@dnsid-ai/sdk 0.21.0 → 0.23.0

package/README.md

@@ -7,7 +7,7 @@ The root `@dnsid-ai/sdk` entrypoint is runtime-neutral: callers inject DNS resol
 ## Package layout
 
 - **Root export (`@dnsid-ai/sdk`)** — runtime-neutral. No Node built-ins, `Buffer`, filesystem, or `undici` imports; you inject `dnsResolver`, `fetchJson`, and key providers. Safe to bundle for browsers and other non-Node runtimes. Its managed C2SP workflows use the portable writer-only binding entrypoint.
-- **`@dnsid-ai/sdk/node` subpath** — Node conveniences: `LocalKeyProvider`, `configFromEnvironment`, `createNodeIdentityManager`, `createNodeIdentityManagerFromDnsid`. Loads the optional `@dnsid-ai/transport` peer when HTTPS defaults are needed.
+- **`@dnsid-ai/sdk/node` subpath** — Node conveniences: `LocalKeyProvider`, configuration loaders (`loadEnvironment`, `loadFile`, `loadCliDirectory`, `mergeLoadedConfig`, `constructIdentityManager`), `createNodeIdentityManager`, and the one-call `createNodeIdentityManagerFromEnvironment` / `FromDnsid` / `FromFile`. Loads the optional `@dnsid-ai/transport` peer when HTTPS defaults are needed.
 - **OIDC lives in `@dnsid-ai/oidc`** — deliberately not re-exported from the root because its default transport is Node-bound, and private-key token minting belongs server-side. Import it directly.
 
 ## Install
@@ -71,12 +71,27 @@ rotation state; already-completed activation or supersession is not repeated.
 ## Node.js convenience usage
 
 ```ts
-import { configFromEnvironment, createNodeIdentityManager, LocalKeyProvider } from '@dnsid-ai/sdk/node';
+import { createNodeIdentityManagerFromEnvironment } from '@dnsid-ai/sdk/node';
 
-const { config, keyStorePath } = configFromEnvironment();
-const keyProvider = await LocalKeyProvider.load(keyStorePath ?? '.dnsid/keys.json', true);
+// Loaders parse; constructors default. Identity from DNSID_*, keys from DNSID_CONFIG_DIR or
+// DNSID_KEY_STORE, log trust from DNSID_LOG_POLICY_URL / _FILE / DNSID_LOG_TRUST_PROFILE_FILE.
+// Without DNSID_DOMAIN the result is a verification-only manager.
+const idm = await createNodeIdentityManagerFromEnvironment();
+```
+
+`createNodeIdentityManagerFromEnvironment(env?, overlay?, deps?)` is exactly
+`constructIdentityManager(mergeLoadedConfig(await loadEnvironment(env), { dnsid: overlay }), deps)`;
+`createNodeIdentityManagerFromDnsid(dir?)` and `createNodeIdentityManagerFromFile(path)` are the same
+shape over `loadCliDirectory` and `loadFile`. Compose sources yourself with `mergeLoadedConfig`
+(field-wise, presence wins, lists replace, `logTrust` atomic). Supplied `deps` always win over loaded
+`logTrust` and `keySource`. The environment schema is in the repository README.
+
+```ts
+import { createNodeIdentityManager, LocalKeyProvider } from '@dnsid-ai/sdk/node';
+
+const keyProvider = await LocalKeyProvider.load('.dnsid/keys.json', true);
 const entityKeyProvider = await LocalKeyProvider.load('.dnsid/entity.keys.json', true);
-const idm = await createNodeIdentityManager(config, { keyProvider, entityKeyProvider });
+const idm = await createNodeIdentityManager({ identity, verification }, { keyProvider, entityKeyProvider });
 ```
 
 `config.transport.dnsServer`/`caBundlePath` configure only the SDK-managed default resolver and
@@ -102,9 +117,11 @@ If the registry CLI has already written `~/.dnsid/config.json` and `~/.dnsid/<fq
 ```ts
 import { createNodeIdentityManagerFromDnsid } from '@dnsid-ai/sdk/node';
 
-const idm = await createNodeIdentityManagerFromDnsid();
+const idm = await createNodeIdentityManagerFromDnsid(); // ~/.dnsid by default; never reads DNSID_CONFIG_DIR
 ```
 
+The CLI loader maps persisted fields as written: a missing `status_url` or `log_ref` fails construction with `ArgumentError` unless the overlay supplies it.
