didkit 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 505c6714968219d931f33b5bf4eb42f90f12b6c4391227b4257a5b4063491128
-  data.tar.gz: 3e877922065e457bb1fe706db1259b8ddd741cacdc7faa7f17ea3adeb4b23faa
+  metadata.gz: cf656ddc5c0b21d616657dc8f7d310c1f5aba7b77828542a1871c05d177ecbc0
+  data.tar.gz: b23f42ec6c434fa1ba7867976310fac7cfa006c0d093ef105141c0cd5c8b8543
 SHA512:
-  metadata.gz: 587c899080bdb947261b54b2bbe2b3263567cb9aecca682086149d3a0ca4692a443a217b42520caca3e24ec246a5e3a0ea058d86c903cadb13075c2ebbac0291
-  data.tar.gz: c76d96e9fda51a31d87a7e15f93549e9594d8651d7668d77a38b9fe0bff09631d78a2d3a34f0afbd6cd9506a0208e9ece7617ebf1128fca7d1ab7d27896a5ea3
+  metadata.gz: c0227bd5bad67bba3086ac4cc3f766d8976cfd0f4d6a882039676b9792a9c1bcb8a9dd69015918b7c5100613d0689a3460fa0350a25c0ab63a1c54b7e3df7c22
+  data.tar.gz: '017428fc8d8cae144b57029f1547615788ab9fb097ab45403803e94e61954c72511cdf68412c053da40437ba6bdd0f3be86990146dcd142389167ebd4febd84e'

data/CHANGELOG.md

@@ -1,3 +1,36 @@
+## [0.5.0] - 2026-10-26
+
+Breaking changes:
+
+- the [ATProto DID spec](https://atproto.com/specs/did#did-documents) now says that if there are multiple handles in a document, only the first one should be checked bi-directionally and the rest should be skipped:
+
+    > The first syntactically valid handle found in the ordered list is treated as the claimed handle, even if it fails to resolve bi-directionally. Any other handle URIs should be ignored.
+
+    - the `get_verified_handle` algorithm has been updated to match this behavior
+    - `Resolver#first_verified_handle` method has been removed
+- `DIDKit::PLCImporter::PLC_SERVICE` was moved to `DIDKit::DEFAULT_PLC_DIRECTORY`
+- `DIDKit::DID::GENERIC_REGEXP` was moved to `DIDKit::GENERIC_DID_REGEXP`
+- `DIDKit::Resolver#nameserver` has been changed to be read-only
+- `DIDKit::Resolver#resolve_handle` and `DID.resolve_handle` now verify the resolve handle bi-directionally, checking also if the matched DID has that handle assigned too; pass `verify: false` to skip this (default is true). This call can now raise an error if the DID document cannot be fetched.
+
+Added:
+
+- added support for decoding public (signing) keys – `Document#signing_key`, `PLCOperation#signing_key` and `DIDKit::PublicKey` class
+- `DIDKit::Resolver` now accepts a `:plc_directory` option that lets you use a PLC mirror server instead of `https://plc.directory`
+- added a shared global `DIDKit.default_resolver`, used internally by `DID` & `Document` – you can reassign it to one configured with a custom DNS nameserver or PLC mirror
+- added support for PLC servers returning `application/did+json` content type instead of `application/did+ld+json` (the spec allows it and the replica server implementation does that)
+- added support for PLC servers returning services with IDs in the absolute format `did:...#id` instead of just `#id`
+- added `DID#did_web_host`, which returns the did:web host URL together with `http(s)://` and a port if included (only for `localhost`), and raises a `DIDError` if the DID is not a did:web; `#web_domain` renamed to `#did_web_domain` and kept with the old behavior, `#web_domain` added as an alias
+
+Other:
+
+- more detailed validation of DID & handle strings and for service endpoint URLs
+- fixed DNS-based handle verification if there are multiple text chunks in a TXT record or multiple TXT records
+- make sure that handle verification is case-insensitive
+- the global `DID` alias is not reassigned if something else already defines it before DIDKit is loaded
+- fixed redirects to relative URLs, and disallowed redirects to non-HTTP URLs and from HTTPS to HTTP
+- fixed `:max_redirects` & `:timeout` options not being used when loading a DID document
+
 ## [0.4.0] - 2026-07-02
 
 - added `#also_known_as` separate from `#handles` in `Document` and `PLCOperation`, which stores the original array of strings as listed in the JSON, not filtered and not stripped of the `at://` prefix
@@ -51,8 +84,6 @@ Also:
 - `PLCImporter` now removes duplicate operations at the edge of pages returned from the `/export` API
 - rewritten some networking code – all classes now use `Net::HTTP` with consistent options instead of `open-uri`
 
-Note: `PLCImporter` will be rewritten soon to add support for updated [plc.directory](https://plc.directory) APIs, so be prepared for some breaking changes there in v. 0.4.
-
 ## [0.2.3] - 2024-07-02
 
 - added a `DID#get_audit_log` method that fetches the PLC audit log for a DID

data/README.md

@@ -15,7 +15,7 @@ Accounts on Bluesky use identifiers like [did:plc:oio4hkxaop4ao4wz2pp3f4cr](http
 
 ## Installation
 
-To use DIDKit, you need a reasonably new version of Ruby – it should run on Ruby 2.6 and above, although it's recommended to use a version that's still getting maintainance updates, i.e. currently 3.2+. A compatible version should be preinstalled on macOS Big Sur and above and on many Linux systems. Otherwise, you can install one using tools such as [RVM](https://rvm.io), [asdf](https://asdf-vm.com), [ruby-install](https://github.com/postmodern/ruby-install) or [ruby-build](https://github.com/rbenv/ruby-build), or `rpm` or `apt-get` on Linux (see more installation options on [ruby-lang.org](https://www.ruby-lang.org/en/downloads/)).
+To use DIDKit, you need a reasonably new version of Ruby – it should run on Ruby 2.6 and above, although it's recommended to use a version that's still getting maintainance updates, i.e. currently 3.3+. A compatible version should be preinstalled on macOS Big Sur and above and on many Linux systems. Otherwise, you can install one using tools such as [RVM](https://rvm.io), [asdf](https://asdf-vm.com), [ruby-install](https://github.com/postmodern/ruby-install) or [ruby-build](https://github.com/rbenv/ruby-build), or `rpm` or `apt-get` on Linux (see more installation options on [ruby-lang.org](https://www.ruby-lang.org/en/downloads/)).
 
