@atproto/lex-resolver 0.0.3 → 0.0.5

package/CHANGELOG.md

@@ -0,0 +1,65 @@
+# @atproto/lex-resolver
+
+## 0.0.5
+
+### Patch Changes
+
+- Updated dependencies [[`693784c`](https://github.com/bluesky-social/atproto/commit/693784c3a0dee4b6a29aa1e018fce682dcae148f), [`d551b0e`](https://github.com/bluesky-social/atproto/commit/d551b0e3527714c111c3ec6e4c90ad7f46369fab)]:
+  - @atproto/lex-data@0.0.3
+  - @atproto/lex-document@0.0.5
+  - @atproto/lex-client@0.0.4
+  - @atproto/lex-schema@0.0.4
+  - @atproto/repo@0.8.12
+
+## 0.0.4
+
+### Patch Changes
+
+- [#4384](https://github.com/bluesky-social/atproto/pull/4384) [`d396de0`](https://github.com/bluesky-social/atproto/commit/d396de016d1d55d08cfad1dabd3ffd9eaeea76ea) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Verify the signature when fetching lexicon document from a repo
+
+- [#4390](https://github.com/bluesky-social/atproto/pull/4390) [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Replace use of `CID` with `Cid`
+
+- [#4383](https://github.com/bluesky-social/atproto/pull/4383) [`8012627`](https://github.com/bluesky-social/atproto/commit/8012627a1226cb2f1c753385ad2497b6b43ffd2e) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add hooks
+
+- [#4383](https://github.com/bluesky-social/atproto/pull/4383) [`8012627`](https://github.com/bluesky-social/atproto/commit/8012627a1226cb2f1c753385ad2497b6b43ffd2e) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add `LexResolverError.from(string)` utility
+
+- [#4383](https://github.com/bluesky-social/atproto/pull/4383) [`8012627`](https://github.com/bluesky-social/atproto/commit/8012627a1226cb2f1c753385ad2497b6b43ffd2e) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove `didAuthority` option (Replaced by `hooks.onResolveAuthority`)
+
+- [#4390](https://github.com/bluesky-social/atproto/pull/4390) [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Rename schema methods `validate`, `check` and `maybe` to `safeParse`, `matches` and `ifMatches` respectively.
+
+- [#4397](https://github.com/bluesky-social/atproto/pull/4397) [`688f9d6`](https://github.com/bluesky-social/atproto/commit/688f9d67597ba96d6e9c4a4aec4d394d42f4cbf4) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add `CHANGELOG.md` to npm package
+
+- Updated dependencies [[`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`2d13d05`](https://github.com/bluesky-social/atproto/commit/2d13d05ab06576703742b1b638d2f243b6b2915f), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`a487ab8`](https://github.com/bluesky-social/atproto/commit/a487ab8afe8f18d00662e666049be8d28de2b57e), [`a487ab8`](https://github.com/bluesky-social/atproto/commit/a487ab8afe8f18d00662e666049be8d28de2b57e), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`bcae2b7`](https://github.com/bluesky-social/atproto/commit/bcae2b77b68da6dc2ec202651c8bf41fd5769f69), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`a487ab8`](https://github.com/bluesky-social/atproto/commit/a487ab8afe8f18d00662e666049be8d28de2b57e), [`a487ab8`](https://github.com/bluesky-social/atproto/commit/a487ab8afe8f18d00662e666049be8d28de2b57e), [`bcae2b7`](https://github.com/bluesky-social/atproto/commit/bcae2b77b68da6dc2ec202651c8bf41fd5769f69), [`03a2a4b`](https://github.com/bluesky-social/atproto/commit/03a2a4bb3814ced7ad1d4fe6c94b5348a3bbc097), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`bcae2b7`](https://github.com/bluesky-social/atproto/commit/bcae2b77b68da6dc2ec202651c8bf41fd5769f69), [`bcae2b7`](https://github.com/bluesky-social/atproto/commit/bcae2b77b68da6dc2ec202651c8bf41fd5769f69), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`d396de0`](https://github.com/bluesky-social/atproto/commit/d396de016d1d55d08cfad1dabd3ffd9eaeea76ea), [`a487ab8`](https://github.com/bluesky-social/atproto/commit/a487ab8afe8f18d00662e666049be8d28de2b57e), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`9f87ff3`](https://github.com/bluesky-social/atproto/commit/9f87ff3aa60090c8c38b6ce400cba6ceff5cd2e9), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba), [`688f9d6`](https://github.com/bluesky-social/atproto/commit/688f9d67597ba96d6e9c4a4aec4d394d42f4cbf4), [`1d445af`](https://github.com/bluesky-social/atproto/commit/1d445af2a7fc27eca5a45869b29266e6a2a7f3ba)]:
+  - @atproto/lex-schema@0.0.3
+  - @atproto/lex-document@0.0.4
+  - @atproto/lex-client@0.0.3
+  - @atproto/lex-data@0.0.2
+  - @atproto/syntax@0.4.2
+  - @atproto/crypto@0.4.5
+  - @atproto-labs/did-resolver@0.2.4
+
+## 0.0.3
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @atproto/lex-client@0.0.2
+  - @atproto/lex-document@0.0.3
+
+## 0.0.2
+
+### Patch Changes
+
+- Updated dependencies [[`5ffd612`](https://github.com/bluesky-social/atproto/commit/5ffd6129909071e979c30f31266119865ab582b6)]:
+  - @atproto/lex-document@0.0.2
+  - @atproto/lex-client@0.0.1
+
+## 0.0.1
+
+### Patch Changes
+
+- [#4371](https://github.com/bluesky-social/atproto/pull/4371) [`46550d6`](https://github.com/bluesky-social/atproto/commit/46550d6c1ffb298f57d54eb1904067b2df5a40af) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Release
+
+- Updated dependencies [[`46550d6`](https://github.com/bluesky-social/atproto/commit/46550d6c1ffb298f57d54eb1904067b2df5a40af)]:
+  - @atproto/lex-client@0.0.1
+  - @atproto/lex-document@0.0.1

package/dist/lex-resolver-error.d.ts

@@ -4,5 +4,6 @@ export declare class LexResolverError extends Error {
     readonly description: string;
     name: string;
     constructor(nsid: NSID, description?: string, options?: ErrorOptions);
+    static from(nsid: NSID | string, description?: string): LexResolverError;
 }
 //# sourceMappingURL=lex-resolver-error.d.ts.map

package/dist/lex-resolver-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lex-resolver-error.d.ts","sourceRoot":"","sources":["../src/lex-resolver-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,qBAAa,gBAAiB,SAAQ,KAAK;aAIvB,IAAI,EAAE,IAAI;aACV,WAAW;IAJ7B,IAAI,SAAqB;gBAGP,IAAI,EAAE,IAAI,EACV,WAAW,SAAuC,EAClE,OAAO,CAAC,EAAE,YAAY;CAIzB"}
+{"version":3,"file":"lex-resolver-error.d.ts","sourceRoot":"","sources":["../src/lex-resolver-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,qBAAa,gBAAiB,SAAQ,KAAK;aAIvB,IAAI,EAAE,IAAI;aACV,WAAW;IAJ7B,IAAI,SAAqB;gBAGP,IAAI,EAAE,IAAI,EACV,WAAW,SAAuC,EAClE,OAAO,CAAC,EAAE,YAAY;IAKxB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;CAMtD"}

package/dist/lex-resolver-error.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LexResolverError = void 0;
+const syntax_1 = require("@atproto/syntax");
 class LexResolverError extends Error {
     nsid;
     description;
@@ -10,6 +11,9 @@ class LexResolverError extends Error {
         this.nsid = nsid;
         this.description = description;
     }
+    static from(nsid, description) {
+        return new LexResolverError(typeof nsid === 'string' ? syntax_1.NSID.from(nsid) : nsid, description);
+    }
 }
 exports.LexResolverError = LexResolverError;
 //# sourceMappingURL=lex-resolver-error.js.map

package/dist/lex-resolver-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"lex-resolver-error.js","sourceRoot":"","sources":["../src/lex-resolver-error.ts"],"names":[],"mappings":";;;AAEA,MAAa,gBAAiB,SAAQ,KAAK;IAIvB;IACA;IAJlB,IAAI,GAAG,kBAAkB,CAAA;IAEzB,YACkB,IAAU,EACV,cAAc,oCAAoC,EAClE,OAAsB;QAEtB,KAAK,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;QAJ1B,SAAI,GAAJ,IAAI,CAAM;QACV,gBAAW,GAAX,WAAW,CAAuC;IAIpE,CAAC;CACF;AAVD,4CAUC","sourcesContent":["import { NSID } from '@atproto/syntax'\n\nexport class LexResolverError extends Error {\n  name = 'LexResolverError'\n\n  constructor(\n    public readonly nsid: NSID,\n    public readonly description = `Could not resolve Lexicon for NSID`,\n    options?: ErrorOptions,\n  ) {\n    super(`${description} (${nsid})`, options)\n  }\n}\n"]}
+{"version":3,"file":"lex-resolver-error.js","sourceRoot":"","sources":["../src/lex-resolver-error.ts"],"names":[],"mappings":";;;AAAA,4CAAsC;AAEtC,MAAa,gBAAiB,SAAQ,KAAK;IAIvB;IACA;IAJlB,IAAI,GAAG,kBAAkB,CAAA;IAEzB,YACkB,IAAU,EACV,cAAc,oCAAoC,EAClE,OAAsB;QAEtB,KAAK,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;QAJ1B,SAAI,GAAJ,IAAI,CAAM;QACV,gBAAW,GAAX,WAAW,CAAuC;IAIpE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,IAAmB,EAAE,WAAoB;QACnD,OAAO,IAAI,gBAAgB,CACzB,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EACjD,WAAW,CACZ,CAAA;IACH,CAAC;CACF;AAjBD,4CAiBC","sourcesContent":["import { NSID } from '@atproto/syntax'\n\nexport class LexResolverError extends Error {\n  name = 'LexResolverError'\n\n  constructor(\n    public readonly nsid: NSID,\n    public readonly description = `Could not resolve Lexicon for NSID`,\n    options?: ErrorOptions,\n  ) {\n    super(`${description} (${nsid})`, options)\n  }\n\n  static from(nsid: NSID | string, description?: string) {\n    return new LexResolverError(\n      typeof nsid === 'string' ? NSID.from(nsid) : nsid,\n      description,\n    )\n  }\n}\n"]}

