@dnsid-ai/sdk 0.21.0 → 0.23.0

package/dist/node.js

@@ -1,10 +1,3 @@
-// src/node.ts
-import * as fs3 from "fs/promises";
-import * as os2 from "os";
-import * as path2 from "path";
-import { IdentityManager, ArgumentError as ArgumentError2, normalizeFQDN as normalizeFQDN2, validateDnsidConfig } from "@dnsid-ai/protocol";
-import { DEFAULT_REGISTRY_URL as DEFAULT_REGISTRY_URL2 } from "@dnsid-ai/registry";
-
 // src/local-key-provider.ts
 import * as fs2 from "fs/promises";
 import * as os from "os";
@@ -59,9 +52,6 @@ var LocalKeyProvider = class _LocalKeyProvider {
     }
     return new _LocalKeyProvider(store, filePath);
   }
-  static async fromEnvironment(env, options = {}) {
-    return _LocalKeyProvider.load(keyStorePathFromEnvironment(env, options.defaultPath), options.createIfMissing, options.algorithm);
-  }
   static async generate(algorithm = "EdDSA") {
     return new _LocalKeyProvider(await buildInitialStore(algorithm), null);
   }
@@ -188,9 +178,6 @@ async function syncDirectory(dir) {
     await directory.close();
   }
 }
-function keyStorePathFromEnvironment(env = process.env, defaultPath = ".dnsid/keys.json") {
-  return env["DNSID_KEY_STORE"] || env["DNSID_KEY_STORE_PATH"] || env["DNSID_KEYSTORE_PATH"] || defaultPath;
-}
 function toPublicJwk(key) {
   const { d: _d, ...pub } = key;
   return pub;
@@ -263,215 +250,269 @@ async function importPrivateKey(key) {
   );
 }
 
-// src/environment.ts
-import { DNSSECMode } from "@dnsid-ai/protocol";
-import { DEFAULT_REGISTRY_URL } from "@dnsid-ai/registry";
-var dnsidEnvironmentVariables = {
-  domain: "DNSID_DOMAIN",
-  governanceId: "DNSID_GOVERNANCE_ID",
-  registryUrl: "DNSID_REGISTRY_URL",
-  apiKey: "DNSID_API_KEY",
-  statusUrl: "DNSID_STATUS_URL",
-  logRef: "DNSID_LOG_REF",
-  ekUrl: "DNSID_EK_URL",
-  kuUrl: "DNSID_KU_URL",
-  dnsServer: "DNSID_DNS_SERVER",
-  caBundlePath: "DNSID_CA_BUNDLE",
-  dnssecMode: "DNSID_DNSSEC_MODE",
-  publicUrl: "DNSID_PUBLIC_URL",
-  keyStorePath: "DNSID_KEY_STORE",
-  agentPort: "DNSID_AGENT_PORT",
-  agentName: "DNSID_AGENT_NAME"
-};
-var environmentSchema = {
-  domain: stringField(dnsidEnvironmentVariables.domain),
-  governanceId: stringField(dnsidEnvironmentVariables.governanceId),
-  registryUrl: stringField(dnsidEnvironmentVariables.registryUrl),
-  apiKey: stringField(dnsidEnvironmentVariables.apiKey),
-  statusUrl: stringField(dnsidEnvironmentVariables.statusUrl),
-  logRef: stringField(dnsidEnvironmentVariables.logRef),
-  ekUrl: stringField(dnsidEnvironmentVariables.ekUrl),
-  kuUrl: stringField(dnsidEnvironmentVariables.kuUrl),
-  dnsServer: stringField(dnsidEnvironmentVariables.dnsServer),
-  caBundlePath: stringField(dnsidEnvironmentVariables.caBundlePath),
-  dnssecMode: dnssecModeField(dnsidEnvironmentVariables.dnssecMode),
-  publicUrl: stringField(dnsidEnvironmentVariables.publicUrl),
-  keyStorePath: stringField(dnsidEnvironmentVariables.keyStorePath),
-  agentPort: positiveIntField(dnsidEnvironmentVariables.agentPort),
-  agentName: stringField(dnsidEnvironmentVariables.agentName)
-};
-function configFromEnvironment(envOrOptions = process.env, options = {}) {
-  const receivedOptions = isConfigFromEnvironmentOptions(envOrOptions);
-  const env = receivedOptions ? process.env : envOrOptions ?? process.env;
-  const resolvedOptions = receivedOptions ? envOrOptions : options;
-  const parsed = parseEnvironment(env);
-  requireFields(parsed, ["domain", "governanceId", ...resolvedOptions.require ?? []]);
-  const registryUrl = parsed.registryUrl ?? DEFAULT_REGISTRY_URL;
-  const statusUrl = parsed.statusUrl ?? protocolStatusUrl(registryUrl, parsed.domain);
-  const config = {
-    identity: defined({
-      domain: parsed.domain,
-      governanceId: parsed.governanceId,
-      logRef: parsed.logRef ?? "noop:0",