 To install the gem, run in the command line:
 
@@ -23,7 +23,7 @@ To install the gem, run in the command line:
 
 Or add this to your app's `Gemfile`:
 
-    gem 'didkit', '~> 0.3'
+    gem 'didkit', '~> 0.5'
 
 
 ## Usage
@@ -42,6 +42,8 @@ This returns a `DID` object, which tells you:
 - the DID type (`#type`, `:plc` or `:web`)
 - if the handle was resolved via a DNS entry or a `.well-known` file (`#resolved_by`, `:dns` or `:http`)
 
+The handle is automatically verified bi-directionally, i.e. the resolver loads the DID document for e.g. `did:plc:oky5czdrnfjpqslsw2a5iclo` and checks if the handle `jay.bsky.team` is listed there under `alsoKnownAs`. If you want to skip that second check, pass `verify: false` to `#resolve_handle`.
+
 To go in the other direction – to find an assigned and verified handle given a DID – create a `DID` from a DID string and call `get_verified_handle`:
 
 ```rb
@@ -89,6 +91,7 @@ You can customize some things about the DID/handle lookups by using the `DIDKit:
 Currently available options include:
 
 - `:nameserver` – override the nameserver used for DNS lookups, e.g. to use Google's or CloudFlare's DNS
+- `:plc_directory` – hostname or URL of a PLC directory mirror to use instead of `plc.directory`
 - `:timeout` – change the connection/response timeout for HTTP requests (default: 15 s)
 - `:max_redirects` – change allowed maximum number of redirects (default: 5)
 
@@ -108,6 +111,24 @@ resolver.get_verified_handle(did)
   # => 'nytimes.com'
 ```
 
+`DID` and `Document` use a shared global resolver instance at `DIDKit.default_resolver`, which you can overwrite with one using a custom config:
+
+```rb
+DIDKit.default_resolver = DIDKit::Resolver.new(plc_directory: 'plc.eurosky.network')
+
+did = DID.resolve_handle('mackuba.eu')
+puts did.document.pds_host
+# uses plc.eurosky.network to look up DID info
+```
+
+More info in the [YARD API docs](https://rubydoc.info/gems/didkit).
+
+
+### Global DID alias
+
+As mentioned earlier, DIDKit defines a global alias `DID` as a shorthand for `DIDKit::DID`. If this happens to conflict with another constant defined by your app or a different dependency, make sure to `require 'didkit'` *after* that constant is already defined, or alternatively, require e.g. `'didkit/did'` directly, which skips the `global_did.rb` file which defines the global `DID`.
+
+
 ## Other resources
 
 - [YARD API documentation](https://rubydoc.info/gems/didkit) at rubydoc.info

data/SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## How To Report a Vulnerability
+
+If you find a potential vulnerability in one of my projects, it's recommended not to report it through a standard publicly-readable issue report, in order to avoid giving possible clues to any potential attackers who could abuse it before it's fixed (see: ["Just a rumour of a bug is enough to find a security exploit these days"](https://anil.recoil.org/notes/rumour-is-the-exploit)).
+
+You can use one of these to contact me instead:
+
+- [@mackuba.eu](https://bsky.app/profile/did:plc:oio4hkxaop4ao4wz2pp3f4cr) on Bluesky (my DMs should be open, or mention me discretely with a request for contact)
+- [@mackuba@martianbase.net](https://martianbase.net/@mackuba) on Mastodon (my personal instance)
+- email: mackuba `@` protonmail.ch (optionally with [this PGP key](https://mail-api.proton.me/pks/lookup?op=get&search=mackuba@protonmail.ch))
+- ["Report a vulnerability"](https://github.com/mackuba/didkit/security/advisories/new) form on GitHub
+
+I do not check my Twitter/X or LinkedIn accounts regularly.
+
+Note: please don't submit AI-reported issues that have not been verified manually :)

data/lib/didkit/at_handles.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'constants'
 require_relative 'errors'
 
 module DIDKit
@@ -13,7 +14,11 @@ module DIDKit
     # Returns a list of ATProto handles assigned to this DID in its DID document.
     #
     # Note: the handles aren't guaranteed to be verified (validated in the other direction).
-    # Use {DID#get_verified_handle} to find a handle that is correctly verified.
+    # Use {DID#get_verified_handle} to get a handle that is correctly verified.
+    #
+    # According to the current [ATProto DID spec](https://atproto.com/specs/did#did-documents),
+    # if a DID has more than one handle assigned, only the first one on the list should be
+    # considered and the rest should be ignored.
     #
     # @api public
     # @return [Array<String>]
@@ -37,7 +42,13 @@ module DIDKit
       raise FormatError, "Invalid alsoKnownAs: #{aka.inspect}" unless aka.all? { |x| x.is_a?(String) }
 
       @also_known_as = aka
-      @handles = aka.select { |x| x =~ %r(\Aat://[^/]+\z) }.map { |x| x.gsub('at://', '') }
+      @handles = extract_handles_from_aka(aka)
+    end
+
+    def extract_handles_from_aka(aka)
+      handles = aka.select { |x| x.start_with?('at://') }.map { |x| x.delete_prefix('at://') }
+
+      handles.select { |h| h =~ DIDKit::HANDLE_REGEXP && h.length <= DIDKit::MAX_HANDLE_LENGTH }
     end
   end
 end

data/lib/didkit/constants.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module DIDKit
+  # URL of the standard PLC directory service.
+  DEFAULT_PLC_DIRECTORY = 'https://plc.directory'
+
+  DOMAIN_SEGMENT =      /[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?/
+  LAST_DOMAIN_SEGMENT =    /[a-zA-Z]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?/
+  private_constant :DOMAIN_SEGMENT, :LAST_DOMAIN_SEGMENT
+
+  # Pattern that matches any valid ATProto handle (without @)
+  HANDLE_REGEXP = /\A(#{DOMAIN_SEGMENT}\.)+#{LAST_DOMAIN_SEGMENT}\z/
+
+  # Pattern that matches any valid did:plc DID
+  DID_PLC_REGEXP = /\Adid\:plc\:[abcdefghijklmnopqrstuvwxyz234567]{24}\z/
+
+  # Pattern that matches a percent-decoded did:web DID
+  DID_WEB_REGEXP = /\Adid\:web\:((#{DOMAIN_SEGMENT}\.)+#{LAST_DOMAIN_SEGMENT}|localhost(:[1-9][0-9]{0,4})?)\z/
+
+  # Pattern that matches any valid DID (including methods unsupported in ATProto)
+  GENERIC_DID_REGEXP = /\Adid:[a-z]+:[a-zA-Z0-9_\.\:\%\-]*[a-zA-Z0-9_\.\-]\z/
+
+  # Maximum allowed DID length in ATProto
+  MAX_DID_LENGTH = 2048
+
+  # Maximum allowed handle length in ATProto
+  MAX_HANDLE_LENGTH = 253
+
+  # TLDs that are not allowed in ATProto handles
+  RESERVED_DOMAINS = %w(alt arpa example internal invalid local localhost onion test)
+end

