TypeScript: @dnsid-ai/sdk — interfaces

Part of Core SDK (@dnsid-ai/sdk).

Interfaces

AgentStatus

Defined in: packages/protocol/src/types.ts:44

Properties

lastTransitionAt

lastTransitionAt: Date;

Defined in: packages/protocol/src/types.ts:46

revocationReason?

optional revocationReason?: RevocationReason;

Defined in: packages/protocol/src/types.ts:47

state

state: AgentStatusState;

Defined in: packages/protocol/src/types.ts:45

---

C2spIssuanceEvent

Defined in: packages/protocol/src/log-events.ts:64

ISSUANCE shape required by the c2sp-tlog codec and verifier.

Extends

• IssuanceEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:30

Inherited from

IssuanceEvent.domain

entityKey?

optional entityKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:46

Accountable-entity record-signing key (ek) recorded in the event.

Inherited from

IssuanceEvent.entityKey

entitySig?

optional entitySig?: string;

Defined in: packages/protocol/src/log-events.ts:50

Entity-key signature over the canonical binding (base64url).

Inherited from

IssuanceEvent.entitySig

governanceId

governanceId: string;

Defined in: packages/protocol/src/log-events.ts:31

Inherited from

IssuanceEvent.governanceId

initialEntityAlg

initialEntityAlg: string;

Defined in: packages/protocol/src/log-events.ts:70

Overrides

IssuanceEvent.initialEntityAlg

initialEntityKid

initialEntityKid: string;

Defined in: packages/protocol/src/log-events.ts:69

c2sp-tlog encoding of the accountable entity key.

Overrides

IssuanceEvent.initialEntityKid

initialEntityPublicKey

initialEntityPublicKey: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:71

Overrides

IssuanceEvent.initialEntityPublicKey

initialEntityThumbprint

initialEntityThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:72

Overrides

IssuanceEvent.initialEntityThumbprint

initialOperationalAlg

initialOperationalAlg: string;

Defined in: packages/protocol/src/log-events.ts:66

Overrides

IssuanceEvent.initialOperationalAlg

initialOperationalKid

initialOperationalKid: string;

Defined in: packages/protocol/src/log-events.ts:65

c2sp-tlog encoding of the initial operational key.

Overrides

IssuanceEvent.initialOperationalKid

initialOperationalPublicKey

initialOperationalPublicKey: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:67

Overrides

IssuanceEvent.initialOperationalPublicKey

initialOperationalThumbprint

initialOperationalThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:68

Overrides

IssuanceEvent.initialOperationalThumbprint

kid?

optional kid?: string;

Defined in: packages/protocol/src/log-events.ts:56

Deprecated

superseded by operationalKey/entityKey.

Inherited from

IssuanceEvent.kid

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

IssuanceEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

IssuanceEvent.operationalCountersig

operationalKey?

optional operationalKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:48

Initial operational key (ku) recorded in the event.

Inherited from

IssuanceEvent.operationalKey

operationalSig?

optional operationalSig?: string;

Defined in: packages/protocol/src/log-events.ts:52

Operational-key countersignature over the same canonical binding (base64url).

Inherited from

IssuanceEvent.operationalSig

publicKey?

optional publicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:58

Deprecated

superseded by operationalKey/entityKey.

Inherited from

IssuanceEvent.publicKey

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

IssuanceEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

IssuanceEvent.signingKid

thumbprint?

optional thumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:60

Deprecated

superseded by the slot thumbprints.

Inherited from

IssuanceEvent.thumbprint

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:42

Inherited from

IssuanceEvent.timestamp

type

type: "ISSUANCE";

Defined in: packages/protocol/src/log-events.ts:29

Inherited from

IssuanceEvent.type

---

DelegationEvent

Defined in: packages/protocol/src/log-events.ts:111

Extends

• BaseLogEvent

Properties

delegatee

delegatee: string;

Defined in: packages/protocol/src/log-events.ts:114

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:113

expiry

expiry: Date;

Defined in: packages/protocol/src/log-events.ts:116

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

scope

scope: string;

Defined in: packages/protocol/src/log-events.ts:115

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:117

type

type: "DELEGATION";

Defined in: packages/protocol/src/log-events.ts:112

---

DnsidConfig

Defined in: packages/protocol/src/types.ts:125

Single core configuration entry point. Omit identity for a verification-only manager.

Properties

identity?

optional identity?: IdentityConfig;

Defined in: packages/protocol/src/types.ts:126

transport?

optional transport?: TransportConfig;

Defined in: packages/protocol/src/types.ts:128

verification?

optional verification?: VerificationConfig;

Defined in: packages/protocol/src/types.ts:127

---

DnsIdJWK

Defined in: packages/protocol/src/types.ts:30

Indexable

[key: string]: unknown

Properties

alg?

optional alg?: string;

Defined in: packages/protocol/src/types.ts:34

JOSE algorithm metadata. Required for draft-01 live ek/ku keys.

crv?

optional crv?: string;

Defined in: packages/protocol/src/types.ts:36

e?

optional e?: string;

Defined in: packages/protocol/src/types.ts:40

kid

kid: string;

Defined in: packages/protocol/src/types.ts:32

kty

kty: string;

Defined in: packages/protocol/src/types.ts:31

n?

optional n?: string;

Defined in: packages/protocol/src/types.ts:39

use?

optional use?: string;

Defined in: packages/protocol/src/types.ts:35

x?

optional x?: string;

Defined in: packages/protocol/src/types.ts:37

y?

optional y?: string;

Defined in: packages/protocol/src/types.ts:38

---

DNSResolver

Defined in: packages/protocol/src/dns-resolver.ts:7

Pluggable DNS resolver dependency. Decouples verifyDomain from the system resolver.