-      statusUrl,
-      ekUrl: parsed.ekUrl,
-      kuUrl: parsed.kuUrl
-    }),
-    verification: defined({ dnssecMode: parsed.dnssecMode }),
-    transport: defined({ dnsServer: parsed.dnsServer, caBundlePath: parsed.caBundlePath })
-  };
-  return {
-    config,
-    registryUrl,
-    apiKey: parsed.apiKey,
-    publicUrl: parsed.publicUrl,
-    keyStorePath: parsed.keyStorePath,
-    agentName: parsed.agentName,
-    agentPort: parsed.agentPort
-  };
-}
-function registryClientOptionsFromEnvironment(env = process.env) {
-  const parsed = parseEnvironment(env);
-  return defined({ baseUrl: parsed.registryUrl ?? DEFAULT_REGISTRY_URL, token: parsed.apiKey });
-}
-function defined(value) {
-  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
-}
-function isConfigFromEnvironmentOptions(value) {
-  if (value === void 0) return false;
-  const keys = Object.keys(value);
-  if (keys.length === 0) return true;
-  return keys.every((key) => key === "require") && Array.isArray(value.require);
-}
-function parseEnvironment(env) {
-  const parsed = {};
-  for (const fieldName of Object.keys(environmentSchema)) {
-    const value = readEnvironmentField(env, fieldName);
-    if (value !== void 0) parsed[fieldName] = value;
-  }
-  return parsed;
-}
-function readEnvironmentField(env, fieldName) {
-  const field = environmentSchema[fieldName];
-  const raw = env[field.variable];
-  if (raw === void 0 || raw === "") return void 0;
-  return field.parse(raw, field.variable);
-}
-function requireFields(parsed, fields) {
-  for (const field of fields) {
-    if (parsed[field] === void 0) throw new Error(`${environmentSchema[field].variable} is required`);
-  }
-}
-function stringField(variable) {
-  return { variable, parse: (value) => value };
-}
-function positiveIntField(variable) {
-  return {
-    variable,
-    parse(value, name) {
-      const parsed = Number(value);
-      if (!Number.isInteger(parsed) || parsed <= 0) {
-        throw new Error(`${name} must be a positive integer`);
-      }
-      return parsed;
-    }
-  };
-}
-function dnssecModeField(variable) {
-  return {
-    variable,
-    parse(value, name) {
-      if (!Object.values(DNSSECMode).includes(value)) {
-        throw new Error(`invalid ${name} "${value}"; expected one of: ${Object.values(DNSSECMode).join(", ")}`);
-      }
-      return value;
-    }
-  };
-}
-function protocolStatusUrl(registryUrl, domain) {
-  return `${registryUrl.replace(/\/$/, "")}/v1/status/${encodeURIComponent(domain)}`;
-}
-
-// src/node.ts
+// src/node-identity-manager.ts
+import { IdentityManager, ArgumentError as ArgumentError2, validateDnsidConfig } from "@dnsid-ai/protocol";
 async function createNodeIdentityManager(config, deps = {}) {
   const { transport, ...core } = validateDnsidConfig(config);
-  const { dnsServer, caBundlePath, allowedUnsafeHosts } = transport;
+  const { dnsServer, caBundlePath, privateAddressHosts } = transport;
   if (dnsServer !== void 0 && deps.dnsResolver && deps.fetchJson) {
     throw new ArgumentError2("config.transport.dnsServer has no SDK-managed consumer when both dnsResolver and fetchJson are injected");
   }
   if (caBundlePath !== void 0 && deps.fetchJson) {
     throw new ArgumentError2("config.transport.caBundlePath has no SDK-managed consumer when fetchJson is injected");
   }
-  if (allowedUnsafeHosts !== void 0 && deps.fetchJson) {
-    throw new ArgumentError2("config.transport.allowedUnsafeHosts has no SDK-managed consumer when fetchJson is injected");
+  if (privateAddressHosts !== void 0 && deps.fetchJson) {
+    throw new ArgumentError2("config.transport.privateAddressHosts has no SDK-managed consumer when fetchJson is injected");
   }
   const transportModule = deps.fetchJson && deps.dnsResolver ? null : await loadNodeTransport();
