@did-btcr2/method 0.41.0 → 0.42.0

package/dist/browser.js

@@ -93159,6 +93159,7 @@ a=end-of-candidates
     CASBeaconError: () => CASBeaconError,
     CHANGE_OUTPUT_VBYTES: () => CHANGE_OUTPUT_VBYTES,
     DEFAULT_FEE_ESTIMATOR: () => DEFAULT_FEE_ESTIMATOR,
+    DEFAULT_MAX_DISCOVERY_ROUNDS: () => DEFAULT_MAX_DISCOVERY_ROUNDS,
     DID_REGEX: () => DID_REGEX,
     DUST_LIMIT_SATS: () => DUST_LIMIT_SATS,
     DidBtcr2: () => DidBtcr2,
@@ -119289,7 +119290,8 @@ a=end-of-candidates
       return new Resolver(didComponents, sidecarData, currentDocument, {
         versionId: resolutionOptions.versionId,
         versionTime: resolutionOptions.versionTime,
-        genesisDocument: resolutionOptions.sidecar?.genesisDocument
+        genesisDocument: resolutionOptions.sidecar?.genesisDocument,
+        maxDiscoveryRounds: resolutionOptions.maxDiscoveryRounds
       });
     }
     /**
@@ -119398,6 +119400,21 @@ a=end-of-candidates
 