data/lib/didkit/did.rb

@@ -3,7 +3,9 @@
 require 'json'
 require 'uri'
 
+require_relative 'constants'
 require_relative 'errors'
+require_relative 'plc_importer'
 require_relative 'requests'
 require_relative 'resolver'
 
@@ -19,8 +21,6 @@ module DIDKit
   #
 
   class DID
-    GENERIC_REGEXP = /\Adid\:\w+\:.+\z/
-
     include Requests
 
     # Resolve a handle into a DID. Looks up the given ATProto domain handle using the DNS TXT method
@@ -31,10 +31,13 @@ module DIDKit
     # check which one it is.
     #
     # @param handle [String, DID] a domain handle (may start with an `@`) or a DID string
+    # @param verify [Boolean] require the handle to be assigned to the DID in the DID document (default: true)
     # @return [DID, nil] resolved DID if found, nil otherwise
+    # @raise [APIError] if verification is enabled and the DID document request is unsuccessful
+    # @raise [FormatError] if verification is enabled and the DID document has invalid data
 
-    def self.resolve_handle(handle)
-      Resolver.new.resolve_handle(handle)
+    def self.resolve_handle(handle, verify: true)
+      DIDKit.default_resolver.resolve_handle(handle, verify: verify)
     end
 
     # @return [Symbol] DID type (`:plc` or `:web`)
@@ -60,14 +63,18 @@ module DIDKit
         did = did.to_s
       end
 
-      if did =~ GENERIC_REGEXP
-        @did = did
-        @type = did.split(':')[1].to_sym
-      else
-        raise DIDError.new("Invalid DID format")
-      end
+      raise ArgumentError.new("did should be a String or a DID object") unless did.is_a?(String)
+      raise DIDError.new("Invalid DID format") unless did =~ DIDKit::GENERIC_DID_REGEXP
+      raise DIDError.new("DID string too long") if did.length > DIDKit::MAX_DID_LENGTH
+
+      @did = did
+      @type = did.split(':')[1].to_sym
 
-      if @type != :plc && @type != :web
+      if @type == :plc
+        validate_did_plc(did)
+      elsif @type == :web
+        validate_did_web(did)
+      else
         raise DIDError.new("Unrecognized DID type: #{@type}")
       end
 
@@ -87,19 +94,19 @@ module DIDKit
     # @return [Document] resolved DID document
 
     def get_document
-      Resolver.new.resolve_did(self)
+      DIDKit.default_resolver.resolve_did(self)
     end
 
-    # Returns the first verified handle assigned to this DID.
+    # Returns the current primary handle assigned to the DID, if it verifies correctly.
     #
-    # Looks up the domain handles assigned to this DID in its DID document, checks if they are
-    # verified (i.e. assigned correctly to this DID using DNS TXT or .well-known) and returns
-    # the first handle that validates correctly, or nil if none matches.
+    # Looks up the first syntactically valid handle in the DID document and checks if it is assigned
+    # correctly to this DID using DNS TXT or .well-known. Any later handles are ignored, even if the
+    # first handle fails verification. Returns nil if the primary handle cannot be verified.
     #
     # @return [String, nil] verified handle domain, if found
 
     def get_verified_handle
-      Resolver.new.get_verified_handle(document)
+      DIDKit.default_resolver.get_verified_handle(document)
     end
 
     # Fetches the PLC audit log (list of all previous operations) for a did:plc DID.
@@ -115,12 +122,31 @@ module DIDKit
       end
     end
 
-    # Returns the domain portion of a did:web identifier.
+    # Returns the domain portion of a did:web identifier. If the DID uses `localhost` with port as the hostname,
+    # the port part is skipped.
     #
     # @return [String, nil] DID domain if the DID is a did:web, nil for did:plc
 
-    def web_domain
-      did.gsub(/^did\:web\:/, '') if type == :web
+    def did_web_domain
+      return nil unless type == :web
+
+      @did_web_host.gsub(/:.*/, '')
+    end
+
+    alias web_domain did_web_domain
+
+    # Returns the URL of the host that hosts a did:web identity, including the http/https scheme
+    # and the port if included.
+    #
+    # @return [String] root URL of the host referenced by the did:web domain
+    # @raise [DIDError] when the DID is not a did:web
+
+    def did_web_host
+      raise DIDError, "DID is not a did:web" unless type == :web
+
+      protocol = (@did_web_host =~ /^localhost(\:.*|$)/) ? 'http' : 'https'
+
+      "#{protocol}://#{@did_web_host}"
     end
 
     # Checks the status of the account/repo on its own PDS using the `getRepoStatus` endpoint.
@@ -136,8 +162,7 @@ module DIDKit
       doc = self.document
       return nil if doc.pds_endpoint.nil?
 