-  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, allowedUnsafeHosts }));
+  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, privateAddressHosts }));
   const dnsResolver = deps.dnsResolver ?? transportModule.createDefaultDnsResolver({ dnsServer });
   return new IdentityManager(core, { ...deps, dnsResolver, fetchJson });
 }
 async function createNodeIdentityVerifier(config = {}, deps = {}) {
   return createNodeIdentityManager(config, deps);
 }
-async function createNodeIdentityManagerFromDnsid(options = {}, deps = {}) {
-  const dnsidDir = options.dnsidDir ?? options.env?.["DNSID_CONFIG_DIR"] ?? process.env["DNSID_CONFIG_DIR"] ?? path2.join(os2.homedir(), ".dnsid");
+async function loadNodeTransport() {
+  try {
+    return await import("@dnsid-ai/transport");
+  } catch (e) {
+    const err = e;
+    if (err.code === "ERR_MODULE_NOT_FOUND" || err.code === "MODULE_NOT_FOUND") {
+      throw new Error("`@dnsid-ai/sdk/node` HTTPS defaults require optional peer `@dnsid-ai/transport`; install it or inject fetchJson.");
+    }
+    throw e;
+  }
+}
+
+// src/config-loading.ts
+import * as fs3 from "fs/promises";
+import * as os2 from "os";
+import * as path2 from "path";
+import {
+  ArgumentError as ArgumentError3,
+  DNSSECMode,
+  normalizeFQDN as normalizeFQDN2,
+  parseJsonNoDuplicateMembers,
+  validateDnsidConfig as validateDnsidConfig2
+} from "@dnsid-ai/protocol";
+import {
+  createC2spTlogVerificationRegistry,
+  createDnsidManagedVerificationRegistry,
+  parseC2spTlogTrustProfile
+} from "@dnsid-ai/log-c2sp-tlog";
+import { RegistryClient } from "@dnsid-ai/registry";
+var IDENTITY_VARIABLES = {
+  DNSID_DOMAIN: "domain",
+  DNSID_GOVERNANCE_ID: "governanceId",
+  DNSID_STATUS_URL: "statusUrl",
+  DNSID_LOG_REF: "logRef",
+  DNSID_EK_URL: "ekUrl",
+  DNSID_KU_URL: "kuUrl",
+  DNSID_PUBLISH_PROFILE: "publishProfile",
+  DNSID_CAPABILITIES_URL: "capabilitiesUrl"
+};
+async function loadEnvironment(env = process.env) {
+  const get = (name) => {
+    const value = env[name]?.trim();
+    return value ? value : void 0;
+  };
+  const identity = compact(Object.fromEntries(
+    Object.entries(IDENTITY_VARIABLES).map(([variable, field]) => [field, get(variable)])
+  ));
+  const dnssecMode = get("DNSID_DNSSEC_MODE");
+  if (dnssecMode !== void 0 && !Object.values(DNSSECMode).includes(dnssecMode)) {
+    throw new ArgumentError3(`invalid DNSID_DNSSEC_MODE "${dnssecMode}"; expected one of: ${Object.values(DNSSECMode).join(", ")}`);
+  }
+  const hosts = get("DNSID_PRIVATE_HOSTS")?.split(",").map((h) => h.trim()).filter(Boolean);
+  const dnsid = compact({
+    identity,
+    verification: compact({ dnssecMode }),
+    transport: compact({
+      dnsServer: get("DNSID_DNS_SERVER"),
+      caBundlePath: get("DNSID_CA_BUNDLE"),
+      privateAddressHosts: hosts?.length ? hosts : void 0
+    })
+  });
+  const policyFile = get("DNSID_LOG_POLICY_FILE");
+  const profileFile = get("DNSID_LOG_TRUST_PROFILE_FILE");
+  const logTrust = compact({
+    policyUrl: get("DNSID_LOG_POLICY_URL"),
+    policyDocument: policyFile === void 0 ? void 0 : new Uint8Array(await fs3.readFile(policyFile)),
+    profile: profileFile === void 0 ? void 0 : jsonObject(await fs3.readFile(profileFile), profileFile)
+  });
+  return top({
+    dnsid,
+    logTrust,
+    registry: compact({ registryUrl: get("DNSID_REGISTRY_URL") }),
+    keySource: compact({ cliDirectory: get("DNSID_CONFIG_DIR"), keyStorePath: get("DNSID_KEY_STORE") })
+  });
+}
+async function loadFile(filePath) {
+  const root = jsonObject(await fs3.readFile(filePath), filePath);
+  rejectUnknown(root, filePath, ["dnsid", "logTrust", "registry"]);
+  const loaded = {};
+  if (root.dnsid !== void 0) loaded.dnsid = loadedDnsid(root.dnsid, `${filePath}: dnsid`);