+
 DNSSEC modes are: `auto` (default), which rejects `FAILED` and permits `VALID`, `UNSIGNED`, or `UNKNOWN`; `validated`, which permits `VALID` or `UNSIGNED`; and `required`, which permits only `VALID`.
 
 ## Included surfaces

package/dist/node.cjs

@@ -31,20 +31,19 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var node_exports = {};
 __export(node_exports, {
   LocalKeyProvider: () => LocalKeyProvider,
-  configFromEnvironment: () => configFromEnvironment,
+  constructIdentityManager: () => constructIdentityManager,
   createNodeIdentityManager: () => createNodeIdentityManager,
   createNodeIdentityManagerFromDnsid: () => createNodeIdentityManagerFromDnsid,
+  createNodeIdentityManagerFromEnvironment: () => createNodeIdentityManagerFromEnvironment,
+  createNodeIdentityManagerFromFile: () => createNodeIdentityManagerFromFile,
   createNodeIdentityVerifier: () => createNodeIdentityVerifier,
-  dnsidEnvironmentVariables: () => dnsidEnvironmentVariables,
-  keyStorePathFromEnvironment: () => keyStorePathFromEnvironment,
-  registryClientOptionsFromEnvironment: () => registryClientOptionsFromEnvironment
+  createRegistryClientFromEnvironment: () => createRegistryClientFromEnvironment,
+  loadCliDirectory: () => loadCliDirectory,
+  loadEnvironment: () => loadEnvironment,
+  loadFile: () => loadFile,
+  mergeLoadedConfig: () => mergeLoadedConfig
 });
 module.exports = __toCommonJS(node_exports);
-var fs3 = __toESM(require("fs/promises"), 1);
-var os2 = __toESM(require("os"), 1);
-var path2 = __toESM(require("path"), 1);
-var import_protocol3 = require("@dnsid-ai/protocol");
-var import_registry2 = require("@dnsid-ai/registry");
 
 // src/local-key-provider.ts
 var fs2 = __toESM(require("fs/promises"), 1);
@@ -100,9 +99,6 @@ var LocalKeyProvider = class _LocalKeyProvider {
     }
     return new _LocalKeyProvider(store, filePath);
   }
-  static async fromEnvironment(env, options = {}) {
-    return _LocalKeyProvider.load(keyStorePathFromEnvironment(env, options.defaultPath), options.createIfMissing, options.algorithm);
-  }
   static async generate(algorithm = "EdDSA") {
     return new _LocalKeyProvider(await buildInitialStore(algorithm), null);
   }
@@ -229,9 +225,6 @@ async function syncDirectory(dir) {
     await directory.close();
   }
 }
-function keyStorePathFromEnvironment(env = process.env, defaultPath = ".dnsid/keys.json") {
-  return env["DNSID_KEY_STORE"] || env["DNSID_KEY_STORE_PATH"] || env["DNSID_KEYSTORE_PATH"] || defaultPath;
-}
 function toPublicJwk(key) {
   const { d: _d, ...pub } = key;
   return pub;
@@ -304,215 +297,259 @@ async function importPrivateKey(key) {
   );
 }
 
-// src/environment.ts
+// src/node-identity-manager.ts
 var import_protocol2 = require("@dnsid-ai/protocol");
-var import_registry = require("@dnsid-ai/registry");
-var dnsidEnvironmentVariables = {
-  domain: "DNSID_DOMAIN",
-  governanceId: "DNSID_GOVERNANCE_ID",
-  registryUrl: "DNSID_REGISTRY_URL",
-  apiKey: "DNSID_API_KEY",
-  statusUrl: "DNSID_STATUS_URL",
-  logRef: "DNSID_LOG_REF",
-  ekUrl: "DNSID_EK_URL",
-  kuUrl: "DNSID_KU_URL",
-  dnsServer: "DNSID_DNS_SERVER",
-  caBundlePath: "DNSID_CA_BUNDLE",
-  dnssecMode: "DNSID_DNSSEC_MODE",
-  publicUrl: "DNSID_PUBLIC_URL",
-  keyStorePath: "DNSID_KEY_STORE",
-  agentPort: "DNSID_AGENT_PORT",
-  agentName: "DNSID_AGENT_NAME"
-};
-var environmentSchema = {
-  domain: stringField(dnsidEnvironmentVariables.domain),
-  governanceId: stringField(dnsidEnvironmentVariables.governanceId),
-  registryUrl: stringField(dnsidEnvironmentVariables.registryUrl),
-  apiKey: stringField(dnsidEnvironmentVariables.apiKey),
-  statusUrl: stringField(dnsidEnvironmentVariables.statusUrl),
-  logRef: stringField(dnsidEnvironmentVariables.logRef),
-  ekUrl: stringField(dnsidEnvironmentVariables.ekUrl),
-  kuUrl: stringField(dnsidEnvironmentVariables.kuUrl),
-  dnsServer: stringField(dnsidEnvironmentVariables.dnsServer),
