@apertoid/core 0.1.0

package/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@apertoid/core",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./src/index.ts",
+      "types": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "zod": "^3.23.8"
+  }
+}

package/src/dns-parser.ts

@@ -0,0 +1,85 @@
+/**
+ * Verifies that a domain owns the given public key by checking standard DNS TXT records.
+ * Uses DNS-over-HTTPS (DoH) to work in Cloudflare Workers, Node.js, and Bun.
+ */
+export async function verifyDomainAgentIdentity(domain: string, assertedPublicKey: string): Promise<boolean> {
+  try {
+    // We try to resolve standard _apertoid record first, then fallback to standard _ans record.
+    const txtRecords = await fetchTxtRecords(domain);
+    if (txtRecords.length === 0) {
+      console.warn(`No DNS TXT records found for agent under domain: ${domain}`);
+      return false;
+    }
+
+    // Look for any record that declares the protocol format (e.g. v=apertoid1 or v=ansv2)
+    const matchingRecord = txtRecords.find(
+      (record) => record.startsWith("v=apertoid1") || record.startsWith("v=ansv2")
+    );
+
+    if (!matchingRecord) {
+      console.warn(`No valid apertoid or ansv2 TXT protocol configuration found under domain: ${domain}`);
+      return false;
+    }
+
+    // Parse attributes: e.g., v=apertoid1; k=ed25519; p=PUBLIC_KEY_HERE
+    // Convert semicolon delimited format to a standard query-string layout for easy parsing
+    const normalizedQuery = matchingRecord.replace(/;\s*/g, "&");
+    const params = new URLSearchParams(normalizedQuery);
+    const registeredKey = params.get("p");
+
+    if (!registeredKey) {
+      console.warn(`Protocol record found but missing 'p' parameter under domain: ${domain}`);
+      return false;
+    }
+
+    // Validate that the key matches
+    return registeredKey === assertedPublicKey;
+  } catch (error) {
+    console.error(`DNS Resolution failure on domain: ${domain}`, error);
+    return false;
+  }
+}
+
+/**
+ * Fetches DNS TXT records from both '_apertoid.<domain>' and '_ans.<domain>' subdomains
+ * using Cloudflare's secure DNS-over-HTTPS API.
+ */
+async function fetchTxtRecords(domain: string): Promise<string[]> {
+  const targets = [`_apertoid.${domain}`, `_ans.${domain}`];
+  const records: string[] = [];
+
+  for (const target of targets) {
+    try {
+      const url = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(target)}&type=TXT`;
+      const response = await fetch(url, {
+        method: "GET",
+        headers: {
+          "Accept": "application/dns-json",
+        },
+      });
+
+      if (!response.ok) {
+        continue;
+      }
+
+      const data = (await response.json()) as {
+        Answer?: Array<{ type: number; data: string }>;
+      };
+
+      if (data.Answer && Array.isArray(data.Answer)) {
+        for (const ans of data.Answer) {
+          // TXT record type in DNS is 16
+          if (ans.type === 16 && ans.data) {
+            // DoH data fields often wrap the string in double quotes. Clean them up.
+            const cleaned = ans.data.replace(/^"|"$/g, "");
+            records.push(cleaned);
+          }
+        }
+      }
+    } catch (err) {
+      console.error(`DoH lookup error for ${target}:`, err);
+    }
+  }
+
+  return records;
+}

package/src/index.ts

@@ -0,0 +1,2 @@
+export * from "./schemas";
+export * from "./dns-parser";

package/src/schemas.ts

@@ -0,0 +1,26 @@
+import { z } from "zod";
+
+// Validates the agent's identity claims according to ApertoID/ANSv2 formats
+export const AgentSchema = z.object({
+  ans_name: z.string().url().regex(/^agent:\/\/(\/\/)?([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}/, {
+    message: "ans_name must match 'agent://domain.com' or 'agent://://domain.com'"
+  }),
+  mcp_endpoint: z.string().url(),
+  public_key: z.string().min(10, { message: "Public key must be at least 10 characters long" }),
+});
+
+// Matches individual tools exposed by the MCP server
+export const ToolSchema = z.object({
+  name: z.string().min(1),
+  description: z.string().optional(),
+  inputSchema: z.record(z.any()).optional().default({}),
+});
+
+// Full configuration profile retrieved from target nodes (e.g. mcp.json)
+export const RawMcpManifestSchema = AgentSchema.extend({
+  tools: z.array(ToolSchema).optional().default([]),
+});
+
+export type Agent = z.infer<typeof AgentSchema>;
+export type Tool = z.infer<typeof ToolSchema>;
+export type RawMcpManifest = z.infer<typeof RawMcpManifestSchema>;

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src/**/*"]
+}