TypeScript: @dnsid-ai/protocol — interfaces

Part of Protocol core (@dnsid-ai/protocol).

Interfaces

AgentStatus

Defined in: packages/protocol/src/types.ts:44

Properties

lastTransitionAt

lastTransitionAt: Date;

Defined in: packages/protocol/src/types.ts:46

revocationReason?

optional revocationReason?: RevocationReason;

Defined in: packages/protocol/src/types.ts:47

state

state: AgentStatusState;

Defined in: packages/protocol/src/types.ts:45

---

C2spIssuanceEvent

Defined in: packages/protocol/src/log-events.ts:64

ISSUANCE shape required by the c2sp-tlog codec and verifier.

Extends

• IssuanceEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:30

Inherited from

IssuanceEvent.domain

entityKey?

optional entityKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:46

Accountable-entity record-signing key (ek) recorded in the event.

Inherited from

IssuanceEvent.entityKey

entitySig?

optional entitySig?: string;

Defined in: packages/protocol/src/log-events.ts:50

Entity-key signature over the canonical binding (base64url).

Inherited from

IssuanceEvent.entitySig

governanceId

governanceId: string;

Defined in: packages/protocol/src/log-events.ts:31

Inherited from

IssuanceEvent.governanceId

initialEntityAlg

initialEntityAlg: string;

Defined in: packages/protocol/src/log-events.ts:70

Overrides

IssuanceEvent.initialEntityAlg

initialEntityKid

initialEntityKid: string;

Defined in: packages/protocol/src/log-events.ts:69

c2sp-tlog encoding of the accountable entity key.

Overrides

IssuanceEvent.initialEntityKid

initialEntityPublicKey

initialEntityPublicKey: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:71

Overrides

IssuanceEvent.initialEntityPublicKey

initialEntityThumbprint

initialEntityThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:72

Overrides

IssuanceEvent.initialEntityThumbprint

initialOperationalAlg

initialOperationalAlg: string;

Defined in: packages/protocol/src/log-events.ts:66

Overrides

IssuanceEvent.initialOperationalAlg

initialOperationalKid

initialOperationalKid: string;

Defined in: packages/protocol/src/log-events.ts:65

c2sp-tlog encoding of the initial operational key.

Overrides

IssuanceEvent.initialOperationalKid

initialOperationalPublicKey

initialOperationalPublicKey: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:67

Overrides

IssuanceEvent.initialOperationalPublicKey

initialOperationalThumbprint

initialOperationalThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:68

Overrides

IssuanceEvent.initialOperationalThumbprint

kid?

optional kid?: string;

Defined in: packages/protocol/src/log-events.ts:56

Deprecated

superseded by operationalKey/entityKey.

Inherited from

IssuanceEvent.kid

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

IssuanceEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

IssuanceEvent.operationalCountersig

operationalKey?

optional operationalKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:48

Initial operational key (ku) recorded in the event.

Inherited from

IssuanceEvent.operationalKey

operationalSig?

optional operationalSig?: string;

Defined in: packages/protocol/src/log-events.ts:52

Operational-key countersignature over the same canonical binding (base64url).

Inherited from

IssuanceEvent.operationalSig

publicKey?

optional publicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:58

Deprecated

superseded by operationalKey/entityKey.

Inherited from

IssuanceEvent.publicKey

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

IssuanceEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

IssuanceEvent.signingKid

thumbprint?

optional thumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:60

Deprecated

superseded by the slot thumbprints.

Inherited from

IssuanceEvent.thumbprint

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:42

Inherited from

IssuanceEvent.timestamp

type

type: "ISSUANCE";

Defined in: packages/protocol/src/log-events.ts:29

Inherited from

IssuanceEvent.type

---

DelegationEvent

Defined in: packages/protocol/src/log-events.ts:111

Extends

• BaseLogEvent

Properties

delegatee

delegatee: string;

Defined in: packages/protocol/src/log-events.ts:114

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:113

expiry

expiry: Date;

Defined in: packages/protocol/src/log-events.ts:116

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

scope

scope: string;

Defined in: packages/protocol/src/log-events.ts:115

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:117

type

type: "DELEGATION";

Defined in: packages/protocol/src/log-events.ts:112

---

DnsidConfig

Defined in: packages/protocol/src/types.ts:125

Single core configuration entry point. Omit identity for a verification-only manager.