-  caBundlePath: stringField(dnsidEnvironmentVariables.caBundlePath),
-  dnssecMode: dnssecModeField(dnsidEnvironmentVariables.dnssecMode),
-  publicUrl: stringField(dnsidEnvironmentVariables.publicUrl),
-  keyStorePath: stringField(dnsidEnvironmentVariables.keyStorePath),
-  agentPort: positiveIntField(dnsidEnvironmentVariables.agentPort),
-  agentName: stringField(dnsidEnvironmentVariables.agentName)
-};
-function configFromEnvironment(envOrOptions = process.env, options = {}) {
-  const receivedOptions = isConfigFromEnvironmentOptions(envOrOptions);
-  const env = receivedOptions ? process.env : envOrOptions ?? process.env;
-  const resolvedOptions = receivedOptions ? envOrOptions : options;
-  const parsed = parseEnvironment(env);
-  requireFields(parsed, ["domain", "governanceId", ...resolvedOptions.require ?? []]);
-  const registryUrl = parsed.registryUrl ?? import_registry.DEFAULT_REGISTRY_URL;
-  const statusUrl = parsed.statusUrl ?? protocolStatusUrl(registryUrl, parsed.domain);
-  const config = {
-    identity: defined({
-      domain: parsed.domain,
-      governanceId: parsed.governanceId,
-      logRef: parsed.logRef ?? "noop:0",
-      statusUrl,
-      ekUrl: parsed.ekUrl,
-      kuUrl: parsed.kuUrl
-    }),
-    verification: defined({ dnssecMode: parsed.dnssecMode }),
-    transport: defined({ dnsServer: parsed.dnsServer, caBundlePath: parsed.caBundlePath })
-  };
-  return {
-    config,
-    registryUrl,
-    apiKey: parsed.apiKey,
-    publicUrl: parsed.publicUrl,
-    keyStorePath: parsed.keyStorePath,
-    agentName: parsed.agentName,
-    agentPort: parsed.agentPort
-  };
-}
-function registryClientOptionsFromEnvironment(env = process.env) {
-  const parsed = parseEnvironment(env);
-  return defined({ baseUrl: parsed.registryUrl ?? import_registry.DEFAULT_REGISTRY_URL, token: parsed.apiKey });
-}
-function defined(value) {
-  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
-}
-function isConfigFromEnvironmentOptions(value) {
-  if (value === void 0) return false;
-  const keys = Object.keys(value);
-  if (keys.length === 0) return true;
-  return keys.every((key) => key === "require") && Array.isArray(value.require);
-}
-function parseEnvironment(env) {
-  const parsed = {};
-  for (const fieldName of Object.keys(environmentSchema)) {
-    const value = readEnvironmentField(env, fieldName);
-    if (value !== void 0) parsed[fieldName] = value;
-  }
-  return parsed;
-}
-function readEnvironmentField(env, fieldName) {
-  const field = environmentSchema[fieldName];
-  const raw = env[field.variable];
-  if (raw === void 0 || raw === "") return void 0;
-  return field.parse(raw, field.variable);
-}
-function requireFields(parsed, fields) {
-  for (const field of fields) {
-    if (parsed[field] === void 0) throw new Error(`${environmentSchema[field].variable} is required`);
-  }
-}
-function stringField(variable) {
-  return { variable, parse: (value) => value };
-}
-function positiveIntField(variable) {
-  return {
-    variable,
-    parse(value, name) {
-      const parsed = Number(value);
-      if (!Number.isInteger(parsed) || parsed <= 0) {
-        throw new Error(`${name} must be a positive integer`);
-      }
-      return parsed;
-    }
-  };
-}
-function dnssecModeField(variable) {
-  return {
-    variable,
-    parse(value, name) {
-      if (!Object.values(import_protocol2.DNSSECMode).includes(value)) {
-        throw new Error(`invalid ${name} "${value}"; expected one of: ${Object.values(import_protocol2.DNSSECMode).join(", ")}`);
-      }
-      return value;
-    }
-  };
-}
-function protocolStatusUrl(registryUrl, domain) {
-  return `${registryUrl.replace(/\/$/, "")}/v1/status/${encodeURIComponent(domain)}`;
-}
-
-// src/node.ts
 async function createNodeIdentityManager(config, deps = {}) {
-  const { transport, ...core } = (0, import_protocol3.validateDnsidConfig)(config);
-  const { dnsServer, caBundlePath, allowedUnsafeHosts } = transport;
