@hashgraphonline/standards-sdk 0.1.161 → 0.1.162

package/dist/es/standards-sdk.es62.js.map

@@ -1 +1 @@
-{"version":3,"file":"standards-sdk.es62.js","sources":["../../src/hcs-14/resolvers/aid-dns-web-profile.ts"],"sourcesContent":["import type {\n  DidResolutionProfile,\n  ProfileResolutionError,\n  UaidProfileResolver,\n  UaidProfileResolverContext,\n} from './types';\nimport type { AdapterMeta } from '../adapters/types';\nimport { nodeDnsTxtLookup, type DnsTxtLookup } from './dns';\nimport { isFqdn, normalizeDomain, parseSemicolonFields } from './profile-utils';\n\nexport const AID_DNS_WEB_PROFILE_ID = 'hcs-14.profile.aid-dns-web';\n\ninterface AidDnsRecord {\n  version: string;\n  protocol: string;\n  endpoint: string;\n  publicKey?: string;\n  keyId?: string;\n}\n\ninterface AidDnsRecordParseError {\n  code: 'ERR_INVALID_AID_RECORD' | 'ERR_ENDPOINT_INVALID';\n}\n\ninterface AidDnsRecordParseSuccess {\n  record: AidDnsRecord;\n}\n\ntype AidDnsRecordParseResult =\n  | AidDnsRecordParseError\n  | AidDnsRecordParseSuccess;\n\ninterface AidDnsVerificationInput {\n  uaid: string;\n  protocol: string;\n  endpoint: string;\n  record: AidDnsRecord;\n}\n\ntype AidDnsVerification = (input: AidDnsVerificationInput) => Promise<boolean>;\n\nexport interface AidDnsWebResolverOptions {\n  dnsLookup?: DnsTxtLookup;\n  supportedUriSchemes?: string[];\n  metadataVerifier?: AidDnsVerification;\n  cryptographicVerifier?: AidDnsVerification;\n}\n\nfunction buildErrorProfile(\n  uaid: string,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>,\n): DidResolutionProfile {\n  const error: ProfileResolutionError = {\n    code,\n    message,\n    details,\n  };\n\n  return {\n    id: uaid,\n    error,\n    metadata: {\n      profile: AID_DNS_WEB_PROFILE_ID,\n      resolved: false,\n    },\n  };\n}\n\nfunction parseRecord(\n  rawRecord: string,\n  supportedSchemes: Set<string>,\n): AidDnsRecordParseResult {\n  const fields = parseSemicolonFields(rawRecord);\n  const version = fields['v'];\n  const protocol = fields['p'] ?? fields['proto'];\n  const endpoint = fields['u'];\n\n  if (!version || !protocol || !endpoint) {\n    return { code: 'ERR_INVALID_AID_RECORD' };\n  }\n  if (!version.toLowerCase().startsWith('aid')) {\n    return { code: 'ERR_INVALID_AID_RECORD' };\n  }\n\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(endpoint);\n  } catch {\n    return { code: 'ERR_ENDPOINT_INVALID' };\n  }\n\n  const scheme = parsedUrl.protocol.replace(/:$/, '').toLowerCase();\n  if (!supportedSchemes.has(scheme)) {\n    return { code: 'ERR_ENDPOINT_INVALID' };\n  }\n\n  return {\n    record: {\n      version,\n      protocol,\n      endpoint: parsedUrl.toString(),\n      publicKey: fields['k'],\n      keyId: fields['i'],\n    },\n  };\n}\n\nfunction deterministicRecordKey(record: AidDnsRecord): string {\n  return `${record.protocol}|${record.endpoint}|${record.publicKey ?? ''}|${record.keyId ?? ''}`;\n}\n\nfunction verificationMethodForLevel(\n  verificationLevel: 'none' | 'metadata' | 'cryptographic',\n): 'aid-pka' | 'metadata-match' | undefined {\n  if (verificationLevel === 'cryptographic') {\n    return 'aid-pka';\n  }\n  if (verificationLevel === 'metadata') {\n    return 'metadata-match';\n  }\n  return undefined;\n}\n\nexport class AidDnsWebProfileResolver implements UaidProfileResolver {\n  readonly profile = AID_DNS_WEB_PROFILE_ID;\n\n  readonly meta: AdapterMeta = {\n    id: 'hcs-14/aid-dns-web',\n    didMethods: ['*'],\n    displayName: 'HCS-14 AID DNS/Web Profile',\n    description:\n      'Resolves uaid:aid identifiers via _agent.<nativeId> DNS TXT records and protocol endpoint hints.',\n  };\n\n  private readonly dnsLookup: DnsTxtLookup;\n  private readonly supportedSchemes: Set<string>;\n  private readonly metadataVerifier?: AidDnsVerification;\n  private readonly cryptographicVerifier?: AidDnsVerification;\n\n  constructor(options: AidDnsWebResolverOptions = {}) {\n    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;\n    this.supportedSchemes = new Set(\n      (options.supportedUriSchemes ?? ['https', 'http', 'wss', 'ws']).map(\n        scheme => scheme.toLowerCase(),\n      ),\n    );\n    this.metadataVerifier = options.metadataVerifier;\n    this.cryptographicVerifier = options.cryptographicVerifier;\n  }\n\n  supports(\n    _uaid: string,\n    parsed: UaidProfileResolverContext['parsedUaid'],\n  ): boolean {\n    if (parsed.method !== 'aid') {\n      return false;\n    }\n    const nativeId = parsed.params['nativeId'];\n    return !!nativeId && isFqdn(nativeId);\n  }\n\n  async resolveProfile(\n    uaid: string,\n    context: UaidProfileResolverContext,\n  ): Promise<DidResolutionProfile | null> {\n    const parsed = context.parsedUaid;\n    if (parsed.method !== 'aid') {\n      return null;\n    }\n\n    const nativeId = parsed.params['nativeId'];\n    if (!nativeId || !isFqdn(nativeId)) {\n      return null;\n    }\n\n    const normalizedNativeId = normalizeDomain(nativeId);\n    const dnsName = `_agent.${normalizedNativeId}`;\n    const txtRecords = await this.dnsLookup(dnsName);\n    if (txtRecords.length === 0) {\n      return null;\n    }\n\n    const parsedRecords = txtRecords.map(record =>\n      parseRecord(record, this.supportedSchemes),\n    );\n    const validRecords = parsedRecords\n      .filter(\n        (result): result is AidDnsRecordParseSuccess => 'record' in result,\n      )\n      .map(result => result.record);\n\n    if (validRecords.length === 0) {\n      const endpointInvalid = parsedRecords.some(\n        result =>\n          !('record' in result) && result.code === 'ERR_ENDPOINT_INVALID',\n      );\n      return buildErrorProfile(\n        uaid,\n        endpointInvalid ? 'ERR_ENDPOINT_INVALID' : 'ERR_INVALID_AID_RECORD',\n        endpointInvalid\n          ? 'AID DNS record endpoint URI is invalid or unsupported.'\n          : 'AID DNS TXT payload is malformed or unsupported.',\n        { dnsName },\n      );\n    }\n\n    const selectedRecord = [...validRecords].sort((a, b) =>\n      deterministicRecordKey(a).localeCompare(deterministicRecordKey(b)),\n    )[0];\n\n    const verificationInput: AidDnsVerificationInput = {\n      uaid,\n      protocol: selectedRecord.protocol,\n      endpoint: selectedRecord.endpoint,\n      record: selectedRecord,\n    };\n\n    let verificationLevel: 'none' | 'metadata' | 'cryptographic' = 'none';\n\n    if (this.metadataVerifier) {\n      const metadataVerified = await this.metadataVerifier(verificationInput);\n      if (!metadataVerified) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERIFICATION_FAILED',\n          'AID metadata verification failed.',\n          { dnsName },\n        );\n      }\n      verificationLevel = 'metadata';\n    }\n\n    if (selectedRecord.publicKey && this.cryptographicVerifier) {\n      const cryptographicVerified =\n        await this.cryptographicVerifier(verificationInput);\n      if (!cryptographicVerified) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERIFICATION_FAILED',\n          'AID cryptographic verification failed.',\n          { dnsName },\n        );\n      }\n      verificationLevel = 'cryptographic';\n    }\n\n    const did = context.did ?? undefined;\n    const alsoKnownAs = did ? [did] : undefined;\n\n    return {\n      id: uaid,\n      did,\n      alsoKnownAs,\n      service: [\n        {\n          id: `${uaid}#aid-endpoint`,\n          type: 'AIDService',\n          serviceEndpoint: selectedRecord.endpoint,\n        },\n      ],\n      metadata: {\n        profile: AID_DNS_WEB_PROFILE_ID,\n        resolved: true,\n        