Properties

identity?

optional identity?: IdentityConfig;

Defined in: packages/protocol/src/types.ts:126

transport?

optional transport?: TransportConfig;

Defined in: packages/protocol/src/types.ts:128

verification?

optional verification?: VerificationConfig;

Defined in: packages/protocol/src/types.ts:127

---

DnsIdJWK

Defined in: packages/protocol/src/types.ts:30

Indexable

[key: string]: unknown

Properties

alg?

optional alg?: string;

Defined in: packages/protocol/src/types.ts:34

JOSE algorithm metadata. Required for draft-01 live ek/ku keys.

crv?

optional crv?: string;

Defined in: packages/protocol/src/types.ts:36

e?

optional e?: string;

Defined in: packages/protocol/src/types.ts:40

kid

kid: string;

Defined in: packages/protocol/src/types.ts:32

kty

kty: string;

Defined in: packages/protocol/src/types.ts:31

n?

optional n?: string;

Defined in: packages/protocol/src/types.ts:39

use?

optional use?: string;

Defined in: packages/protocol/src/types.ts:35

x?

optional x?: string;

Defined in: packages/protocol/src/types.ts:37

y?

optional y?: string;

Defined in: packages/protocol/src/types.ts:38

---

DNSResolver

Defined in: packages/protocol/src/dns-resolver.ts:7

Pluggable DNS resolver dependency. Decouples verifyDomain from the system resolver.

Methods

fetchTXT()

fetchTXT(name, options?): Promise<[TXTRecord[], DNSSECState]>;

Defined in: packages/protocol/src/dns-resolver.ts:14

Fetches TXT records for the given DNS owner name.

Parameters

name

string

Normalized FQDN without trailing dot (e.g. “_dnsid.agent.example”). MUST be treated as an absolute name — no search-domain expansion.

options?

signal?

AbortSignal

Returns

Promise<[TXTRecord[], DNSSECState]>

The record set and the DNSSEC validation state of the response.

---

FetchResult

Defined in: packages/protocol/src/identity-manager.ts:54

Properties

data

data: unknown;

Defined in: packages/protocol/src/identity-manager.ts:55

tlsCert

tlsCert: TLSCertificate;

Defined in: packages/protocol/src/identity-manager.ts:56

---

IdentityCache

Defined in: packages/protocol/src/identity-cache.ts:11

Cache for verified domain results. Held by IdentityManager and consulted at the start of every verifyDomain call.

Implementation requirements:

• Get MUST return null for any entry whose VerifiedDomain.expiry() has passed.
• Put MUST derive the entry TTL from result.expiry() and evict automatically when that time arrives.
• Implementations MUST be safe for concurrent use.

Methods

evict()

evict(domain): void;

Defined in: packages/protocol/src/identity-cache.ts:19

Removes a domain from the cache immediately.

Parameters

domain

string

Returns

void

get()

get(domain): VerifiedDomain | null;

Defined in: packages/protocol/src/identity-cache.ts:13

Returns the cached VerifiedDomain for a domain, or null if not cached or expired.

Parameters

domain

string

Returns

VerifiedDomain | null

put()

put(domain, result): void;

Defined in: packages/protocol/src/identity-cache.ts:16

Stores a verified domain result. Entry expires at result.expiry().

Parameters

domain

string

result

VerifiedDomain

Returns

void

---

IdentityConfig

Defined in: packages/protocol/src/types.ts:63

Local identity publication settings (DnsidConfig.identity). Contains no verification or transport policy.