-      pds_host = uri_origin(doc.pds_endpoint)
-      url = URI("#{pds_host}/xrpc/com.atproto.sync.getRepoStatus")
+      url = URI.join(doc.pds_endpoint, "/xrpc/com.atproto.sync.getRepoStatus")
       url.query = URI.encode_www_form(:did => @did)
 
       response = get_response(url, request_options)
@@ -197,5 +222,34 @@ module DIDKit
         false
       end
     end
+
+
+    private
+
+    def validate_did_plc(did)
+      raise DIDError.new("Invalid did:plc") unless did =~ DIDKit::DID_PLC_REGEXP
+    end
+
+    def validate_did_web(did)
+      identifier_part = did.delete_prefix('did:web:')
+
+      # literal colons delimit paths in did:web - a port separator must be percent-encoded
+      raise DIDError.new("Invalid did:web") if identifier_part.include?(':')
+
+      decoded_host = URI::DEFAULT_PARSER.unescape(identifier_part).b
+      raise DIDError.new("Invalid did:web") unless "did:web:#{decoded_host}" =~ DIDKit::DID_WEB_REGEXP
+
+      if decoded_host.include?(':')
+        hostname, port = decoded_host.split(':')
+        raise DIDError.new("Invalid did:web server port") unless port.to_i.between?(1, 65535)
+      else
+        hostname = decoded_host
+      end
+
+      tld = hostname.split('.').last.downcase
+      raise DIDError.new("Invalid did:web TLD: #{tld}") if RESERVED_DOMAINS.include?(tld) && hostname != 'localhost'
+
+      @did_web_host = decoded_host
+    end
   end
 end

data/lib/didkit/document.rb

@@ -2,6 +2,7 @@
 
 require_relative 'at_handles'
 require_relative 'errors'
+require_relative 'public_key'
 require_relative 'resolver'
 require_relative 'service_record'
 require_relative 'services'
@@ -9,22 +10,29 @@ require_relative 'services'
 module DIDKit
 
   #
-  # Parsed DID document from a JSON file loaded from [plc.directory](https://plc.directory) or a did:web domain.
+  # Parsed DID document from a JSON file loaded from the PLC directory ([plc.directory](https://plc.directory)
+  # or a mirror) or from a did:web domain.
   #
   # Use {DID#document} or {Resolver#resolve_did} to fetch a DID document and return this object.
   #
+  # Related specifications:
+  # - [ATProto DID](https://atproto.com/specs/did)
+  #
 
   class Document
     include AtHandles
     include Services
 
+    SERVICE_REGEXP = /\A(did:[^#]+)?#[^#]+\z/
+    private_constant :SERVICE_REGEXP
+
     # @return [Hash] the complete JSON data of the DID document
     attr_reader :json
 
     # @return [DID] the DID that this document describes
     attr_reader :did
 
-    # @return [Array<ServiceRecords>] service records like PDS details assigned to the DID
+    # @return [Array<ServiceRecord>] service records like PDS details assigned to the DID
     attr_reader :services
 
     # Creates a DID document object.
@@ -34,6 +42,9 @@ module DIDKit
     # @raise [FormatError] when required fields are missing or invalid.
 
     def initialize(did, json)
+      raise ArgumentError, "did should be a DID object" unless did.is_a?(DID)
+      raise ArgumentError, "json should be a Hash" unless json.is_a?(Hash)
+
       raise FormatError, "Missing id field" if json['id'].nil?
       raise FormatError, "Invalid id field" unless json['id'].is_a?(String)
       raise FormatError, "id field doesn't match expected DID" unless json['id'] == did.to_s
@@ -45,16 +56,42 @@ module DIDKit
       parse_also_known_as(json['alsoKnownAs'] || [])
     end
 
-    # Returns the first verified handle assigned to the DID.
+    # Returns the current primary handle assigned to the DID, if it verifies correctly.
     #
-    # Looks up the domain handles assigned to this DID in the DID document, checks if they are
-    # verified (i.e. assigned correctly to this DID using DNS TXT or .well-known) and returns
-    # the first handle that validates correctly, or nil if none matches.
+    # Looks up the first syntactically valid handle in the DID document and checks if it is assigned
+    # correctly to this DID using DNS TXT or .well-known. Any later handles are ignored, even if the
+    # first handle fails verification. Returns nil if the primary handle cannot be verified.
     #
     # @return [String, nil] verified handle domain, if found
 
     def get_verified_handle
-      Resolver.new.get_verified_handle(self)
+      DIDKit.default_resolver.get_verified_handle(self)
+    end
+
+    # Returns the account's public signing key parsed from the DID document's `verificationMethod`.
+    #
+    # @return [PublicKey, nil] decoded signing key wrapped in {PublicKey}, or nil if no matching verification
+    #   method is found
+    # @raise [FormatError] when `verificationMethod` or one of its entries has an invalid type
+    # @raise [ArgumentError] when selected key data is not a string
+    # @raise [PublicKeyError] when the key is invalid, incorrectly encoded, or has unsupported type
+
+    def signing_key
+      keys = @json['verificationMethod']
+      return nil if keys.nil?
+
+      raise FormatError, "verificationMethod is not an array: #{keys.inspect}" unless keys.is_a?(Array)
+
+      keys.each do |data|
+        raise FormatError, "verificationMethod item is invalid: #{data.inspect}" unless data.is_a?(Hash)
+
+        next unless data['id'] == "#{@did}#atproto" || data['id'] == "#atproto"
+        next unless data['controller'] == @did.to_s && data['type'] == 'Multikey' && !data['publicKeyMultibase'].nil?
+
+        return PublicKey.new(data['publicKeyMultibase'])
+      end
+
+      nil
     end
 
 
@@ -70,7 +107,16 @@ module DIDKit
 
         raise FormatError, "Missing service id" unless id
         raise FormatError, "Invalid service id: #{id.inspect}" unless id.is_a?(String)
-        next if !id.start_with?('#')
+        next unless id =~ SERVICE_REGEXP
+
+        if id.start_with?('did:')
+          did, rest = id.split('#')
+          next unless did == @did.to_s
+
+          id = rest
+        else
+          id = id.gsub(/^#/, '')
+        end
 
         raise FormatError, "Missing service type" unless type
         raise FormatError, "Invalid service type: #{type.inspect}" unless type.is_a?(String)
@@ -79,7 +125,7 @@ module DIDKit
         raise FormatError, "Invalid service endpoint: #{endpoint.inspect}" unless endpoint.is_a?(String)
 
         begin
-          @services << ServiceRecord.new(id.gsub(/^#/, ''), type, endpoint)
+          @services << ServiceRecord.new(id, type, endpoint)
         rescue FormatError => e
           # ignore services with invalid URIs
         end

data/lib/didkit/errors.rb

@@ -38,4 +38,10 @@ module DIDKit
   #
   class FormatError < StandardError
   end
+
+  #
+  # Raised when an account's public key is invalid or unsupported.
+  #
+  class PublicKeyError < StandardError
+  end
 end

data/lib/didkit/global_did.rb

@@ -0,0 +1,5 @@
+require_relative 'did'
+
+unless defined?(::DID)
+  DID = DIDKit::DID
+end

data/lib/didkit/plc_importer.rb

@@ -1,21 +1,22 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'set'
 require 'time'
 require 'uri'
 