Methods

fetchTXT()

fetchTXT(name, options?): Promise<[TXTRecord[], DNSSECState]>;

Defined in: packages/protocol/src/dns-resolver.ts:14

Fetches TXT records for the given DNS owner name.

Parameters

name

string

Normalized FQDN without trailing dot (e.g. “_dnsid.agent.example”). MUST be treated as an absolute name — no search-domain expansion.

options?

signal?

AbortSignal

Returns

Promise<[TXTRecord[], DNSSECState]>

The record set and the DNSSEC validation state of the response.

---

FetchResult

Defined in: packages/protocol/src/identity-manager.ts:54

Properties

data

data: unknown;

Defined in: packages/protocol/src/identity-manager.ts:55

tlsCert

tlsCert: TLSCertificate;

Defined in: packages/protocol/src/identity-manager.ts:56

---

IdentityCache

Defined in: packages/protocol/src/identity-cache.ts:11

Cache for verified domain results. Held by IdentityManager and consulted at the start of every verifyDomain call.

Implementation requirements:

• Get MUST return null for any entry whose VerifiedDomain.expiry() has passed.
• Put MUST derive the entry TTL from result.expiry() and evict automatically when that time arrives.
• Implementations MUST be safe for concurrent use.

Methods

evict()

evict(domain): void;

Defined in: packages/protocol/src/identity-cache.ts:19

Removes a domain from the cache immediately.

Parameters

domain

string

Returns

void

get()

get(domain): VerifiedDomain | null;

Defined in: packages/protocol/src/identity-cache.ts:13

Returns the cached VerifiedDomain for a domain, or null if not cached or expired.

Parameters

domain

string

Returns

VerifiedDomain | null

put()

put(domain, result): void;

Defined in: packages/protocol/src/identity-cache.ts:16

Stores a verified domain result. Entry expires at result.expiry().

Parameters

domain

string

result

VerifiedDomain

Returns

void

---

IdentityConfig

Defined in: packages/protocol/src/types.ts:63

Local identity publication settings (DnsidConfig.identity). Contains no verification or transport policy.

Properties

capabilitiesUrl?

optional capabilitiesUrl?: string;

Defined in: packages/protocol/src/types.ts:83

HTTPS URL for the capabilities document (cu tag).

domain

domain: string;

Defined in: packages/protocol/src/types.ts:65

FQDN of the DNSid identity. Normalized with normalizeFQDN on construction.

ekUrl?

optional ekUrl?: string;

Defined in: packages/protocol/src/types.ts:77

HTTPS URL for the accountable-entity JWKS endpoint (ek tag). Required for draft-01 publishing.

governanceId

governanceId: string;

Defined in: packages/protocol/src/types.ts:67

Registrant domain (gi tag).

kuUrl?

optional kuUrl?: string;

Defined in: packages/protocol/src/types.ts:79

HTTPS URL for the identity’s operational/runtime JWKS endpoint (ku tag). Required for draft-01 publishing.

logRef

logRef: string;

Defined in: packages/protocol/src/types.ts:69

Log reference for the lr tag. Format: {method}:{entry-ref}.

maxKeyAge?

optional maxKeyAge?: MaxKeyAge;

Defined in: packages/protocol/src/types.ts:75

Maximum signing key age for the ka tag.

policyFlags?

optional policyFlags?: string;

Defined in: packages/protocol/src/types.ts:73

Comma-separated policy flags for the fl tag.

publishProfile?

optional publishProfile?: string;

Defined in: packages/protocol/src/types.ts:81

_dnsid behavior profile to emit. Defaults to dnsid-draft-01.

statusUrl

statusUrl: string;

Defined in: packages/protocol/src/types.ts:71

HTTPS URL for the lifecycle status endpoint (su tag).

---

IdentityManagerDependencies

Defined in: packages/protocol/src/identity-manager.ts:84

Runtime objects injected into IdentityManager. Configuration data lives in DnsidConfig.

Properties

cache?

optional cache?: IdentityCache;

Defined in: packages/protocol/src/identity-manager.ts:91

dnsResolver?

optional dnsResolver?: DNSResolver;

Defined in: packages/protocol/src/identity-manager.ts:90

entityKeyProvider?

optional entityKeyProvider?: KeyProvider;

Defined in: packages/protocol/src/identity-manager.ts:88

Accountable-entity key provider for _dnsid signing and lifecycle events. Rejected without config.identity.

fetchJson?

optional fetchJson?: JsonFetcher;

Defined in: packages/protocol/src/identity-manager.ts:92

keyProvider?

optional keyProvider?: KeyProvider;

Defined in: packages/protocol/src/identity-manager.ts:86

Local operational signer. Required with config.identity; rejected without it.

logRegistry?

optional logRegistry?: LogRegistry;

Defined in: packages/protocol/src/identity-manager.ts:89

---

IdentityResolver

Defined in: packages/protocol/src/identity-manager.ts:95

Extended by

• SigningIdentityManager

Methods

verifyDomain()

verifyDomain(
   domain,
   peerCert?,
   options?
): Promise<VerifiedDomain>;

Defined in: packages/protocol/src/identity-manager.ts:96

Parameters

domain

string

peerCert?

TLSCertificate

options?