package/dist/lex-resolver.d.ts

@@ -1,20 +1,55 @@
+import { Cid } from '@atproto/lex-data';
 import { LexiconDocument } from '@atproto/lex-document';
 import { AtUri, NSID } from '@atproto/syntax';
 import { CreateDidResolverOptions, Did, DidResolver, ResolveDidOptions } from '@atproto-labs/did-resolver';
+export type LexResolverResult = {
+    uri: AtUri;
+    cid: Cid;
+    lexicon: LexiconDocument;
+};
+export type LexResolverFetchResult = {
+    cid: Cid;
+    lexicon: LexiconDocument;
+};
+type Awaitable<T> = T | Promise<T>;
+export type LexResolverHooks = {
+    onResolveAuthority?(data: {
+        nsid: NSID;
+    }): Awaitable<void | Did>;
+    onResolveAuthorityResult?(data: {
+        nsid: NSID;
+        did: Did;
+    }): Awaitable<void>;
+    onResolveAuthorityError?(data: {
+        nsid: NSID;
+        err: unknown;
+    }): Awaitable<void>;
+    onFetch?(data: {
+        uri: AtUri;
+    }): Awaitable<void | LexResolverFetchResult>;
+    onFetchResult?(data: {
+        uri: AtUri;
+        cid: Cid;
+        lexicon: LexiconDocument;
+    }): Awaitable<void>;
+    onFetchError?(data: {
+        uri: AtUri;
+        err: unknown;
+    }): Awaitable<void>;
+};
 export type LexResolverOptions = CreateDidResolverOptions & {
-    didAuthority?: Did;
+    hooks?: LexResolverHooks;
 };
-export { AtUri, NSID };
+export { AtUri, type Cid, NSID };
 export type { LexiconDocument, ResolveDidOptions };
 export declare class LexResolver {
     protected readonly options: LexResolverOptions;
     protected readonly didResolver: DidResolver<'plc' | 'web'>;
     constructor(options: LexResolverOptions);
-    get(nsidStr: NSID | string, options?: ResolveDidOptions): Promise<{
-        uri: AtUri;
-        document: LexiconDocument;
-    }>;
+    get(nsidStr: NSID | string, options?: ResolveDidOptions): Promise<LexResolverResult>;
     resolve(nsidStr: NSID | string): Promise<AtUri>;
-    fetch(uriStr: AtUri | string, options?: ResolveDidOptions): Promise<LexiconDocument>;
+    protected resolveLexiconAuthority(nsid: NSID): Promise<Did>;
+    fetch(uriStr: AtUri | string, options?: ResolveDidOptions): Promise<LexResolverResult>;
+    protected fetchLexiconUri(uri: AtUri, options?: ResolveDidOptions): Promise<LexResolverFetchResult>;
 }
 //# sourceMappingURL=lex-resolver.d.ts.map

package/dist/lex-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lex-resolver.d.ts","sourceRoot":"","sources":["../src/lex-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAyB,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EACL,wBAAwB,EACxB,GAAG,EACH,WAAW,EACX,iBAAiB,EAIlB,MAAM,4BAA4B,CAAA;AAGnC,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,GAAG;IAC1D,YAAY,CAAC,EAAE,GAAG,CAAA;CACnB,CAAA;AAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACtB,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAA;AAElD,qBAAa,WAAW;IAGV,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB;IAF1D,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC,CAAA;gBAE3B,OAAO,EAAE,kBAAkB;IAIpD,GAAG,CACP,OAAO,EAAE,IAAI,GAAG,MAAM,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC;QACT,GAAG,EAAE,KAAK,CAAA;QACV,QAAQ,EAAE,eAAe,CAAA;KAC1B,CAAC;IAMI,OAAO,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAe/C,KAAK,CACT,MAAM,EAAE,KAAK,GAAG,MAAM,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,eAAe,CAAC;CAmE5B"}
+{"version":3,"file":"lex-resolver.d.ts","sourceRoot":"","sources":["../src/lex-resolver.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,eAAe,EAAyB,MAAM,uBAAuB,CAAA;AAQ9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAc,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAEL,wBAAwB,EACxB,GAAG,EACH,WAAW,EACX,iBAAiB,EAIlB,MAAM,4BAA4B,CAAA;AAInC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,KAAK,CAAA;IACV,GAAG,EAAE,GAAG,CAAA;IACR,OAAO,EAAE,eAAe,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,GAAG,CAAA;IACR,OAAO,EAAE,eAAe,CAAA;CACzB,CAAA;AAED,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAElC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,kBAAkB,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IAChE,wBAAwB,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1E,uBAAuB,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE7E,OAAO,CAAC,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,KAAK,CAAA;KAAE,GAAG,SAAS,CAAC,IAAI,GAAG,sBAAsB,CAAC,CAAA;IACxE,aAAa,CAAC,CAAC,IAAI,EAAE;QACnB,GAAG,EAAE,KAAK,CAAA;QACV,GAAG,EAAE,GAAG,CAAA;QACR,OAAO,EAAE,eAAe,CAAA;KACzB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACnB,YAAY,CAAC,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;CACnE,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,GAAG;IAC1D,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB,CAAA;AAED,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,EAAE,IAAI,EAAE,CAAA;AAChC,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAA;AAElD,qBAAa,WAAW;IAGV,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB;IAF1D,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC,CAAA;gBAE3B,OAAO,EAAE,kBAAkB;IAIpD,GAAG,CACP,OAAO,EAAE,IAAI,GAAG,MAAM,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,iBAAiB,CAAC;IAKvB,OAAO,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;cAuBrC,uBAAuB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;IAY3D,KAAK,CACT,MAAM,EAAE,KAAK,GAAG,MAAM,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,iBAAiB,CAAC;cAmBb,eAAe,CAC7B,GAAG,EAAE,KAAK,EACV,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,sBAAsB,CAAC;CAqEnC"}