   // src/core/resolver.ts
   init_utils2();
+  var DEFAULT_MAX_DISCOVERY_ROUNDS = 10;
+  function isRecord(value2) {
+    return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+  }
+  function isCASAnnouncement(value2) {
+    return isRecord(value2) && Object.values(value2).every((v) => typeof v === "string");
+  }
+  function isSignedBTCR2Update(value2) {
+    if (!isRecord(value2)) return false;
+    return Array.isArray(value2.patch) && typeof value2.sourceHash === "string" && typeof value2.targetHash === "string" && typeof value2.targetVersionId === "number" && isRecord(value2.proof);
+  }
+  function isSMTProof(value2) {
+    if (!isRecord(value2)) return false;
+    return typeof value2.id === "string" && typeof value2.collapsed === "string" && Array.isArray(value2.hashes);
+  }
   var Resolver = class _Resolver {
     // --- Immutable inputs ---
     #didComponents;
@@ -119415,6 +119432,10 @@ a=end-of-candidates
     #requestCache = /* @__PURE__ */ new Set();
     #unsortedUpdates = [];
     #resolvedResponse = null;
+    /** Upper bound on multi-round beacon-discovery passes; see {@link DEFAULT_MAX_DISCOVERY_ROUNDS}. */
+    #maxDiscoveryRounds;
+    /** Count of beacon-discovery passes driven by updates adding new beacon services. */
+    #discoveryRounds = 0;
     /**
      * @internal Use {@link DidBtcr2.resolve} to create instances.
      */
@@ -119424,6 +119445,7 @@ a=end-of-candidates
       this.#currentDocument = currentDocument;
       this.#versionId = options2?.versionId;
       this.#versionTime = options2?.versionTime;
+      this.#maxDiscoveryRounds = options2?.maxDiscoveryRounds ?? DEFAULT_MAX_DISCOVERY_ROUNDS;
       if (options2?.genesisDocument) {
         this.#providedGenesisDocument = options2.genesisDocument;
       }
@@ -119738,6 +119760,13 @@ a=end-of-candidates
                 return !this.#requestCache.has(address);
               });
               if (hasNewServices) {
+                if (++this.#discoveryRounds > this.#maxDiscoveryRounds) {
+                  throw new ResolveError(
+                    `Exceeded maximum beacon-discovery rounds (${this.#maxDiscoveryRounds}); the DID document may chain beacon services without terminating.`,
+                    INVALID_DID_DOCUMENT,
+                    { maxDiscoveryRounds: this.#maxDiscoveryRounds }
+                  );
+                }
                 this.#phase = "BeaconDiscovery" /* BeaconDiscovery */;
                 continue;
               }
@@ -119764,38 +119793,84 @@ a=end-of-candidates
     provide(need, data) {
       switch (need.kind) {
         case "NeedGenesisDocument": {
+          if (!isRecord(data)) {
+            throw new ResolveError(
+              "Provided data for NeedGenesisDocument must be a document object.",
+              INVALID_DID_UPDATE,
+              { kind: need.kind }
+            );
+          }
           this.#providedGenesisDocument = data;
           break;
         }
         case "NeedBeaconSignals": {
-          const signals = data;
-          for (const [service, serviceSignals] of signals) {
+          if (!(data instanceof Map)) {
+            throw new ResolveError(
+              "Provided data for NeedBeaconSignals must be a Map of beacon services to signals.",
+              INVALID_DID_UPDATE,
+              { kind: need.kind }
+            );
+          }
+          for (const [service, serviceSignals] of data) {
             this.#beaconServicesSignals.set(service, serviceSignals);
           }
           break;
         }
         case "NeedCASAnnouncement": {
-          const announcement = data;
-          this.#sidecarData.casMap.set(canonicalHash(announcement, { encoding: "hex" }), announcement);
+          if (!isCASAnnouncement(data)) {
+            throw new ResolveError(
+              "Provided data for NeedCASAnnouncement is not a CAS announcement.",
+              INVALID_DID_UPDATE,
+              { kind: need.kind }
+            );
+          }
+          const announcementHash = canonicalHash(data, { encoding: "hex" });
+          if (announcementHash !== need.announcementHash) {
+            throw new ResolveError(
+              `CAS announcement hash mismatch: expected ${need.announcementHash}, got ${announcementHash}.`,
+              INVALID_DID_UPDATE,
+              { expected: need.announcementHash, actual: announcementHash }
+            );
+          }
+          this.#sidecarData.casMap.set(announcementHash, data);
           break;
         }
         case "NeedSignedUpdate": {
-          const update = data;
-          this.#sidecarData.updateMap.set(canonicalHash(update, { encoding: "hex" }), update);
+          if (!isSignedBTCR2Update(data)) {
+            throw new ResolveError(
+              "Provided data for NeedSignedUpdate is not a signed BTCR2 update.",
+              INVALID_DID_UPDATE,
+              { kind: need.kind }
+            );
+          }
+          const updateHash = canonicalHash(data, { encoding: "hex" });
+          if (updateHash !== need.updateHash) {
+            throw new ResolveError(
+              `Signed update hash mismatch: expected ${need.updateHash}, got ${updateHash}.`,
+              INVALID_DID_UPDATE,
+              { expected: need.updateHash, actual: updateHash }
+            );
+          }
+          this.#sidecarData.updateMap.set(updateHash, data);
           break;
         }
         case "NeedSMTProof": {
-          const smtNeed = need;
-          const proof = data;
-          const proofIdHex = encode(decode(proof.id, "base64urlnopad"), "hex");
-          if (proofIdHex !== smtNeed.smtRootHash) {
+          if (!isSMTProof(data)) {
+            throw new ResolveError(
+              "Provided data for NeedSMTProof is not an SMT proof.",
+              INVALID_DID_UPDATE,
+              { kind: need.kind }
+            );
+          }
+          const proofIdHex = encode(decode(data.id, "base64urlnopad"), "hex");
+          if (proofIdHex !== need.smtRootHash) {
             throw new ResolveError(
-              `SMT proof root hash mismatch: expected ${smtNeed.smtRootHash}, got ${proofIdHex}`,
+              `SMT proof root hash mismatch: expected ${need.smtRootHash}, got ${proofIdHex}`,
               INVALID_DID_UPDATE,
-              { expected: smtNeed.smtRootHash, actual: proofIdHex }
+              { expected: need.smtRootHash, actual: proofIdHex }
             );
           }
-          this.#sidecarData.smtMap.set(smtNeed.smtRootHash, proof);
+          this.#sidecarData.smtMap.set(need.smtRootHash, data);
           break;
         }
       }

package/dist/browser.mjs

@@ -119242,7 +119242,8 @@ var DidBtcr2 = class {
     return new Resolver(didComponents, sidecarData, currentDocument, {
       versionId: resolutionOptions.versionId,
       versionTime: resolutionOptions.versionTime,
-      genesisDocument: resolutionOptions.sidecar?.genesisDocument
+      genesisDocument: resolutionOptions.sidecar?.genesisDocument,
+      maxDiscoveryRounds: resolutionOptions.maxDiscoveryRounds
     });
   }
   /**
@@ -119351,6 +119352,21 @@ var DidBtcr2 = class {
 