Properties

capabilitiesUrl?

optional capabilitiesUrl?: string;

Defined in: packages/protocol/src/types.ts:83

HTTPS URL for the capabilities document (cu tag).

domain

domain: string;

Defined in: packages/protocol/src/types.ts:65

FQDN of the DNSid identity. Normalized with normalizeFQDN on construction.

ekUrl?

optional ekUrl?: string;

Defined in: packages/protocol/src/types.ts:77

HTTPS URL for the accountable-entity JWKS endpoint (ek tag). Required for draft-01 publishing.

governanceId

governanceId: string;

Defined in: packages/protocol/src/types.ts:67

Registrant domain (gi tag).

kuUrl?

optional kuUrl?: string;

Defined in: packages/protocol/src/types.ts:79

HTTPS URL for the identity’s operational/runtime JWKS endpoint (ku tag). Required for draft-01 publishing.

logRef

logRef: string;

Defined in: packages/protocol/src/types.ts:69

Log reference for the lr tag. Format: {method}:{entry-ref}.

maxKeyAge?

optional maxKeyAge?: MaxKeyAge;

Defined in: packages/protocol/src/types.ts:75

Maximum signing key age for the ka tag.

policyFlags?

optional policyFlags?: string;

Defined in: packages/protocol/src/types.ts:73

Comma-separated policy flags for the fl tag.

publishProfile?

optional publishProfile?: string;

Defined in: packages/protocol/src/types.ts:81

_dnsid behavior profile to emit. Defaults to dnsid-draft-01.

statusUrl

statusUrl: string;

Defined in: packages/protocol/src/types.ts:71

HTTPS URL for the lifecycle status endpoint (su tag).

---

IdentityManagerDependencies

Defined in: packages/protocol/src/identity-manager.ts:84

Runtime objects injected into IdentityManager. Configuration data lives in DnsidConfig.

Properties

cache?

optional cache?: IdentityCache;

Defined in: packages/protocol/src/identity-manager.ts:91

dnsResolver?

optional dnsResolver?: DNSResolver;

Defined in: packages/protocol/src/identity-manager.ts:90

entityKeyProvider?

optional entityKeyProvider?: KeyProvider;

Defined in: packages/protocol/src/identity-manager.ts:88

Accountable-entity key provider for _dnsid signing and lifecycle events. Rejected without config.identity.

fetchJson?

optional fetchJson?: JsonFetcher;

Defined in: packages/protocol/src/identity-manager.ts:92

keyProvider?

optional keyProvider?: KeyProvider;

Defined in: packages/protocol/src/identity-manager.ts:86

Local operational signer. Required with config.identity; rejected without it.

logRegistry?

optional logRegistry?: LogRegistry;

Defined in: packages/protocol/src/identity-manager.ts:89

---

IdentityResolver

Defined in: packages/protocol/src/identity-manager.ts:95

Extended by

• SigningIdentityManager

Methods

verifyDomain()

verifyDomain(
   domain,
   peerCert?,
   options?
): Promise<VerifiedDomain>;

Defined in: packages/protocol/src/identity-manager.ts:96

Parameters

domain

string

peerCert?

TLSCertificate

options?

VerificationOptions

Returns

Promise<VerifiedDomain>

---

IssuanceEvent

Defined in: packages/protocol/src/log-events.ts:28

Extends

• BaseLogEvent

Extended by

• C2spIssuanceEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:30

entityKey?

optional entityKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:46

Accountable-entity record-signing key (ek) recorded in the event.

entitySig?

optional entitySig?: string;

Defined in: packages/protocol/src/log-events.ts:50

Entity-key signature over the canonical binding (base64url).

governanceId

governanceId: string;

Defined in: packages/protocol/src/log-events.ts:31

initialEntityAlg?

optional initialEntityAlg?: string;

Defined in: packages/protocol/src/log-events.ts:39

initialEntityKid?

optional initialEntityKid?: string;

Defined in: packages/protocol/src/log-events.ts:38

c2sp-tlog encoding of the accountable entity key.

initialEntityPublicKey?

optional initialEntityPublicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:40

initialEntityThumbprint?

optional initialEntityThumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:41

initialOperationalAlg?

optional initialOperationalAlg?: string;

Defined in: packages/protocol/src/log-events.ts:34

initialOperationalKid?

optional initialOperationalKid?: string;

Defined in: packages/protocol/src/log-events.ts:33

c2sp-tlog encoding of the initial operational key.

initialOperationalPublicKey?

optional initialOperationalPublicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:35

initialOperationalThumbprint?

optional initialOperationalThumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:36

kid?

optional kid?: string;

Defined in: packages/protocol/src/log-events.ts:56

Deprecated

superseded by operationalKey/entityKey.