+require_relative 'constants'
 require_relative 'errors'
 require_relative 'plc_operation'
 require_relative 'requests'
 
 #
-# NOTE: this class is pending a rewrite once new APIs are deployed to plc.directory.
-# Things will change here in v. 0.5.
+# NOTE: this class is pending a rewrite to handle updated plc.directory APIs.
+# Things will change here in v. 0.6.
 #
 
 module DIDKit
   class PLCImporter
-    PLC_SERVICE = 'plc.directory'
     MAX_PAGE = 1000
 
     include Requests
@@ -35,11 +36,13 @@ module DIDKit
       end
 
       @last_page_cids = []
-      @plc_service = service || PLC_SERVICE
+
+      @plc_service = service || DIDKit::DEFAULT_PLC_DIRECTORY
+      @plc_service = "https://#{@plc_service}" unless @plc_service.include?('://')
     end
 
     def get_export(args = {})
-      url = URI("https://#{@plc_service}/export")
+      url = URI("#{@plc_service}/export")
       url.query = URI.encode_www_form(args)
 
       data = get_data(url, content_type: 'application/jsonlines')
@@ -47,7 +50,7 @@ module DIDKit
     end
 
     def fetch_audit_log(did)
-      json = get_json("https://#{@plc_service}/#{did}/log/audit", :content_type => :json)
+      json = get_json("#{@plc_service}/#{did}/log/audit", :content_type => :json)
       json.map { |j| PLCOperation.new(j) }
     end
 

data/lib/didkit/plc_operation.rb

@@ -4,6 +4,7 @@ require 'time'
 
 require_relative 'at_handles'
 require_relative 'errors'
+require_relative 'public_key'
 require_relative 'service_record'
 require_relative 'services'
 
@@ -35,10 +36,10 @@ module DIDKit
     attr_reader :created_at
 
     # Returns the `type` field of the operation (usually `"plc_operation"`).
-    # @return [String] the operation type
+    # @return [Symbol] the operation type
     attr_reader :type
 
-    # @return [Array<ServiceRecords>] service records like PDS details assigned to the DID
+    # @return [Array<ServiceRecord>, nil] service records like PDS details assigned to the DID
     attr_reader :services
 
 
@@ -92,6 +93,37 @@ module DIDKit
       @json['nullified'] == true
     end
 
+    # Returns the account's public signing key listed in this PLC operation under `verificationMethods`.
+    #
+    # @return [PublicKey, nil] decoded signing key wrapped in {PublicKey}, or nil for `tombstone` operations
+    # @raise [FormatError] when a required field is missing or has a wrong type
+    # @raise [PublicKeyError] when the key is invalid, incorrectly encoded, or has unsupported type
+
+    def signing_key
+      case @type
+      when :plc_operation
+        methods = @json['operation']['verificationMethods']
+        raise FormatError, "Missing verificationMethods key: #{@json}" if methods.nil?
+        raise FormatError, "Invalid verificationMethods key: #{methods.inspect}" unless methods.is_a?(Hash)
+
+        key = methods['atproto']
+        raise FormatError, "Missing verificationMethods.atproto key: #{@json}" if key.nil?
+        raise FormatError, "Invalid verificationMethods.atproto key: #{key.inspect}" unless key.is_a?(String)
+        raise PublicKeyError, "Key should start with did:key: #{key.inspect}" unless key.start_with?('did:key:')
+
+        PublicKey.new(key[8..-1])
+      when :create
+        key = @json['operation']['signingKey']
+        raise FormatError, "Missing signingKey field: #{@json}" if key.nil?
+        raise FormatError, "Invalid signingKey field: #{key.inspect}" unless key.is_a?(String)
+        raise PublicKeyError, "Key should start with did:key: #{key.inspect}" unless key.start_with?('did:key:')
+
+        PublicKey.new(key[8..-1])
+      else
+        nil
+      end
+    end
+
 