VerificationOptions

Returns

Promise<VerifiedDomain>

---

IssuanceEvent

Defined in: packages/protocol/src/log-events.ts:28

Extends

• BaseLogEvent

Extended by

• C2spIssuanceEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:30

entityKey?

optional entityKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:46

Accountable-entity record-signing key (ek) recorded in the event.

entitySig?

optional entitySig?: string;

Defined in: packages/protocol/src/log-events.ts:50

Entity-key signature over the canonical binding (base64url).

governanceId

governanceId: string;

Defined in: packages/protocol/src/log-events.ts:31

initialEntityAlg?

optional initialEntityAlg?: string;

Defined in: packages/protocol/src/log-events.ts:39

initialEntityKid?

optional initialEntityKid?: string;

Defined in: packages/protocol/src/log-events.ts:38

c2sp-tlog encoding of the accountable entity key.

initialEntityPublicKey?

optional initialEntityPublicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:40

initialEntityThumbprint?

optional initialEntityThumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:41

initialOperationalAlg?

optional initialOperationalAlg?: string;

Defined in: packages/protocol/src/log-events.ts:34

initialOperationalKid?

optional initialOperationalKid?: string;

Defined in: packages/protocol/src/log-events.ts:33

c2sp-tlog encoding of the initial operational key.

initialOperationalPublicKey?

optional initialOperationalPublicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:35

initialOperationalThumbprint?

optional initialOperationalThumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:36

kid?

optional kid?: string;

Defined in: packages/protocol/src/log-events.ts:56

Deprecated

superseded by operationalKey/entityKey.

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

operationalKey?

optional operationalKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:48

Initial operational key (ku) recorded in the event.

operationalSig?

optional operationalSig?: string;

Defined in: packages/protocol/src/log-events.ts:52

Operational-key countersignature over the same canonical binding (base64url).

publicKey?

optional publicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:58

Deprecated

superseded by operationalKey/entityKey.

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

thumbprint?

optional thumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:60

Deprecated

superseded by the slot thumbprints.

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:42

type

type: "ISSUANCE";

Defined in: packages/protocol/src/log-events.ts:29

---

IssuanceKeySlot

Defined in: packages/protocol/src/log-events.ts:19

A key slot recorded in a draft-01 bilateral ISSUANCE event (ek or ku).

Properties

alg

alg: string;

Defined in: packages/protocol/src/log-events.ts:25

JWS alg the slot’s signature is produced/verified under.

jwk

jwk: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:20

kid?

optional kid?: string;

Defined in: packages/protocol/src/log-events.ts:23

thumbprint

thumbprint: string;

Defined in: packages/protocol/src/log-events.ts:22

RFC 7638 JWK thumbprint of jwk.

---

IssueManagedIdentityOptions

Defined in: packages/sdk/src/managed-issuance.ts:64

Extends

• ManagedIssuanceCoordination

Properties

activateAcceptedIssuance

activateAcceptedIssuance: (issuance) => Promise<void>;

Defined in: packages/sdk/src/managed-issuance.ts:61

Publishes/converges status only after exact-byte log acceptance is durably bound. Must be idempotent because a crash can replay it before activated is persisted.

Parameters

issuance

ManagedIssuanceState

Returns

Promise<void>

Inherited from

ManagedIssuanceCoordination.activateAcceptedIssuance

createIssuance

createIssuance: (intent) => Promise<ManagedIssuanceState | undefined>;

Defined in: packages/sdk/src/managed-issuance.ts:54

Atomically creates the intent; returns the existing operation if the create lost a race.

Parameters

intent

ManagedIssuanceState

Returns

Promise<ManagedIssuanceState | undefined>

Inherited from

ManagedIssuanceCoordination.createIssuance

domain

domain: string;

Defined in: packages/sdk/src/managed-issuance.ts:65

entityKey

entityKey: DnsIdJWK;

Defined in: packages/sdk/src/managed-issuance.ts:68

Trusted accountable-entity public key whose existing sigs.ae is required.

governanceId

governanceId: string;

Defined in: packages/sdk/src/managed-issuance.ts:66

idempotencyKey

idempotencyKey: string;

Defined in: packages/sdk/src/managed-issuance.ts:71

loadIssuance

loadIssuance: () => Promise<ManagedIssuanceState | undefined>;

Defined in: packages/sdk/src/managed-issuance.ts:52

Loads the one durable setup operation, if it exists.

Returns

Promise<ManagedIssuanceState | undefined>

Inherited from

ManagedIssuanceCoordination.loadIssuance

logReference?

optional logReference?: string;

Defined in: packages/sdk/src/managed-issuance.ts:73

Optional configured reference; a registry response must match it exactly.

operationalKeyProvider

operationalKeyProvider: KeyProvider;

Defined in: packages/sdk/src/managed-issuance.ts:69

persistIssuance

persistIssuance: (issuance) => Promise<void>;

Defined in: packages/sdk/src/managed-issuance.ts:56

Atomically persists the intent, exact bytes, and every reconciliation transition.

Parameters

issuance

ManagedIssuanceState

Returns

Promise<void>

Inherited from

ManagedIssuanceCoordination.persistIssuance

registryClient

registryClient: ManagedIssuanceRegistry;

Defined in: packages/sdk/src/managed-issuance.ts:70

---

JsonFetchOptions

Defined in: packages/protocol/src/identity-manager.ts:74

Properties

allowedHost?

optional allowedHost?: string;

Defined in: packages/protocol/src/identity-manager.ts:76

domainBoundary?

optional domainBoundary?: boolean;

Defined in: packages/protocol/src/identity-manager.ts:77

maxResponseBytes?

optional maxResponseBytes?: number;

Defined in: packages/protocol/src/identity-manager.ts:78

signal?

optional signal?: AbortSignal;

Defined in: packages/protocol/src/identity-manager.ts:75

---

KeyProvider

Defined in: packages/protocol/src/key-provider.ts:14

Standardized interface for Key Management Systems.