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

operationalKey?

optional operationalKey?: IssuanceKeySlot;

Defined in: packages/protocol/src/log-events.ts:48

Initial operational key (ku) recorded in the event.

operationalSig?

optional operationalSig?: string;

Defined in: packages/protocol/src/log-events.ts:52

Operational-key countersignature over the same canonical binding (base64url).

publicKey?

optional publicKey?: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:58

Deprecated

superseded by operationalKey/entityKey.

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

thumbprint?

optional thumbprint?: string;

Defined in: packages/protocol/src/log-events.ts:60

Deprecated

superseded by the slot thumbprints.

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:42

type

type: "ISSUANCE";

Defined in: packages/protocol/src/log-events.ts:29

---

IssuanceKeySlot

Defined in: packages/protocol/src/log-events.ts:19

A key slot recorded in a draft-01 bilateral ISSUANCE event (ek or ku).

Properties

alg

alg: string;

Defined in: packages/protocol/src/log-events.ts:25

JWS alg the slot’s signature is produced/verified under.

jwk

jwk: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:20

kid?

optional kid?: string;

Defined in: packages/protocol/src/log-events.ts:23

thumbprint

thumbprint: string;

Defined in: packages/protocol/src/log-events.ts:22

RFC 7638 JWK thumbprint of jwk.

---

JsonFetchOptions

Defined in: packages/protocol/src/identity-manager.ts:74

Properties

allowedHost?

optional allowedHost?: string;

Defined in: packages/protocol/src/identity-manager.ts:76

domainBoundary?

optional domainBoundary?: boolean;

Defined in: packages/protocol/src/identity-manager.ts:77

maxResponseBytes?

optional maxResponseBytes?: number;

Defined in: packages/protocol/src/identity-manager.ts:78

signal?

optional signal?: AbortSignal;

Defined in: packages/protocol/src/identity-manager.ts:75

---

KeyProvider

Defined in: packages/protocol/src/key-provider.ts:14

Standardized interface for Key Management Systems.

Implementations may wrap local key files, cloud KMS (AWS KMS, GCP Cloud KMS, Azure Key Vault), or HSMs. The SDK never handles private key material directly.

Key states:

• Pending: generated but not yet promoted (excluded from ListKeyIds / JWKS)
• Active: current signing key (in JWKS; used for signing)
• Retained: rotated out; kept for verification/audit (not used for new signing)

Methods

activate()

activate(kid): Promise<void>;

Defined in: packages/protocol/src/key-provider.ts:55

Promotes a pending key to active. The previously active key transitions to retained.

Parameters

kid

string

Returns

Promise<void>

generateKey()

generateKey(): Promise<string>;

Defined in: packages/protocol/src/key-provider.ts:50

Generates a new key pair in the pending state. Returns the new key’s kid.

Returns

Promise<string>

jwk()

jwk(kid): Promise<DnsIdJWK>;

Defined in: packages/protocol/src/key-provider.ts:27

Returns the JWK representation of a key by ID (active, pending, or retained). Raises if not found.

Parameters

kid

string

Returns

Promise<DnsIdJWK>

listKeyIds()

listKeyIds(): Promise<string[]>;

Defined in: packages/protocol/src/key-provider.ts:33

Returns the IDs of all active and retained keys (pending keys excluded). The active key ID MUST appear first; retained keys follow in any order.

Returns

Promise<string[]>

purge()?

optional purge(kid): Promise<void>;

Defined in: packages/protocol/src/key-provider.ts:63

Parameters

kid

string

Returns

Promise<void>

Deprecated

Use supersede().

sign()

sign(payload): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/key-provider.ts:39

Signs the given payload with the current active signing key. Returns raw signature bytes.