+  if (root.logTrust !== void 0) {
+    const trust = object(root.logTrust, `${filePath}: logTrust`);
+    rejectUnknown(trust, `${filePath}: logTrust`, ["managed", "profile", "policyUrl"]);
+    loaded.logTrust = compact({
+      managed: optional(trust, "managed", "boolean", `${filePath}: logTrust`),
+      profile: trust.profile === void 0 ? void 0 : object(trust.profile, `${filePath}: logTrust.profile`),
+      policyUrl: optional(trust, "policyUrl", "string", `${filePath}: logTrust`)
+    });
+  }
+  if (root.registry !== void 0) {
+    const registry = object(root.registry, `${filePath}: registry`);
+    rejectUnknown(registry, `${filePath}: registry`, ["registryUrl"]);
+    loaded.registry = compact({ registryUrl: optional(registry, "registryUrl", "string", `${filePath}: registry`) });
+  }
+  return loaded;
+}
+function loadedDnsid(value, source) {
+  const raw = object(value, source);
+  rejectUnknown(raw, source, ["identity", "verification", "transport"]);
+  if (raw.identity !== void 0) {
+    const identity = object(raw.identity, `${source}.identity`);
+    const keys = ["domain", "governanceId", "logRef", "statusUrl", "policyFlags", "maxKeyAge", "ekUrl", "kuUrl", "publishProfile", "capabilitiesUrl"];
+    rejectUnknown(identity, `${source}.identity`, keys);
+    for (const key of keys) optional(identity, key, "string", `${source}.identity`);
+  }
+  if (raw.verification !== void 0) {
+    const verification = object(raw.verification, `${source}.verification`);
+    rejectUnknown(verification, `${source}.verification`, ["statusCheckInterval", "dnssecMode", "trustedEntities"]);
+    if (verification.statusCheckInterval !== void 0 && (typeof verification.statusCheckInterval !== "number" || !Number.isFinite(verification.statusCheckInterval))) {
+      throw new ArgumentError3(`${source}.verification.statusCheckInterval must be a finite number`);
+    }
+    const mode = optional(verification, "dnssecMode", "string", `${source}.verification`);
+    if (mode !== void 0 && !Object.values(DNSSECMode).includes(mode)) {
+      throw new ArgumentError3(`${source}.verification.dnssecMode is invalid`);
+    }
+    if (verification.trustedEntities !== void 0) {
+      if (!Array.isArray(verification.trustedEntities)) throw new ArgumentError3(`${source}.verification.trustedEntities must be an array`);
+      for (const [index, entry] of verification.trustedEntities.entries()) {
+        const label = `${source}.verification.trustedEntities[${index}]`;
+        const entity = object(entry, label);
+        rejectUnknown(entity, label, ["governanceId", "entityKeyThumbprints"]);
+        if (typeof entity.governanceId !== "string") throw new ArgumentError3(`${label}.governanceId must be a string`);
+        if (entity.entityKeyThumbprints !== void 0 && (!Array.isArray(entity.entityKeyThumbprints) || entity.entityKeyThumbprints.some((pin) => typeof pin !== "string"))) {
+          throw new ArgumentError3(`${label}.entityKeyThumbprints must be an array of strings`);
+        }
+      }
+    }
+  }
+  if (raw.transport !== void 0) {
+    const transport = object(raw.transport, `${source}.transport`);
+    rejectUnknown(transport, `${source}.transport`, ["dnsServer", "caBundlePath", "privateAddressHosts"]);
+    for (const key of ["dnsServer", "caBundlePath"]) optional(transport, key, "string", `${source}.transport`);
+    if (transport.privateAddressHosts !== void 0 && (!Array.isArray(transport.privateAddressHosts) || transport.privateAddressHosts.some((host) => typeof host !== "string"))) {
+      throw new ArgumentError3(`${source}.transport.privateAddressHosts must be an array of strings`);
+    }
+  }
+  return raw;
+}
+var CLI_IDENTITY_FIELDS = {
+  domain: "domain",
+  governance_id: "governanceId",