Implementations may wrap local key files, cloud KMS (AWS KMS, GCP Cloud KMS, Azure Key Vault), or HSMs. The SDK never handles private key material directly.

Key states:

• Pending: generated but not yet promoted (excluded from ListKeyIds / JWKS)
• Active: current signing key (in JWKS; used for signing)
• Retained: rotated out; kept for verification/audit (not used for new signing)

Methods

activate()

activate(kid): Promise<void>;

Defined in: packages/protocol/src/key-provider.ts:55

Promotes a pending key to active. The previously active key transitions to retained.

Parameters

kid

string

Returns

Promise<void>

generateKey()

generateKey(): Promise<string>;

Defined in: packages/protocol/src/key-provider.ts:50

Generates a new key pair in the pending state. Returns the new key’s kid.

Returns

Promise<string>

jwk()

jwk(kid): Promise<DnsIdJWK>;

Defined in: packages/protocol/src/key-provider.ts:27

Returns the JWK representation of a key by ID (active, pending, or retained). Raises if not found.

Parameters

kid

string

Returns

Promise<DnsIdJWK>

listKeyIds()

listKeyIds(): Promise<string[]>;

Defined in: packages/protocol/src/key-provider.ts:33

Returns the IDs of all active and retained keys (pending keys excluded). The active key ID MUST appear first; retained keys follow in any order.

Returns

Promise<string[]>

purge()?

optional purge(kid): Promise<void>;

Defined in: packages/protocol/src/key-provider.ts:63

Parameters

kid

string

Returns

Promise<void>

Deprecated

Use supersede().

sign()

sign(payload): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/key-provider.ts:39

Signs the given payload with the current active signing key. Returns raw signature bytes.

Parameters

payload

Uint8Array

Returns

Promise<Uint8Array<ArrayBufferLike>>

signingKey()

signingKey(): Promise<DnsIdJWK>;

Defined in: packages/protocol/src/key-provider.ts:21

Returns the JWK representation of the current active public signing key. The returned kid MUST NOT contain ’#’.

Returns

Promise<DnsIdJWK>

signKey()

signKey(kid, payload): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/key-provider.ts:42

Signs with a specified active or pending key.

Parameters

kid

string

payload

Uint8Array

Returns

Promise<Uint8Array<ArrayBufferLike>>

supersede()

supersede(kid): Promise<void>;

Defined in: packages/protocol/src/key-provider.ts:60

Supersedes and removes a retained key from this provider’s published key set.

Parameters

kid

string

Returns

Promise<void>

---

KeyRotationEvent

Defined in: packages/protocol/src/log-events.ts:75

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:77

newOperationalAlg

newOperationalAlg: string;

Defined in: packages/protocol/src/log-events.ts:81

newOperationalKid

newOperationalKid: string;

Defined in: packages/protocol/src/log-events.ts:80

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

newOperationalPublicKey

newOperationalPublicKey: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:83

newOperationalThumbprint

newOperationalThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:82

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

previousOperationalKid

previousOperationalKid: string;

Defined in: packages/protocol/src/log-events.ts:78

previousOperationalThumbprint

previousOperationalThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:79

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:84

type

type: "KEY_ROTATION";

Defined in: packages/protocol/src/log-events.ts:76

---

Log

Defined in: packages/protocol/src/log.ts:33

Write interface for the agent’s own immutable log. Implementations may wrap a blockchain, CT-style transparency log, SCITT service, or any append-only log.

Implementations may satisfy both Log and LogReader; C2SP uses a separate prepared-event append workflow instead of the generic writeEvent method.

Methods

canonical()

canonical(event): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/log.ts:39

Returns the canonical byte representation of the event for this log method. Called by IdentityManager.signAndWriteEvent to produce the bytes that are signed. MUST produce identical output to LogReader.canonical for the same event.

Parameters

event

LogEvent

Returns

Promise<Uint8Array<ArrayBufferLike>>

writeEvent()

writeEvent(event): Promise<string>;

Defined in: packages/protocol/src/log.ts:46

Appends a signed event to the log. The event MUST already carry the signatures required by its log method before writeEvent is called. Returns a LogRef identifying the recorded entry.

Parameters

event

LogEvent

Returns

Promise<string>

---

LoggedStateEvidence

Defined in: packages/protocol/src/log.ts:7

Verified proof boundary accepted for a complete lifecycle-state decision.

Properties

checkpoint

checkpoint: Uint8Array;

Defined in: packages/protocol/src/log.ts:21

Opaque accepted checkpoint or equivalent log-state evidence.

completenessMode

completenessMode: string;

Defined in: packages/protocol/src/log.ts:19

Binding-defined completeness mechanism.

completeThrough

completeThrough: string;

Defined in: packages/protocol/src/log.ts:17

Opaque method-specific position through which completeness was established.

freshnessTime

freshnessTime: Date;

Defined in: packages/protocol/src/log.ts:23

Independently verified freshness time.

historyEnd?

optional historyEnd?: string;

Defined in: packages/protocol/src/log.ts:15

Method-specific final applied event reference, when one exists.

historyStart

historyStart: string;

Defined in: packages/protocol/src/log.ts:13

Method-specific genesis reference included in the verified history.

loggedState

loggedState: AgentStatusState;

Defined in: packages/protocol/src/log.ts:11

Verified lifecycle state through historyEnd, not current protocol status.

logReference

logReference: string;

Defined in: packages/protocol/src/log.ts:9

Complete identity-instance log reference verified by the binding.