Parameters

payload

Uint8Array

Returns

Promise<Uint8Array<ArrayBufferLike>>

signingKey()

signingKey(): Promise<DnsIdJWK>;

Defined in: packages/protocol/src/key-provider.ts:21

Returns the JWK representation of the current active public signing key. The returned kid MUST NOT contain ’#’.

Returns

Promise<DnsIdJWK>

signKey()

signKey(kid, payload): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/key-provider.ts:42

Signs with a specified active or pending key.

Parameters

kid

string

payload

Uint8Array

Returns

Promise<Uint8Array<ArrayBufferLike>>

supersede()

supersede(kid): Promise<void>;

Defined in: packages/protocol/src/key-provider.ts:60

Supersedes and removes a retained key from this provider’s published key set.

Parameters

kid

string

Returns

Promise<void>

---

KeyRotationEvent

Defined in: packages/protocol/src/log-events.ts:75

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:77

newOperationalAlg

newOperationalAlg: string;

Defined in: packages/protocol/src/log-events.ts:81

newOperationalKid

newOperationalKid: string;

Defined in: packages/protocol/src/log-events.ts:80

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

newOperationalPublicKey

newOperationalPublicKey: DnsIdJWK;

Defined in: packages/protocol/src/log-events.ts:83

newOperationalThumbprint

newOperationalThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:82

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

previousOperationalKid

previousOperationalKid: string;

Defined in: packages/protocol/src/log-events.ts:78

previousOperationalThumbprint

previousOperationalThumbprint: string;

Defined in: packages/protocol/src/log-events.ts:79

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:84

type

type: "KEY_ROTATION";

Defined in: packages/protocol/src/log-events.ts:76

---

Log

Defined in: packages/protocol/src/log.ts:33

Write interface for the agent’s own immutable log. Implementations may wrap a blockchain, CT-style transparency log, SCITT service, or any append-only log.

Implementations may satisfy both Log and LogReader; C2SP uses a separate prepared-event append workflow instead of the generic writeEvent method.

Methods

canonical()

canonical(event): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/log.ts:39

Returns the canonical byte representation of the event for this log method. Called by IdentityManager.signAndWriteEvent to produce the bytes that are signed. MUST produce identical output to LogReader.canonical for the same event.

Parameters

event

LogEvent

Returns

Promise<Uint8Array<ArrayBufferLike>>

writeEvent()

writeEvent(event): Promise<string>;

Defined in: packages/protocol/src/log.ts:46

Appends a signed event to the log. The event MUST already carry the signatures required by its log method before writeEvent is called. Returns a LogRef identifying the recorded entry.

Parameters

event

LogEvent

Returns

Promise<string>

---

LoggedStateEvidence

Defined in: packages/protocol/src/log.ts:7

Verified proof boundary accepted for a complete lifecycle-state decision.

Properties

checkpoint

checkpoint: Uint8Array;

Defined in: packages/protocol/src/log.ts:21

Opaque accepted checkpoint or equivalent log-state evidence.

completenessMode

completenessMode: string;

Defined in: packages/protocol/src/log.ts:19

Binding-defined completeness mechanism.

completeThrough

completeThrough: string;

Defined in: packages/protocol/src/log.ts:17

Opaque method-specific position through which completeness was established.

freshnessTime

freshnessTime: Date;

Defined in: packages/protocol/src/log.ts:23

Independently verified freshness time.

historyEnd?

optional historyEnd?: string;

Defined in: packages/protocol/src/log.ts:15

Method-specific final applied event reference, when one exists.

historyStart

historyStart: string;

Defined in: packages/protocol/src/log.ts:13

Method-specific genesis reference included in the verified history.

loggedState

loggedState: AgentStatusState;

Defined in: packages/protocol/src/log.ts:11

Verified lifecycle state through historyEnd, not current protocol status.

logReference

logReference: string;

Defined in: packages/protocol/src/log.ts:9

Complete identity-instance log reference verified by the binding.