+  const { transport, ...core } = (0, import_protocol2.validateDnsidConfig)(config);
+  const { dnsServer, caBundlePath, privateAddressHosts } = transport;
   if (dnsServer !== void 0 && deps.dnsResolver && deps.fetchJson) {
-    throw new import_protocol3.ArgumentError("config.transport.dnsServer has no SDK-managed consumer when both dnsResolver and fetchJson are injected");
+    throw new import_protocol2.ArgumentError("config.transport.dnsServer has no SDK-managed consumer when both dnsResolver and fetchJson are injected");
   }
   if (caBundlePath !== void 0 && deps.fetchJson) {
-    throw new import_protocol3.ArgumentError("config.transport.caBundlePath has no SDK-managed consumer when fetchJson is injected");
+    throw new import_protocol2.ArgumentError("config.transport.caBundlePath has no SDK-managed consumer when fetchJson is injected");
   }
-  if (allowedUnsafeHosts !== void 0 && deps.fetchJson) {
-    throw new import_protocol3.ArgumentError("config.transport.allowedUnsafeHosts has no SDK-managed consumer when fetchJson is injected");
+  if (privateAddressHosts !== void 0 && deps.fetchJson) {
+    throw new import_protocol2.ArgumentError("config.transport.privateAddressHosts has no SDK-managed consumer when fetchJson is injected");
   }
   const transportModule = deps.fetchJson && deps.dnsResolver ? null : await loadNodeTransport();
-  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, allowedUnsafeHosts }));
+  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, privateAddressHosts }));
   const dnsResolver = deps.dnsResolver ?? transportModule.createDefaultDnsResolver({ dnsServer });
-  return new import_protocol3.IdentityManager(core, { ...deps, dnsResolver, fetchJson });
+  return new import_protocol2.IdentityManager(core, { ...deps, dnsResolver, fetchJson });
 }
 async function createNodeIdentityVerifier(config = {}, deps = {}) {
   return createNodeIdentityManager(config, deps);
 }
-async function createNodeIdentityManagerFromDnsid(options = {}, deps = {}) {
-  const dnsidDir = options.dnsidDir ?? options.env?.["DNSID_CONFIG_DIR"] ?? process.env["DNSID_CONFIG_DIR"] ?? path2.join(os2.homedir(), ".dnsid");
+async function loadNodeTransport() {
+  try {
+    return await import("@dnsid-ai/transport");
+  } catch (e) {
+    const err = e;
+    if (err.code === "ERR_MODULE_NOT_FOUND" || err.code === "MODULE_NOT_FOUND") {
+      throw new Error("`@dnsid-ai/sdk/node` HTTPS defaults require optional peer `@dnsid-ai/transport`; install it or inject fetchJson.");
+    }
+    throw e;
+  }
+}
+
+// src/config-loading.ts
+var fs3 = __toESM(require("fs/promises"), 1);
+var os2 = __toESM(require("os"), 1);
+var path2 = __toESM(require("path"), 1);
+var import_protocol3 = require("@dnsid-ai/protocol");
+var import_log_c2sp_tlog = require("@dnsid-ai/log-c2sp-tlog");
+var import_registry = require("@dnsid-ai/registry");
+var IDENTITY_VARIABLES = {
+  DNSID_DOMAIN: "domain",
+  DNSID_GOVERNANCE_ID: "governanceId",
+  DNSID_STATUS_URL: "statusUrl",
+  DNSID_LOG_REF: "logRef",
+  DNSID_EK_URL: "ekUrl",
+  DNSID_KU_URL: "kuUrl",
+  DNSID_PUBLISH_PROFILE: "publishProfile",
+  DNSID_CAPABILITIES_URL: "capabilitiesUrl"
+};
+async function loadEnvironment(env = process.env) {
+  const get = (name) => {
+    const value = env[name]?.trim();
+    return value ? value : void 0;
+  };
+  const identity = compact(Object.fromEntries(
+    Object.entries(IDENTITY_VARIABLES).map(([variable, field]) => [field, get(variable)])
+  ));
+  const dnssecMode = get("DNSID_DNSSEC_MODE");
+  if (dnssecMode !== void 0 && !Object.values(import_protocol3.DNSSECMode).includes(dnssecMode)) {
+    throw new import_protocol3.ArgumentError(`invalid DNSID_DNSSEC_MODE "${dnssecMode}"; expected one of: ${Object.values(import_protocol3.DNSSECMode).join(", ")}`);
+  }
+  const hosts = get("DNSID_PRIVATE_HOSTS")?.split(",").map((h) => h.trim()).filter(Boolean);
+  const dnsid = compact({
+    identity,