package/dist/lex-resolver.js

@@ -1,14 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LexResolver = exports.NSID = exports.AtUri = void 0;
+const tslib_1 = require("tslib");
 const promises_1 = require("node:dns/promises");
+const crypto = tslib_1.__importStar(require("@atproto/crypto"));
 const lex_client_1 = require("@atproto/lex-client");
 const lex_document_1 = require("@atproto/lex-document");
+const repo_1 = require("@atproto/repo");
 const syntax_1 = require("@atproto/syntax");
 Object.defineProperty(exports, "AtUri", { enumerable: true, get: function () { return syntax_1.AtUri; } });
 Object.defineProperty(exports, "NSID", { enumerable: true, get: function () { return syntax_1.NSID; } });
 const did_resolver_1 = require("@atproto-labs/did-resolver");
 const lex_resolver_error_js_1 = require("./lex-resolver-error.js");
+const com = tslib_1.__importStar(require("./lexicons/com.js"));
 class LexResolver {
     options;
     didResolver;
@@ -18,89 +22,153 @@ class LexResolver {
     }
     async get(nsidStr, options) {
         const uri = await this.resolve(nsidStr);
-        const document = await this.fetch(uri, options);
-        return { uri, document };
+        return this.fetch(uri, options);
     }
     async resolve(nsidStr) {
         const nsid = syntax_1.NSID.from(nsidStr);
-        const did = this.options.didAuthority ??
-            (await resolveLexiconDidAuthority(nsid).catch((cause) => {
-                throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to resolve DID authority for Lexicon`, { cause });
+        const did = (await this.options.hooks?.onResolveAuthority?.({ nsid })) ??
+            (await this.resolveLexiconAuthority(nsid).then(async (did) => {
+                await this.options.hooks?.onResolveAuthorityResult?.({ nsid, did });
+                return did;
+            }, async (err) => {
+                await this.options.hooks?.onResolveAuthorityError?.({ nsid, err });
+                throw err;
             }));
         return syntax_1.AtUri.make(did, 'com.atproto.lexicon.schema', nsid.toString());
     }
+    // @TODO This class could be made compatible with browsers by making the
+    // following method abstract and/or by allowing the caller to inject a DNS
+    // resolver implementation (based on DNS-over-HTTPS or similar), instead of
+    // using the Node.js built-in resolver.
+    async resolveLexiconAuthority(nsid) {
+        try {
+            return await getDomainTxtDid(`_lexicon.${nsid.authority}`);
+        }
+        catch (cause) {
+            throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to resolve lexicon DID authority for ${nsid}`, { cause });
+        }
+    }
     async fetch(uriStr, options) {
         const uri = typeof uriStr === 'string' ? new syntax_1.AtUri(uriStr) : uriStr;
+        const { lexicon, cid } = (await this.options.hooks?.onFetch?.({ uri })) ??
+            (await this.fetchLexiconUri(uri, options).then(async (res) => {
+                await this.options.hooks?.onFetchResult?.({ uri, ...res });
+                return res;
+            }, async (err) => {
+                await this.options.hooks?.onFetchError?.({ uri, err });
+                throw err;
+            }));
+        return { uri, cid, lexicon };
+    }
+    async fetchLexiconUri(uri, options) {
         const { did, nsid } = parseLexiconUri(uri);
-        if (this.options.didAuthority && this.options.didAuthority !== did) {
-            throw new lex_resolver_error_js_1.LexResolverError(nsid, `DID authority mismatch: expected ${this.options.didAuthority}, got ${did}`);
-        }
-        const didDocument = await this.didResolver
+        const { pds, key } = await this.didResolver
             .resolve(did, options)
+            .then(did_resolver_1.extractAtprotoData)
             .catch((cause) => {
-            throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to resolve DID document for ${uri}`, { cause });
+            throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to resolve DID document for ${did}`, { cause });
         });
-        let service;
-        try {
-            service = (0, did_resolver_1.extractPdsUrl)(didDocument);
-        }
-        catch (cause) {
-            throw new lex_resolver_error_js_1.LexResolverError(nsid, `No PDS service endpoint found in DID document for ${uri}`, { cause });
+        if (!key || !pds || !URL.canParse(pds.serviceEndpoint)) {
+            throw new lex_resolver_error_js_1.LexResolverError(nsid, `No atproto PDS service endpoint or signing key found in ${did} DID document`);
         }
         const agent = (0, lex_client_1.buildAgent)({
-            service,
+            service: pds.serviceEndpoint,
             fetch: this.options.fetch,
         });
-        // TODO: use com.atproto.sync.getRecord and check signature using
-        // DID document key
-        const response = await new lex_client_1.Client(agent)
-            .getRecord('com.atproto.lexicon.schema', nsid.toString(), { repo: did })
-            .catch((cause) => {
-            throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to fetch Lexicon document at ${uri}`, { cause });
+        const collection = 'com.atproto.lexicon.schema';
+        const rkey = nsid.toString();
+        const { cid, record } = await (0, lex_client_1.xrpc)(agent, com.atproto.sync.getRecord, {
+            signal: options?.signal,
+            headers: options?.noCache ? { 'Cache-Control': 'no-cache' } : undefined,
+            params: { did, collection, rkey },
+        }).then(({ body: carBytes }) => {
+            return verifyRecordProof(carBytes, did, key, collection, rkey).catch((cause) => {
+                throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to verify Lexicon record proof at ${uri}`, { cause });
+            });
+        }, (cause) => {
+            throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to fetch Record ${uri}`, {
+                cause,
+            });
         });
-        const result = lex_document_1.lexiconDocumentSchema.validate(response.body.value);
-        if (!result.success) {
+        const validationResult = lex_document_1.lexiconDocumentSchema.safeParse(record);
+        if (!validationResult.success) {
             throw new lex_resolver_error_js_1.LexResolverError(nsid, `Invalid Lexicon document at ${uri}`, {
-                cause: result.error,
+                cause: validationResult.error,
             });
         }
-        const document = result.value;
-        if (document.id !== nsid.toString()) {
-            throw new lex_resolver_error_js_1.LexResolverError(nsid, `Invalid document id "${document.id}" for ${uri}`);
+        const lexicon = validationResult.value;
+        if (lexicon.id !== uri.rkey) {
+            throw new lex_resolver_error_js_1.LexResolverError(nsid, `Invalid document id "${lexicon.id}" at ${uri}`);
         }
-        return document;
+        return { lexicon, cid };
     }
 }
 exports.LexResolver = LexResolver;
 function parseLexiconUri(uri) {
     // Validate input URI
     const nsid = syntax_1.NSID.from(uri.rkey);
-    const did = uri.host;
-    (0, did_resolver_1.assertDid)(did);
-    return { did, nsid };
-}
-async function resolveLexiconDidAuthority(nsid) {
     try {
-        return await getDomainTxtDid(`_lexicon.${nsid.authority}`);
+        const did = uri.host;
+        (0, did_resolver_1.assertDid)(did);
+        return { did, nsid };
     }
     catch (cause) {
-        throw new lex_resolver_error_js_1.LexResolverError(nsid, `Failed to resolve lexicon DID authority`, { cause });
+        throw new lex_resolver_error_js_1.LexResolverError(nsid, `URI host is not a DID ${uri}`, { cause });
     }
 }
 async function getDomainTxtDid(domain) {
-    return parseDnsResult(await (0, promises_1.resolveTxt)(domain));
-}
-function parseDnsResult(chunkedResults) {
-    const didDefs = chunkedResults
+    const didLines = (await (0, promises_1.resolveTxt)(domain))
         .map((chunks) => chunks.join(''))
         .filter((i) => i.startsWith('did='));
-    if (didDefs.length === 1) {
-        const did = didDefs[0].slice(4);
+    if (didLines.length === 1) {
+        const did = didLines[0].slice(4);
         (0, did_resolver_1.assertDid)(did);
         return did;
     }
-    throw didDefs.length > 1
+    throw didLines.length > 1
         ? new Error('Multiple DIDs found in DNS TXT records')
         : new Error('No DID found in DNS TXT records');
 }
+async function verifyRecordProof(car, did, key, collection, rkey) {
+    const { root, blocks } = await (0, repo_1.readCarWithRoot)(car);
+    const blockstore = new repo_1.MemoryBlockstore(blocks);
+    const commit = await blockstore.readObj(root, repo_1.def.commit);
+    if (commit.did !== did) {
+        throw new Error(`Invalid repo did: ${commit.did}`);
+    }
+    const signingKey = getDidKeyFromMultibase(key);
+    const validSig = await (0, repo_1.verifyCommitSig)(commit, signingKey);
+    if (!validSig) {
+        throw new Error(`Invalid signature on commit: ${root.toString()}`);
+    }
+    const mst = repo_1.MST.load(blockstore, commit.data);
+    const cid = await mst.get(`${collection}/${rkey}`);
+    if (!cid)
+        throw new Error('Record not found in proof');
+    const record = await blockstore.readRecord(cid);
+    if (record?.$type !== collection) {
+        throw new Error(`Invalid record type: expected ${collection}, got ${record?.$type}`);
+    }
+    return { cid, record };
+}
+function getDidKeyFromMultibase(key) {
+    switch (key.type) {
+        case 'EcdsaSecp256r1VerificationKey2019': {
+            const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase);
+            return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes);
+        }
+        case 'EcdsaSecp256k1VerificationKey2019': {
+            const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase);
+            return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes);
+        }
+        case 'Multikey': {
+            const { jwtAlg, keyBytes } = crypto.parseMultikey(key.publicKeyMultibase);
+            return crypto.formatDidKey(jwtAlg, keyBytes);
+        }
+        default: {
+            // Should never happen
+            throw new Error(`Unsupported verification method type: ${key.type}`);
+        }
+    }
+}
 //# sourceMappingURL=lex-resolver.js.map

