; DNS for AI Discovery (DNS-AID) — salat.top
;
; ServiceMode SVCB / HTTPS records published in the `_agents.salat.top`
; subtree so AI agents can discover salat.top endpoints through DNS.
;
; Specs:
;   draft-mozleywilliams-dnsop-dnsaid   https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/
;   RFC 9460 (SVCB / HTTPS)            https://www.rfc-editor.org/rfc/rfc9460
;
; Run `scripts/setup-dns-aid.sh` to push these records to Cloudflare.
; DNSSEC must be active on the salat.top zone so validating resolvers
; return authenticated data (AD=1).

; ----------------------------------------------------------------------------
; Agent index / homepage discovery (HTTPS, plain HTTP/2 fallback)
; ----------------------------------------------------------------------------
_index._agents.salat.top. 3600 IN HTTPS 1 . (
    alpn="h2,http/1.1"
    port=443
    ipv4hint=185.27.134.105
    ipv6hint=2a06:fb00:1::1:185:27:134:105
    mandatory="alpn,port"
)

; ----------------------------------------------------------------------------
; A2A (Agent-to-Agent) card discovery
; Uses the "a2a" ALPN token defined by draft-mozleywilliams-dnsop-dnsaid with
; h2 + http/1.1 as fallbacks per RFC 9460 §7.1.
; ----------------------------------------------------------------------------
_a2a._agents.salat.top. 3600 IN HTTPS 1 . (
    alpn="a2a,h2,http/1.1"
    port=443
    ipv4hint=185.27.134.105
    ipv6hint=2a06:fb00:1::1:185:27:134:105
    mandatory="alpn,port"
)

; ----------------------------------------------------------------------------
; MCP (Model Context Protocol) server discovery
; ----------------------------------------------------------------------------
_mcp._agents.salat.top. 3600 IN HTTPS 1 . (
    alpn="mcp,h2,http/1.1"
    port=443
    ipv4hint=185.27.134.105
    ipv6hint=2a06:fb00:1::1:185:27:134:105
    mandatory="alpn,port"
)

; ----------------------------------------------------------------------------
; LLMs.txt discovery (LLM-friendly root, plain HTTPS)
; ----------------------------------------------------------------------------
_llmstxt._agents.salat.top. 3600 IN HTTPS 1 . (
    alpn="h2,http/1.1"
    port=443
    ipv4hint=185.27.134.105
    ipv6hint=2a06:fb00:1::1:185:27:134:105
    mandatory="alpn,port"
)

; ----------------------------------------------------------------------------
; Custom DNS-AID parameters (draft-mozleywilliams-dnsop-dnsaid §4)
; Until these keys are registered, draft §6.2 requires numeric "keyNNNNN"
; SvcParamKey names. Scanners look for these as alpn=agnostic hints.
;
; key65400 = agent-card URL       (string)
; key65401 = supported identities (comma-list)
; key65402 = auth.md URI          (string)
; ----------------------------------------------------------------------------
_agent._agents.salat.top. 3600 IN HTTPS 1 . (
    alpn="h2,http/1.1"
    port=443
    ipv4hint=185.27.134.105
    ipv6hint=2a06:fb00:1::1:185:27:134:105
    mandatory="alpn,port"
    key65400="https://salat.top/.well-known/mcp/server-card.json"
    key65401="public"
    key65402="https://salat.top/auth.md"
)

; ----------------------------------------------------------------------------
; Verification (DNS-over-HTTPS, DO=1 → AD flag required):
;   curl -H "Accept: application/dns-json" \
;        "https://cloudflare-dns.com/dns-query?name=_a2a._agents.salat.top&type=HTTPS&do=1"
;
; Enable DNSSEC in the Cloudflare dashboard under:
;   SSL/TLS → Edge Certificates → DNSSEC
; ----------------------------------------------------------------------------