+    verification: compact({ dnssecMode }),
+    transport: compact({
+      dnsServer: get("DNSID_DNS_SERVER"),
+      caBundlePath: get("DNSID_CA_BUNDLE"),
+      privateAddressHosts: hosts?.length ? hosts : void 0
+    })
+  });
+  const policyFile = get("DNSID_LOG_POLICY_FILE");
+  const profileFile = get("DNSID_LOG_TRUST_PROFILE_FILE");
+  const logTrust = compact({
+    policyUrl: get("DNSID_LOG_POLICY_URL"),
+    policyDocument: policyFile === void 0 ? void 0 : new Uint8Array(await fs3.readFile(policyFile)),
+    profile: profileFile === void 0 ? void 0 : jsonObject(await fs3.readFile(profileFile), profileFile)
+  });
+  return top({
+    dnsid,
+    logTrust,
+    registry: compact({ registryUrl: get("DNSID_REGISTRY_URL") }),
+    keySource: compact({ cliDirectory: get("DNSID_CONFIG_DIR"), keyStorePath: get("DNSID_KEY_STORE") })
+  });
+}
+async function loadFile(filePath) {
+  const root = jsonObject(await fs3.readFile(filePath), filePath);
+  rejectUnknown(root, filePath, ["dnsid", "logTrust", "registry"]);
+  const loaded = {};
+  if (root.dnsid !== void 0) loaded.dnsid = loadedDnsid(root.dnsid, `${filePath}: dnsid`);
+  if (root.logTrust !== void 0) {
+    const trust = object(root.logTrust, `${filePath}: logTrust`);
+    rejectUnknown(trust, `${filePath}: logTrust`, ["managed", "profile", "policyUrl"]);
+    loaded.logTrust = compact({
+      managed: optional(trust, "managed", "boolean", `${filePath}: logTrust`),
+      profile: trust.profile === void 0 ? void 0 : object(trust.profile, `${filePath}: logTrust.profile`),
+      policyUrl: optional(trust, "policyUrl", "string", `${filePath}: logTrust`)
+    });
+  }
+  if (root.registry !== void 0) {
+    const registry = object(root.registry, `${filePath}: registry`);
+    rejectUnknown(registry, `${filePath}: registry`, ["registryUrl"]);
+    loaded.registry = compact({ registryUrl: optional(registry, "registryUrl", "string", `${filePath}: registry`) });
+  }
+  return loaded;
+}
+function loadedDnsid(value, source) {
+  const raw = object(value, source);
+  rejectUnknown(raw, source, ["identity", "verification", "transport"]);
+  if (raw.identity !== void 0) {
+    const identity = object(raw.identity, `${source}.identity`);
+    const keys = ["domain", "governanceId", "logRef", "statusUrl", "policyFlags", "maxKeyAge", "ekUrl", "kuUrl", "publishProfile", "capabilitiesUrl"];
+    rejectUnknown(identity, `${source}.identity`, keys);
+    for (const key of keys) optional(identity, key, "string", `${source}.identity`);
+  }
+  if (raw.verification !== void 0) {
+    const verification = object(raw.verification, `${source}.verification`);
+    rejectUnknown(verification, `${source}.verification`, ["statusCheckInterval", "dnssecMode", "trustedEntities"]);
+    if (verification.statusCheckInterval !== void 0 && (typeof verification.statusCheckInterval !== "number" || !Number.isFinite(verification.statusCheckInterval))) {
+      throw new import_protocol3.ArgumentError(`${source}.verification.statusCheckInterval must be a finite number`);
+    }
+    const mode = optional(verification, "dnssecMode", "string", `${source}.verification`);
+    if (mode !== void 0 && !Object.values(import_protocol3.DNSSECMode).includes(mode)) {
+      throw new import_protocol3.ArgumentError(`${source}.verification.dnssecMode is invalid`);
+    }
+    if (verification.trustedEntities !== void 0) {
+      if (!Array.isArray(verification.trustedEntities)) throw new import_protocol3.ArgumentError(`${source}.verification.trustedEntities must be an array`);
+      for (const [index, entry] of verification.trustedEntities.entries()) {
+        const label = `${source}.verification.trustedEntities[${index}]`;
+        const entity = object(entry, label);
+        rejectUnknown(entity, label, ["governanceId", "entityKeyThumbprints"]);
+        if (typeof entity.governanceId !== "string") throw new import_protocol3.ArgumentError(`${label}.governanceId must be a string`);