endpoint: selectedRecord.endpoint,\n        protocol: selectedRecord.protocol,\n        verification: {\n          level: verificationLevel,\n          method: verificationMethodForLevel(verificationLevel),\n        },\n        verificationLevel,\n        precedenceSource: 'dns',\n      },\n    };\n  }\n}\n"],"names":[],"mappings":";;AAUO,MAAM,yBAAyB;AAsCtC,SAAS,kBACP,MACA,MACA,SACA,SACsB;AACtB,QAAM,QAAgC;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAGF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,UAAU;AAAA,IAAA;AAAA,EACZ;AAEJ;AAEA,SAAS,YACP,WACA,kBACyB;AACzB,QAAM,SAAS,qBAAqB,SAAS;AAC7C,QAAM,UAAU,OAAO,GAAG;AAC1B,QAAM,WAAW,OAAO,GAAG,KAAK,OAAO,OAAO;AAC9C,QAAM,WAAW,OAAO,GAAG;AAE3B,MAAI,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU;AACtC,WAAO,EAAE,MAAM,yBAAA;AAAA,EACjB;AACA,MAAI,CAAC,QAAQ,YAAA,EAAc,WAAW,KAAK,GAAG;AAC5C,WAAO,EAAE,MAAM,yBAAA;AAAA,EACjB;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,QAAQ;AAAA,EAC9B,QAAQ;AACN,WAAO,EAAE,MAAM,uBAAA;AAAA,EACjB;AAEA,QAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,EAAE,EAAE,YAAA;AACpD,MAAI,CAAC,iBAAiB,IAAI,MAAM,GAAG;AACjC,WAAO,EAAE,MAAM,uBAAA;AAAA,EACjB;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA,UAAU,UAAU,SAAA;AAAA,MACpB,WAAW,OAAO,GAAG;AAAA,MACrB,OAAO,OAAO,GAAG;AAAA,IAAA;AAAA,EACnB;AAEJ;AAEA,SAAS,uBAAuB,QAA8B;AAC5D,SAAO,GAAG,OAAO,QAAQ,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,EAAE,IAAI,OAAO,SAAS,EAAE;AAC9F;AAEA,SAAS,2BACP,mBAC0C;AAC1C,MAAI,sBAAsB,iBAAiB;AACzC,WAAO;AAAA,EACT;AACA,MAAI,sBAAsB,YAAY;AACpC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,MAAM,yBAAwD;AAAA,EAgBnE,YAAY,UAAoC,IAAI;AAfpD,SAAS,UAAU;AAEnB,SAAS,OAAoB;AAAA,MAC3B,IAAI;AAAA,MACJ,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa;AAAA,MACb,aACE;AAAA,IAAA;AASF,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,mBAAmB,IAAI;AAAA,OACzB,QAAQ,uBAAuB,CAAC,SAAS,QAAQ,OAAO,IAAI,GAAG;AAAA,QAC9D,CAAA,WAAU,OAAO,YAAA;AAAA,MAAY;AAAA,IAC/B;AAEF,SAAK,mBAAmB,QAAQ;AAChC,SAAK,wBAAwB,QAAQ;AAAA,EACvC;AAAA,EAEA,SACE,OACA,QACS;AACT,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,WAAO,CAAC,CAAC,YAAY,OAAO,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,eACJ,MACA,SACsC;AACtC,UAAM,SAAS,QAAQ;AACvB,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,QAAI,CAAC,YAAY,CAAC,OAAO,QAAQ,GAAG;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,qBAAqB,gBAAgB,QAAQ;AACnD,UAAM,UAAU,UAAU,kBAAkB;AAC5C,UAAM,aAAa,MAAM,KAAK,UAAU,OAAO;AAC/C,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO;AAAA,IACT;AAEA,UAAM,gBAAgB,WAAW;AAAA,MAAI,CAAA,WACnC,YAAY,QAAQ,KAAK,gBAAgB;AAAA,IAAA;AAE3C,UAAM,eAAe,cAClB;AAAA,MACC,CAAC,WAA+C,YAAY;AAAA,IAAA,EAE7D,IAAI,CAAA,WAAU,OAAO,MAAM;AAE9B,QAAI,aAAa,WAAW,GAAG;AAC7B,YAAM,kBAAkB,cAAc;AAAA,QACpC,CAAA,WACE,EAAE,YAAY,WAAW,OAAO,SAAS;AAAA,MAAA;AAE7C,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB,yBAAyB;AAAA,QAC3C,kBACI,2DACA;AAAA,QACJ,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,iBAAiB,CAAC,GAAG,YAAY,EAAE;AAAA,MAAK,CAAC,GAAG,MAChD,uBAAuB,CAAC,EAAE,cAAc,uBAAuB,CAAC,CAAC;AAAA,IAAA,EACjE,CAAC;AAEH,UAAM,oBAA6C;AAAA,MACjD;AAAA,MACA,UAAU,eAAe;AAAA,MACzB,UAAU,eAAe;AAAA,MACzB,QAAQ;AAAA,IAAA;AAGV,QAAI,oBAA2D;AAE/D,QAAI,KAAK,kBAAkB;AACzB,YAAM,mBAAmB,MAAM,KAAK,iBAAiB,iBAAiB;AACtE,UAAI,CAAC,kBAAkB;AACrB,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,QAAA;AAAA,QAAQ;AAAA,MAEd;AACA,0BAAoB;AAAA,IACtB;AAEA,QAAI,eAAe,aAAa,KAAK,uBAAuB;AAC1D,YAAM,wBACJ,MAAM,KAAK,sBAAsB,iBAAiB;AACpD,UAAI,CAAC,uBAAuB;AAC1B,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,QAAA;AAAA,QAAQ;AAAA,MAEd;AACA,0BAAoB;AAAA,IACtB;AAEA,UAAM,MAAM,QAAQ,OAAO;AAC3B,UAAM,cAAc,MAAM,CAAC,GAAG,IAAI;AAElC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,SAAS;AAAA,QACP;AAAA,UACE,IAAI,GAAG,IAAI;AAAA,UACX,MAAM;AAAA,UACN,iBAAiB,eAAe;AAAA,QAAA;AAAA,MAClC;AAAA,MAEF,UAAU;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU,eAAe;AAAA,QACzB,UAAU,eAAe;AAAA,QACzB,cAAc;AAAA,UACZ,OAAO;AAAA,UACP,QAAQ,2BAA2B,iBAAiB;AAAA,QAAA;AAAA,QAEtD;AAAA,QACA,kBAAkB;AAAA,MAAA;AAAA,IACpB;AAAA,EAEJ;AACF;"}
+{"version":3,"file":"standards-sdk.es62.js","sources":["../../src/hcs-14/resolvers/aid-dns-web-profile.ts"],"sourcesContent":["import type {\n  DidResolutionProfile,\n  ProfileResolutionError,\n  UaidProfileResolver,\n  UaidProfileResolverContext,\n} from './types';\nimport type { AdapterMeta } from '../adapters/types';\nimport { nodeDnsTxtLookup, type DnsTxtLookup } from './dns';\nimport { isFqdn, normalizeDomain, parseSemicolonFields } from './profile-utils';\n\nexport const AID_DNS_WEB_PROFILE_ID = 'hcs-14.profile.aid-dns-web';\n\ninterface AidDnsRecord {\n  version: string;\n  protocol: string;\n  endpoint: string;\n  publicKey?: string;\n  keyId?: string;\n}\n\ninterface AidDnsRecordParseError {\n  code: 'ERR_INVALID_AID_RECORD' | 'ERR_ENDPOINT_INVALID';\n}\n\ninterface AidDnsRecordParseSuccess {\n  record: AidDnsRecord;\n}\n\ntype AidDnsRecordParseResult =\n  | AidDnsRecordParseError\n  | AidDnsRecordParseSuccess;\n\ninterface AidDnsVerificationInput {\n  uaid: string;\n  protocol: string;\n  endpoint: string;\n  record: AidDnsRecord;\n}\n\ntype AidDnsVerification = (input: AidDnsVerificationInput) => Promise<boolean>;\n\nexport interface AidDnsWebResolverOptions {\n  dnsLookup?: DnsTxtLookup;\n  supportedUriSchemes?: string[];\n  metadataVerifier?: AidDnsVerification;\n  cryptographicVerifier?: AidDnsVerification;\n}\n\nfunction buildErrorProfile(\n  uaid: string,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>,\n): DidResolutionProfile {\n  const error: ProfileResolutionError = {\n    code,\n    message,\n    details,\n  };\n\n  return {\n    id: uaid,\n    error,\n    metadata: {\n      profile: AID_DNS_WEB_PROFILE_ID,\n      resolved: false,\n    },\n  };\n}\n\nfunction parseRecord(\n  rawRecord: string,\n  supportedSchemes: Set<string>,\n): AidDnsRecordParseResult {\n  const fields = parseSemicolonFields(rawRecord);\n  const version = fields['v'];\n  const protocol = fields['p'] ?? fields['proto'];\n  const endpoint = fields['u'];\n\n  if (!version || !protocol || !endpoint) {\n    return { code: 'ERR_INVALID_AID_RECORD' };\n  }\n  if (!version.toLowerCase().startsWith('aid')) {\n    return { code: 'ERR_INVALID_AID_RECORD' };\n  }\n\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(endpoint);\n  } catch {\n    return { code: 'ERR_ENDPOINT_INVALID' };\n  }\n\n  const scheme = parsedUrl.protocol.replace(/:$/, '').toLowerCase();\n  if (!supportedSchemes.has(scheme)) {\n    return { code: 'ERR_ENDPOINT_INVALID' };\n  }\n\n  return {\n    record: {\n      version,\n      protocol,\n      endpoint: parsedUrl.toString(),\n      publicKey: fields['k'],\n      keyId: fields['i'],\n    },\n  };\n}\n\nfunction deterministicRecordKey(record: AidDnsRecord): string {\n  return `${record.protocol}|${record.endpoint}|${record.publicKey ?? ''}|${record.keyId ?? ''}`;\n}\n\nfunction verificationMethodForLevel(\n  verificationLevel: 'none' | 'metadata' | 'cryptographic',\n): 'aid-pka' | 'metadata-match' | undefined {\n  if (verificationLevel === 'cryptographic') {\n    return 'aid-pka';\n  }\n  if (verificationLevel === 'metadata') {\n    return 'metadata-match';\n  }\n  return undefined;\n}\n\nexport class AidDnsWebProfileResolver implements UaidProfileResolver {\n  readonly adapterKind: 'uaid-profile-resolver' = 'uaid-profile-resolver';\n  readonly profile = AID_DNS_WEB_PROFILE_ID;\n\n  readonly meta: AdapterMeta = {\n    id: 'hcs-14/aid-dns-web',\n    didMethods: ['*'],\n    displayName: 'HCS-14 AID DNS/Web Profile',\n    description:\n      'Resolves uaid:aid identifiers via _agent.