     private
 

data/lib/didkit/public_key.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require 'base58'
+require 'openssl'
+require_relative 'errors'
+
+module DIDKit
+
+  #
+  # A public signing key of an ATProto account, decoded from its DID document or PLC operation.
+  #
+  # Both `k256` (`secp256k1`) and `p256` (`secp256r1`, `prime256v1`) keys are supported. Keys from
+  # legacy DID documents (before August 2023) without a `did:key:` prefix are intentionally *not* supported.
+  #
+  # Related documentation:
+  # - [ATProto: Cryptography](https://atproto.com/specs/cryptography)
+  # - [02, 03 or 04? So What Are Compressed and Uncompressed Public Keys?](https://medium.com/asecuritysite-when-bob-met-alice/02-03-or-04-so-what-are-compressed-and-uncompressed-public-keys-6abcb57efeb6)
+  # - [multicodec](https://github.com/multiformats/multicodec) & [multibase](https://github.com/multiformats/multibase)
+  #
+
+  class PublicKey
+
+    # Multicodec varint prefix for a compressed `k256` public key.
+    K256_PREFIX = "\xE7\x01".b.freeze
+
+    # Multicodec varint prefix for a compressed `p256` public key.
+    P256_PREFIX = "\x80\x24".b.freeze
+
+    # OpenSSL group name for the K-256 curve.
+    K256_GROUP_NAME = 'secp256k1'
+
+    # OpenSSL group name for the P-256 curve.
+    P256_GROUP_NAME = 'prime256v1'
+
+    # @return [String] a 33-byte binary string containing the raw compressed public key
+    attr_reader :compressed_key
+
+    # @return [String] the original multikey value, Base58-encoded with a `z` multibase prefix
+    attr_reader :multibase
+
+
+    # Decodes and validates an ATProto account public key.
+    #
+    # @param string [String] key in the multikey string form, without the `did:key:` prefix
+    # @raise [ArgumentError] when the argument is not a string
+    # @raise [PublicKeyError] when the key is invalid, incorrectly encoded, or has unsupported type
+
+    def initialize(string)
+      raise ArgumentError, "Expected a string argument" unless string.is_a?(String)
+
+      # both supported curve prefixes produce 48 Base58 characters, plus the multibase prefix;
+      # skip base58 decoding if the passed data is obviously wrong or too long
+      raise PublicKeyError, "Unsupported key encoding: #{string.inspect}" unless string.start_with?('z')
+      raise PublicKeyError, "Invalid encoded key length (#{string.bytesize})" unless string.bytesize == 49
+
+      @multibase = string
+
+      begin
+        key_decoded = Base58.base58_to_binary(string[1..-1], :bitcoin)
+      rescue ArgumentError
+        raise PublicKeyError, "Invalid Base58 encoding in key data"
+      end
+
+      prefix = key_decoded.byteslice(0, 2)
+
+      case prefix
+      when K256_PREFIX
+        @key_type = :k256
+      when P256_PREFIX
+        @key_type = :p256
+      else
+        raise PublicKeyError, "Unsupported key type: #{string.inspect}"
+      end
+
+      raise PublicKeyError, "Invalid key length (#{key_decoded.bytesize})" unless key_decoded.bytesize == 35
+
+      @compressed_key = key_decoded.byteslice(2, 33)
+
+      validate_ec_point
+    end
+
+    # Returns a short name of the key's elliptic curve.
+    # @return [Symbol] `:k256` or `:p256`
+
+    def type
+      @key_type
+    end
+
+    # Returns the OpenSSL elliptic curve group representing the given key's type.
+    # @return [OpenSSL::PKey::EC::Group] the `secp256k1` or `prime256v1` group
+
+    def ec_group
+      @ec_group ||= OpenSSL::PKey::EC::Group.new(@key_type == :k256 ? K256_GROUP_NAME : P256_GROUP_NAME)
+    end
+
+    # Returns the OpenSSL object representing the key's point on the elliptic curve.
+    #
+    # @return [OpenSSL::PKey::EC::Point] elliptic curve point for the key
+
+    def ec_point
+      @ec_point ||= OpenSSL::PKey::EC::Point.new(ec_group, @compressed_key)
+    end
+
+
+    private
+
+    def validate_ec_point
+      if !ec_point.on_curve?
+        # shouldn't generally happen because OpenSSL rejects such keys in Point initializer
+        raise PublicKeyError, "Invalid key data: #{@multibase.inspect}"
+      end
+    rescue OpenSSL::OpenSSLError
+      raise PublicKeyError, "Invalid key data: #{@multibase.inspect}"
+    end
+  end
+end

data/lib/didkit/requests.rb

@@ -22,7 +22,6 @@ module DIDKit
       timeout = options[:timeout] || 15
 
       request_options = {
-        use_ssl: true,
         open_timeout: timeout,
         read_timeout: timeout
       }
@@ -34,13 +33,18 @@ module DIDKit
       loop do
         visited_urls << url
 
-        response = Net::HTTP.start(url.host, url.port, request_options) do |http|
+        request_options.update(use_ssl: (url.scheme == 'https'))
+
+        response = Net::HTTP.start(url.hostname, url.port, request_options) do |http|
           request = Net::HTTP::Get.new(url)
           http.request(request)
         end
 
         if response.is_a?(Net::HTTPRedirection) && redirects < max_redirects && (location = response['Location'])
-          url = URI(location.include?('://') ? location : (uri_origin(url) + location))
+          target = URI.join(url.to_s, location)
+          return response unless target.scheme == 'https' || (target.scheme == 'http' && url.scheme == 'http')
+
+          url = target
 
           if visited_urls.include?(url)
             return response
@@ -54,6 +58,7 @@ module DIDKit
     end
 
     def get_data(url, options = {})
+      options = options.dup
       content_type = options.delete(:content_type)
       response = get_response(url, options)
 
@@ -84,13 +89,5 @@ module DIDKit
         raise ArgumentError, "Invalid expected_type: #{expected_type.inspect}"
       end
     end
-
-    # backported from https://github.com/ruby/uri/pull/30/files for older Rubies
-    def uri_origin(uri)
-      uri = uri.is_a?(URI) ? uri : URI(uri)
-      authority = (uri.port == uri.default_port) ? uri.host : "#{uri.host}:#{uri.port}"
-
-      "#{uri.scheme}://#{authority}"
-    end
   end
 end

data/lib/didkit/resolver.rb

@@ -1,36 +1,50 @@
 # frozen_string_literal: true
 
+require 'ipaddr'
 require 'net/http'
 require 'resolv'
+require 'uri'
 
+require_relative 'constants'
 require_relative 'did'
 require_relative 'document'
 require_relative 'requests'
 
 module DIDKit
 
+  class << self
+    # Default shared resolver used when calling {DID}/{Document} methods directly.
+    # @return [DIDKit::Resolver]
+    def default_resolver
+      @default_resolver ||= Resolver.new
+    end
+
+    attr_writer :default_resolver
+  end
+
+
   #
   # A class which manages resolving of handles to DIDs and DIDs to DID documents.
   #
 
   class Resolver
-    # These TLDs are not allowed in ATProto handles, so the resolver returns nil for them
-    # without trying to look them up.
-    RESERVED_DOMAINS = %w(alt arpa example internal invalid local localhost onion test)
-
     include Requests
 
-    # @return [String, Array<String>] custom DNS nameserver(s) to use for DNS TXT lookups
-    attr_accessor :nameserver
+    # @return [String, Array<String>, nil] custom DNS nameserver(s) to use for DNS TXT lookups
+    attr_reader :nameserver
 
     # @param options [Hash] resolver options
     # @option options [String, Array<String>] :nameserver custom DNS nameserver(s) to use (IP or an array of IPs)
+    # @option options [String] :plc_directory URL or host[:port] of an alternate PLC directory,
+    #   without a path; defaults to HTTPS (HTTP allowed for localhost/loopback IPs only)
     # @option options [Integer] :timeout request timeout in seconds (default: 15)
     # @option options [Integer] :max_redirects maximum number of redirects to follow (default: 5)
-
+    # @raise [ArgumentError] if the PLC directory address is invalid
+    #
     def initialize(options = {})
       @nameserver = options[:nameserver]
-      @request_options = options.slice(:timeout, :max_redirects)
+      @plc_service = options.key?(:plc_directory) ? parse_plc_service(options[:plc_directory]) : DEFAULT_PLC_DIRECTORY
+      @request_options = options.slice(:timeout, :max_redirects).freeze
     end
 
