Record format
@flashylabs/agent-dns
agent-dns/1 — the Gateway layer’s naming step: one DNS TXT record at _agent.<domain> pointing at the domain’s agent/1 document, so a machine gets from a domain name to an organisation’s agents without asking a directory first. DNS points; the document describes.
version 0.1.0 · measured 2026-10-19 from a checkout · source: agent-dns
node vendor-agent-dns.mjs check vectors — dependency-free; the spec, not on npmOne record, one url: a domain has exactly one v=agent1 record, and two is refused as duplicate-records rather than resolved by picking the first — ambiguity is refused, never guessed. Records of other versions at the same name are ignored, so a future agent2 can coexist.
The domain rule is canonical here: vendor-domain.mjs (normalizeDomain, isSameDomain, sameDomainUrl) is the whole of the same-domain rule and is vendored byte-identically into agent-wellknown, bastion and flashy-examples. Host-or-subdomain, no Public Suffix List, no guessing.
Edge cases — each one paid for once
Null is never zero, and four findings never collapse
A resolver returns ok, absent, unreachable or invalid and nothing else; a test enumerates six failure shapes (DNS throws, connection refused, a 500, a 502, a hang) and asserts none reads absent. unreachable is a fact about the resolver, never evidence a domain has no agent — the same nothing a parked domain and an egress refusal both return.
The stranger is never fetched
A url that fails the same-domain rule, or a redirect that would leave the domain or drop to http, ends resolution before any request to that host; the tests record every fetcher call and assert the list. A checker that fetched first and judged after would leak the request the rule exists to withhold.