<nativeId> DNS TXT records and protocol endpoint hints.',\n  };\n\n  private readonly dnsLookup: DnsTxtLookup;\n  private readonly supportedSchemes: Set<string>;\n  private readonly metadataVerifier?: AidDnsVerification;\n  private readonly cryptographicVerifier?: AidDnsVerification;\n\n  constructor(options: AidDnsWebResolverOptions = {}) {\n    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;\n    this.supportedSchemes = new Set(\n      (options.supportedUriSchemes ?? ['https', 'http', 'wss', 'ws']).map(\n        scheme => scheme.toLowerCase(),\n      ),\n    );\n    this.metadataVerifier = options.metadataVerifier;\n    this.cryptographicVerifier = options.cryptographicVerifier;\n  }\n\n  supports(\n    _uaid: string,\n    parsed: UaidProfileResolverContext['parsedUaid'],\n  ): boolean {\n    if (parsed.method !== 'aid') {\n      return false;\n    }\n    const nativeId = parsed.params['nativeId'];\n    return !!nativeId && isFqdn(nativeId);\n  }\n\n  async resolveProfile(\n    uaid: string,\n    context: UaidProfileResolverContext,\n  ): Promise<DidResolutionProfile | null> {\n    const parsed = context.parsedUaid;\n    if (parsed.method !== 'aid') {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NOT_APPLICABLE',\n        'AID DNS/Web profile only applies to uaid:aid identifiers.',\n      );\n    }\n\n    const nativeId = parsed.params['nativeId'];\n    if (!nativeId || !isFqdn(nativeId)) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NOT_APPLICABLE',\n        'AID DNS/Web profile requires an FQDN nativeId.',\n      );\n    }\n\n    const normalizedNativeId = normalizeDomain(nativeId);\n    const dnsName = `_agent.${normalizedNativeId}`;\n    const txtRecords = await this.dnsLookup(dnsName);\n    if (txtRecords.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NO_DNS_RECORD',\n        'No AID DNS TXT record was found for the requested nativeId.',\n        { dnsName },\n      );\n    }\n\n    const parsedRecords = txtRecords.map(record =>\n      parseRecord(record, this.supportedSchemes),\n    );\n    const validRecords = parsedRecords\n      .filter(\n        (result): result is AidDnsRecordParseSuccess => 'record' in result,\n      )\n      .map(result => result.record);\n\n    if (validRecords.length === 0) {\n      const endpointInvalid = parsedRecords.some(\n        result =>\n          !('record' in result) && result.code === 'ERR_ENDPOINT_INVALID',\n      );\n      return buildErrorProfile(\n        uaid,\n        endpointInvalid ? 'ERR_ENDPOINT_INVALID' : 'ERR_INVALID_AID_RECORD',\n        endpointInvalid\n          ? 'AID DNS record endpoint URI is invalid or unsupported.'\n          : 'AID DNS TXT payload is malformed or unsupported.',\n        { dnsName },\n      );\n    }\n\n    const selectedRecord = [...validRecords].sort((a, b) =>\n      deterministicRecordKey(a).localeCompare(deterministicRecordKey(b)),\n    )[0];\n\n    const verificationInput: AidDnsVerificationInput = {\n      uaid,\n      protocol: selectedRecord.protocol,\n      endpoint: selectedRecord.endpoint,\n      record: selectedRecord,\n    };\n\n    let verificationLevel: 'none' | 'metadata' | 'cryptographic' = 'none';\n\n    if (this.metadataVerifier) {\n      const metadataVerified = await this.metadataVerifier(verificationInput);\n      if (!metadataVerified) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERIFICATION_FAILED',\n          'AID metadata verification failed.',\n          { dnsName },\n        );\n      }\n      verificationLevel = 'metadata';\n    }\n\n    if (selectedRecord.publicKey && this.cryptographicVerifier) {\n      const cryptographicVerified =\n        await this.cryptographicVerifier(verificationInput);\n      if (!cryptographicVerified) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERIFICATION_FAILED',\n          'AID cryptographic verification failed.',\n          { dnsName },\n        );\n      }\n      verificationLevel = 'cryptographic';\n    }\n\n    const did = context.did ?? undefined;\n    const alsoKnownAs = did ? [did] : undefined;\n\n    return {\n      id: uaid,\n      did,\n      alsoKnownAs,\n      service: [\n        {\n          id: `${uaid}#aid-endpoint`,\n          type: 'AIDService',\n          serviceEndpoint: selectedRecord.endpoint,\n        },\n      ],\n      metadata: {\n        profile: AID_DNS_WEB_PROFILE_ID,\n        resolved: true,\n        endpoint: selectedRecord.endpoint,\n        protocol: selectedRecord.protocol,\n        verification: {\n          level: verificationLevel,\n          method: verificationMethodForLevel(verificationLevel),\n        },\n        verificationLevel,\n        precedenceSource: 'dns',\n      },\n    };\n  }\n}\n"],"names":[],"mappings":";;AAUO,MAAM,yBAAyB;AAsCtC,SAAS,kBACP,MACA,MACA,SACA,SACsB;AACtB,QAAM,QAAgC;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAGF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,UAAU;AAAA,IAAA;AAAA,EACZ;AAEJ;AAEA,SAAS,YACP,WACA,kBACyB;AACzB,QAAM,SAAS,qBAAqB,SAAS;AAC7C,QAAM,UAAU,OAAO,GAAG;AAC1B,QAAM,WAAW,OAAO,GAAG,KAAK,OAAO,OAAO;AAC9C,QAAM,WAAW,OAAO,GAAG;AAE3B,MAAI,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU;AACtC,WAAO,EAAE,MAAM,yBAAA;AAAA,EACjB;AACA,MAAI,CAAC,QAAQ,YAAA,EAAc,WAAW,KAAK,GAAG;AAC5C,WAAO,EAAE,MAAM,yBAAA;AAAA,EACjB;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,QAAQ;AAAA,EAC9B,QAAQ;AACN,WAAO,EAAE,MAAM,uBAAA;AAAA,EACjB;AAEA,QAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,EAAE,EAAE,YAAA;AACpD,MAAI,CAAC,iBAAiB,IAAI,MAAM,GAAG;AACjC,WAAO,EAAE,MAAM,uBAAA;AAAA,EACjB;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA,UAAU,UAAU,SAAA;AAAA,MACpB,WAAW,OAAO,GAAG;AAAA,MACrB,OAAO,OAAO,GAAG;AAAA,IAAA;AAAA,EACnB;AAEJ;AAEA,SAAS,uBAAuB,QAA8B;AAC5D,SAAO,GAAG,OAAO,QAAQ,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,EAAE,IAAI,OAAO,SAAS,EAAE;AAC9F;AAEA,SAAS,2BACP,mBAC0C;AAC1C,MAAI,sBAAsB,iBAAiB;AACzC,WAAO;AAAA,EACT;AACA,MAAI,sBAAsB,YAAY;AACpC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,MAAM,yBAAwD;AAAA,EAiBnE,YAAY,UAAoC,IAAI;AAhBpD,SAAS,cAAuC;AAChD,SAAS,UAAU;AAEnB,SAAS,OAAoB;AAAA,MAC3B,IAAI;AAAA,MACJ,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa;AAAA,MACb,aACE;AAAA,IAAA;AASF,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,mBAAmB,IAAI;AAAA,OACzB,QAAQ,uBAAuB,CAAC,SAAS,QAAQ,OAAO,IAAI,GAAG;AAAA,QAC9D,CAAA,WAAU,OAAO,YAAA;AAAA,MAAY;AAAA,IAC/B;AAEF,SAAK,mBAAmB,QAAQ;AAChC,SAAK,wBAAwB,QAAQ;AAAA,EACvC;AAAA,EAEA,SACE,OACA,QACS;AACT,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,WAAO,CAAC,CAAC,YAAY,OAAO,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,eACJ,MACA,SACsC;AACtC,UAAM,SAAS,QAAQ;AACvB,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,QAAI,CAAC,YAAY,CAAC,OAAO,QAAQ,GAAG;AAClC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,qBAAqB,gBAAgB,QAAQ;AACnD,UAAM,UAAU,UAAU,kBAAkB;AAC5C,UAAM,aAAa,MAAM,KAAK,UAAU,OAAO;AAC/C,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,gBAAgB,WAAW;AAAA,MAAI,CAAA,WACnC,YAAY,QAAQ,KAAK,gBAAgB;AAAA,IAAA;AAE3C,UAAM,eAAe,cAClB;AAAA,MACC,CAAC,WAA+C,YAAY;AAAA,IAAA,EAE7D,IAAI,CAAA,WAAU,OAAO,MAAM;AAE9B,QAAI,aAAa,WAAW,GAAG;AAC7B,YAAM,kBAAkB,cAAc;AAAA,QACpC,CAAA,WACE,EAAE,YAAY,WAAW,OAAO,SAAS;AAAA,MAAA;AAE7C,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB,yBAAyB;AAAA,QAC3C,kBACI,2DACA;AAAA,QACJ,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,iBAAiB,CAAC,GAAG,YAAY,EAAE;AAAA,MAAK,CAAC,GAAG,MAChD,uBAAuB,CAAC,EAAE,cAAc,uBAAuB,CAAC,CAAC;AAAA,IAAA,EACjE,CAAC;AAEH,UAAM,oBAA6C;AAAA,MACjD;AAAA,MACA,UAAU,eAAe;AAAA,MACzB,UAAU,eAAe;AAAA,MACzB,QAAQ;AAAA,IAAA;AAGV,QAAI,oBAA2D;AAE/D,QAAI,KAAK,kBAAkB;AACzB,YAAM,mBAAmB,MAAM,KAAK,iBAAiB,iBAAiB;AACtE,UAAI,CAAC,kBAAkB;AACrB,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,QAAA;AAAA,QAAQ;AAAA,MAEd;AACA,0BAAoB;AAAA,IACtB;AAEA,QAAI,eAAe,aAAa,KAAK,uBAAuB;AAC1D,YAAM,wBACJ,MAAM,KAAK,sBAAsB,iBAAiB;AACpD,UAAI,CAAC,uBAAuB;AAC1B,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,QAAA;AAAA,QAAQ;AAAA,MAEd;AACA,0BAAoB;AAAA,IACtB;AAEA,UAAM,MAAM,QAAQ,OAAO;AAC3B,UAAM,cAAc,MAAM,CAAC,GAAG,IAAI;AAElC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,SAAS;AAAA,QACP;AAAA,UACE,IAAI,GAAG,IAAI;AAAA,UACX,MAAM;AAAA,UACN,iBAAiB,eAAe;AAAA,QAAA;AAAA,MAClC;AAAA,MAEF,UAAU;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU,eAAe;AAAA,QACzB,UAAU,eAAe;AAAA,QACzB,cAAc;AAAA,UACZ,OAAO;AAAA,UACP,QAAQ,2BAA2B,iBAAiB;AAAA,QAAA;AAAA,QAEtD;AAAA,QACA,kBAAkB;AAAA,MAAA;AAAA,IACpB;AAAA,EAEJ;AACF;"}