+        if (entity.entityKeyThumbprints !== void 0 && (!Array.isArray(entity.entityKeyThumbprints) || entity.entityKeyThumbprints.some((pin) => typeof pin !== "string"))) {
+          throw new import_protocol3.ArgumentError(`${label}.entityKeyThumbprints must be an array of strings`);
+        }
+      }
+    }
+  }
+  if (raw.transport !== void 0) {
+    const transport = object(raw.transport, `${source}.transport`);
+    rejectUnknown(transport, `${source}.transport`, ["dnsServer", "caBundlePath", "privateAddressHosts"]);
+    for (const key of ["dnsServer", "caBundlePath"]) optional(transport, key, "string", `${source}.transport`);
+    if (transport.privateAddressHosts !== void 0 && (!Array.isArray(transport.privateAddressHosts) || transport.privateAddressHosts.some((host) => typeof host !== "string"))) {
+      throw new import_protocol3.ArgumentError(`${source}.transport.privateAddressHosts must be an array of strings`);
+    }
+  }
+  return raw;
+}
+var CLI_IDENTITY_FIELDS = {
+  domain: "domain",
+  governance_id: "governanceId",
+  status_url: "statusUrl",
+  log_ref: "logRef",
+  ek_url: "ekUrl",
+  ku_url: "kuUrl",
+  capabilities_url: "capabilitiesUrl",
+  publish_profile: "publishProfile",
+  max_key_age: "maxKeyAge"
+};
+async function loadCliDirectory(dnsidDir = path2.join(os2.homedir(), ".dnsid")) {
   let configPath = path2.join(dnsidDir, "config.json");
-  let raw = await readConfig(configPath);
-  const pointerDomain = stringField2(raw, "domain", "fqdn");
-  if (pointerDomain) {
-    const identityConfigPath = path2.join(dnsidDir, (0, import_protocol3.normalizeFQDN)(pointerDomain, true), "config.json");
+  let raw;
+  try {
+    raw = jsonObject(await fs3.readFile(configPath), configPath);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+    throw new Error(`${configPath} not found; run the DNSid CLI to register your domain first`);
+  }
+  if (typeof raw.domain === "string" && raw.domain !== "") {
+    const identityConfigPath = path2.join(dnsidDir, (0, import_protocol3.normalizeFQDN)(raw.domain, true), "config.json");
     try {
-      raw = await readJson(identityConfigPath);
+      raw = jsonObject(await fs3.readFile(identityConfigPath), identityConfigPath);
       configPath = identityConfigPath;
     } catch (e) {
       if (e.code !== "ENOENT") throw e;
     }
   }
-  const field = (...keys) => stringField2(raw, ...keys);
-  const loaded = {
-    domain: field("domain", "fqdn"),
-    governanceId: field("governanceId", "governance_id"),
-    logRef: field("logRef", "log_ref"),
-    statusUrl: field("statusUrl", "status_url"),
-    ekUrl: field("ekUrl", "ek_url"),
-    kuUrl: field("kuUrl", "ku_url"),
-    capabilitiesUrl: field("capabilitiesUrl", "capabilities_url"),
-    publishProfile: field("publishProfile", "publish_profile"),
-    maxKeyAge: maxKeyAgeValue(raw.maxKeyAge ?? raw.max_key_age, configPath)
-  };
-  const identity = { ...definedOnly(loaded), ...definedOnly(options.config?.identity ?? {}) };
-  if (!identity.domain) throw new Error(`${configPath} must include domain`);
-  if (!identity.governanceId) throw new Error(`${configPath} must include governanceId or governance_id`);
-  identity.logRef ??= "noop:0";
-  identity.statusUrl ??= protocolStatusUrl2(field("registryUrl", "registry_url", "server_url") ?? import_registry2.DEFAULT_REGISTRY_URL, identity.domain);
-  const keyProvider = deps.keyProvider ?? await LocalKeyProvider.fromDirectory(await identityKeyDir(dnsidDir, identity.domain));
-  const entityKeyProvider = deps.entityKeyProvider ?? await optionalEntityKeyProvider(
-    path2.dirname(configPath),
-    field("entityKeyPath", "entity_key_path"),
-    field("entityKeyDir", "entity_key_dir")
-  );
-  return createNodeIdentityManager(
-    { identity, verification: options.config?.verification, transport: options.config?.transport },
-    { ...deps, keyProvider, entityKeyProvider }
-  );