package/dist/lex-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"lex-resolver.js","sourceRoot":"","sources":["../src/lex-resolver.ts"],"names":[],"mappings":";;;AAAA,gDAA8C;AAC9C,oDAAwD;AACxD,wDAA8E;AAC9E,4CAA6C;AAgBpC,sFAhBA,cAAK,OAgBA;AAAE,qFAhBA,aAAI,OAgBA;AAfpB,6DAQmC;AACnC,mEAA0D;AAS1D,MAAa,WAAW;IAGS;IAFZ,WAAW,CAA4B;IAE1D,YAA+B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;QACxD,IAAI,CAAC,WAAW,GAAG,IAAA,gCAAiB,EAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CACP,OAAsB,EACtB,OAA2B;QAK3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAsB;QAClC,MAAM,IAAI,GAAG,aAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/B,MAAM,GAAG,GACP,IAAI,CAAC,OAAO,CAAC,YAAY;YACzB,CAAC,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACtD,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,6CAA6C,EAC7C,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC,CAAC,CAAC,CAAA;QAEL,OAAO,cAAK,CAAC,IAAI,CAAC,GAAG,EAAE,4BAA4B,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAAsB,EACtB,OAA2B;QAE3B,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,cAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACnE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,GAAG,EAAE,CAAC;YACnE,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,oCAAoC,IAAI,CAAC,OAAO,CAAC,YAAY,SAAS,GAAG,EAAE,CAC5E,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW;aACvC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC;aACrB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,sCAAsC,GAAG,EAAE,EAC3C,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,IAAI,OAAY,CAAA;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,4BAAa,EAAC,WAAW,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,qDAAqD,GAAG,EAAE,EAC1D,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,uBAAU,EAAC;YACvB,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;SAC1B,CAAC,CAAA;QAEF,iEAAiE;QACjE,mBAAmB;QACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,mBAAM,CAAC,KAAK,CAAC;aACrC,SAAS,CAAC,4BAA4B,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;aACvE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,uCAAuC,GAAG,EAAE,EAC5C,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,MAAM,GAAG,oCAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,wCAAgB,CAAC,IAAI,EAAE,+BAA+B,GAAG,EAAE,EAAE;gBACrE,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAA;QAE7B,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,wBAAwB,QAAQ,CAAC,EAAE,SAAS,GAAG,EAAE,CAClD,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF;AAxGD,kCAwGC;AAED,SAAS,eAAe,CAAC,GAAU;IAIjC,qBAAqB;IACrB,MAAM,IAAI,GAAG,aAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAA;IACpB,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAA;IAEd,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,IAAU;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,yCAAyC,EACzC,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,OAAO,cAAc,CAAC,MAAM,IAAA,qBAAU,EAAC,MAAM,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,cAA0B;IAChD,MAAM,OAAO,GAAG,cAAc;SAC3B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAEtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/B,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAA;QACd,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,OAAO,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC;QACrD,CAAC,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;AAClD,CAAC","sourcesContent":["import { resolveTxt } from 'node:dns/promises'\nimport { Client, buildAgent } from '@atproto/lex-client'\nimport { LexiconDocument, lexiconDocumentSchema } from '@atproto/lex-document'\nimport { AtUri, NSID } from '@atproto/syntax'\nimport {\n  CreateDidResolverOptions,\n  Did,\n  DidResolver,\n  ResolveDidOptions,\n  assertDid,\n  createDidResolver,\n  extractPdsUrl,\n} from '@atproto-labs/did-resolver'\nimport { LexResolverError } from './lex-resolver-error.js'\n\nexport type LexResolverOptions = CreateDidResolverOptions & {\n  didAuthority?: Did\n}\n\nexport { AtUri, NSID }\nexport type { LexiconDocument, ResolveDidOptions }\n\nexport class LexResolver {\n  protected readonly didResolver: DidResolver<'plc' | 'web'>\n\n  constructor(protected readonly options: LexResolverOptions) {\n    this.didResolver = createDidResolver(options)\n  }\n\n  async get(\n    nsidStr: NSID | string,\n    options?: ResolveDidOptions,\n  ): Promise<{\n    uri: AtUri\n    document: LexiconDocument\n  }> {\n    const uri = await this.resolve(nsidStr)\n    const document = await this.fetch(uri, options)\n    return { uri, document }\n  }\n\n  async resolve(nsidStr: NSID | string): Promise<AtUri> {\n    const nsid = NSID.from(nsidStr)\n    const did =\n      this.options.didAuthority ??\n      (await resolveLexiconDidAuthority(nsid).catch((cause) => {\n        throw new LexResolverError(\n          nsid,\n          `Failed to resolve DID authority for Lexicon`,\n          { cause },\n        )\n      }))\n\n    return AtUri.make(did, 'com.atproto.lexicon.schema', nsid.toString())\n  }\n\n  async fetch(\n    uriStr: AtUri | string,\n    options?: ResolveDidOptions,\n  ): Promise<LexiconDocument> {\n    const uri = typeof uriStr === 'string' ? new AtUri(uriStr) : uriStr\n    const { did, nsid } = parseLexiconUri(uri)\n\n    if (this.options.didAuthority && this.options.didAuthority !== did) {\n      throw new LexResolverError(\n        nsid,\n        `DID authority mismatch: expected ${this.options.didAuthority}, got ${did}`,\n      )\n    }\n\n    const didDocument = await this.didResolver\n      .resolve(did, options)\n      .catch((cause) => {\n        throw new LexResolverError(\n          nsid,\n          `Failed to resolve DID document for ${uri}`,\n          { cause },\n        )\n      })\n\n    let service: URL\n    try {\n      service = extractPdsUrl(didDocument)\n    } catch (cause) {\n      throw new LexResolverError(\n        nsid,\n        `No PDS service endpoint found in DID document for ${uri}`,\n        { cause },\n      )\n    }\n\n    const agent = buildAgent({\n      service,\n      fetch: this.options.fetch,\n    })\n\n    // TODO: use com.atproto.sync.getRecord and check signature using\n    // DID document key\n    const response = await new Client(agent)\n      .getRecord('com.atproto.lexicon.schema', nsid.toString(), { repo: did })\n      .catch((cause) => {\n        throw new LexResolverError(\n          nsid,\n          `Failed to fetch Lexicon document at ${uri}`,\n          { cause },\n        )\n      })\n\n    const result = lexiconDocumentSchema.validate(response.body.value)\n    if (!result.success) {\n      throw new LexResolverError(nsid, `Invalid Lexicon document at ${uri}`, {\n        cause: result.error,\n      })\n    }\n\n    const document = result.value\n\n    if (document.id !== nsid.toString()) {\n      throw new LexResolverError(\n        nsid,\n        `Invalid document id \"${document.id}\" for ${uri}`,\n      )\n    }\n\n    return document\n  }\n}\n\nfunction parseLexiconUri(uri: AtUri): {\n  did: Did\n  nsid: NSID\n} {\n  // Validate input URI\n  const nsid = NSID.from(uri.rkey)\n  const did = uri.host\n  assertDid(did)\n\n  return { did, nsid }\n}\n\nasync function resolveLexiconDidAuthority(nsid: NSID): Promise<Did> {\n  try {\n    return await getDomainTxtDid(`_lexicon.${nsid.authority}`)\n  } catch (cause) {\n    throw new LexResolverError(\n      nsid,\n      `Failed to resolve lexicon DID authority`,\n      { cause },\n    )\n  }\n}\n\nasync function getDomainTxtDid(domain: string): Promise<Did> {\n  return parseDnsResult(await resolveTxt(domain))\n}\n\nfunction parseDnsResult(chunkedResults: string[][]): Did {\n  const didDefs = chunkedResults\n    .map((chunks) => chunks.join(''))\n    .filter((i) => i.startsWith('did='))\n\n  if (didDefs.length === 1) {\n    const did = didDefs[0].slice(4)\n    assertDid(did)\n    return did\n  }\n\n  throw didDefs.length > 1\n    ? new Error('Multiple DIDs found in DNS TXT records')\n    : new Error('No DID found in DNS TXT records')\n}\n"]}
+{"version":3,"file":"lex-resolver.js","sourceRoot":"","sources":["../src/lex-resolver.ts"],"names":[],"mappings":";;;;AAAA,gDAA8C;AAC9C,gEAAyC;AACzC,oDAAsD;AAEtD,wDAA8E;AAC9E,wCAMsB;AACtB,4CAAyD;AA6ChD,sFA7CA,cAAK,OA6CA;AAAY,qFA7CV,aAAI,OA6CU;AA5C9B,6DASmC;AACnC,mEAA0D;AAC1D,+DAAwC;AAoCxC,MAAa,WAAW;IAGS;IAFZ,WAAW,CAA4B;IAE1D,YAA+B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;QACxD,IAAI,CAAC,WAAW,GAAG,IAAA,gCAAiB,EAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CACP,OAAsB,EACtB,OAA2B;QAE3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAsB;QAClC,MAAM,IAAI,GAAG,aAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAE/B,MAAM,GAAG,GACP,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;gBACnE,OAAO,GAAG,CAAA;YACZ,CAAC,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClE,MAAM,GAAG,CAAA;YACX,CAAC,CACF,CAAC,CAAA;QAEJ,OAAO,cAAK,CAAC,IAAI,CAAC,GAAG,EAAE,4BAA4B,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IAC7B,KAAK,CAAC,uBAAuB,CAAC,IAAU;QAChD,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,+CAA+C,IAAI,EAAE,EACrD,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAAsB,EACtB,OAA2B;QAE3B,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,cAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAEnE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GACpB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9C,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAC5C,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAA;gBAC1D,OAAO,GAAG,CAAA;YACZ,CAAC,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;gBACtD,MAAM,GAAG,CAAA;YACX,CAAC,CACF,CAAC,CAAA;QAEJ,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;IAC9B,CAAC;IAES,KAAK,CAAC,eAAe,CAC7B,GAAU,EACV,OAA2B;QAE3B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QAE1C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW;aACxC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC;aACrB,IAAI,CAAC,iCAAkB,CAAC;aACxB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,sCAAsC,GAAG,EAAE,EAC3C,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,2DAA2D,GAAG,eAAe,CAC9E,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,uBAAU,EAAC;YACvB,OAAO,EAAE,GAAG,CAAC,eAAe;YAC5B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;SAC1B,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,4BAA4B,CAAA;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAE5B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,iBAAI,EAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE;YACpE,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;YACvE,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;SAClC,CAAC,CAAC,IAAI,CACL,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;YACrB,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAClE,CAAC,KAAK,EAAE,EAAE;gBACR,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,4CAA4C,GAAG,EAAE,EACjD,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC,CACF,CAAA;QACH,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,IAAI,wCAAgB,CAAC,IAAI,EAAE,0BAA0B,GAAG,EAAE,EAAE;gBAChE,KAAK;aACN,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QAED,MAAM,gBAAgB,GAAG,oCAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAChE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,wCAAgB,CAAC,IAAI,EAAE,+BAA+B,GAAG,EAAE,EAAE;gBACrE,KAAK,EAAE,gBAAgB,CAAC,KAAK;aAC9B,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAA;QACtC,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,wCAAgB,CACxB,IAAI,EACJ,wBAAwB,OAAO,CAAC,EAAE,QAAQ,GAAG,EAAE,CAChD,CAAA;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;IACzB,CAAC;CACF;AAhJD,kCAgJC;AAED,SAAS,eAAe,CAAC,GAAU;IAIjC,qBAAqB;IACrB,MAAM,IAAI,GAAG,aAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAA;QACpB,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAA;QACd,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wCAAgB,CAAC,IAAI,EAAE,yBAAyB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAA,qBAAU,EAAC,MAAM,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAChC,IAAA,wBAAS,EAAC,GAAG,CAAC,CAAA;QACd,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC;QACrD,CAAC,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAe,EACf,GAAQ,EACR,GAA8B,EAC9B,UAAsB,EACtB,IAAY;IAEZ,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,sBAAe,EAAC,GAAG,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,IAAI,uBAAgB,CAAC,MAAM,CAAC,CAAA;IAE/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,UAAO,CAAC,MAAM,CAAC,CAAA;IAC7D,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAe,EAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,GAAG,GAAG,UAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAE7C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;IAClD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAEtD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC/C,IAAI,MAAM,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,iCAAiC,UAAU,SAAS,MAAM,EAAE,KAAK,EAAE,CACpE,CAAA;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;AACxB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAA8B;IAC5D,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,mCAAmC,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC3D,CAAC;QACD,KAAK,mCAAmC,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAA;QAChE,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YACzE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,sBAAsB;YACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { resolveTxt } from 'node:dns/promises'\nimport * as crypto from '@atproto/crypto'\nimport { buildAgent, xrpc } from '@atproto/lex-client'\nimport { Cid } from '@atproto/lex-data'\nimport { LexiconDocument, lexiconDocumentSchema } from '@atproto/lex-document'\nimport {\n  MST,\n  MemoryBlockstore,\n  def as repoDef,\n  readCarWithRoot,\n  verifyCommitSig,\n} from '@atproto/repo'\nimport { AtUri, NSID, NsidString } from '@atproto/syntax'\nimport {\n  AtprotoVerificationMethod,\n  CreateDidResolverOptions,\n  Did,\n  DidResolver,\n  ResolveDidOptions,\n  assertDid,\n  createDidResolver,\n  extractAtprotoData,\n} from '@atproto-labs/did-resolver'\nimport { LexResolverError } from './lex-resolver-error.js'\nimport * as com from './lexicons/com.js'\n\nexport type LexResolverResult = {\n  uri: AtUri\n  cid: Cid\n  lexicon: LexiconDocument\n}\n\nexport type LexResolverFetchResult = {\n  cid: Cid\n  lexicon: LexiconDocument\n}\n\ntype Awaitable<T> = T | Promise<T>\n\nexport type LexResolverHooks = {\n  onResolveAuthority?(data: { nsid: NSID }): Awaitable<void | Did>\n  onResolveAuthorityResult?(data: { nsid: NSID; did: Did }): Awaitable<void>\n  onResolveAuthorityError?(data: { nsid: NSID; err: unknown }): Awaitable<void>\n\n  onFetch?(data: { uri: AtUri }): Awaitable<void | LexResolverFetchResult>\n  onFetchResult?(data: {\n    uri: AtUri\n    cid: Cid\n    lexicon: LexiconDocument\n  }): Awaitable<void>\n  onFetchError?(data: { uri: AtUri; err: unknown }): Awaitable<void>\n}\n\nexport type LexResolverOptions = CreateDidResolverOptions & {\n  hooks?: LexResolverHooks\n}\n\nexport { AtUri, type Cid, NSID }\nexport type { LexiconDocument, ResolveDidOptions }\n\nexport class LexResolver {\n  protected readonly didResolver: DidResolver<'plc' | 'web'>\n\n  constructor(protected readonly options: LexResolverOptions) {\n    this.didResolver = createDidResolver(options)\n  }\n\n  async get(\n    nsidStr: NSID | string,\n    options?: ResolveDidOptions,\n  ): Promise<LexResolverResult> {\n    const uri = await this.resolve(nsidStr)\n    return this.fetch(uri, options)\n  }\n\n  async resolve(nsidStr: NSID | string): Promise<AtUri> {\n    const nsid = NSID.from(nsidStr)\n\n    const did =\n      (await this.options.hooks?.onResolveAuthority?.({ nsid })) ??\n      (await this.resolveLexiconAuthority(nsid).then(\n        async (did) => {\n          await this.options.hooks?.onResolveAuthorityResult?.({ nsid, did })\n          return did\n        },\n        async (err) => {\n          await this.options.hooks?.onResolveAuthorityError?.({ nsid, err })\n          throw err\n        },\n      ))\n\n    return AtUri.make(did, 'com.atproto.lexicon.schema', nsid.toString())\n  }\n\n  // @TODO This class could be made compatible with browsers by making the\n  // following method abstract and/or by allowing the caller to inject a DNS\n  // resolver implementation (based on DNS-over-HTTPS or similar), instead of\n  // using the Node.js built-in resolver.\n  protected async resolveLexiconAuthority(nsid: NSID): Promise<Did> {\n    try {\n      return await getDomainTxtDid(`_lexicon.${nsid.authority}`)\n    } catch (cause) {\n      throw new LexResolverError(\n        nsid,\n        `Failed to resolve lexicon DID authority for ${nsid}`,\n        { cause },\n      )\n    }\n  }\n\n  async fetch(\n    uriStr: AtUri | string,\n    options?: ResolveDidOptions,\n  ): Promise<LexResolverResult> {\n    const uri = typeof uriStr === 'string' ? new AtUri(uriStr) : uriStr\n\n    const { lexicon, cid } =\n      (await this.options.hooks?.onFetch?.({ uri })) ??\n      (await this.fetchLexiconUri(uri, options).then(\n        async (res) => {\n          await this.options.hooks?.onFetchResult?.({ uri, ...res })\n          return res\n        },\n        async (err) => {\n          await this.options.hooks?.onFetchError?.({ uri, err })\n          throw err\n        },\n      ))\n\n    return { uri, cid, lexicon }\n  }\n\n  protected async fetchLexiconUri(\n    uri: AtUri,\n    options?: ResolveDidOptions,\n  ): Promise<LexResolverFetchResult> {\n    const { did, nsid } = parseLexiconUri(uri)\n\n    const { pds, key } = await this.didResolver\n      .resolve(did, options)\n      .then(extractAtprotoData)\n      .catch((cause) => {\n        throw new LexResolverError(\n          nsid,\n          `Failed to resolve DID document for ${did}`,\n          { cause },\n        )\n      })\n\n    if (!key || !pds || !URL.canParse(pds.serviceEndpoint)) {\n      throw new LexResolverError(\n        nsid,\n        `No atproto PDS service endpoint or signing key found in ${did} DID document`,\n      )\n    }\n\n    const agent = buildAgent({\n      service: pds.serviceEndpoint,\n      fetch: this.options.fetch,\n    })\n\n    const collection = 'com.atproto.lexicon.schema'\n    const rkey = nsid.toString()\n\n    const { cid, record } = await xrpc(agent, com.atproto.sync.getRecord, {\n      signal: options?.signal,\n      headers: options?.noCache ? { 'Cache-Control': 'no-cache' } : undefined,\n      params: { did, collection, rkey },\n    }).then(\n      ({ body: carBytes }) => {\n        return verifyRecordProof(carBytes, did, key, collection, rkey).catch(\n          (cause) => {\n            throw new LexResolverError(\n              nsid,\n              `Failed to verify Lexicon record proof at ${uri}`,\n              { cause },\n            )\n          },\n        )\n      },\n      (cause) => {\n        throw new LexResolverError(nsid, `Failed to fetch Record ${uri}`, {\n          cause,\n        })\n      },\n    )\n\n    const validationResult = lexiconDocumentSchema.safeParse(record)\n    if (!validationResult.success) {\n      throw new LexResolverError(nsid, `Invalid Lexicon document at ${uri}`, {\n        cause: validationResult.error,\n      })\n    }\n\n    const lexicon = validationResult.value\n    if (lexicon.id !== uri.rkey) {\n      throw new LexResolverError(\n        nsid,\n        `Invalid document id \"${lexicon.id}\" at ${uri}`,\n      )\n    }\n\n    return { lexicon, cid }\n  }\n}\n\nfunction parseLexiconUri(uri: AtUri): {\n  did: Did\n  nsid: NSID\n} {\n  // Validate input URI\n  const nsid = NSID.from(uri.rkey)\n  try {\n    const did = uri.host\n    assertDid(did)\n    return { did, nsid }\n  } catch (cause) {\n    throw new LexResolverError(nsid, `URI host is not a DID ${uri}`, { cause })\n  }\n}\n\nasync function getDomainTxtDid(domain: string): Promise<Did> {\n  const didLines = (await resolveTxt(domain))\n    .map((chunks) => chunks.join(''))\n    .filter((i) => i.startsWith('did='))\n\n  if (didLines.length === 1) {\n    const did = didLines[0].slice(4)\n    assertDid(did)\n    return did\n  }\n\n  throw didLines.length > 1\n    ? new Error('Multiple DIDs found in DNS TXT records')\n    : new Error('No DID found in DNS TXT records')\n}\n\nasync function verifyRecordProof(\n  car: Uint8Array,\n  did: Did,\n  key: AtprotoVerificationMethod,\n  collection: NsidString,\n  rkey: string,\n) {\n  const { root, blocks } = await readCarWithRoot(car)\n  const blockstore = new MemoryBlockstore(blocks)\n\n  const commit = await blockstore.readObj(root, repoDef.commit)\n  if (commit.did !== did) {\n    throw new Error(`Invalid repo did: ${commit.did}`)\n  }\n\n  const signingKey = getDidKeyFromMultibase(key)\n  const validSig = await verifyCommitSig(commit, signingKey)\n  if (!validSig) {\n    throw new Error(`Invalid signature on commit: ${root.toString()}`)\n  }\n\n  const mst = MST.load(blockstore, commit.data)\n\n  const cid = await mst.get(`${collection}/${rkey}`)\n  if (!cid) throw new Error('Record not found in proof')\n\n  const record = await blockstore.readRecord(cid)\n  if (record?.$type !== collection) {\n    throw new Error(\n      `Invalid record type: expected ${collection}, got ${record?.$type}`,\n    )\n  }\n\n  return { cid, record }\n}\n\nfunction getDidKeyFromMultibase(key: AtprotoVerificationMethod) {\n  switch (key.type) {\n    case 'EcdsaSecp256r1VerificationKey2019': {\n      const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)\n      return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes)\n    }\n    case 'EcdsaSecp256k1VerificationKey2019': {\n      const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)\n      return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes)\n    }\n    case 'Multikey': {\n      const { jwtAlg, keyBytes } = crypto.parseMultikey(key.publicKeyMultibase)\n      return crypto.formatDidKey(jwtAlg, keyBytes)\n    }\n    default: {\n      // Should never happen\n      throw new Error(`Unsupported verification method type: ${key.type}`)\n    }\n  }\n}\n"]}