package/dist/es/standards-sdk.es63.js

@@ -1,8 +1,8 @@
-import { nodeDnsTxtLookup } from "./standards-sdk.es65.js";
-import { uaidTargetFromParsed, isFqdn, normalizeDomain, buildCanonicalUaid, parseSemicolonFields } from "./standards-sdk.es158.js";
-import { AID_DNS_WEB_PROFILE_ID } from "./standards-sdk.es62.js";
-import { UAID_DID_RESOLUTION_PROFILE_ID } from "./standards-sdk.es64.js";
-const UAID_DNS_WEB_PROFILE_ID = "hcs-14.profile.uaid-dns-web";
+import { nodeDnsTxtLookup } from "./standards-sdk.es66.js";
+import { isFqdn, normalizeDomain } from "./standards-sdk.es159.js";
+import { normalizeAnsVersion, isValidAnsProfileVersion, parseAnsDnsTxtRecord, toErrorMessage, parseAnsAgentCard, extractEndpointCandidates, selectPreferredEndpoint } from "./standards-sdk.es160.js";
+const ANS_DNS_WEB_PROFILE_ID = "hcs-14.profile.ans-dns-web";
+const UAID_UNSPECIFIED_PARAM_VALUE = "0";
 function buildErrorProfile(uaid, code, message, details) {
   const error = {
     code,
@@ -13,100 +13,58 @@ function buildErrorProfile(uaid, code, message, details) {
     id: uaid,
     error,
     metadata: {
-      profile: UAID_DNS_WEB_PROFILE_ID,
+      profile: ANS_DNS_WEB_PROFILE_ID,
       resolved: false
     }
   };
 }
-function canonicalizeNativeDomainParams(params) {
-  const next = { ...params };
-  const nativeId = next["nativeId"];
-  if (nativeId && isFqdn(nativeId)) {
-    next["nativeId"] = normalizeDomain(nativeId);
+async function defaultFetchJson(url) {
+  if (typeof globalThis.fetch !== "function") {
+    throw new Error("Fetch API is unavailable in this runtime.");
   }
-  const domain = next["domain"];
-  if (domain && isFqdn(domain)) {
-    next["domain"] = normalizeDomain(domain);
+  const response = await globalThis.fetch(url, {
+    method: "GET",
+    headers: {
+      accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Agent Card request failed with status ${response.status}.`
+    );
   }
-  return next;
+  return response.json();
 }
-function validateRecordFields(fields, queriedNativeId) {
-  const target = fields["target"];
-  const id = fields["id"];
-  const uid = fields["uid"];
-  const proto = fields["proto"];
-  const nativeId = fields["nativeId"];
-  if (target !== "aid" && target !== "did") {
-    return null;
-  }
-  if (!id || !uid || !proto || !nativeId) {
-    return null;
-  }
-  if (normalizeDomain(nativeId) !== queriedNativeId) {
-    return null;
-  }
-  if ("registry" in fields && !fields["registry"]) {
-    return null;
-  }
-  const did = fields["did"];
-  if (did && (target !== "did" || !did.startsWith("did:"))) {
-    return null;
-  }
-  const params = {
-    uid,
-    proto,
-    nativeId
-  };
-  if (fields["registry"]) {
-    params["registry"] = fields["registry"];
-  }
-  if (fields["domain"]) {
-    params["domain"] = fields["domain"];
-  }
-  if (fields["src"]) {
-    params["src"] = fields["src"];
-  }
-  return {
-    target,
-    id,
-    uid,
-    proto,
-    nativeId,
-    registry: fields["registry"],
-    domain: fields["domain"],
-    src: fields["src"],
-    did,
-    memo: fields["m"],
-    reconstructedUaid: buildCanonicalUaid(
-      target,
-      id,
-      canonicalizeNativeDomainParams(params)
-    )
-  };
+function isUnspecifiedUaidParamValue(value) {
+  return !value || value === UAID_UNSPECIFIED_PARAM_VALUE;
 }
-function selectFollowupProfiles(target) {
-  if (target === "aid") {
-    return [AID_DNS_WEB_PROFILE_ID];
-  }
-  return [UAID_DID_RESOLUTION_PROFILE_ID];
+function selectDeterministicAnsDnsRecord(records) {
+  return [...records].sort((a, b) => a.url.localeCompare(b.url))[0];
 }
-class UaidDnsWebProfileResolver {
+class AnsDnsWebProfileResolver {
   constructor(options = {}) {
-    this.profile = UAID_DNS_WEB_PROFILE_ID;
+    this.adapterKind = "uaid-profile-resolver";
+    this.profile = ANS_DNS_WEB_PROFILE_ID;
     this.meta = {
-      id: "hcs-14/uaid-dns-web",
+      id: "hcs-14/ans-dns-web",
       didMethods: ["*"],
-      displayName: "HCS-14 UAID DNS TXT Profile",
-      description: "Binds UAIDs to DNS TXT records at _uaid.<nativeId> and can continue to follow-up profile resolution."
+      displayName: "HCS-14 ANS DNS/Web Profile",
+      description: "Resolves ANS uaid:aid identifiers via _ans.<nativeId> TXT records and Agent Card endpoint selection."
     };
     this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;
-    this.dnssecValidation = options.dnssecValidation;
-    this.requireFullResolution = options.requireFullResolution ?? false;
-    this.enableFollowupResolution = options.enableFollowupResolution ?? true;
+    this.fetchJson = options.fetchJson ?? defaultFetchJson;
+    this.supportedSchemes = new Set(
+      (options.supportedUriSchemes ?? ["https", "wss"]).map(
+        (scheme) => scheme.toLowerCase()
+      )
+    );
+    this.transparencyVerifier = options.transparencyVerifier;
   }
   supports(_uaid, parsed) {
-    const target = uaidTargetFromParsed(parsed);
-    if (target !== "aid" && target !== "did") {
+    if (parsed.method !== "aid") {
+      return false;
+    }
+    if (parsed.params["registry"] !== "ans") {
       return false;
     }
     const nativeId = parsed.params["nativeId"];
@@ -114,113 +72,216 @@ class UaidDnsWebProfileResolver {
   }
   async resolveProfile(uaid, context) {
     const parsed = context.parsedUaid;
+    if (parsed.method !== "aid") {
+      return buildErrorProfile(
+        uaid,
+        "ERR_NOT_APPLICABLE",
+        "ANS profile only applies to uaid:aid identifiers."
+      );
+    }
+    if (parsed.params["registry"] !== "ans") {
+      return buildErrorProfile(
+        uaid,
+        "ERR_NOT_APPLICABLE",
+        "ANS profile requires registry=ans."
+      );
+    }
     const nativeId = parsed.params["nativeId"];
     if (!nativeId || !isFqdn(nativeId)) {
-      return null;
+      return buildErrorProfile(
+        uaid,
+        "ERR_NOT_APPLICABLE",
+        "ANS profile requires an FQDN nativeId."
+      );
+    }
+    const uid = parsed.params["uid"];
+    if (isUnspecifiedUaidParamValue(uid)) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_NOT_APPLICABLE",
+        "ANS profile requires a non-zero uid parameter."
+      );
+    }
+    const protocol = parsed.params["proto"];
+    if (isUnspecifiedUaidParamValue(protocol)) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_PROTOCOL_UNSPECIFIED",
+        "ANS profile requires a usable proto parameter."
+      );
+    }
+    const uaidVersion = parsed.params["version"];
+    const normalizedUaidVersion = uaidVersion === void 0 ? void 0 : normalizeAnsVersion(uaidVersion);
+    if (uaidVersion !== void 0 && !isValidAnsProfileVersion(uaidVersion)) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_NOT_APPLICABLE",
+        "ANS profile requires a valid semver version parameter when provided."