+  const str = (key) => optional(raw, key, "string", configPath) || void 0;
+  const identity = compact(Object.fromEntries(
+    Object.entries(CLI_IDENTITY_FIELDS).map(([key, field]) => [field, str(key)])
+  ));
+  const entityKeyPath = str("entity_key_path");
+  return top({
+    dnsid: compact({ identity }),
+    keySource: compact({
+      cliDirectory: dnsidDir,
+      entityKeyPath: entityKeyPath === void 0 ? void 0 : path2.resolve(path2.dirname(configPath), entityKeyPath)
+    })
+  });
 }
-function definedOnly(value) {
-  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+function mergeLoadedConfig(base, overlay) {
+  return top({
+    dnsid: mergeDnsid(base.dnsid, overlay.dnsid),
+    logTrust: overlay.logTrust ?? base.logTrust,
+    registry: mergeSection(base.registry, overlay.registry),
+    keySource: mergeSection(base.keySource, overlay.keySource)
+  });
+}
+function mergeDnsid(base, overlay) {
+  if (!base || !overlay) return overlay ?? base;
+  return compact({
+    identity: mergeSection(base.identity, overlay.identity),
+    verification: mergeSection(base.verification, overlay.verification),
+    transport: mergeSection(base.transport, overlay.transport)
+  });
 }
-async function readConfig(configPath) {
-  return readJson(configPath).catch((e) => {
-    if (e.code === "ENOENT") {
-      throw new Error(`${configPath} not found; run the DNSid CLI to register your domain first`);
+function mergeSection(base, overlay) {
+  if (!base || !overlay) return overlay ?? base;
+  return { ...base, ...definedEntries(overlay) };
+}
+var MANAGED_DEFAULTS_MS = 10 * 60 * 1e3;
+async function constructIdentityManager(loaded, deps = {}) {
+  (0, import_protocol3.validateDnsidConfig)(loaded.dnsid ?? {});
+  const filled = { ...deps };
+  if (!filled.logRegistry && loaded.logTrust) {
+    filled.logRegistry = await logRegistryFromTrust(loaded.logTrust, loaded.dnsid?.transport);
+  }
+  const identity = loaded.dnsid?.identity;
+  if (identity && loaded.keySource) {
+    if (!filled.keyProvider) filled.keyProvider = await operationalKeyProvider(loaded.keySource, identity.domain);
+    if (!filled.entityKeyProvider && loaded.keySource.entityKeyPath !== void 0) {
+      filled.entityKeyProvider = await LocalKeyProvider.fromFile(loaded.keySource.entityKeyPath);
     }
-    throw e;
+  }
+  return createNodeIdentityManager(loaded.dnsid ?? {}, filled);
+}
+async function logRegistryFromTrust(trust, transport) {
+  const variants = ["managed", "profile", "policyDocument", "policyUrl"].filter((k) => trust[k] !== void 0);
+  if (variants.length !== 1) {
+    throw new import_protocol3.ArgumentError(`logTrust requires exactly one of managed, profile, policyDocument, policyUrl; got ${variants.length}`);
+  }
+  if (trust.managed !== void 0) {
+    if (trust.managed !== true) throw new import_protocol3.ArgumentError("logTrust.managed must be true when present");
+    return (0, import_log_c2sp_tlog.createDnsidManagedVerificationRegistry)();
+  }
+  return (0, import_log_c2sp_tlog.createC2spTlogVerificationRegistry)({
+    trustProfile: trust.profile && (0, import_log_c2sp_tlog.parseC2spTlogTrustProfile)(new TextEncoder().encode(JSON.stringify(trust.profile))),
+    policyDocument: trust.policyDocument,
+    policyUrl: trust.policyUrl,
+    transport,
+    checkpointMaxAge: MANAGED_DEFAULTS_MS,
+    maxBundleLifetimeMs: trust.profile ? MANAGED_DEFAULTS_MS : void 0,
+    allowedClockSkew: 0
   });
 }
-async function optionalEntityKeyProvider(root, file, legacyDir) {
-  if (file) {
-    return LocalKeyProvider.fromFile(path2.isAbsolute(file) ? file : path2.resolve(root, file));
+async function operationalKeyProvider(source, domain) {
+  if (source.cliDirectory !== void 0) {
+    return LocalKeyProvider.fromDirectory(await identityKeyDir(source.cliDirectory, domain));
   }
-  if (!legacyDir) return void 0;
-  return LocalKeyProvider.fromDirectory(path2.isAbsolute(legacyDir) ? legacyDir : path2.resolve(root, legacyDir));