package/dist/lexicons/com/atproto/sync/getRecord.d.ts

@@ -0,0 +1,3 @@
+export * from './getRecord.defs.js';
+export * as $defs from './getRecord.defs.js';
+//# sourceMappingURL=getRecord.d.ts.map

package/dist/lexicons/com/atproto/sync/getRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRecord.d.ts","sourceRoot":"","sources":["../../../../../src/lexicons/com/atproto/sync/getRecord.ts"],"names":[],"mappings":"AAIA,cAAc,qBAAqB,CAAA;AACnC,OAAO,KAAK,KAAK,MAAM,qBAAqB,CAAA"}

package/dist/lexicons/com/atproto/sync/getRecord.defs.d.ts

@@ -0,0 +1,32 @@
+import { l } from '@atproto/lex-schema';
+declare const $nsid = "com.atproto.sync.getRecord";
+export { $nsid };
+/**
+ * Get data blocks needed to prove the existence or non-existence of record in the current version of repo. Does not require auth.
+ */
+declare const main: l.Query<"com.atproto.sync.getRecord", l.ParamsSchema<{
+    readonly did: l.StringSchema<{
+        readonly format: "did";
+    }>;
+    readonly collection: l.StringSchema<{
+        readonly format: "nsid";
+    }>;
+    readonly rkey: l.StringSchema<{
+        readonly format: "record-key";
+    }>;
+}>, l.Payload<"application/vnd.ipld.car", undefined>, readonly ["RecordNotFound", "RepoNotFound", "RepoTakendown", "RepoSuspended", "RepoDeactivated"]>;
+export { main };
+export declare const $params: l.ParamsSchema<{
+    readonly did: l.StringSchema<{
+        readonly format: "did";
+    }>;
+    readonly collection: l.StringSchema<{
+        readonly format: "nsid";
+    }>;
+    readonly rkey: l.StringSchema<{
+        readonly format: "record-key";
+    }>;
+}>, $output: l.Payload<"application/vnd.ipld.car", undefined>;
+export type Params = l.InferQueryParameters<typeof main>;
+export type Output = l.InferQueryOutputBody<typeof main>;
+//# sourceMappingURL=getRecord.defs.d.ts.map

package/dist/lexicons/com/atproto/sync/getRecord.defs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRecord.defs.d.ts","sourceRoot":"","sources":["../../../../../src/lexicons/com/atproto/sync/getRecord.defs.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAA;AAEvC,QAAA,MAAM,KAAK,+BAA+B,CAAA;AAE1C,OAAO,EAAE,KAAK,EAAE,CAAA;AAEhB;;GAEG;AACH,QAAA,MAAM,IAAI;;;;;;;;;;uJAiBP,CAAA;AACH,OAAO,EAAE,IAAI,EAAE,CAAA;AAEf,eAAO,MAAM,OAAO;;;;;;;;;;EAAkB,EACpC,OAAO,kDAAc,CAAA;AAEvB,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,oBAAoB,CAAC,OAAO,IAAI,CAAC,CAAA;AACxD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,oBAAoB,CAAC,OAAO,IAAI,CAAC,CAAA"}

package/dist/lexicons/com/atproto/sync/getRecord.defs.js

@@ -0,0 +1,30 @@
+"use strict";
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.$output = exports.$params = exports.main = exports.$nsid = void 0;
+const lex_schema_1 = require("@atproto/lex-schema");
+const $nsid = 'com.atproto.sync.getRecord';
+exports.$nsid = $nsid;
+/**
+ * Get data blocks needed to prove the existence or non-existence of record in the current version of repo. Does not require auth.
+ */
+const main = 
+/*#__PURE__*/
+lex_schema_1.l.query($nsid, 
+/*#__PURE__*/ lex_schema_1.l.params({
+    did: /*#__PURE__*/ lex_schema_1.l.string({ format: 'did' }),
+    collection: /*#__PURE__*/ lex_schema_1.l.string({ format: 'nsid' }),
+    rkey: /*#__PURE__*/ lex_schema_1.l.string({ format: 'record-key' }),
+}), 
+/*#__PURE__*/ lex_schema_1.l.payload('application/vnd.ipld.car'), [
+    'RecordNotFound',
+    'RepoNotFound',
+    'RepoTakendown',
+    'RepoSuspended',
+    'RepoDeactivated',
+]);
+exports.main = main;
+exports.$params = main.parameters, exports.$output = main.output;
+//# sourceMappingURL=getRecord.defs.js.map

package/dist/lexicons/com/atproto/sync/getRecord.defs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRecord.defs.js","sourceRoot":"","sources":["../../../../../src/lexicons/com/atproto/sync/getRecord.defs.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,oDAAuC;AAEvC,MAAM,KAAK,GAAG,4BAA4B,CAAA;AAEjC,sBAAK;AAEd;;GAEG;AACH,MAAM,IAAI;AACR,aAAa;AACb,cAAC,CAAC,KAAK,CACL,KAAK;AACL,aAAa,CAAC,cAAC,CAAC,MAAM,CAAC;IACrB,GAAG,EAAE,aAAa,CAAC,cAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9C,UAAU,EAAE,aAAa,CAAC,cAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAI,EAAE,aAAa,CAAC,cAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;CACvD,CAAC;AACF,aAAa,CAAC,cAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,EACnD;IACE,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,eAAe;IACf,iBAAiB;CAClB,CACF,CAAA;AACM,oBAAI;AAEA,QAAA,OAAO,GAAG,IAAI,CAAC,UAAU,EACpC,QAAA,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nimport { l } from '@atproto/lex-schema'\n\nconst $nsid = 'com.atproto.sync.getRecord'\n\nexport { $nsid }\n\n/**\n * Get data blocks needed to prove the existence or non-existence of record in the current version of repo. Does not require auth.\n */\nconst main =\n  /*#__PURE__*/\n  l.query(\n    $nsid,\n    /*#__PURE__*/ l.params({\n      did: /*#__PURE__*/ l.string({ format: 'did' }),\n      collection: /*#__PURE__*/ l.string({ format: 'nsid' }),\n      rkey: /*#__PURE__*/ l.string({ format: 'record-key' }),\n    }),\n    /*#__PURE__*/ l.payload('application/vnd.ipld.car'),\n    [\n      'RecordNotFound',\n      'RepoNotFound',\n      'RepoTakendown',\n      'RepoSuspended',\n      'RepoDeactivated',\n    ],\n  )\nexport { main }\n\nexport const $params = main.parameters,\n  $output = main.output\n\nexport type Params = l.InferQueryParameters<typeof main>\nexport type Output = l.InferQueryOutputBody<typeof main>\n"]}

package/dist/lexicons/com/atproto/sync/getRecord.js

@@ -0,0 +1,10 @@
+"use strict";
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.$defs = void 0;
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./getRecord.defs.js"), exports);
+exports.$defs = tslib_1.__importStar(require("./getRecord.defs.js"));
+//# sourceMappingURL=getRecord.js.map

package/dist/lexicons/com/atproto/sync/getRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getRecord.js","sourceRoot":"","sources":["../../../../../src/lexicons/com/atproto/sync/getRecord.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;AAEH,8DAAmC;AACnC,qEAA4C","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * from './getRecord.defs.js'\nexport * as $defs from './getRecord.defs.js'\n"]}

package/dist/lexicons/com/atproto/sync.d.ts

@@ -0,0 +1,2 @@
+export * as getRecord from './sync/getRecord.js';
+//# sourceMappingURL=sync.d.ts.map