---

LogReader

Defined in: packages/protocol/src/log.ts:57

Read and verify interface for a specific log entry. Bound at construction to a full lr value (e.g. “algorand:AGENT_ADDR_BASE32”).

Evidence-returning methods MUST verify the applicable inclusion, timestamp, append-only consistency, and lifecycle signatures before returning success. canonical only serializes an event; it does not verify log evidence.

Methods

canonical()

canonical(event): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/log.ts:63

Returns the canonical byte representation of the event for this log method. Used to verify the signatures required by the log method on events read from the log. MUST produce identical output to Log.canonical for the same supported event.

Parameters

event

LogEvent

Returns

Promise<Uint8Array<ArrayBufferLike>>

keyTimestamp()

keyTimestamp(domain, keyThumbprint): Promise<Date>;

Defined in: packages/protocol/src/log.ts:69

Returns the timestamp at which the given key thumbprint was bound to the domain (ISSUANCE or KEY_ROTATION event). Used for ka validation.

Parameters

domain

string

keyThumbprint

string

Returns

Promise<Date>

readEvent()

readEvent(ref): Promise<LogEvent>;

Defined in: packages/protocol/src/log.ts:92

Reads a single event by its log reference. MUST verify inclusion proof and timestamp proof before returning.

Parameters

ref

string

Returns

Promise<LogEvent>

rebuildHistory()

rebuildHistory(domain): Promise<LogEvent[]>;

Defined in: packages/protocol/src/log.ts:102

Rebuilds the full event history for the domain in authoritative log order. MUST verify inclusion proofs, timestamp proofs, append-only consistency, and required lifecycle signatures on every returned event. Event signature verification MUST use the public keys valid for that event in the reconstructed lifecycle history. Events with invalid signatures MUST NOT be returned.

Parameters

domain

string

Returns

Promise<LogEvent[]>

verifyBilateralBinding()

verifyBilateralBinding(
   record,
   entityKey,
   operationalKey
): Promise<{
  initialEntityThumbprint: string;
  initialOperationalThumbprint: string;
  timestamp: Date;
}>;

Defined in: packages/protocol/src/log.ts:72

Verifies draft-01 bilateral ISSUANCE binding for the current TXT record.

Parameters

record

unknown

entityKey

unknown

operationalKey

unknown

Returns

Promise<{ initialEntityThumbprint: string; initialOperationalThumbprint: string; timestamp: Date; }>

verifyNonRevocation()

verifyNonRevocation(domain, at): Promise<LoggedStateEvidence>;

Defined in: packages/protocol/src/log.ts:86

Verifies that the domain is neither REVOKED nor RETIRED at the given timestamp. Raises on a terminal state or if complete, fresh evidence cannot be established. Returns the accepted proof boundary.

Parameters

domain

string

at

Date

Returns

Promise<LoggedStateEvidence>

verifyOperationalContinuity()

verifyOperationalContinuity(
   domain,
   initialOperationalThumbprint,
   currentOperationalThumbprint
): Promise<void>;

Defined in: packages/protocol/src/log.ts:79

Verifies KEY_ROTATION continuity from ISSUANCE to the current operational key.

Parameters

domain

string

initialOperationalThumbprint

string

currentOperationalThumbprint

string

Returns

Promise<void>

---

ManagedIssuanceCoordination

Defined in: packages/sdk/src/managed-issuance.ts:50

Extended by

• IssueManagedIdentityOptions
• ResumeManagedIssuanceOptions

Properties

activateAcceptedIssuance

activateAcceptedIssuance: (issuance) => Promise<void>;

Defined in: packages/sdk/src/managed-issuance.ts:61

Publishes/converges status only after exact-byte log acceptance is durably bound. Must be idempotent because a crash can replay it before activated is persisted.

Parameters

issuance

ManagedIssuanceState

Returns

Promise<void>

createIssuance

createIssuance: (intent) => Promise<ManagedIssuanceState | undefined>;

Defined in: packages/sdk/src/managed-issuance.ts:54

Atomically creates the intent; returns the existing operation if the create lost a race.

Parameters

intent

ManagedIssuanceState

Returns

Promise<ManagedIssuanceState | undefined>

loadIssuance

loadIssuance: () => Promise<ManagedIssuanceState | undefined>;

Defined in: packages/sdk/src/managed-issuance.ts:52

Loads the one durable setup operation, if it exists.

Returns

Promise<ManagedIssuanceState | undefined>

persistIssuance

persistIssuance: (issuance) => Promise<void>;

Defined in: packages/sdk/src/managed-issuance.ts:56

Atomically persists the intent, exact bytes, and every reconciliation transition.