---

LogReader

Defined in: packages/protocol/src/log.ts:57

Read and verify interface for a specific log entry. Bound at construction to a full lr value (e.g. “algorand:AGENT_ADDR_BASE32”).

Evidence-returning methods MUST verify the applicable inclusion, timestamp, append-only consistency, and lifecycle signatures before returning success. canonical only serializes an event; it does not verify log evidence.

Methods

canonical()

canonical(event): Promise<Uint8Array<ArrayBufferLike>>;

Defined in: packages/protocol/src/log.ts:63

Returns the canonical byte representation of the event for this log method. Used to verify the signatures required by the log method on events read from the log. MUST produce identical output to Log.canonical for the same supported event.

Parameters

event

LogEvent

Returns

Promise<Uint8Array<ArrayBufferLike>>

keyTimestamp()

keyTimestamp(domain, keyThumbprint): Promise<Date>;

Defined in: packages/protocol/src/log.ts:69

Returns the timestamp at which the given key thumbprint was bound to the domain (ISSUANCE or KEY_ROTATION event). Used for ka validation.

Parameters

domain

string

keyThumbprint

string

Returns

Promise<Date>

readEvent()

readEvent(ref): Promise<LogEvent>;

Defined in: packages/protocol/src/log.ts:92

Reads a single event by its log reference. MUST verify inclusion proof and timestamp proof before returning.

Parameters

ref

string

Returns

Promise<LogEvent>

rebuildHistory()

rebuildHistory(domain): Promise<LogEvent[]>;

Defined in: packages/protocol/src/log.ts:102

Rebuilds the full event history for the domain in authoritative log order. MUST verify inclusion proofs, timestamp proofs, append-only consistency, and required lifecycle signatures on every returned event. Event signature verification MUST use the public keys valid for that event in the reconstructed lifecycle history. Events with invalid signatures MUST NOT be returned.

Parameters

domain

string

Returns

Promise<LogEvent[]>

verifyBilateralBinding()

verifyBilateralBinding(
   record,
   entityKey,
   operationalKey
): Promise<{
  initialEntityThumbprint: string;
  initialOperationalThumbprint: string;
  timestamp: Date;
}>;

Defined in: packages/protocol/src/log.ts:72

Verifies draft-01 bilateral ISSUANCE binding for the current TXT record.

Parameters

record

unknown

entityKey

unknown

operationalKey

unknown

Returns

Promise<{ initialEntityThumbprint: string; initialOperationalThumbprint: string; timestamp: Date; }>

verifyNonRevocation()

verifyNonRevocation(domain, at): Promise<LoggedStateEvidence>;

Defined in: packages/protocol/src/log.ts:86

Verifies that the domain is neither REVOKED nor RETIRED at the given timestamp. Raises on a terminal state or if complete, fresh evidence cannot be established. Returns the accepted proof boundary.

Parameters

domain

string

at

Date

Returns

Promise<LoggedStateEvidence>

verifyOperationalContinuity()

verifyOperationalContinuity(
   domain,
   initialOperationalThumbprint,
   currentOperationalThumbprint
): Promise<void>;

Defined in: packages/protocol/src/log.ts:79

Verifies KEY_ROTATION continuity from ISSUANCE to the current operational key.

Parameters

domain

string

initialOperationalThumbprint

string

currentOperationalThumbprint

string

Returns

Promise<void>

---

MigrationEvent

Defined in: packages/protocol/src/log-events.ts:100

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:102

finalEntryRef

finalEntryRef: string;

Defined in: packages/protocol/src/log-events.ts:105

newLog

newLog: string;

Defined in: packages/protocol/src/log-events.ts:104

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

previousLog

previousLog: string;

Defined in: packages/protocol/src/log-events.ts:103

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:106

type

type: "MIGRATION";

Defined in: packages/protocol/src/log-events.ts:101

---

OperationalKeyRotationOptions

Defined in: packages/protocol/src/identity-manager.ts:59

Properties

publishKeySet

publishKeySet: (keySet) => Promise<void>;

Defined in: packages/protocol/src/identity-manager.ts:61

Publishes the pending operational JWKS at the configured ku endpoint before continuity is appended.

