// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
// ══════════════════════════════════════════════════════════════════
// Trust Root Policy (W2-B1): did:web .well-known/aps-agents.json
// ══════════════════════════════════════════════════════════════════
// A discovery CONVENTION (not a hosted service): a domain publishes a
// static JSON document at /.well-known/aps-agents.json listing the agent
// issuers it vouches for and the locators a relying party can use to
// resolve their keys (via the M3 resolver). A relying party fetches it
// once to BOOTSTRAP a trust-root-policy; the policy itself remains the
// signed, anti-rollback artifact that governs verdicts.
//
// This file ships:
//   - the well-known path constant (the convention),
//   - the document shape,
//   - a pure GENERATOR (no network, no I/O), and
//   - the URL composer, which reuses the exact host/port encoding the
//     existing did:web resolver uses for did.json (didWebToUrl), so the
//     two well-known endpoints live under the same host rules.
//
// It is NOT a registry, gateway, or resolution endpoint. Publishing the
// generated bytes (to a static host, a repo, GitHub Pages) is an
// operator concern outside this SDK.
// ══════════════════════════════════════════════════════════════════
import { didWebToUrl } from '../../core/did-interop.js';
/** The convention path. A did:web domain serves this static document. */
export const WELL_KNOWN_APS_AGENTS_PATH = '/.well-known/aps-agents.json';
export const APS_AGENTS_DOC_SPEC_VERSION = '1.0';
/** Pure generator: validate the entries and produce the document object.
 *  No network, no filesystem; the caller serializes and publishes. */
export function generateApsAgentsDoc(input) {
    if (!input.domain || typeof input.domain !== 'string') {
        throw new Error('domain is required');
    }
    if (!Array.isArray(input.agents)) {
        throw new Error('agents must be an array');
    }
    for (const a of input.agents) {
        if (!a.issuer_id)
            throw new Error('each agent entry needs an issuer_id');
        if (!Array.isArray(a.pubkeys_hex) || a.pubkeys_hex.length === 0) {
            throw new Error(`agent ${a.issuer_id} must list at least one pubkey`);
        }
        for (const k of a.pubkeys_hex) {
            if (!/^[0-9a-f]{64}$/.test(k)) {
                throw new Error(`agent ${a.issuer_id} pubkey must be 64-char lowercase hex`);
            }
        }
    }
    return {
        spec_version: APS_AGENTS_DOC_SPEC_VERSION,
        domain: input.domain,
        generated_at: input.generated_at,
        agents: input.agents,
    };
}
/** Compose the HTTPS URL for a domain's aps-agents document, reusing the
 *  did:web host/port encoding so it sits beside did.json under identical
 *  host rules.
 *
 *   apsAgentsUrl('example.com')        → https://example.com/.well-known/aps-agents.json
 *   apsAgentsUrl('did:web:example.com')→ https://example.com/.well-known/aps-agents.json
 *   apsAgentsUrl('did:web:host%3A8443')→ https://host:8443/.well-known/aps-agents.json
 *
 *  A bare domain is treated as did:web:<domain> for encoding purposes. */
export function apsAgentsUrl(domainOrDidWeb) {
    const didWeb = domainOrDidWeb.startsWith('did:web:')
        ? domainOrDidWeb.split('#')[0]
        : `did:web:${domainOrDidWeb}`;
    // didWebToUrl yields .../.well-known/did.json for a bare domain, or
    // .../<path>/did.json for a pathful did:web. We reuse it ONLY to share
    // the host/port encoding, then take the origin and append the
    // aps-agents convention path. The convention always lives at the
    // origin's /.well-known/aps-agents.json regardless of did:web path.
    const didJsonUrl = didWebToUrl(didWeb);
    const origin = new URL(didJsonUrl).origin;
    return `${origin}${WELL_KNOWN_APS_AGENTS_PATH}`;
}
//# sourceMappingURL=well-known.js.map