Parameters

issuance

ManagedIssuanceState

Returns

Promise<void>

---

ManagedIssuanceRegistry

Defined in: packages/sdk/src/managed-issuance.ts:17

Methods

prepareIssuance()

prepareIssuance(domain, idempotencyKey): Promise<PreparedRegistryEvent>;

Defined in: packages/sdk/src/managed-issuance.ts:18

Parameters

domain

string

idempotencyKey

string

Returns

Promise<PreparedRegistryEvent>

submitPreparedEvent()

submitPreparedEvent(
   domain,
   entryBytes,
   idempotencyKey
): Promise<SubmissionResult>;

Defined in: packages/sdk/src/managed-issuance.ts:19

Parameters

domain

string

entryBytes

Uint8Array

idempotencyKey

string

Returns

Promise<SubmissionResult>

---

ManagedIssuanceState

Defined in: packages/sdk/src/managed-issuance.ts:22

Properties

activated

readonly activated: boolean;

Defined in: packages/sdk/src/managed-issuance.ts:41

domain

readonly domain: string;

Defined in: packages/sdk/src/managed-issuance.ts:23

entityKid

readonly entityKid: string;

Defined in: packages/sdk/src/managed-issuance.ts:26

entityThumbprint

readonly entityThumbprint: string;

Defined in: packages/sdk/src/managed-issuance.ts:27

entryBytes?

readonly optional entryBytes?: Uint8Array<ArrayBufferLike>;

Defined in: packages/sdk/src/managed-issuance.ts:33

Exact completed canonical bytes. Undefined only for an intent.

entryHash?

readonly optional entryHash?: string;

Defined in: packages/sdk/src/managed-issuance.ts:35

SHA-256 of entryBytes, persisted before the first submission.

governanceId

readonly governanceId: string;

Defined in: packages/sdk/src/managed-issuance.ts:24

idempotencyKey

readonly idempotencyKey: string;

Defined in: packages/sdk/src/managed-issuance.ts:25

logReference?

readonly optional logReference?: string;

Defined in: packages/sdk/src/managed-issuance.ts:31

Undefined only while the durable intent precedes remote preparation.

operationalKid

readonly operationalKid: string;

Defined in: packages/sdk/src/managed-issuance.ts:28

operationalThumbprint

readonly operationalThumbprint: string;

Defined in: packages/sdk/src/managed-issuance.ts:29

submission?

readonly optional submission?: ManagedIssuanceSubmission;

Defined in: packages/sdk/src/managed-issuance.ts:36

terminalFailure?

readonly optional terminalFailure?: object;

Defined in: packages/sdk/src/managed-issuance.ts:37

errorCode?

readonly optional errorCode?: string;

stage

readonly stage: "preparation" | "submission";

---

ManagedKeyRotationRegistry

Defined in: packages/sdk/src/managed-key-rotation.ts:20

Methods

prepareKeyRotation()

prepareKeyRotation(
   domain,
   request,
   idempotencyKey
): Promise<PreparedRegistryEvent>;

Defined in: packages/sdk/src/managed-key-rotation.ts:21

Parameters

domain

string

request

KeyRotationPreparationRequest

idempotencyKey

string

Returns

Promise<PreparedRegistryEvent>

submitPreparedEvent()

submitPreparedEvent(
   domain,
   entryBytes,
   idempotencyKey
): Promise<SubmissionResult>;

Defined in: packages/sdk/src/managed-key-rotation.ts:26

Parameters

domain

string

entryBytes

Uint8Array

idempotencyKey

string

Returns

Promise<SubmissionResult>

---

ManagedKeyRotationResult

Defined in: packages/sdk/src/managed-key-rotation.ts:46

Properties

activated

readonly activated: boolean;

Defined in: packages/sdk/src/managed-key-rotation.ts:58

applicationSigningPaused

readonly applicationSigningPaused: boolean;

Defined in: packages/sdk/src/managed-key-rotation.ts:59

domain

readonly domain: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:47

entryBytes

readonly entryBytes: Uint8Array;

Defined in: packages/sdk/src/managed-key-rotation.ts:55

Persist these exact bytes with idempotencyKey while activated is false. Callers must pause new application signing until this rotation is accepted.

idempotencyKey

readonly idempotencyKey: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:56

logReference

readonly logReference: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:48

newKid

readonly newKid: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:50

previousKid

readonly previousKid: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:49

submission?

readonly optional submission?: SubmissionResult;

Defined in: packages/sdk/src/managed-key-rotation.ts:57

---

MigrationEvent

Defined in: packages/protocol/src/log-events.ts:100

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:102

finalEntryRef

finalEntryRef: string;

Defined in: packages/protocol/src/log-events.ts:105

newLog

newLog: string;

Defined in: packages/protocol/src/log-events.ts:104

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

previousLog

previousLog: string;

Defined in: packages/protocol/src/log-events.ts:103

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:106

type

type: "MIGRATION";

Defined in: packages/protocol/src/log-events.ts:101

---

OperationalKeyRotationOptions

Defined in: packages/protocol/src/identity-manager.ts:59

Properties

publishKeySet

publishKeySet: (keySet) => Promise<void>;

Defined in: packages/protocol/src/identity-manager.ts:61

Publishes the pending operational JWKS at the configured ku endpoint before continuity is appended.

Parameters

keySet

JWKS

Returns

Promise<void>

timestamp?

optional timestamp?: Date;

Defined in: packages/protocol/src/identity-manager.ts:62

---

OperationalKeyRotationResult

Defined in: packages/protocol/src/identity-manager.ts:65

Properties

event

event: KeyRotationEvent;

Defined in: packages/protocol/src/identity-manager.ts:66

keySet

keySet: JWKS;

Defined in: packages/protocol/src/identity-manager.ts:68

logRef

logRef: string;

Defined in: packages/protocol/src/identity-manager.ts:67

---

ResumeManagedIssuanceOptions

Defined in: packages/sdk/src/managed-issuance.ts:76

Extends

• ManagedIssuanceCoordination

Properties

activateAcceptedIssuance

activateAcceptedIssuance: (issuance) => Promise<void>;

Defined in: packages/sdk/src/managed-issuance.ts:61

Publishes/converges status only after exact-byte log acceptance is durably bound. Must be idempotent because a crash can replay it before activated is persisted.