Parameters

keySet

JWKS

Returns

Promise<void>

timestamp?

optional timestamp?: Date;

Defined in: packages/protocol/src/identity-manager.ts:62

---

OperationalKeyRotationResult

Defined in: packages/protocol/src/identity-manager.ts:65

Properties

event

event: KeyRotationEvent;

Defined in: packages/protocol/src/identity-manager.ts:66

keySet

keySet: JWKS;

Defined in: packages/protocol/src/identity-manager.ts:68

logRef

logRef: string;

Defined in: packages/protocol/src/identity-manager.ts:67

---

RetirementEvent

Defined in: packages/protocol/src/log-events.ts:94

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:96

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:97

type

type: "RETIREMENT";

Defined in: packages/protocol/src/log-events.ts:95

---

RetryBackoffOptions

Defined in: packages/protocol/src/retry.ts:3

Properties

initialDelayMs?

optional initialDelayMs?: number;

Defined in: packages/protocol/src/retry.ts:7

Delay before the first retry. Default: 100ms.

jitter?

optional jitter?: boolean;

Defined in: packages/protocol/src/retry.ts:13

Apply full jitter in the range [0, delay]. Default: true.

maxAttempts?

optional maxAttempts?: number;

Defined in: packages/protocol/src/retry.ts:5

Total attempts including the initial call. Default: 3.

maxDelayMs?

optional maxDelayMs?: number;

Defined in: packages/protocol/src/retry.ts:9

Maximum delay between attempts. Default: 2000ms.

multiplier?

optional multiplier?: number;

Defined in: packages/protocol/src/retry.ts:11

Exponential multiplier applied after each failed attempt. Default: 2.

shouldRetry?

optional shouldRetry?: (error, attempt) => boolean;

Defined in: packages/protocol/src/retry.ts:15

Optional policy override. Defaults to retrying transient VerificationError only.

Parameters

error

unknown

attempt

number

Returns

boolean

sleep?

optional sleep?: (ms) => Promise<void>;

Defined in: packages/protocol/src/retry.ts:17

Test hook for sleeping.

Parameters

ms

number

Returns

Promise<void>

---

RevocationEvent

Defined in: packages/protocol/src/log-events.ts:87

Extends

• BaseLogEvent

Properties

domain

domain: string;

Defined in: packages/protocol/src/log-events.ts:89

newOperationalProof?

optional newOperationalProof?: string;

Defined in: packages/protocol/src/log-events.ts:13

Base64url new-operational-key proof of possession. Required for c2sp-tlog KEY_ROTATION.

Inherited from

BaseLogEvent.newOperationalProof

operationalCountersig?

optional operationalCountersig?: string;

Defined in: packages/protocol/src/log-events.ts:11

Base64url operational-key countersignature. Required for draft-01 ISSUANCE.

Inherited from

BaseLogEvent.operationalCountersig

reason

reason:
  | "keyCompromise"
  | "policyViolation"
  | "superseded"
  | "cessationOfOperation";

Defined in: packages/protocol/src/log-events.ts:91

sig?

optional sig?: string;

Defined in: packages/protocol/src/log-events.ts:9

Base64url signature. Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.sig

signingKid?

optional signingKid?: string;

Defined in: packages/protocol/src/log-events.ts:7

Set by IdentityManager.signAndWriteEvent; leave undefined when constructing.

Inherited from

BaseLogEvent.signingKid

timestamp

timestamp: Date;

Defined in: packages/protocol/src/log-events.ts:90

type

type: "REVOCATION";

Defined in: packages/protocol/src/log-events.ts:88

---

SigningIdentityManager

Defined in: packages/protocol/src/identity-manager.ts:99

Extends

• IdentityResolver

Properties

config

config: object;

Defined in: packages/protocol/src/identity-manager.ts:100

identity?

optional identity?: object;

identity.domain

domain: string;

Methods

getKeyProvider()

getKeyProvider(): KeyProvider;

Defined in: packages/protocol/src/identity-manager.ts:101

Returns

KeyProvider

verifyDomain()

verifyDomain(
   domain,
   peerCert?,
   options?
): Promise<VerifiedDomain>;

Defined in: packages/protocol/src/identity-manager.ts:96

Parameters

domain

string

peerCert?