+  if (source.keyStorePath !== void 0) return LocalKeyProvider.load(source.keyStorePath);
+  return void 0;
 }
 async function identityKeyDir(dnsidDir, domain) {
   for (const filename of ["private.jwk", "private.pem"]) {
@@ -525,36 +562,66 @@ async function identityKeyDir(dnsidDir, domain) {
   }
   return path2.join(dnsidDir, (0, import_protocol3.normalizeFQDN)(domain, true));
 }
-function stringField2(raw, ...keys) {
-  return keys.map((key) => raw[key]).find((value) => typeof value === "string" && value !== "");
+function createNodeIdentityManagerFromEnvironment(env, overlay, deps) {
+  return loadEnvironment(env).then((loaded) => constructIdentityManager(mergeLoadedConfig(loaded, top({ dnsid: overlay })), deps));
 }
-function maxKeyAgeValue(value, configPath) {
-  if (value == null || value === "") return void 0;
-  if (["24h", "7d", "30d", "90d"].includes(String(value))) return value;
-  throw new Error(`${configPath} has invalid maxKeyAge "${String(value)}"`);
+function createNodeIdentityManagerFromDnsid(dnsidDir, overlay, deps) {
+  return loadCliDirectory(dnsidDir).then((loaded) => constructIdentityManager(mergeLoadedConfig(loaded, top({ dnsid: overlay })), deps));
 }
-function protocolStatusUrl2(registryUrl, domain) {
-  return `${registryUrl.replace(/\/$/, "")}/v1/status/${encodeURIComponent((0, import_protocol3.normalizeFQDN)(domain, true))}`;
+function createNodeIdentityManagerFromFile(filePath, overlay, deps) {
+  return loadFile(filePath).then((loaded) => constructIdentityManager(mergeLoadedConfig(loaded, top({ dnsid: overlay })), deps));
 }
-async function loadNodeTransport() {
+async function createRegistryClientFromEnvironment(env) {
+  const source = env ?? process.env;
+  const loaded = await loadEnvironment(source);
+  return new import_registry.RegistryClient(compact({ baseUrl: loaded.registry?.registryUrl, token: source.DNSID_API_KEY?.trim() || void 0 }));
+}
+function definedEntries(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+function top(value) {
+  return definedEntries(value);
+}
+function compact(value) {
+  const defined = definedEntries(value);
+  return Object.keys(defined).length > 0 ? defined : void 0;
+}
+function jsonObject(bytes, source) {
+  let value;
   try {
-    return await import("@dnsid-ai/transport");
+    value = (0, import_protocol3.parseJsonNoDuplicateMembers)(bytes);
   } catch (e) {
-    const err = e;
-    if (err.code === "ERR_MODULE_NOT_FOUND" || err.code === "MODULE_NOT_FOUND") {
-      throw new Error("`@dnsid-ai/sdk/node` HTTPS defaults require optional peer `@dnsid-ai/transport`; install it or inject fetchJson.");
-    }
-    throw e;
+    throw new import_protocol3.ArgumentError(`${source}: ${e.message}`);
   }
+  return object(value, source);
+}
+function object(value, source) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new import_protocol3.ArgumentError(`${source} must be a JSON object`);
+  return value;
+}
+function rejectUnknown(raw, source, allowed) {
+  for (const key of Object.keys(raw)) {
+    if (!allowed.includes(key)) throw new import_protocol3.ArgumentError(`${source} has unknown member "${key}"`);
+  }
+}
+function optional(raw, key, type, source) {
+  const value = raw[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== type) throw new import_protocol3.ArgumentError(`${source}.${key} must be a ${type}`);
+  return value;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   LocalKeyProvider,
-  configFromEnvironment,
+  constructIdentityManager,
   createNodeIdentityManager,
   createNodeIdentityManagerFromDnsid,
+  createNodeIdentityManagerFromEnvironment,
+  createNodeIdentityManagerFromFile,
   createNodeIdentityVerifier,
-  dnsidEnvironmentVariables,
-  keyStorePathFromEnvironment,
-  registryClientOptionsFromEnvironment
+  createRegistryClientFromEnvironment,
+  loadCliDirectory,
+  loadEnvironment,
+  loadFile,
+  mergeLoadedConfig
 });