+  status_url: "statusUrl",
+  log_ref: "logRef",
+  ek_url: "ekUrl",
+  ku_url: "kuUrl",
+  capabilities_url: "capabilitiesUrl",
+  publish_profile: "publishProfile",
+  max_key_age: "maxKeyAge"
+};
+async function loadCliDirectory(dnsidDir = path2.join(os2.homedir(), ".dnsid")) {
   let configPath = path2.join(dnsidDir, "config.json");
-  let raw = await readConfig(configPath);
-  const pointerDomain = stringField2(raw, "domain", "fqdn");
-  if (pointerDomain) {
-    const identityConfigPath = path2.join(dnsidDir, normalizeFQDN2(pointerDomain, true), "config.json");
+  let raw;
+  try {
+    raw = jsonObject(await fs3.readFile(configPath), configPath);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+    throw new Error(`${configPath} not found; run the DNSid CLI to register your domain first`);
+  }
+  if (typeof raw.domain === "string" && raw.domain !== "") {
+    const identityConfigPath = path2.join(dnsidDir, normalizeFQDN2(raw.domain, true), "config.json");
     try {
-      raw = await readJson(identityConfigPath);
+      raw = jsonObject(await fs3.readFile(identityConfigPath), identityConfigPath);
       configPath = identityConfigPath;
     } catch (e) {
       if (e.code !== "ENOENT") throw e;
     }
   }
-  const field = (...keys) => stringField2(raw, ...keys);
-  const loaded = {
-    domain: field("domain", "fqdn"),
-    governanceId: field("governanceId", "governance_id"),
-    logRef: field("logRef", "log_ref"),
-    statusUrl: field("statusUrl", "status_url"),
-    ekUrl: field("ekUrl", "ek_url"),
-    kuUrl: field("kuUrl", "ku_url"),
-    capabilitiesUrl: field("capabilitiesUrl", "capabilities_url"),
-    publishProfile: field("publishProfile", "publish_profile"),
-    maxKeyAge: maxKeyAgeValue(raw.maxKeyAge ?? raw.max_key_age, configPath)
-  };
-  const identity = { ...definedOnly(loaded), ...definedOnly(options.config?.identity ?? {}) };
-  if (!identity.domain) throw new Error(`${configPath} must include domain`);
-  if (!identity.governanceId) throw new Error(`${configPath} must include governanceId or governance_id`);
-  identity.logRef ??= "noop:0";
-  identity.statusUrl ??= protocolStatusUrl2(field("registryUrl", "registry_url", "server_url") ?? DEFAULT_REGISTRY_URL2, identity.domain);
-  const keyProvider = deps.keyProvider ?? await LocalKeyProvider.fromDirectory(await identityKeyDir(dnsidDir, identity.domain));
-  const entityKeyProvider = deps.entityKeyProvider ?? await optionalEntityKeyProvider(
-    path2.dirname(configPath),
-    field("entityKeyPath", "entity_key_path"),
-    field("entityKeyDir", "entity_key_dir")
-  );
-  return createNodeIdentityManager(
-    { identity, verification: options.config?.verification, transport: options.config?.transport },
-    { ...deps, keyProvider, entityKeyProvider }
-  );
+  const str = (key) => optional(raw, key, "string", configPath) || void 0;
+  const identity = compact(Object.fromEntries(
+    Object.entries(CLI_IDENTITY_FIELDS).map(([key, field]) => [field, str(key)])
+  ));
+  const entityKeyPath = str("entity_key_path");
+  return top({
+    dnsid: compact({ identity }),
+    keySource: compact({
+      cliDirectory: dnsidDir,
+      entityKeyPath: entityKeyPath === void 0 ? void 0 : path2.resolve(path2.dirname(configPath), entityKeyPath)
+    })
+  });
 }
-function definedOnly(value) {
-  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+function mergeLoadedConfig(base, overlay) {
+  return top({
+    dnsid: mergeDnsid(base.dnsid, overlay.dnsid),
+    logTrust: overlay.logTrust ?? base.logTrust,
+    registry: mergeSection(base.registry, overlay.registry),
+    keySource: mergeSection(base.keySource, overlay.keySource)
+  });
+}
+function mergeDnsid(base, overlay) {
+  if (!base || !overlay) return overlay ?? base;