package/dist/lexicons/com/atproto/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../../src/lexicons/com/atproto/sync.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,SAAS,MAAM,qBAAqB,CAAA"}

package/dist/lexicons/com/atproto/sync.js

@@ -0,0 +1,9 @@
+"use strict";
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRecord = void 0;
+const tslib_1 = require("tslib");
+exports.getRecord = tslib_1.__importStar(require("./sync/getRecord.js"));
+//# sourceMappingURL=sync.js.map

package/dist/lexicons/com/atproto/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../../src/lexicons/com/atproto/sync.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;AAEH,yEAAgD","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * as getRecord from './sync/getRecord.js'\n"]}

package/dist/lexicons/com/atproto.d.ts

@@ -0,0 +1,2 @@
+export * as sync from './atproto/sync.js';
+//# sourceMappingURL=atproto.d.ts.map

package/dist/lexicons/com/atproto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atproto.d.ts","sourceRoot":"","sources":["../../../src/lexicons/com/atproto.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA"}

package/dist/lexicons/com/atproto.js

@@ -0,0 +1,9 @@
+"use strict";
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sync = void 0;
+const tslib_1 = require("tslib");
+exports.sync = tslib_1.__importStar(require("./atproto/sync.js"));
+//# sourceMappingURL=atproto.js.map

package/dist/lexicons/com/atproto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atproto.js","sourceRoot":"","sources":["../../../src/lexicons/com/atproto.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;AAEH,kEAAyC","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * as sync from './atproto/sync.js'\n"]}

package/dist/lexicons/com.d.ts

@@ -0,0 +1,2 @@
+export * as atproto from './com/atproto.js';
+//# sourceMappingURL=com.d.ts.map

package/dist/lexicons/com.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"com.d.ts","sourceRoot":"","sources":["../../src/lexicons/com.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA"}

package/dist/lexicons/com.js

@@ -0,0 +1,9 @@
+"use strict";
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.atproto = void 0;
+const tslib_1 = require("tslib");
+exports.atproto = tslib_1.__importStar(require("./com/atproto.js"));
+//# sourceMappingURL=com.js.map

package/dist/lexicons/com.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"com.js","sourceRoot":"","sources":["../../src/lexicons/com.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;AAEH,oEAA2C","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * as atproto from './com/atproto.js'\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/lex-resolver",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "license": "MIT",
   "description": "Lexicon document resolver utility for AT Lexicons",
   "keywords": [
@@ -17,7 +17,11 @@
   },
   "files": [
     "./src",
-    "./dist"
+    "./tsconfig.build.json",
+    "./tsconfig.tests.json",
+    "./tsconfig.json",
+    "./dist",
+    "./CHANGELOG.md"
   ],
   "sideEffects": false,
   "type": "commonjs",
@@ -32,13 +36,20 @@
   },
   "dependencies": {
     "tslib": "^2.8.1",
-    "@atproto-labs/did-resolver": "0.2.3",
-    "@atproto/lex-client": "0.0.2",
-    "@atproto/lex-document": "0.0.3",
-    "@atproto/syntax": "0.4.1"
+    "@atproto-labs/did-resolver": "0.2.4",
+    "@atproto/crypto": "0.4.5",
+    "@atproto/lex-client": "0.0.4",
+    "@atproto/lex-data": "0.0.3",
+    "@atproto/lex-document": "0.0.5",
+    "@atproto/lex-schema": "0.0.4",
+    "@atproto/repo": "0.8.12",
+    "@atproto/syntax": "0.4.2"
+  },
+  "devDependencies": {
+    "@atproto/lex-builder": "0.0.6"
   },
-  "devDependencies": {},
   "scripts": {
+    "prebuild": "node ./scripts/lex-build.mjs",
     "build": "tsc --build tsconfig.build.json"
   }
 }

package/src/lex-resolver-error.ts

@@ -10,4 +10,11 @@ export class LexResolverError extends Error {
   ) {
     super(`${description} (${nsid})`, options)
   }
+
+  static from(nsid: NSID | string, description?: string) {
+    return new LexResolverError(
+      typeof nsid === 'string' ? NSID.from(nsid) : nsid,
+      description,
+    )
+  }
 }

package/src/lex-resolver.ts

@@ -1,23 +1,61 @@
 import { resolveTxt } from 'node:dns/promises'
-import { Client, buildAgent } from '@atproto/lex-client'
+import * as crypto from '@atproto/crypto'
+import { buildAgent, xrpc } from '@atproto/lex-client'
+import { Cid } from '@atproto/lex-data'
 import { LexiconDocument, lexiconDocumentSchema } from '@atproto/lex-document'
-import { AtUri, NSID } from '@atproto/syntax'
 import {
+  MST,
+  MemoryBlockstore,
+  def as repoDef,
+  readCarWithRoot,
+  verifyCommitSig,
+} from '@atproto/repo'
+import { AtUri, NSID, NsidString } from '@atproto/syntax'
+import {
+  AtprotoVerificationMethod,
   CreateDidResolverOptions,
   Did,
   DidResolver,
   ResolveDidOptions,
   assertDid,
   createDidResolver,
-  extractPdsUrl,
+  extractAtprotoData,
 } from '@atproto-labs/did-resolver'
 import { LexResolverError } from './lex-resolver-error.js'
+import * as com from './lexicons/com.js'
+
+export type LexResolverResult = {
+  uri: AtUri
+  cid: Cid
+  lexicon: LexiconDocument
+}
+
+export type LexResolverFetchResult = {
+  cid: Cid
+  lexicon: LexiconDocument
+}
+
+type Awaitable<T> = T | Promise<T>
+
+export type LexResolverHooks = {
+  onResolveAuthority?(data: { nsid: NSID }): Awaitable<void | Did>
+  onResolveAuthorityResult?(data: { nsid: NSID; did: Did }): Awaitable<void>
+  onResolveAuthorityError?(data: { nsid: NSID; err: unknown }): Awaitable<void>
+
+  onFetch?(data: { uri: AtUri }): Awaitable<void | LexResolverFetchResult>
+  onFetchResult?(data: {
+    uri: AtUri
+    cid: Cid
+    lexicon: LexiconDocument
+  }): Awaitable<void>
+  onFetchError?(data: { uri: AtUri; err: unknown }): Awaitable<void>
+}
 
 export type LexResolverOptions = CreateDidResolverOptions & {
-  didAuthority?: Did
+  hooks?: LexResolverHooks
 }
 
-export { AtUri, NSID }
+export { AtUri, type Cid, NSID }
 export type { LexiconDocument, ResolveDidOptions }
 
 export class LexResolver {
@@ -30,99 +68,139 @@ export class LexResolver {
   async get(
     nsidStr: NSID | string,
     options?: ResolveDidOptions,
-  ): Promise<{
-    uri: AtUri
-    document: LexiconDocument
-  }> {
+  ): Promise<LexResolverResult> {
     const uri = await this.resolve(nsidStr)
-    const document = await this.fetch(uri, options)
-    return { uri, document }
+    return this.fetch(uri, options)
   }
 
   async resolve(nsidStr: NSID | string): Promise<AtUri> {
     const nsid = NSID.from(nsidStr)
+
     const did =
-      this.options.didAuthority ??
-      (await resolveLexiconDidAuthority(nsid).catch((cause) => {
-        throw new LexResolverError(
-          nsid,
-          `Failed to resolve DID authority for Lexicon`,
-          { cause },
-        )
-      }))
+      (await this.options.hooks?.onResolveAuthority?.({ nsid })) ??
+      (await this.resolveLexiconAuthority(nsid).then(
+        async (did) => {
+          await this.options.hooks?.onResolveAuthorityResult?.({ nsid, did })
+          return did
+        },
+        async (err) => {
+          await this.options.hooks?.onResolveAuthorityError?.({ nsid, err })
+          throw err
+        },
+      ))
 
     return AtUri.make(did, 'com.atproto.lexicon.schema', nsid.toString())
   }
 
+  // @TODO This class could be made compatible with browsers by making the
+  // following method abstract and/or by allowing the caller to inject a DNS
+  // resolver implementation (based on DNS-over-HTTPS or similar), instead of
+  // using the Node.js built-in resolver.
+  protected async resolveLexiconAuthority(nsid: NSID): Promise<Did> {
+    try {
+      return await getDomainTxtDid(`_lexicon.${nsid.authority}`)
+    } catch (cause) {
+      throw new LexResolverError(
+        nsid,
+        `Failed to resolve lexicon DID authority for ${nsid}`,
+        { cause },
+      )
+    }
+  }
+
   async fetch(
     uriStr: AtUri | string,
     options?: ResolveDidOptions,
-  ): Promise<LexiconDocument> {
+  ): Promise<LexResolverResult> {
     const uri = typeof uriStr === 'string' ? new AtUri(uriStr) : uriStr
-    const { did, nsid } = parseLexiconUri(uri)
 
-    if (this.options.didAuthority && this.options.didAuthority !== did) {
-      throw new LexResolverError(
-        nsid,
-        `DID authority mismatch: expected ${this.options.didAuthority}, got ${did}`,
-      )
-    }
+    const { lexicon, cid } =
+      (await this.options.hooks?.onFetch?.({ uri })) ??
+      (await this.fetchLexiconUri(uri, options).then(
+        async (res) => {
+          await this.options.hooks?.onFetchResult?.({ uri, ...res })
+          return res
+        },
+        async (err) => {
+          await this.options.hooks?.onFetchError?.({ uri, err })
+          throw err
+        },
+      ))
+
+    return { uri, cid, lexicon }
+  }
 