     # Resolve a handle into a DID. Looks up the given ATProto domain handle using the DNS TXT method
@@ -41,46 +55,56 @@ module DIDKit
     # check which one it is.
     #
     # @param handle [String, DID] a domain handle (may start with an `@`) or a DID string
+    # @param verify [Boolean] require the handle to be assigned to the DID in the DID document (default: true)
     # @return [DID, nil] resolved DID if found, nil otherwise
+    # @raise [APIError] if verification is enabled and the DID document request is unsuccessful
+    # @raise [FormatError] if verification is enabled and the DID document has invalid data
 
-    def resolve_handle(handle)
-      if handle.is_a?(DID) || handle =~ DID::GENERIC_REGEXP
-        return DID.new(handle)
+    def resolve_handle(handle, verify: true)
+      if !(handle.is_a?(DID) || handle.is_a?(String))
+        raise ArgumentError, "handle argument should be a String or a DID object"
       end
 
-      domain = handle.gsub(/^@/, '')
+      if handle.is_a?(DID) || handle =~ DIDKit::GENERIC_DID_REGEXP
+        return DID.new(handle)
+      end
 
-      return nil if RESERVED_DOMAINS.include?(domain.split('.').last)
+      domain = handle.gsub(/^@/, '').downcase(:ascii)
+      return nil unless valid_handle_identifier?(domain)
 
       if dns_did = resolve_handle_by_dns(domain)
-        DID.new(dns_did, :dns)
+        referenced_did = DID.new(dns_did, :dns)
       elsif http_did = resolve_handle_by_well_known(domain)
-        DID.new(http_did, :http)
+        referenced_did = DID.new(http_did, :http)
       else
-        nil
+        return nil
+      end
+
+      if verify
+        document = self.resolve_did(referenced_did)
+        return nil unless document.handles.first&.downcase == domain
       end
+
+      referenced_did
     end
 
     # Tries to resolve a handle into DID using the DNS TXT method.
     #
     # Checks the DNS records for a given domain for an entry `_atproto.#{domain}` whose value is
-    # a correct DID string.
+    # a correct DID string. Records are rejected if there exists more than one valid entry and they
+    # are referencing two or more different DIDs.
     #
     # @param domain [String] a domain handle to look up
-    # @return [String, nil] resolved DID if found, nil otherwise
+    # @return [String, nil] resolved DID if one valid record is found, nil otherwise
 
     def resolve_handle_by_dns(domain)
       dns_records = Resolv::DNS.open(resolv_options) do |d|
         d.getresources("_atproto.#{domain}", Resolv::DNS::Resource::IN::TXT)
       end
 
-      if record = dns_records.first
-        if string = record.strings.first
-          return parse_did_from_dns(string)
-        end
-      end
+      dids = dns_records.map { |record| parse_did_from_dns(record.data) }.compact.uniq
 
-      nil
+      dids.length == 1 ? dids.first : nil
     end
 
     # Tries to resolve a handle into DID using the HTTP .well-known method.
@@ -100,14 +124,15 @@ module DIDKit
       end
 
       nil
-    rescue StandardError => e
+    rescue StandardError
       nil
     end
 
     # Resolve a DID to a DID document.
     #
     # Looks up the DID document with the DID's identity details from an appropriate source, i.e. either
-    # [plc.directory](https://plc.directory) for did:plc DIDs, or the did:web's domain for did:web DIDs.
+    # [plc.directory](https://plc.directory) or its mirror for did:plc DIDs, or the did:web's domain
+    # for did:web DIDs.
     #
     # @param did [String, DID] DID string or object
     # @return [Document] resolved DID document
@@ -119,11 +144,11 @@ module DIDKit
       did.type == :plc ? resolve_did_plc(did) : resolve_did_web(did)
     end
 
-    # Returns the first verified handle assigned to the given DID.
+    # Returns the current primary handle assigned to the given DID, if it verifies correctly.
     #
-    # Looks up the domain handles assigned to the DID in the DID document, checks if they are
-    # verified (i.e. assigned correctly to this DID using DNS TXT or .well-known) and returns
-    # the first handle that validates correctly, or nil if none matches.
+    # Looks up the first syntactically valid handle in the DID document and checks if it is assigned
+    # correctly to this DID using DNS TXT or .well-known. Any later handles are ignored, even if the
+    # first handle fails verification. Returns nil if the primary handle cannot be verified.
     #
     # @param subject [String, DID, Document] a DID or its DID document
     # @return [String, nil] verified handle domain, if found
@@ -131,44 +156,87 @@ module DIDKit
     def get_verified_handle(subject)
       document = subject.is_a?(Document) ? subject : resolve_did(subject)
 
-      first_verified_handle(document.did, document.handles)
-    end
+      primary_handle = document.handles.first
 
-    # Returns the first handle from the list that resolves back to the given DID.
-    #
-    # @param did [DID, String] DID to verify the handles against
-    # @param handles [Array<String>] handles to check
-    # @return [String, nil] a verified handle, if found
+      return nil if primary_handle.nil?
+      return nil unless resolve_handle(primary_handle, verify: false) == document.did.to_s
 
-    def first_verified_handle(did, handles)
-      handles.detect { |h| resolve_handle(h) == did.to_s }
+      primary_handle
     end
 
 
     private
 
+    def valid_handle_identifier?(handle)
+      return false unless handle =~ DIDKit::HANDLE_REGEXP && handle.length <= DIDKit::MAX_HANDLE_LENGTH
+      return false if DIDKit::RESERVED_DOMAINS.include?(handle.split('.').last)
+
+      true
+    end
+
     def resolv_options
       options = Resolv::DNS::Config.default_config_hash.dup
       options[:nameserver] = nameserver if nameserver
       options
     end
 