+      );
     }
     const normalizedNativeId = normalizeDomain(nativeId);
-    const dnsName = `_uaid.${normalizedNativeId}`;
-    const inputCanonical = buildCanonicalUaid(
-      uaidTargetFromParsed(parsed),
-      parsed.id,
-      canonicalizeNativeDomainParams(parsed.params)
-    );
+    const dnsName = `_ans.${normalizedNativeId}`;
     const txtRecords = await this.dnsLookup(dnsName);
     if (txtRecords.length === 0) {
-      return null;
+      return buildErrorProfile(
+        uaid,
+        "ERR_NO_DNS_RECORD",
+        "No ANS DNS TXT record was found for the requested nativeId.",
+        { dnsName }
+      );
     }
-    const parsedRecords = txtRecords.map((record) => parseSemicolonFields(record)).map((fields) => validateRecordFields(fields, normalizedNativeId));
-    const validRecords = parsedRecords.filter(
-      (record) => record !== null
-    );
-    if (validRecords.length === 0) {
+    const validTxtRecords = txtRecords.map((record) => parseAnsDnsTxtRecord(record)).filter((record) => record !== null);
+    if (validTxtRecords.length === 0) {
       return buildErrorProfile(
         uaid,
-        "ERR_INVALID_UAID_DNS_RECORD",
-        "DNS TXT payload at _uaid record is invalid.",
+        "ERR_INVALID_ANS_RECORD",
+        "ANS DNS TXT payload is malformed or unsupported.",
         { dnsName }
       );
     }
-    const matchingRecords = validRecords.filter(
-      (record) => record.target === uaidTargetFromParsed(parsed) && record.id === parsed.id && record.reconstructedUaid === inputCanonical
+    let matchingVersionRecords = validTxtRecords;
+    if (normalizedUaidVersion) {
+      const recordsWithVersion = validTxtRecords.filter((record) => {
+        return record.version !== void 0;
+      });
+      if (recordsWithVersion.length === 0) {
+        return buildErrorProfile(
+          uaid,
+          "ERR_VERSION_MISMATCH",
+          "UAID specifies a version but no ANS DNS TXT record carries a version field.",
+          { dnsName, uaidVersion: normalizedUaidVersion }
+        );
+      }
+      matchingVersionRecords = recordsWithVersion.filter((record) => {
+        return record.version === normalizedUaidVersion;
+      });
+      if (matchingVersionRecords.length === 0) {
+        return buildErrorProfile(
+          uaid,
+          "ERR_VERSION_MISMATCH",
+          "UAID version does not match ANS DNS TXT record version.",
+          { dnsName, uaidVersion: normalizedUaidVersion }
+        );
+      }
+    }
+    const selectedRecord = selectDeterministicAnsDnsRecord(
+      matchingVersionRecords
     );
-    if (matchingRecords.length === 0) {
+    let agentCardPayload;
+    try {
+      agentCardPayload = await this.fetchJson(selectedRecord.url);
+    } catch (error) {
       return buildErrorProfile(
         uaid,
-        "ERR_UAID_MISMATCH",
-        "DNS TXT payload does not match the input UAID after canonical reconstruction.",
+        "ERR_AGENT_CARD_INVALID",
+        "Agent Card retrieval failed.",
         {
-          dnsName,
-          inputCanonical
+          stage: "fetch",
+          agentCardUrl: selectedRecord.url,
+          reason: toErrorMessage(error)
         }
       );
     }
-    const selected = [...matchingRecords].sort(
-      (a, b) => a.reconstructedUaid.localeCompare(b.reconstructedUaid)
-    )[0];
-    const dnssecValidated = this.dnssecValidation ? await this.dnssecValidation(dnsName) : false;
-    const verificationLevel = dnssecValidated ? "dns-binding-dnssec" : "dns-binding";
-    if (this.enableFollowupResolution) {
-      const followupProfiles = selectFollowupProfiles(selected.target);
-      for (const followupProfileId of followupProfiles) {
-        const followup = await context.resolveUaidProfileById(
-          followupProfileId,
-          uaid
-        );
-        if (!followup) {
-          continue;
-        }
-        if (followup.error || followup.metadata?.resolved === false) {
-          return buildErrorProfile(
-            uaid,
-            "ERR_FOLLOWUP_RESOLUTION_FAILED",
-            "Follow-up profile resolution failed after successful DNS binding.",
-            {
-              followupProfileId,
-              dnsName
-            }
-          );
+    const agentCard = parseAnsAgentCard(agentCardPayload);
+    if (!agentCard) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_AGENT_CARD_INVALID",
+        "Agent Card is missing required fields.",
+        { stage: "validate", agentCardUrl: selectedRecord.url }
+      );
+    }
+    if (agentCard.ansName !== uid) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_AGENT_CARD_INVALID",
+        "Agent Card ansName does not match UAID uid.",
+        {
+          stage: "validate",
+          expectedUid: uid,
+          actualAnsName: agentCard.ansName
         }
-        return {
-          ...followup,
-          metadata: {
-            ...followup.metadata,
-            profile: UAID_DNS_WEB_PROFILE_ID,
-            resolved: true,
-            verificationLevel,
-            reconstructedUaid: selected.reconstructedUaid,
-            selectedFollowupProfile: followupProfileId,
-            resolutionMode: "full-resolution"
-          }
-        };
-      }
+      );
     }
-    if (this.requireFullResolution) {
+    const endpointCandidates = extractEndpointCandidates(
+      agentCard.endpoints,
+      this.supportedSchemes
+    );
+    const anchoredCandidates = endpointCandidates.filter((candidate) => {
+      return normalizeDomain(candidate.parsedUrl.hostname) === normalizedNativeId;
+    });
+    if (anchoredCandidates.length === 0) {
       return buildErrorProfile(
         uaid,
-        "ERR_NO_FOLLOWUP_PROFILE",
-        "Resolver policy requires full resolution, but no supported follow-up profile was available.",
-        { dnsName }
+        "ERR_ENDPOINT_NOT_ANCHORED",
+        "No endpoint URL is anchored to the UAID nativeId host.",
+        {
+          nativeId: normalizedNativeId
+        }
       );
     }
-    const did = selected.did ?? context.did ?? void 0;
+    const selectedEndpoint = selectPreferredEndpoint(anchoredCandidates, protocol) ?? anchoredCandidates[0];
+    let transparencyAttempted = false;
+    let transparencySucceeded = false;
+    if (this.transparencyVerifier) {
+      transparencyAttempted = true;
+      transparencySucceeded = await this.transparencyVerifier({
+        uaid,
+        protocol,
+        endpoint: selectedEndpoint.endpointUrl,
+        agentCardUrl: selectedRecord.url,
+        transparencyHints: agentCard.transparencyHints
+      });
+      if (!transparencySucceeded) {
+        return buildErrorProfile(
+          uaid,
+          "ERR_TRANSPARENCY_VERIFICATION_FAILED",
+          "Transparency verification failed.",
+          {
+            agentCardUrl: selectedRecord.url
+          }
+        );
+      }
+    }
+    const did = context.did ?? void 0;
     const alsoKnownAs = did ? [did] : void 0;
+    const verificationLevel = transparencySucceeded ? "cryptographic" : "metadata";
+    const verificationMethod = transparencySucceeded ? "ans-transparency" : "metadata-match";
     return {
       id: uaid,
       did,
       alsoKnownAs,
+      service: [
+        {
+          id: `${uaid}#ans-endpoint`,
+          type: "ANSService",
+          serviceEndpoint: selectedEndpoint.endpointUrl
+        }
+      ],
       metadata: {
-        profile: UAID_DNS_WEB_PROFILE_ID,
+        profile: ANS_DNS_WEB_PROFILE_ID,
         resolved: true,
-        reconstructedUaid: selected.reconstructedUaid,
+        endpoint: selectedEndpoint.endpointUrl,
+        protocol,
+        precedenceSource: "dns",
+        verification: {
+          level: verificationLevel,
+          method: verificationMethod
+        },
         verificationLevel,
-        resolutionMode: "dns-binding-only"
+        agentCardUrl: selectedRecord.url,
+        dnsRecordSelection: "lexicographically-smallest-url",
+        transparencyHints: agentCard.transparencyHints,
+        transparencyVerification: {
+          attempted: transparencyAttempted,
+          succeeded: transparencySucceeded
+        }
       }
     };
   }
 }
 export {
-  UAID_DNS_WEB_PROFILE_ID,
-  UaidDnsWebProfileResolver
+  ANS_DNS_WEB_PROFILE_ID,
+  AnsDnsWebProfileResolver
 };
 //# sourceMappingURL=standards-sdk.es63.js.map

package/dist/es/standards-sdk.es63.js.map

@@ -1 +1 @@