-    const didDocument = await this.didResolver
+  protected async fetchLexiconUri(
+    uri: AtUri,
+    options?: ResolveDidOptions,
+  ): Promise<LexResolverFetchResult> {
+    const { did, nsid } = parseLexiconUri(uri)
+
+    const { pds, key } = await this.didResolver
       .resolve(did, options)
+      .then(extractAtprotoData)
       .catch((cause) => {
         throw new LexResolverError(
           nsid,
-          `Failed to resolve DID document for ${uri}`,
+          `Failed to resolve DID document for ${did}`,
           { cause },
         )
       })
 
-    let service: URL
-    try {
-      service = extractPdsUrl(didDocument)
-    } catch (cause) {
+    if (!key || !pds || !URL.canParse(pds.serviceEndpoint)) {
       throw new LexResolverError(
         nsid,
-        `No PDS service endpoint found in DID document for ${uri}`,
-        { cause },
+        `No atproto PDS service endpoint or signing key found in ${did} DID document`,
       )
     }
 
     const agent = buildAgent({
-      service,
+      service: pds.serviceEndpoint,
       fetch: this.options.fetch,
     })
 
-    // TODO: use com.atproto.sync.getRecord and check signature using
-    // DID document key
-    const response = await new Client(agent)
-      .getRecord('com.atproto.lexicon.schema', nsid.toString(), { repo: did })
-      .catch((cause) => {
-        throw new LexResolverError(
-          nsid,
-          `Failed to fetch Lexicon document at ${uri}`,
-          { cause },
+    const collection = 'com.atproto.lexicon.schema'
+    const rkey = nsid.toString()
+
+    const { cid, record } = await xrpc(agent, com.atproto.sync.getRecord, {
+      signal: options?.signal,
+      headers: options?.noCache ? { 'Cache-Control': 'no-cache' } : undefined,
+      params: { did, collection, rkey },
+    }).then(
+      ({ body: carBytes }) => {
+        return verifyRecordProof(carBytes, did, key, collection, rkey).catch(
+          (cause) => {
+            throw new LexResolverError(
+              nsid,
+              `Failed to verify Lexicon record proof at ${uri}`,
+              { cause },
+            )
+          },
         )
-      })
+      },
+      (cause) => {
+        throw new LexResolverError(nsid, `Failed to fetch Record ${uri}`, {
+          cause,
+        })
+      },
+    )
 
-    const result = lexiconDocumentSchema.validate(response.body.value)
-    if (!result.success) {
+    const validationResult = lexiconDocumentSchema.safeParse(record)
+    if (!validationResult.success) {
       throw new LexResolverError(nsid, `Invalid Lexicon document at ${uri}`, {
-        cause: result.error,
+        cause: validationResult.error,
       })
     }
 
-    const document = result.value
-
-    if (document.id !== nsid.toString()) {
+    const lexicon = validationResult.value
+    if (lexicon.id !== uri.rkey) {
       throw new LexResolverError(
         nsid,
-        `Invalid document id "${document.id}" for ${uri}`,
+        `Invalid document id "${lexicon.id}" at ${uri}`,
       )
     }
 
-    return document
+    return { lexicon, cid }
   }
 }
 
@@ -132,40 +210,84 @@ function parseLexiconUri(uri: AtUri): {
 } {
   // Validate input URI
   const nsid = NSID.from(uri.rkey)
-  const did = uri.host
-  assertDid(did)
-
-  return { did, nsid }
-}
-
-async function resolveLexiconDidAuthority(nsid: NSID): Promise<Did> {
   try {
-    return await getDomainTxtDid(`_lexicon.${nsid.authority}`)
+    const did = uri.host
+    assertDid(did)
+    return { did, nsid }
   } catch (cause) {
-    throw new LexResolverError(
-      nsid,
-      `Failed to resolve lexicon DID authority`,
-      { cause },
-    )
+    throw new LexResolverError(nsid, `URI host is not a DID ${uri}`, { cause })
   }
 }
 
 async function getDomainTxtDid(domain: string): Promise<Did> {
-  return parseDnsResult(await resolveTxt(domain))
-}
-
-function parseDnsResult(chunkedResults: string[][]): Did {
-  const didDefs = chunkedResults
+  const didLines = (await resolveTxt(domain))
     .map((chunks) => chunks.join(''))
     .filter((i) => i.startsWith('did='))
 
-  if (didDefs.length === 1) {
-    const did = didDefs[0].slice(4)
+  if (didLines.length === 1) {
+    const did = didLines[0].slice(4)
     assertDid(did)
     return did
   }
 
-  throw didDefs.length > 1
+  throw didLines.length > 1
     ? new Error('Multiple DIDs found in DNS TXT records')
     : new Error('No DID found in DNS TXT records')
 }
+
+async function verifyRecordProof(
+  car: Uint8Array,
+  did: Did,
+  key: AtprotoVerificationMethod,
+  collection: NsidString,
+  rkey: string,
+) {
+  const { root, blocks } = await readCarWithRoot(car)
+  const blockstore = new MemoryBlockstore(blocks)
+
+  const commit = await blockstore.readObj(root, repoDef.commit)
+  if (commit.did !== did) {
+    throw new Error(`Invalid repo did: ${commit.did}`)
+  }
+
+  const signingKey = getDidKeyFromMultibase(key)
+  const validSig = await verifyCommitSig(commit, signingKey)
+  if (!validSig) {
+    throw new Error(`Invalid signature on commit: ${root.toString()}`)
+  }
+
+  const mst = MST.load(blockstore, commit.data)
+
+  const cid = await mst.get(`${collection}/${rkey}`)
+  if (!cid) throw new Error('Record not found in proof')
+
+  const record = await blockstore.readRecord(cid)
+  if (record?.$type !== collection) {
+    throw new Error(
+      `Invalid record type: expected ${collection}, got ${record?.$type}`,
+    )
+  }
+
+  return { cid, record }
+}
+
+function getDidKeyFromMultibase(key: AtprotoVerificationMethod) {
+  switch (key.type) {
+    case 'EcdsaSecp256r1VerificationKey2019': {
+      const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)
+      return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes)
+    }
+    case 'EcdsaSecp256k1VerificationKey2019': {
+      const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)
+      return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes)
+    }
+    case 'Multikey': {
+      const { jwtAlg, keyBytes } = crypto.parseMultikey(key.publicKeyMultibase)
+      return crypto.formatDidKey(jwtAlg, keyBytes)
+    }
+    default: {
+      // Should never happen
+      throw new Error(`Unsupported verification method type: ${key.type}`)
+    }
+  }
+}

package/src/lexicons/com/atproto/sync/getRecord.defs.ts

@@ -0,0 +1,38 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+import { l } from '@atproto/lex-schema'
+
+const $nsid = 'com.atproto.sync.getRecord'
+
+export { $nsid }
+
+/**
+ * Get data blocks needed to prove the existence or non-existence of record in the current version of repo. Does not require auth.
+ */
+const main =
+  /*#__PURE__*/
+  l.query(
+    $nsid,
+    /*#__PURE__*/ l.params({
+      did: /*#__PURE__*/ l.string({ format: 'did' }),
+      collection: /*#__PURE__*/ l.string({ format: 'nsid' }),
+      rkey: /*#__PURE__*/ l.string({ format: 'record-key' }),
+    }),
+    /*#__PURE__*/ l.payload('application/vnd.ipld.car'),
+    [
+      'RecordNotFound',
+      'RepoNotFound',
+      'RepoTakendown',
+      'RepoSuspended',
+      'RepoDeactivated',
+    ],
+  )
+export { main }
+
+export const $params = main.parameters,
+  $output = main.output
+
+export type Params = l.InferQueryParameters<typeof main>
+export type Output = l.InferQueryOutputBody<typeof main>

package/src/lexicons/com/atproto/sync/getRecord.ts

@@ -0,0 +1,6 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * from './getRecord.defs.js'
+export * as $defs from './getRecord.defs.js'

package/src/lexicons/com/atproto/sync.ts

@@ -0,0 +1,5 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * as getRecord from './sync/getRecord.js'

package/src/lexicons/com/atproto.ts

@@ -0,0 +1,5 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * as sync from './atproto/sync.js'

package/src/lexicons/com.ts

@@ -0,0 +1,5 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * as atproto from './com/atproto.js'

package/tsconfig.build.json

@@ -0,0 +1,13 @@
+{
+  "extends": ["../../../tsconfig/node.json"],
+  "include": ["./src"],
+  "exclude": ["**/*.test.ts"],
+  "compilerOptions": {
+    "noImplicitAny": true,
+    "importHelpers": true,
+    "target": "ES2023",
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "types": ["node"]
+  }
+}

package/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "include": [],
+  "references": [
+    { "path": "./tsconfig.build.json" },
+    { "path": "./tsconfig.tests.json" }
+  ]
+}

package/tsconfig.tests.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../../tsconfig/tests.json",
+  "include": ["./tests", "./src/**.test.ts"],
+  "compilerOptions": {
+    "noImplicitAny": true,
+    "rootDir": "./",
+    "baseUrl": "./"
+  }
+}