+  return compact({
+    identity: mergeSection(base.identity, overlay.identity),
+    verification: mergeSection(base.verification, overlay.verification),
+    transport: mergeSection(base.transport, overlay.transport)
+  });
 }
-async function readConfig(configPath) {
-  return readJson(configPath).catch((e) => {
-    if (e.code === "ENOENT") {
-      throw new Error(`${configPath} not found; run the DNSid CLI to register your domain first`);
+function mergeSection(base, overlay) {
+  if (!base || !overlay) return overlay ?? base;
+  return { ...base, ...definedEntries(overlay) };
+}
+var MANAGED_DEFAULTS_MS = 10 * 60 * 1e3;
+async function constructIdentityManager(loaded, deps = {}) {
+  validateDnsidConfig2(loaded.dnsid ?? {});
+  const filled = { ...deps };
+  if (!filled.logRegistry && loaded.logTrust) {
+    filled.logRegistry = await logRegistryFromTrust(loaded.logTrust, loaded.dnsid?.transport);
+  }
+  const identity = loaded.dnsid?.identity;
+  if (identity && loaded.keySource) {
+    if (!filled.keyProvider) filled.keyProvider = await operationalKeyProvider(loaded.keySource, identity.domain);
+    if (!filled.entityKeyProvider && loaded.keySource.entityKeyPath !== void 0) {
+      filled.entityKeyProvider = await LocalKeyProvider.fromFile(loaded.keySource.entityKeyPath);
     }
-    throw e;
+  }
+  return createNodeIdentityManager(loaded.dnsid ?? {}, filled);
+}
+async function logRegistryFromTrust(trust, transport) {
+  const variants = ["managed", "profile", "policyDocument", "policyUrl"].filter((k) => trust[k] !== void 0);
+  if (variants.length !== 1) {
+    throw new ArgumentError3(`logTrust requires exactly one of managed, profile, policyDocument, policyUrl; got ${variants.length}`);
+  }
+  if (trust.managed !== void 0) {
+    if (trust.managed !== true) throw new ArgumentError3("logTrust.managed must be true when present");
+    return createDnsidManagedVerificationRegistry();
+  }
+  return createC2spTlogVerificationRegistry({
+    trustProfile: trust.profile && parseC2spTlogTrustProfile(new TextEncoder().encode(JSON.stringify(trust.profile))),
+    policyDocument: trust.policyDocument,
+    policyUrl: trust.policyUrl,
+    transport,
+    checkpointMaxAge: MANAGED_DEFAULTS_MS,
+    maxBundleLifetimeMs: trust.profile ? MANAGED_DEFAULTS_MS : void 0,
+    allowedClockSkew: 0
   });
 }
-async function optionalEntityKeyProvider(root, file, legacyDir) {
-  if (file) {
-    return LocalKeyProvider.fromFile(path2.isAbsolute(file) ? file : path2.resolve(root, file));
+async function operationalKeyProvider(source, domain) {
+  if (source.cliDirectory !== void 0) {
+    return LocalKeyProvider.fromDirectory(await identityKeyDir(source.cliDirectory, domain));
   }
-  if (!legacyDir) return void 0;
-  return LocalKeyProvider.fromDirectory(path2.isAbsolute(legacyDir) ? legacyDir : path2.resolve(root, legacyDir));
+  if (source.keyStorePath !== void 0) return LocalKeyProvider.load(source.keyStorePath);
+  return void 0;
 }
 async function identityKeyDir(dnsidDir, domain) {
   for (const filename of ["private.jwk", "private.pem"]) {
@@ -484,35 +525,65 @@ async function identityKeyDir(dnsidDir, domain) {
   }
   return path2.join(dnsidDir, normalizeFQDN2(domain, true));
 }
-function stringField2(raw, ...keys) {
-  return keys.map((key) => raw[key]).find((value) => typeof value === "string" && value !== "");
+function createNodeIdentityManagerFromEnvironment(env, overlay, deps) {
+  return loadEnvironment(env).then((loaded) => constructIdentityManager(mergeLoadedConfig(loaded, top({ dnsid: overlay })), deps));
 }
-function maxKeyAgeValue(value, configPath) {
-  if (value == null || value === "") return void 0;
-  if (["24h", "7d", "30d", "90d"].includes(String(value))) return value;