TLSCertificate

options?

VerificationOptions

Returns

Promise<VerifiedDomain>

Inherited from

IdentityResolver.verifyDomain

---

TLSCertificate

Defined in: packages/protocol/src/types.ts:50

Properties

notAfter

notAfter: Date;

Defined in: packages/protocol/src/types.ts:51

san

san: string[];

Defined in: packages/protocol/src/types.ts:52

---

TransportConfig

Defined in: packages/protocol/src/types.ts:105

SDK-managed DNS and HTTPS deployment settings (DnsidConfig.transport). Never alters protocol semantics.

Properties

caBundlePath?

optional caBundlePath?: string;

Defined in: packages/protocol/src/types.ts:109

Path to a PEM CA bundle appended to the system root certificates for TLS verification.

dnsServer?

optional dnsServer?: string;

Defined in: packages/protocol/src/types.ts:107

Custom DNS server (host, host:port, or [ipv6]:port). Omit to use the system resolver.

privateAddressHosts?

optional privateAddressHosts?: readonly string[];

Defined in: packages/protocol/src/types.ts:121

Hostnames, or leading-dot suffixes such as .test, whose SDK-managed HTTPS destinations may resolve to loopback or private-use addresses. An exact entry matches only that name; .test matches test and every name beneath it on a DNS-label boundary, case-insensitively and ignoring a trailing dot. Link-local, multicast, reserved, and mixed public/private resolutions stay rejected, IP-literal URLs are never exempted, and every redirect hop is matched independently. Nothing is allowed by default; there is no built-in .test exemption. Entries are validated at construction (IP literals, ports, schemes, paths, credentials → ArgumentError). Applies only to the default fetcher; rejected when fetchJson is injected. Not a DNSid protocol field.

---

TrustedEntity

Defined in: packages/protocol/src/types.ts:87

One counterparty allowlist entry. Exact gi match; optional pins on the current record-signing key.

Properties

entityKeyThumbprints?

optional entityKeyThumbprints?: string[];

Defined in: packages/protocol/src/types.ts:91

Unpadded base64url RFC 7638 SHA-256 thumbprints the current ek signing key must match. Non-empty when present.

governanceId

governanceId: string;

Defined in: packages/protocol/src/types.ts:89

Accountable-entity governance domain. Normalized with normalizeFQDN on construction.

---

TXTRecord

Defined in: packages/protocol/src/types.ts:57

Properties

strings

strings: string[];

Defined in: packages/protocol/src/types.ts:58

ttl

ttl: number;

Defined in: packages/protocol/src/types.ts:59

---

VerificationConfig

Defined in: packages/protocol/src/types.ts:95

Protocol verification and counterparty acceptance settings (DnsidConfig.verification).

Properties

dnssecMode?

optional dnssecMode?: DNSSECMode;

Defined in: packages/protocol/src/types.ts:99

DNSSEC enforcement mode. Default: ‘auto’.

statusCheckInterval?

optional statusCheckInterval?: number;

Defined in: packages/protocol/src/types.ts:97

Maximum age (seconds) of cached status before re-fetching su. Default: 0 (re-fetch every call).

trustedEntities?

optional trustedEntities?: TrustedEntity[];

Defined in: packages/protocol/src/types.ts:101

Counterparty allowlist. Absent: no acceptance decision. []: deny all.

---

VerificationOptions

Defined in: packages/protocol/src/verification-budget.ts:3

Properties

signal?

optional signal?: AbortSignal;

Defined in: packages/protocol/src/verification-budget.ts:6

timeoutMs?

optional timeoutMs?: number;

Defined in: packages/protocol/src/verification-budget.ts:5

Overall invocation budget, including all discovery and evidence. Default: 30 seconds.