d", "90d"].includes(String(value))) return value;
+  throw new Error(`${configPath} has invalid maxKeyAge "${String(value)}"`);
+}
+function protocolStatusUrl2(registryUrl, domain) {
+  return `${registryUrl.replace(/\/$/, "")}/v1/status/${encodeURIComponent(normalizeFQDN2(domain, true))}`;
+}
+async function loadNodeTransport() {
+  try {
+    return await import("@dnsid-ai/transport");
+  } catch (e) {
+    const err = e;
+    if (err.code === "ERR_MODULE_NOT_FOUND" || err.code === "MODULE_NOT_FOUND") {
+      throw new Error("`@dnsid-ai/sdk/node` HTTPS defaults require optional peer `@dnsid-ai/transport`; install it or inject fetchJson.");
+    }
+    throw e;
+  }
+}
+export {
+  LocalKeyProvider,
+  configFromEnvironment,
+  createNodeIdentityManager,
+  createNodeIdentityManagerFromDnsid,
+  createNodeIdentityVerifier,
+  dnsidEnvironmentVariables,
+  keyStorePathFromEnvironment,
+  registryClientOptionsFromEnvironment
+};

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@dnsid-ai/sdk",
+  "version": "0.20.1",
+  "description": "Runtime-neutral DNSid SDK entrypoint with optional Node.js convenience helpers.",
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./node": {
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.js",
+      "require": "./dist/node.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dnsid-ai/dnsid-ts.git",
+    "directory": "packages/sdk"
+  },
+  "bugs": {
+    "url": "https://github.com/dnsid-ai/dnsid-ts/issues"
+  },
+  "homepage": "https://github.com/dnsid-ai/dnsid-ts#readme",
+  "keywords": [
+    "dnsid",
+    "sdk",
+    "dns",
+    "identity"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/node.ts --format esm,cjs --dts --clean",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@dnsid-ai/protocol": "^0.20.1",
+    "@dnsid-ai/http-signatures": "^0.20.1",
+    "@dnsid-ai/jose": "^0.20.1",
+    "@dnsid-ai/log-c2sp-tlog": "^0.20.1",
+    "@dnsid-ai/registry": "^0.20.1",
+    "@dnsid-ai/web-bot-auth": "^0.20.1"
+  },
+  "peerDependencies": {
+    "@dnsid-ai/transport": "^0.20.1"
+  },
+  "peerDependenciesMeta": {
+    "@dnsid-ai/transport": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "Apache-2.0"
+}