-{"version":3,"file":"standards-sdk.es63.js","sources":["../../src/hcs-14/resolvers/uaid-dns-web-profile.ts"],"sourcesContent":["import type {\n  DidResolutionProfile,\n  ProfileResolutionError,\n  UaidProfileResolver,\n  UaidProfileResolverContext,\n} from './types';\nimport type { AdapterMeta } from '../adapters/types';\nimport { nodeDnsTxtLookup, type DnsTxtLookup } from './dns';\nimport {\n  buildCanonicalUaid,\n  isFqdn,\n  normalizeDomain,\n  parseSemicolonFields,\n  uaidTargetFromParsed,\n} from './profile-utils';\nimport { AID_DNS_WEB_PROFILE_ID } from './aid-dns-web-profile';\nimport { UAID_DID_RESOLUTION_PROFILE_ID } from './uaid-did-resolution-profile';\n\nexport const UAID_DNS_WEB_PROFILE_ID = 'hcs-14.profile.uaid-dns-web';\n\ninterface UaidDnsWebRecord {\n  target: 'aid' | 'did';\n  id: string;\n  uid: string;\n  proto: string;\n  nativeId: string;\n  registry?: string;\n  domain?: string;\n  src?: string;\n  did?: string;\n  memo?: string;\n  reconstructedUaid: string;\n}\n\nexport interface UaidDnsWebResolverOptions {\n  dnsLookup?: DnsTxtLookup;\n  dnssecValidation?: (hostname: string) => Promise<boolean>;\n  requireFullResolution?: boolean;\n  enableFollowupResolution?: boolean;\n}\n\nfunction buildErrorProfile(\n  uaid: string,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>,\n): DidResolutionProfile {\n  const error: ProfileResolutionError = {\n    code,\n    message,\n    details,\n  };\n\n  return {\n    id: uaid,\n    error,\n    metadata: {\n      profile: UAID_DNS_WEB_PROFILE_ID,\n      resolved: false,\n    },\n  };\n}\n\nfunction canonicalizeNativeDomainParams(\n  params: Record<string, string>,\n): Record<string, string> {\n  const next = { ...params };\n  const nativeId = next['nativeId'];\n  if (nativeId && isFqdn(nativeId)) {\n    next['nativeId'] = normalizeDomain(nativeId);\n  }\n  const domain = next['domain'];\n  if (domain && isFqdn(domain)) {\n    next['domain'] = normalizeDomain(domain);\n  }\n  return next;\n}\n\nfunction validateRecordFields(\n  fields: Record<string, string>,\n  queriedNativeId: string,\n): UaidDnsWebRecord | null {\n  const target = fields['target'];\n  const id = fields['id'];\n  const uid = fields['uid'];\n  const proto = fields['proto'];\n  const nativeId = fields['nativeId'];\n\n  if (target !== 'aid' && target !== 'did') {\n    return null;\n  }\n  if (!id || !uid || !proto || !nativeId) {\n    return null;\n  }\n  if (normalizeDomain(nativeId) !== queriedNativeId) {\n    return null;\n  }\n  if ('registry' in fields && !fields['registry']) {\n    return null;\n  }\n  const did = fields['did'];\n  if (did && (target !== 'did' || !did.startsWith('did:'))) {\n    return null;\n  }\n\n  const params: Record<string, string> = {\n    uid,\n    proto,\n    nativeId,\n  };\n  if (fields['registry']) {\n    params['registry'] = fields['registry'];\n  }\n  if (fields['domain']) {\n    params['domain'] = fields['domain'];\n  }\n  if (fields['src']) {\n    params['src'] = fields['src'];\n  }\n\n  return {\n    target,\n    id,\n    uid,\n    proto,\n    nativeId,\n    registry: fields['registry'],\n    domain: fields['domain'],\n    src: fields['src'],\n    did,\n    memo: fields['m'],\n    reconstructedUaid: buildCanonicalUaid(\n      target,\n      id,\n      canonicalizeNativeDomainParams(params),\n    ),\n  };\n}\n\nfunction selectFollowupProfiles(target: 'aid' | 'did'): string[] {\n  if (target === 'aid') {\n    return [AID_DNS_WEB_PROFILE_ID];\n  }\n  return [UAID_DID_RESOLUTION_PROFILE_ID];\n}\n\nexport class UaidDnsWebProfileResolver implements UaidProfileResolver {\n  readonly profile = UAID_DNS_WEB_PROFILE_ID;\n\n  readonly meta: AdapterMeta = {\n    id: 'hcs-14/uaid-dns-web',\n    didMethods: ['*'],\n    displayName: 'HCS-14 UAID DNS TXT Profile',\n    description:\n      'Binds UAIDs to DNS TXT records at _uaid.<nativeId> and can continue to follow-up profile resolution.',\n  };\n\n  private readonly dnsLookup: DnsTxtLookup;\n  private readonly dnssecValidation?: (hostname: string) => Promise<boolean>;\n  private readonly requireFullResolution: boolean;\n  private readonly enableFollowupResolution: boolean;\n\n  constructor(options: UaidDnsWebResolverOptions = {}) {\n    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;\n    this.dnssecValidation = options.dnssecValidation;\n    this.requireFullResolution = options.requireFullResolution ?? false;\n    this.enableFollowupResolution = options.enableFollowupResolution ?? true;\n  }\n\n  supports(\n    _uaid: string,\n    parsed: UaidProfileResolverContext['parsedUaid'],\n  ): boolean {\n    const target = uaidTargetFromParsed(parsed);\n    if (target !== 'aid' && target !== 'did') {\n      return false;\n    }\n    const nativeId = parsed.params['nativeId'];\n    return !!nativeId && isFqdn(nativeId);\n  }\n\n  async resolveProfile(\n    uaid: string,\n    context: UaidProfileResolverContext,\n  ): Promise<DidResolutionProfile | null> {\n    const parsed = context.parsedUaid;\n    const nativeId = parsed.params['nativeId'];\n    if (!nativeId || !isFqdn(nativeId)) {\n      return null;\n    }\n\n    const normalizedNativeId = normalizeDomain(nativeId);\n    const dnsName = `_uaid.${normalizedNativeId}`;\n    const inputCanonical = buildCanonicalUaid(\n      uaidTargetFromParsed(parsed),\n      parsed.id,\n      canonicalizeNativeDomainParams(parsed.params),\n    );\n\n    const txtRecords = await this.dnsLookup(dnsName);\n    if (txtRecords.length === 0) {\n      return null;\n    }\n\n    const parsedRecords = txtRecords\n      .map(record => parseSemicolonFields(record))\n      .map(fields => validateRecordFields(fields, normalizedNativeId));\n    const validRecords = parsedRecords.filter(\n      (record): record is UaidDnsWebRecord => record !== null,\n    );\n\n    if (validRecords.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_INVALID_UAID_DNS_RECORD',\n        'DNS TXT payload at _uaid record is invalid.',\n        { dnsName },\n      );\n    }\n\n    const matchingRecords = validRecords.filter(\n      record =>\n        record.target === uaidTargetFromParsed(parsed) &&\n        record.id === parsed.id &&\n        record.reconstructedUaid === inputCanonical,\n    );\n\n    if (matchingRecords.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_UAID_MISMATCH',\n        'DNS TXT payload does not match the input UAID after canonical reconstruction.',\n        {\n          dnsName,\n          inputCanonical,\n        },\n      );\n    }\n\n    const selected = [...matchingRecords].sort((a, b) =>\n      a.reconstructedUaid.localeCompare(b.reconstructedUaid),\n    )[0];\n\n    const dnssecValidated = this.dnssecValidation\n      ? await this.dnssecValidation(dnsName)\n      : false;\n    const verificationLevel = dnssecValidated\n      ? 'dns-binding-dnssec'\n      : 'dns-binding';\n\n    if (this.enableFollowupResolution) {\n      const followupProfiles = selectFollowupProfiles(selected.target);\n      for (const followupProfileId of followupProfiles) {\n        const followup = await context.resolveUaidProfileById(\n          followupProfileId,\n          uaid,\n        );\n        if (!followup) {\n          continue;\n        }\n        if (followup.error || followup.metadata?.resolved === false) {\n          return buildErrorProfile(\n            uaid,\n            'ERR_FOLLOWUP_RESOLUTION_FAILED',\n            'Follow-up profile resolution failed after successful DNS binding.',\n            {\n              followupProfileId,\n              dnsName,\n            },\n          );\n        }\n        return {\n          ...followup,\n          metadata: {\n            ...followup.metadata,\n            profile: UAID_DNS_WEB_PROFILE_ID,\n            resolved: true,\n            verificationLevel,\n            reconstructedUaid: selected.reconstructedUaid,\n            selectedFollowupProfile: followupProfileId,\n            resolutionMode: 'full-resolution',\n          },\n        };\n      }\n    }\n\n    if (this.requireFullResolution) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NO_FOLLOWUP_PROFILE',\n        'Resolver policy requires full resolution, but no supported follow-up profile was available.',\n        { dnsName },\n      );\n    }\n\n    const did = selected.did ?? context.did ?? undefined;\n    const alsoKnownAs = did ? [did] : undefined;\n\n    return {\n      id: uaid,\n      did,\n      alsoKnownAs,\n      metadata: {\n        profile: UAID_DNS_WEB_PROFILE_ID,\n        resolved: true,\n        reconstructedUaid: selected.reconstructedUaid,\n        verificationLevel,\n        resolutionMode: 'dns-binding-only',\n      },\n    };\n  }\n}\n"],"names":[],"mappings":";;;;AAkBO,MAAM,0BAA0B;AAuBvC,SAAS,kBACP,MACA,MACA,SACA,SACsB;AACtB,QAAM,QAAgC;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAGF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,UAAU;AAAA,IAAA;AAAA,EACZ;AAEJ;AAEA,SAAS,+BACP,QACwB;AACxB,QAAM,OAAO,EAAE,GAAG,OAAA;AAClB,QAAM,WAAW,KAAK,UAAU;AAChC,MAAI,YAAY,OAAO,QAAQ,GAAG;AAChC,SAAK,UAAU,IAAI,gBAAgB,QAAQ;AAAA,EAC7C;AACA,QAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,UAAU,OAAO,MAAM,GAAG;AAC5B,SAAK,QAAQ,IAAI,gBAAgB,MAAM;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,qBACP,QACA,iBACyB;AACzB,QAAM,SAAS,OAAO,QAAQ;AAC9B,QAAM,KAAK,OAAO,IAAI;AACtB,QAAM,MAAM,OAAO,KAAK;AACxB,QAAM,QAAQ,OAAO,OAAO;AAC5B,QAAM,WAAW,OAAO,UAAU;AAElC,MAAI,WAAW,SAAS,WAAW,OAAO;AACxC,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU;AACtC,WAAO;AAAA,EACT;AACA,MAAI,gBAAgB,QAAQ,MAAM,iBAAiB;AACjD,WAAO;AAAA,EACT;AACA,MAAI,cAAc,UAAU,CAAC,OAAO,UAAU,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,MAAM,OAAO,KAAK;AACxB,MAAI,QAAQ,WAAW,SAAS,CAAC,IAAI,WAAW,MAAM,IAAI;AACxD,WAAO;AAAA,EACT;AAEA,QAAM,SAAiC;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,UAAU,IAAI,OAAO,UAAU;AAAA,EACxC;AACA,MAAI,OAAO,QAAQ,GAAG;AACpB,WAAO,QAAQ,IAAI,OAAO,QAAQ;AAAA,EACpC;AACA,MAAI,OAAO,KAAK,GAAG;AACjB,WAAO,KAAK,IAAI,OAAO,KAAK;AAAA,EAC9B;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,OAAO,UAAU;AAAA,IAC3B,QAAQ,OAAO,QAAQ;AAAA,IACvB,KAAK,OAAO,KAAK;AAAA,IACjB;AAAA,IACA,MAAM,OAAO,GAAG;AAAA,IAChB,mBAAmB;AAAA,MACjB;AAAA,MACA;AAAA,MACA,+BAA+B,MAAM;AAAA,IAAA;AAAA,EACvC;AAEJ;AAEA,SAAS,uBAAuB,QAAiC;AAC/D,MAAI,WAAW,OAAO;AACpB,WAAO,CAAC,sBAAsB;AAAA,EAChC;AACA,SAAO,CAAC,8BAA8B;AACxC;AAEO,MAAM,0BAAyD;AAAA,EAgBpE,YAAY,UAAqC,IAAI;AAfrD,SAAS,UAAU;AAEnB,SAAS,OAAoB;AAAA,MAC3B,IAAI;AAAA,MACJ,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa;AAAA,MACb,aACE;AAAA,IAAA;AASF,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,mBAAmB,QAAQ;AAChC,SAAK,wBAAwB,QAAQ,yBAAyB;AAC9D,SAAK,2BAA2B,QAAQ,4BAA4B;AAAA,EACtE;AAAA,EAEA,SACE,OACA,QACS;AACT,UAAM,SAAS,qBAAqB,MAAM;AAC1C,QAAI,WAAW,SAAS,WAAW,OAAO;AACxC,aAAO;AAAA,IACT;AACA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,WAAO,CAAC,CAAC,YAAY,OAAO,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,eACJ,MACA,SACsC;AACtC,UAAM,SAAS,QAAQ;AACvB,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,QAAI,CAAC,YAAY,CAAC,OAAO,QAAQ,GAAG;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,qBAAqB,gBAAgB,QAAQ;AACnD,UAAM,UAAU,SAAS,kBAAkB;AAC3C,UAAM,iBAAiB;AAAA,MACrB,qBAAqB,MAAM;AAAA,MAC3B,OAAO;AAAA,MACP,+BAA+B,OAAO,MAAM;AAAA,IAAA;AAG9C,UAAM,aAAa,MAAM,KAAK,UAAU,OAAO;AAC/C,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO;AAAA,IACT;AAEA,UAAM,gBAAgB,WACnB,IAAI,CAAA,WAAU,qBAAqB,MAAM,CAAC,EAC1C,IAAI,CAAA,WAAU,qBAAqB,QAAQ,kBAAkB,CAAC;AACjE,UAAM,eAAe,cAAc;AAAA,MACjC,CAAC,WAAuC,WAAW;AAAA,IAAA;AAGrD,QAAI,aAAa,WAAW,GAAG;AAC7B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,kBAAkB,aAAa;AAAA,MACnC,CAAA,WACE,OAAO,WAAW,qBAAqB,MAAM,KAC7C,OAAO,OAAO,OAAO,MACrB,OAAO,sBAAsB;AAAA,IAAA;AAGjC,QAAI,gBAAgB,WAAW,GAAG;AAChC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,QAAA;AAAA,MACF;AAAA,IAEJ;AAEA,UAAM,WAAW,CAAC,GAAG,eAAe,EAAE;AAAA,MAAK,CAAC,GAAG,MAC7C,EAAE,kBAAkB,cAAc,EAAE,iBAAiB;AAAA,IAAA,EACrD,CAAC;AAEH,UAAM,kBAAkB,KAAK,mBACzB,MAAM,KAAK,iBAAiB,OAAO,IACnC;AACJ,UAAM,oBAAoB,kBACtB,uBACA;AAEJ,QAAI,KAAK,0BAA0B;AACjC,YAAM,mBAAmB,uBAAuB,SAAS,MAAM;AAC/D,iBAAW,qBAAqB,kBAAkB;AAChD,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAEF,YAAI,CAAC,UAAU;AACb;AAAA,QACF;AACA,YAAI,SAAS,SAAS,SAAS,UAAU,aAAa,OAAO;AAC3D,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,cACE;AAAA,cACA;AAAA,YAAA;AAAA,UACF;AAAA,QAEJ;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,UAAU;AAAA,YACR,GAAG,SAAS;AAAA,YACZ,SAAS;AAAA,YACT,UAAU;AAAA,YACV;AAAA,YACA,mBAAmB,SAAS;AAAA,YAC5B,yBAAyB;AAAA,YACzB,gBAAgB;AAAA,UAAA;AAAA,QAClB;AAAA,MAEJ;AAAA,IACF;AAEA,QAAI,KAAK,uBAAuB;AAC9B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,MAAM,SAAS,OAAO,QAAQ,OAAO;AAC3C,UAAM,cAAc,MAAM,CAAC,GAAG,IAAI;AAElC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,UAAU;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,mBAAmB,SAAS;AAAA,QAC5B;AAAA,QACA,gBAAgB;AAAA,MAAA;AAAA,IAClB;AAAA,EAEJ;AACF;"}
+{"version":3,"file":"standards-sdk.es63.js","sources":["../../src/hcs-14/resolvers/ans-dns-web-profile.ts"],"sourcesContent":["import type {\n  DidResolutionProfile,\n  ProfileResolutionError,\n  ProfileResolutionTransparencyHints,\n  UaidProfileResolver,\n  UaidProfileResolverContext,\n} from './types';\nimport type { AdapterMeta } from '../adapters/types';\nimport { nodeDnsTxtLookup, type DnsTxtLookup } from './dns';\nimport { isFqdn, normalizeDomain } from './profile-utils';\nimport {\n  parseAnsDnsTxtRecord,\n  type AnsDnsTxtRecord,\n  parseAnsAgentCard,\n  extractEndpointCandidates,\n  selectPreferredEndpoint,\n  isValidAnsProfileVersion,\n  normalizeAnsVersion,\n  toErrorMessage,\n} from './ans-dns-web-profile-utils';\n\nexport const ANS_DNS_WEB_PROFILE_ID = 'hcs-14.profile.ans-dns-web';\n\nexport interface AnsTransparencyVerificationInput {\n  uaid: string;\n  protocol: string;\n  endpoint: string;\n  agentCardUrl: string;\n  transparencyHints?: ProfileResolutionTransparencyHints;\n}\n\ntype AnsTransparencyVerifier = (\n  input: AnsTransparencyVerificationInput,\n) => Promise<boolean>;\n\nexport interface AnsDnsWebResolverOptions {\n  dnsLookup?: DnsTxtLookup;\n  fetchJson?: (url: string) => Promise<unknown>;\n  supportedUriSchemes?: string[];\n  transparencyVerifier?: AnsTransparencyVerifier;\n}\n\nconst UAID_UNSPECIFIED_PARAM_VALUE = '0';\n\nfunction buildErrorProfile(\n  uaid: string,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>,\n): DidResolutionProfile {\n  const error: ProfileResolutionError = {\n    code,\n    message,\n    details,\n  };\n\n  return {\n    id: uaid,\n    error,\n    metadata: {\n      profile: ANS_DNS_WEB_PROFILE_ID,\n      resolved: false,\n    },\n  };\n}\n\nasync function defaultFetchJson(url: string): Promise<unknown> {\n  if (typeof globalThis.fetch !== 'function') {\n    throw new Error('Fetch API is unavailable in this runtime.');\n  }\n\n  const response = await globalThis.fetch(url, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n    },\n  });\n  if (!response.ok) {\n    throw new Error(\n      `Agent Card request failed with status ${response.status}.`,\n    );\n  }\n  return response.json();\n}\n\nfunction isUnspecifiedUaidParamValue(value: string | undefined): boolean {\n  return !value || value === UAID_UNSPECIFIED_PARAM_VALUE;\n}\n\nfunction selectDeterministicAnsDnsRecord(\n  records: AnsDnsTxtRecord[],\n): AnsDnsTxtRecord {\n  return [...records].sort((a, b) => a.url.localeCompare(b.url))[0];\n}\n\nexport class AnsDnsWebProfileResolver implements UaidProfileResolver {\n  readonly adapterKind: 'uaid-profile-resolver' = 'uaid-profile-resolver';\n  readonly profile = ANS_DNS_WEB_PROFILE_ID;\n\n  readonly meta: AdapterMeta = {\n    id: 'hcs-14/ans-dns-web',\n    didMethods: ['*'],\n    displayName: 'HCS-14 ANS DNS/Web Profile',\n    description:\n      'Resolves ANS uaid:aid identifiers via _ans.<nativeId> TXT records and Agent Card endpoint selection.',\n  };\n\n  private readonly dnsLookup: DnsTxtLookup;\n  private readonly fetchJson: (url: string) => Promise<unknown>;\n  private readonly supportedSchemes: Set<string>;\n  private readonly transparencyVerifier?: AnsTransparencyVerifier;\n\n  constructor(options: AnsDnsWebResolverOptions = {}) {\n    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;\n    this.fetchJson = options.fetchJson ?? defaultFetchJson;\n    this.supportedSchemes = new Set(\n      (options.supportedUriSchemes ?? ['https', 'wss']).map(scheme =>\n        scheme.toLowerCase(),\n      ),\n    );\n    this.transparencyVerifier = options.transparencyVerifier;\n  }\n\n  supports(\n    _uaid: string,\n    parsed: UaidProfileResolverContext['parsedUaid'],\n  ): boolean {\n    if (parsed.method !== 'aid') {\n      return false;\n    }\n    if (parsed.params['registry'] !== 'ans') {\n      return false;\n    }\n    const nativeId = parsed.params['nativeId'];\n    return !!nativeId && isFqdn(nativeId);\n  }\n\n  async resolveProfile(\n    uaid: string,\n    context: UaidProfileResolverContext,\n  ): Promise<DidResolutionProfile | null> {\n    const parsed = context.parsedUaid;\n    if (parsed.method !== 'aid') {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NOT_APPLICABLE',\n        'ANS profile only applies to uaid:aid identifiers.',\n      );\n    }\n    if (parsed.params['registry'] !== 'ans') {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NOT_APPLICABLE',\n        'ANS profile requires registry=ans.',\n      );\n    }\n\n    const nativeId = parsed.params['nativeId'];\n    if (!nativeId || !isFqdn(nativeId)) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NOT_APPLICABLE',\n        'ANS profile requires an FQDN nativeId.',\n      );\n    }\n\n    const uid = parsed.params['uid'];\n    if (isUnspecifiedUaidParamValue(uid)) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NOT_APPLICABLE',\n        'ANS profile requires a non-zero uid parameter.',\n      );\n    }\n\n    const protocol = parsed.params['proto'];\n    if (isUnspecifiedUaidParamValue(protocol)) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_PROTOCOL_UNSPECIFIED',\n        'ANS profile requires a usable proto parameter.',\n      );\n    }\n    const uaidVersion = parsed.params['version'];\n    const normalizedUaidVersion =\n      uaidVersion === undefined ? undefined : normalizeAnsVersion(uaidVersion);\n    if (uaidVersion !== undefined && !isValidAnsProfileVersion(uaidVersion)) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NOT_APPLICABLE',\n        'ANS profile requires a valid semver version parameter when provided.',\n      );\n    }\n\n    const normalizedNativeId = normalizeDomain(nativeId);\n    const dnsName = `_ans.${normalizedNativeId}`;\n    const txtRecords = await this.dnsLookup(dnsName);\n    if (txtRecords.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NO_DNS_RECORD',\n        'No ANS DNS TXT record was found for the requested nativeId.',\n        { dnsName },\n      );\n    }\n\n    const validTxtRecords = txtRecords\n      .map(record => parseAnsDnsTxtRecord(record))\n      .filter((record): record is AnsDnsTxtRecord => record !== null);\n    if (validTxtRecords.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_INVALID_ANS_RECORD',\n        'ANS DNS TXT payload is malformed or unsupported.',\n        { dnsName },\n      );\n    }\n\n    let matchingVersionRecords = validTxtRecords;\n    if (normalizedUaidVersion) {\n      const recordsWithVersion = validTxtRecords.filter(record => {\n        return record.version !