Function resolve 

pub async fn resolve(
    did_url: &str,
    at_rfc3339: &str,
) -> Result<NotaryPublicKey, AphError>

Resolves the notary public key a DID URL names, building both adapters for you (spec §8.4.6).

The no-host convenience path: a system-configured resolver and a guarded HTTPS client are constructed here and handed to aph_core::discovery::composer::resolve under MechanismSelection::NamedByDid. An adopter who wants a pinned mechanism, a shared resolver, or a client they configured should build HickoryTxtLookup and ReqwestDocumentFetch themselves and call the composer directly — this function is the default, not the only door.

What the §8.4.6 order does

A did:key DID is decoded in-process and touches NO network at all: the key bytes are the identifier, so this path works on an air-gapped verifier. A did:web DID probes DNS TXT first and advances to the document fetch only when nothing is published there — absence advances, failure never does. A mechanism that was offered and then FAILED refuses on the spot under its own code, because retrying a weaker anchor when a stronger one breaks hands an attacker a free downgrade.

at_rfc3339

Pass the envelope’s decisionTimestamp, not the wall clock. Per §8.4.7 a verifier accepts any envelope whose signing key was valid at the moment the decision was made; using “now” instead would start rejecting correctly-signed historical envelopes the day an old key’s notAfter passes.

Errors

Whatever the chosen mechanism returns, unflattened — APH_E008 unreachable, APH_E014 nothing published, APH_E003 outside the key’s validity window, APH_E010 unsupported method or algorithm. Also APH_E008 if the host’s own resolver configuration cannot be read, which is deliberately indistinguishable from a failed lookup.