Parameters

issuance

ManagedIssuanceState

Returns

Promise<void>

Inherited from

ManagedIssuanceCoordination.activateAcceptedIssuance

createIssuance

createIssuance: (intent) => Promise<ManagedIssuanceState | undefined>;

Defined in: packages/sdk/src/managed-issuance.ts:54

Atomically creates the intent; returns the existing operation if the create lost a race.

Parameters

intent

ManagedIssuanceState

Returns

Promise<ManagedIssuanceState | undefined>

Inherited from

ManagedIssuanceCoordination.createIssuance

entityKey

entityKey: DnsIdJWK;

Defined in: packages/sdk/src/managed-issuance.ts:77

loadIssuance

loadIssuance: () => Promise<ManagedIssuanceState | undefined>;

Defined in: packages/sdk/src/managed-issuance.ts:52

Loads the one durable setup operation, if it exists.

Returns

Promise<ManagedIssuanceState | undefined>

Inherited from

ManagedIssuanceCoordination.loadIssuance

operationalKeyProvider

operationalKeyProvider: KeyProvider;

Defined in: packages/sdk/src/managed-issuance.ts:78

persistIssuance

persistIssuance: (issuance) => Promise<void>;

Defined in: packages/sdk/src/managed-issuance.ts:56

Atomically persists the intent, exact bytes, and every reconciliation transition.

Parameters

issuance

ManagedIssuanceState

Returns

Promise<void>

Inherited from

ManagedIssuanceCoordination.persistIssuance

registryClient

registryClient: ManagedIssuanceRegistry;

Defined in: packages/sdk/src/managed-issuance.ts:79

---

ResumeManagedOperationalKeyRotationOptions

Defined in: packages/sdk/src/managed-key-rotation.ts:62

Properties

keyProvider

keyProvider: KeyProvider;

Defined in: packages/sdk/src/managed-key-rotation.ts:63

persistRotation

persistRotation: (rotation) => Promise<void>;

Defined in: packages/sdk/src/managed-key-rotation.ts:66

Parameters

rotation

ManagedKeyRotationResult

Returns

Promise<void>

registryClient

registryClient: Pick<ManagedKeyRotationRegistry, "submitPreparedEvent">;

Defined in: packages/sdk/src/managed-key-rotation.ts:64

rotation

rotation: ManagedKeyRotationResult;

Defined in: packages/sdk/src/managed-key-rotation.ts:65

setApplicationSigningPaused

setApplicationSigningPaused: (paused) => Promise<void>;

Defined in: packages/sdk/src/managed-key-rotation.ts:67

Parameters

paused

boolean

Returns

Promise<void>

---

RetirementEvent

Defined in: packages/protocol/src/log-events.ts:94

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:96

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:97

type

type: "RETIREMENT";

Defined in: packages/protocol/src/log-events.ts:95

---

RetryBackoffOptions

Defined in: packages/protocol/src/retry.ts:3

Properties

initialDelayMs?

optional initialDelayMs?: number;

Defined in: packages/protocol/src/retry.ts:7

Delay before the first retry. Default: 100ms.

jitter?

optional jitter?: boolean;

Defined in: packages/protocol/src/retry.ts:13

Apply full jitter in the range [0, delay]. Default: true.

maxAttempts?

optional maxAttempts?: number;

Defined in: packages/protocol/src/retry.ts:5

Total attempts including the initial call. Default: 3.

maxDelayMs?

optional maxDelayMs?: number;

Defined in: packages/protocol/src/retry.ts:9

Maximum delay between attempts. Default: 2000ms.

multiplier?

optional multiplier?: number;

Defined in: packages/protocol/src/retry.ts:11

Exponential multiplier applied after each failed attempt. Default: 2.

shouldRetry?

optional shouldRetry?: (error, attempt) => boolean;

Defined in: packages/protocol/src/retry.ts:15

Optional policy override. Defaults to retrying transient VerificationError only.

Parameters

error

unknown

attempt

number

Returns

boolean

sleep?

optional sleep?: (ms) => Promise<void>;

Defined in: packages/protocol/src/retry.ts:17

Test hook for sleeping.

Parameters

ms

number

Returns

Promise<void>

---

RevocationEvent

Defined in: packages/protocol/src/log-events.ts:87

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:89

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

reason

reason:
  | "keyCompromise"
  | "policyViolation"
  | "superseded"
  | "cessationOfOperation";

Defined in: packages/protocol/src/log-events.ts:91

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:90

type

type: "REVOCATION";

Defined in: packages/protocol/src/log-events.ts:88

---

RotateManagedOperationalKeyOptions

Defined in: packages/sdk/src/managed-key-rotation.ts:33

Properties

domain

domain: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:34

idempotencyKey

idempotencyKey: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:39

keyProvider

keyProvider: KeyProvider;

Defined in: packages/sdk/src/managed-key-rotation.ts:37

logReference

logReference: string;

Defined in: packages/sdk/src/managed-key-rotation.ts:36

Exact unindexed c2sp-tlog reference configured for this identity.

persistRotation

persistRotation: (rotation) => Promise<void>;

Defined in: packages/sdk/src/managed-key-rotation.ts:41

Durably persists exact bytes and every subsequent reconciliation state.

Parameters

rotation

ManagedKeyRotationResult

Returns

Promise<void>

registryClient

registryClient: ManagedKeyRotationRegistry;

Defined in: packages/sdk/src/managed-key-rotation.ts:38

setApplicationSigningPaused

setApplicationSigningPaused: (paused) => Promise<void>;

Defined in: packages/sdk/src/managed-key-rotation.ts:43

Pauses application signing before submission and resumes it only after durable activation.