-  throw new Error(`${configPath} has invalid maxKeyAge "${String(value)}"`);
+function createNodeIdentityManagerFromDnsid(dnsidDir, overlay, deps) {
+  return loadCliDirectory(dnsidDir).then((loaded) => constructIdentityManager(mergeLoadedConfig(loaded, top({ dnsid: overlay })), deps));
 }
-function protocolStatusUrl2(registryUrl, domain) {
-  return `${registryUrl.replace(/\/$/, "")}/v1/status/${encodeURIComponent(normalizeFQDN2(domain, true))}`;
+function createNodeIdentityManagerFromFile(filePath, overlay, deps) {
+  return loadFile(filePath).then((loaded) => constructIdentityManager(mergeLoadedConfig(loaded, top({ dnsid: overlay })), deps));
 }
-async function loadNodeTransport() {
+async function createRegistryClientFromEnvironment(env) {
+  const source = env ?? process.env;
+  const loaded = await loadEnvironment(source);
+  return new RegistryClient(compact({ baseUrl: loaded.registry?.registryUrl, token: source.DNSID_API_KEY?.trim() || void 0 }));
+}
+function definedEntries(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+function top(value) {
+  return definedEntries(value);
+}
+function compact(value) {
+  const defined = definedEntries(value);
+  return Object.keys(defined).length > 0 ? defined : void 0;
+}
+function jsonObject(bytes, source) {
+  let value;
   try {
-    return await import("@dnsid-ai/transport");
+    value = parseJsonNoDuplicateMembers(bytes);
   } catch (e) {
-    const err = e;
-    if (err.code === "ERR_MODULE_NOT_FOUND" || err.code === "MODULE_NOT_FOUND") {
-      throw new Error("`@dnsid-ai/sdk/node` HTTPS defaults require optional peer `@dnsid-ai/transport`; install it or inject fetchJson.");
-    }
-    throw e;
+    throw new ArgumentError3(`${source}: ${e.message}`);
   }
+  return object(value, source);
+}
+function object(value, source) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new ArgumentError3(`${source} must be a JSON object`);
+  return value;
+}
+function rejectUnknown(raw, source, allowed) {
+  for (const key of Object.keys(raw)) {
+    if (!allowed.includes(key)) throw new ArgumentError3(`${source} has unknown member "${key}"`);
+  }
+}
+function optional(raw, key, type, source) {
+  const value = raw[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== type) throw new ArgumentError3(`${source}.${key} must be a ${type}`);
+  return value;
 }
 export {
   LocalKeyProvider,
-  configFromEnvironment,
+  constructIdentityManager,
   createNodeIdentityManager,
   createNodeIdentityManagerFromDnsid,
+  createNodeIdentityManagerFromEnvironment,
+  createNodeIdentityManagerFromFile,
   createNodeIdentityVerifier,
-  dnsidEnvironmentVariables,
-  keyStorePathFromEnvironment,
-  registryClientOptionsFromEnvironment
+  createRegistryClientFromEnvironment,
+  loadCliDirectory,
+  loadEnvironment,
+  loadFile,
+  mergeLoadedConfig
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dnsid-ai/sdk",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Runtime-neutral DNSid SDK entrypoint with optional Node.js convenience helpers.",
   "type": "module",
   "types": "./dist/index.d.ts",
@@ -39,15 +39,15 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@dnsid-ai/protocol": "^0.21.0",
-    "@dnsid-ai/http-signatures": "^0.21.0",
-    "@dnsid-ai/jose": "^0.21.0",
-    "@dnsid-ai/log-c2sp-tlog": "^0.21.0",
-    "@dnsid-ai/registry": "^0.21.0",
-    "@dnsid-ai/web-bot-auth": "^0.21.0"
+    "@dnsid-ai/protocol": "^0.23.0",
+    "@dnsid-ai/http-signatures": "^0.23.0",
+    "@dnsid-ai/jose": "^0.23.0",
+    "@dnsid-ai/log-c2sp-tlog": "^0.23.0",
+    "@dnsid-ai/registry": "^0.23.0",
+    "@dnsid-ai/web-bot-auth": "^0.23.0"
   },
   "peerDependencies": {
-    "@dnsid-ai/transport": "^0.21.0"
+    "@dnsid-ai/transport": "^0.23.0"
   },
   "peerDependenciesMeta": {
     "@dnsid-ai/transport": {