== undefined;\n      });\n      if (recordsWithVersion.length === 0) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERSION_MISMATCH',\n          'UAID specifies a version but no ANS DNS TXT record carries a version field.',\n          { dnsName, uaidVersion: normalizedUaidVersion },\n        );\n      }\n      matchingVersionRecords = recordsWithVersion.filter(record => {\n        return record.version === normalizedUaidVersion;\n      });\n      if (matchingVersionRecords.length === 0) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERSION_MISMATCH',\n          'UAID version does not match ANS DNS TXT record version.',\n          { dnsName, uaidVersion: normalizedUaidVersion },\n        );\n      }\n    }\n\n    const selectedRecord = selectDeterministicAnsDnsRecord(\n      matchingVersionRecords,\n    );\n\n    let agentCardPayload: unknown;\n    try {\n      agentCardPayload = await this.fetchJson(selectedRecord.url);\n    } catch (error) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_AGENT_CARD_INVALID',\n        'Agent Card retrieval failed.',\n        {\n          stage: 'fetch',\n          agentCardUrl: selectedRecord.url,\n          reason: toErrorMessage(error),\n        },\n      );\n    }\n\n    const agentCard = parseAnsAgentCard(agentCardPayload);\n    if (!agentCard) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_AGENT_CARD_INVALID',\n        'Agent Card is missing required fields.',\n        { stage: 'validate', agentCardUrl: selectedRecord.url },\n      );\n    }\n    if (agentCard.ansName !== uid) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_AGENT_CARD_INVALID',\n        'Agent Card ansName does not match UAID uid.',\n        {\n          stage: 'validate',\n          expectedUid: uid,\n          actualAnsName: agentCard.ansName,\n        },\n      );\n    }\n\n    const endpointCandidates = extractEndpointCandidates(\n      agentCard.endpoints,\n      this.supportedSchemes,\n    );\n    const anchoredCandidates = endpointCandidates.filter(candidate => {\n      return (\n        normalizeDomain(candidate.parsedUrl.hostname) === normalizedNativeId\n      );\n    });\n    if (anchoredCandidates.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_ENDPOINT_NOT_ANCHORED',\n        'No endpoint URL is anchored to the UAID nativeId host.',\n        {\n          nativeId: normalizedNativeId,\n        },\n      );\n    }\n\n    const selectedEndpoint =\n      selectPreferredEndpoint(anchoredCandidates, protocol) ??\n      anchoredCandidates[0]!;\n\n    let transparencyAttempted = false;\n    let transparencySucceeded = false;\n    if (this.transparencyVerifier) {\n      transparencyAttempted = true;\n      transparencySucceeded = await this.transparencyVerifier({\n        uaid,\n        protocol,\n        endpoint: selectedEndpoint.endpointUrl,\n        agentCardUrl: selectedRecord.url,\n        transparencyHints: agentCard.transparencyHints,\n      });\n      if (!transparencySucceeded) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_TRANSPARENCY_VERIFICATION_FAILED',\n          'Transparency verification failed.',\n          {\n            agentCardUrl: selectedRecord.url,\n          },\n        );\n      }\n    }\n\n    const did = context.did ?? undefined;\n    const alsoKnownAs = did ? [did] : undefined;\n    const verificationLevel: 'metadata' | 'cryptographic' =\n      transparencySucceeded ? 'cryptographic' : 'metadata';\n    const verificationMethod = transparencySucceeded\n      ? 'ans-transparency'\n      : 'metadata-match';\n\n    return {\n      id: uaid,\n      did,\n      alsoKnownAs,\n      service: [\n        {\n          id: `${uaid}#ans-endpoint`,\n          type: 'ANSService',\n          serviceEndpoint: selectedEndpoint.endpointUrl,\n        },\n      ],\n      metadata: {\n        profile: ANS_DNS_WEB_PROFILE_ID,\n        resolved: true,\n        endpoint: selectedEndpoint.endpointUrl,\n        protocol,\n        precedenceSource: 'dns',\n        verification: {\n          level: verificationLevel,\n          method: verificationMethod,\n        },\n        verificationLevel,\n        agentCardUrl: selectedRecord.url,\n        dnsRecordSelection: 'lexicographically-smallest-url',\n        transparencyHints: agentCard.transparencyHints,\n        transparencyVerification: {\n          attempted: transparencyAttempted,\n          succeeded: transparencySucceeded,\n        },\n      },\n    };\n  }\n}\n"],"names":[],"mappings":";;;AAqBO,MAAM,yBAAyB;AAqBtC,MAAM,+BAA+B;AAErC,SAAS,kBACP,MACA,MACA,SACA,SACsB;AACtB,QAAM,QAAgC;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAGF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,UAAU;AAAA,IAAA;AAAA,EACZ;AAEJ;AAEA,eAAe,iBAAiB,KAA+B;AAC7D,MAAI,OAAO,WAAW,UAAU,YAAY;AAC1C,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,WAAW,MAAM,WAAW,MAAM,KAAK;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,IAAA;AAAA,EACV,CACD;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,yCAAyC,SAAS,MAAM;AAAA,IAAA;AAAA,EAE5D;AACA,SAAO,SAAS,KAAA;AAClB;AAEA,SAAS,4BAA4B,OAAoC;AACvE,SAAO,CAAC,SAAS,UAAU;AAC7B;AAEA,SAAS,gCACP,SACiB;AACjB,SAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;AAClE;AAEO,MAAM,yBAAwD;AAAA,EAiBnE,YAAY,UAAoC,IAAI;AAhBpD,SAAS,cAAuC;AAChD,SAAS,UAAU;AAEnB,SAAS,OAAoB;AAAA,MAC3B,IAAI;AAAA,MACJ,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa;AAAA,MACb,aACE;AAAA,IAAA;AASF,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,mBAAmB,IAAI;AAAA,OACzB,QAAQ,uBAAuB,CAAC,SAAS,KAAK,GAAG;AAAA,QAAI,CAAA,WACpD,OAAO,YAAA;AAAA,MAAY;AAAA,IACrB;AAEF,SAAK,uBAAuB,QAAQ;AAAA,EACtC;AAAA,EAEA,SACE,OACA,QACS;AACT,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,IACT;AACA,QAAI,OAAO,OAAO,UAAU,MAAM,OAAO;AACvC,aAAO;AAAA,IACT;AACA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,WAAO,CAAC,CAAC,YAAY,OAAO,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,eACJ,MACA,SACsC;AACtC,UAAM,SAAS,QAAQ;AACvB,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AACA,QAAI,OAAO,OAAO,UAAU,MAAM,OAAO;AACvC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,QAAI,CAAC,YAAY,CAAC,OAAO,QAAQ,GAAG;AAClC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAI,4BAA4B,GAAG,GAAG;AACpC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,WAAW,OAAO,OAAO,OAAO;AACtC,QAAI,4BAA4B,QAAQ,GAAG;AACzC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AACA,UAAM,cAAc,OAAO,OAAO,SAAS;AAC3C,UAAM,wBACJ,gBAAgB,SAAY,SAAY,oBAAoB,WAAW;AACzE,QAAI,gBAAgB,UAAa,CAAC,yBAAyB,WAAW,GAAG;AACvE,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,qBAAqB,gBAAgB,QAAQ;AACnD,UAAM,UAAU,QAAQ,kBAAkB;AAC1C,UAAM,aAAa,MAAM,KAAK,UAAU,OAAO;AAC/C,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,kBAAkB,WACrB,IAAI,CAAA,WAAU,qBAAqB,MAAM,CAAC,EAC1C,OAAO,CAAC,WAAsC,WAAW,IAAI;AAChE,QAAI,gBAAgB,WAAW,GAAG;AAChC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,QAAI,yBAAyB;AAC7B,QAAI,uBAAuB;AACzB,YAAM,qBAAqB,gBAAgB,OAAO,CAAA,WAAU;AAC1D,eAAO,OAAO,YAAY;AAAA,MAC5B,CAAC;AACD,UAAI,mBAAmB,WAAW,GAAG;AACnC,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,SAAS,aAAa,sBAAA;AAAA,QAAsB;AAAA,MAElD;AACA,+BAAyB,mBAAmB,OAAO,CAAA,WAAU;AAC3D,eAAO,OAAO,YAAY;AAAA,MAC5B,CAAC;AACD,UAAI,uBAAuB,WAAW,GAAG;AACvC,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,SAAS,aAAa,sBAAA;AAAA,QAAsB;AAAA,MAElD;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB;AAAA,IAAA;AAGF,QAAI;AACJ,QAAI;AACF,yBAAmB,MAAM,KAAK,UAAU,eAAe,GAAG;AAAA,IAC5D,SAAS,OAAO;AACd,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,OAAO;AAAA,UACP,cAAc,eAAe;AAAA,UAC7B,QAAQ,eAAe,KAAK;AAAA,QAAA;AAAA,MAC9B;AAAA,IAEJ;AAEA,UAAM,YAAY,kBAAkB,gBAAgB;AACpD,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,OAAO,YAAY,cAAc,eAAe,IAAA;AAAA,MAAI;AAAA,IAE1D;AACA,QAAI,UAAU,YAAY,KAAK;AAC7B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,OAAO;AAAA,UACP,aAAa;AAAA,UACb,eAAe,UAAU;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEJ;AAEA,UAAM,qBAAqB;AAAA,MACzB,UAAU;AAAA,MACV,KAAK;AAAA,IAAA;AAEP,UAAM,qBAAqB,mBAAmB,OAAO,CAAA,cAAa;AAChE,aACE,gBAAgB,UAAU,UAAU,QAAQ,MAAM;AAAA,IAEtD,CAAC;AACD,QAAI,mBAAmB,WAAW,GAAG;AACnC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE,UAAU;AAAA,QAAA;AAAA,MACZ;AAAA,IAEJ;AAEA,UAAM,mBACJ,wBAAwB,oBAAoB,QAAQ,KACpD,mBAAmB,CAAC;AAEtB,QAAI,wBAAwB;AAC5B,QAAI,wBAAwB;AAC5B,QAAI,KAAK,sBAAsB;AAC7B,8BAAwB;AACxB,8BAAwB,MAAM,KAAK,qBAAqB;AAAA,QACtD;AAAA,QACA;AAAA,QACA,UAAU,iBAAiB;AAAA,QAC3B,cAAc,eAAe;AAAA,QAC7B,mBAAmB,UAAU;AAAA,MAAA,CAC9B;AACD,UAAI,CAAC,uBAAuB;AAC1B,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,YACE,cAAc,eAAe;AAAA,UAAA;AAAA,QAC/B;AAAA,MAEJ;AAAA,IACF;AAEA,UAAM,MAAM,QAAQ,OAAO;AAC3B,UAAM,cAAc,MAAM,CAAC,GAAG,IAAI;AAClC,UAAM,oBACJ,wBAAwB,kBAAkB;AAC5C,UAAM,qBAAqB,wBACvB,qBACA;AAEJ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,SAAS;AAAA,QACP;AAAA,UACE,IAAI,GAAG,IAAI;AAAA,UACX,MAAM;AAAA,UACN,iBAAiB,iBAAiB;AAAA,QAAA;AAAA,MACpC;AAAA,MAEF,UAAU;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU,iBAAiB;AAAA,QAC3B;AAAA,QACA,kBAAkB;AAAA,QAClB,cAAc;AAAA,UACZ,OAAO;AAAA,UACP,QAAQ;AAAA,QAAA;AAAA,QAEV;AAAA,QACA,cAAc,eAAe;AAAA,QAC7B,oBAAoB;AAAA,QACpB,mBAAmB,UAAU;AAAA,QAC7B,0BAA0B;AAAA,UACxB,WAAW;AAAA,UACX,WAAW;AAAA,QAAA;AAAA,MACb;AAAA,IACF;AAAA,EAEJ;AACF;"}