Parameters

paused

boolean

Returns

Promise<void>

---

SDKConformance

Defined in: packages/sdk/src/conformance.ts:9

Immutable protocol-facing conformance metadata for this SDK release.

Properties

knownDeviations

readonly knownDeviations: readonly string[];

Defined in: packages/sdk/src/conformance.ts:14

logBindings

readonly logBindings: Readonly<Record<string, string>>;

Defined in: packages/sdk/src/conformance.ts:13

publishProfile

readonly publishProfile: string;

Defined in: packages/sdk/src/conformance.ts:10

specificationStatus

readonly specificationStatus: "internet-draft" | "rfc";

Defined in: packages/sdk/src/conformance.ts:12

verificationProfiles

readonly verificationProfiles: Readonly<Record<string, string>>;

Defined in: packages/sdk/src/conformance.ts:11

---

SigningIdentityManager

Defined in: packages/protocol/src/identity-manager.ts:99

Extends

• IdentityResolver

Properties

config

config: object;

Defined in: packages/protocol/src/identity-manager.ts:100

identity?

optional identity?: object;

identity.domain

domain: string;

Methods

getKeyProvider()

getKeyProvider(): KeyProvider;

Defined in: packages/protocol/src/identity-manager.ts:101

Returns

KeyProvider

verifyDomain()

verifyDomain(
   domain,
   peerCert?,
   options?
): Promise<VerifiedDomain>;

Defined in: packages/protocol/src/identity-manager.ts:96

Parameters

domain

string

peerCert?

TLSCertificate

options?

VerificationOptions

Returns

Promise<VerifiedDomain>

Inherited from

IdentityResolver.verifyDomain

---

TLSCertificate

Defined in: packages/protocol/src/types.ts:50

Properties

notAfter

notAfter: Date;

Defined in: packages/protocol/src/types.ts:51

san

san: string[];

Defined in: packages/protocol/src/types.ts:52

---

TransportConfig

Defined in: packages/protocol/src/types.ts:105

SDK-managed DNS and HTTPS deployment settings (DnsidConfig.transport). Never alters protocol semantics.

Properties

caBundlePath?

optional caBundlePath?: string;

Defined in: packages/protocol/src/types.ts:109

Path to a PEM CA bundle appended to the system root certificates for TLS verification.

dnsServer?

optional dnsServer?: string;

Defined in: packages/protocol/src/types.ts:107

Custom DNS server (host, host:port, or [ipv6]:port). Omit to use the system resolver.

privateAddressHosts?

optional privateAddressHosts?: readonly string[];

Defined in: packages/protocol/src/types.ts:121

Hostnames, or leading-dot suffixes such as .test, whose SDK-managed HTTPS destinations may resolve to loopback or private-use addresses. An exact entry matches only that name; .test matches test and every name beneath it on a DNS-label boundary, case-insensitively and ignoring a trailing dot. Link-local, multicast, reserved, and mixed public/private resolutions stay rejected, IP-literal URLs are never exempted, and every redirect hop is matched independently. Nothing is allowed by default; there is no built-in .test exemption. Entries are validated at construction (IP literals, ports, schemes, paths, credentials → ArgumentError). Applies only to the default fetcher; rejected when fetchJson is injected. Not a DNSid protocol field.

---

TrustedEntity

Defined in: packages/protocol/src/types.ts:87

One counterparty allowlist entry. Exact gi match; optional pins on the current record-signing key.

Properties

entityKeyThumbprints?

optional entityKeyThumbprints?: string[];

Defined in: packages/protocol/src/types.ts:91

Unpadded base64url RFC 7638 SHA-256 thumbprints the current ek signing key must match. Non-empty when present.

governanceId

governanceId: string;

Defined in: packages/protocol/src/types.ts:89

Accountable-entity governance domain. Normalized with normalizeFQDN on construction.

---

TXTRecord

Defined in: packages/protocol/src/types.ts:57

Properties

strings

strings: string[];

Defined in: packages/protocol/src/types.ts:58

ttl

ttl: number;

Defined in: packages/protocol/src/types.ts:59

---

VerificationConfig

Defined in: packages/protocol/src/types.ts:95

Protocol verification and counterparty acceptance settings (DnsidConfig.verification).

Properties

dnssecMode?

optional dnssecMode?: DNSSECMode;

Defined in: packages/protocol/src/types.ts:99

DNSSEC enforcement mode. Default: ‘auto’.

statusCheckInterval?

optional statusCheckInterval?: number;

Defined in: packages/protocol/src/types.ts:97

Maximum age (seconds) of cached status before re-fetching su. Default: 0 (re-fetch every call).

trustedEntities?

optional trustedEntities?: TrustedEntity[];

Defined in: packages/protocol/src/types.ts:101

Counterparty allowlist. Absent: no acceptance decision. []: deny all.

---

VerificationOptions

Defined in: packages/protocol/src/verification-budget.ts:3

Extended by

• HttpVerificationOptions
• HttpVerificationOptions
• VerifyOIDCTokenOptions
• StreamVerifierOptions
• VerifyC2spStreamBundleOptions

Properties

signal?

optional signal?: AbortSignal;

Defined in: packages/protocol/src/verification-budget.ts:6

timeoutMs?

optional timeoutMs?: number;

Defined in: packages/protocol/src/verification-budget.ts:5

Overall invocation budget, including all discovery and evidence. Default: 30 seconds.