+    def parse_plc_service(url)
+      raise ArgumentError, 'PLC directory URL must be a string' unless url.is_a?(String)
+
+      url = "https://#{url}" unless url.include?('://')
+      uri = URI.parse(url.chomp('/'))
+
+      unless uri.is_a?(URI::HTTP) && uri.host && !uri.host.empty? && uri.path.empty?
+        raise ArgumentError, 'PLC directory must be a hostname or a HTTP(S) URL without a path'
+      end
+
+      unless !uri.userinfo && !uri.query && !uri.fragment
+        raise ArgumentError, 'PLC directory URL must not include user credentials, query, or fragment part'
+      end
+
+      if uri.scheme == 'http' && !loopback_host?(uri.hostname)
+        raise ArgumentError, 'http:// URLs are allowed only with localhost or a loopback IP'
+      end
+
+      uri.to_s
+    rescue URI::InvalidURIError
+      raise ArgumentError, 'Invalid PLC directory URL'
+    end
+
+    def loopback_host?(host)
+      host.downcase(:ascii) == 'localhost' || IPAddr.new(host).loopback?
+    rescue IPAddr::InvalidAddressError
+      false
+    end
+
+    def valid_did?(did)
+      DID.new(did)
+      true
+    rescue DIDError
+      false
+    end
+
     def parse_did_from_dns(txt)
-      txt =~ /\Adid\=(did\:\w+\:.*)\z/ ? $1 : nil
+      return nil unless txt.start_with?('did=')
+
+      did = txt.delete_prefix('did=')
+
+      valid_did?(did) ? did : nil
     end
 
     def parse_did_from_well_known(text)
       text = text.strip
-      text.lines.length == 1 && text =~ DID::GENERIC_REGEXP ? text : nil
+      text.lines.length == 1 && valid_did?(text) ? text : nil
     end
 
     def resolve_did_plc(did)
-      json = get_json("https://plc.directory/#{did}", content_type: /^application\/did\+ld\+json(;.+)?$/)
+      options = @request_options.merge(content_type: /^application\/did(\+ld)?\+json(;.+)?$/)
+      json = get_json("#{@plc_service}/#{did}", options)
       Document.new(did, json)
     end
 
     def resolve_did_web(did)
-      json = get_json("https://#{did.web_domain}/.well-known/did.json")
+      json = get_json("#{did.did_web_host}/.well-known/did.json", @request_options)
       Document.new(did, json)
     end
   end

data/lib/didkit/services.rb

@@ -21,29 +21,55 @@ module DIDKit
       @services&.detect { |s| s.key == key && s.type == type }
     end
 
-    # Returns the PDS service endpoint, if present.
+    # Returns the PDS service endpoint, if present and valid.
     #
     # If the DID has an `#atproto_pds` service declared in its `service` section,
     # returns the URL in its `serviceEndpoint` field. In other words, this is the URL
     # of the PDS assigned to a given user, which stores the user's account and repo.
     #
+    # Returns nil if the service record is present, but the URL is not a valid HTTP(S) URL.
+    # For PDS endpoint specifically, the URL should only contain the scheme, hostname, and
+    # optional port number, but no userinfo, path, query or other components. As an exception,
+    # a path in the form of a single trailing slash is also allowed.
+    #
     # @api public
     # @return [String, nil] PDS service endpoint URL
 
     def pds_endpoint
-      @pds_endpoint ||= get_service('atproto_pds', 'AtprotoPersonalDataServer')&.endpoint
+      return @pds_endpoint if @pds_endpoint
+
+      endpoint = get_service('atproto_pds', 'AtprotoPersonalDataServer')&.endpoint
+      return nil if endpoint.nil?
+
+      uri = URI(endpoint)
+
+      return nil if uri.scheme !~ /^https?$/ || uri.host.nil? || uri.host.empty?
+      return nil if uri.userinfo || uri.query || uri.fragment
+      return nil unless uri.path.empty? || uri.path == '/'
+
+      @pds_endpoint = endpoint
     end
 
-    # Returns the labeler service endpoint, if present.
+    # Returns the labeler service endpoint, if present and valid.
     #
     # If the DID has an `#atproto_labeler` service declared in its `service` section,
     # returns the URL in its `serviceEndpoint` field.
     #
+    # Returns nil if the service record is present, but the URL is not an HTTP(S) URL.
+    #
     # @api public
     # @return [String, nil] labeler service endpoint URL
 
     def labeler_endpoint
-      @labeler_endpoint ||= get_service('atproto_labeler', 'AtprotoLabeler')&.endpoint
+      return @labeler_endpoint if @labeler_endpoint
+
+      endpoint = get_service('atproto_labeler', 'AtprotoLabeler')&.endpoint
+      return nil if endpoint.nil?
+
+      uri = URI(endpoint)
+      return nil if uri.scheme !~ /^https?$/ || uri.host.nil? || uri.host.empty?
+
+      @labeler_endpoint = endpoint
     end
 
     # Returns the hostname of the PDS service, if present.

data/lib/didkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DIDKit
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/didkit.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
+require_relative "didkit/constants"
 require_relative "didkit/did"
 require_relative "didkit/document"
+require_relative "didkit/global_did"
 require_relative "didkit/plc_importer"
 require_relative "didkit/plc_operation"
 require_relative "didkit/resolver"
@@ -9,5 +11,3 @@ require_relative "didkit/version"
 
 module DIDKit
 end
-
-DID = DIDKit::DID

metadata

@@ -1,14 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: didkit
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Kuba Suder
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies: []
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: base58
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
 email:
 - jakub.suder@gmail.com
 executables: []
@@ -18,19 +32,22 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
+- SECURITY.md
 - lib/didkit.rb
 - lib/didkit/at_handles.rb
+- lib/didkit/constants.rb
 - lib/didkit/did.rb
 - lib/didkit/document.rb
 - lib/didkit/errors.rb
+- lib/didkit/global_did.rb
 - lib/didkit/plc_importer.rb
 - lib/didkit/plc_operation.rb
+- lib/didkit/public_key.rb
 - lib/didkit/requests.rb
 - lib/didkit/resolver.rb
 - lib/didkit/service_record.rb
 - lib/didkit/services.rb
 - lib/didkit/version.rb
-- sig/didkit.rbs
 homepage: https://ruby.sdk.blue
 licenses:
 - Zlib
@@ -38,6 +55,7 @@ metadata:
   bug_tracker_uri: https://tangled.org/mackuba.eu/didkit/issues
   changelog_uri: https://tangled.org/mackuba.eu/didkit/blob/master/CHANGELOG.md
   source_code_uri: https://tangled.org/mackuba.eu/didkit
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -52,7 +70,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.15
+rubygems_version: 4.0.18
 specification_version: 4
 summary: A library for handling Distributed ID (DID) identifiers used in Bluesky AT
   Protocol

data/sig/didkit.rbs

@@ -1,4 +0,0 @@
-module Didkit
-  VERSION: String
-  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
-end