 // src/core/resolver.ts
 init_utils2();
+var DEFAULT_MAX_DISCOVERY_ROUNDS = 10;
+function isRecord(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function isCASAnnouncement(value2) {
+  return isRecord(value2) && Object.values(value2).every((v) => typeof v === "string");
+}
+function isSignedBTCR2Update(value2) {
+  if (!isRecord(value2)) return false;
+  return Array.isArray(value2.patch) && typeof value2.sourceHash === "string" && typeof value2.targetHash === "string" && typeof value2.targetVersionId === "number" && isRecord(value2.proof);
+}
+function isSMTProof(value2) {
+  if (!isRecord(value2)) return false;
+  return typeof value2.id === "string" && typeof value2.collapsed === "string" && Array.isArray(value2.hashes);
+}
 var Resolver = class _Resolver {
   // --- Immutable inputs ---
   #didComponents;
@@ -119368,6 +119384,10 @@ var Resolver = class _Resolver {
   #requestCache = /* @__PURE__ */ new Set();
   #unsortedUpdates = [];
   #resolvedResponse = null;
+  /** Upper bound on multi-round beacon-discovery passes; see {@link DEFAULT_MAX_DISCOVERY_ROUNDS}. */
+  #maxDiscoveryRounds;
+  /** Count of beacon-discovery passes driven by updates adding new beacon services. */
+  #discoveryRounds = 0;
   /**
    * @internal Use {@link DidBtcr2.resolve} to create instances.
    */
@@ -119377,6 +119397,7 @@ var Resolver = class _Resolver {
     this.#currentDocument = currentDocument;
     this.#versionId = options2?.versionId;
     this.#versionTime = options2?.versionTime;
+    this.#maxDiscoveryRounds = options2?.maxDiscoveryRounds ?? DEFAULT_MAX_DISCOVERY_ROUNDS;
     if (options2?.genesisDocument) {
       this.#providedGenesisDocument = options2.genesisDocument;
     }
@@ -119691,6 +119712,13 @@ var Resolver = class _Resolver {
               return !this.#requestCache.has(address);
             });
             if (hasNewServices) {
+              if (++this.#discoveryRounds > this.#maxDiscoveryRounds) {
+                throw new ResolveError(
+                  `Exceeded maximum beacon-discovery rounds (${this.#maxDiscoveryRounds}); the DID document may chain beacon services without terminating.`,
+                  INVALID_DID_DOCUMENT,
+                  { maxDiscoveryRounds: this.#maxDiscoveryRounds }
+                );
+              }
               this.#phase = "BeaconDiscovery" /* BeaconDiscovery */;
               continue;
             }
@@ -119717,38 +119745,84 @@ var Resolver = class _Resolver {
   provide(need, data) {
     switch (need.kind) {
       case "NeedGenesisDocument": {
+        if (!isRecord(data)) {
+          throw new ResolveError(
+            "Provided data for NeedGenesisDocument must be a document object.",
+            INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
         this.#providedGenesisDocument = data;
         break;
       }
       case "NeedBeaconSignals": {
-        const signals = data;
-        for (const [service, serviceSignals] of signals) {
+        if (!(data instanceof Map)) {
+          throw new ResolveError(
+            "Provided data for NeedBeaconSignals must be a Map of beacon services to signals.",
+            INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        for (const [service, serviceSignals] of data) {
           this.#beaconServicesSignals.set(service, serviceSignals);
         }
         break;
       }
       case "NeedCASAnnouncement": {
-        const announcement = data;
-        this.#sidecarData.casMap.set(canonicalHash(announcement, { encoding: "hex" }), announcement);
+        if (!isCASAnnouncement(data)) {
+          throw new ResolveError(
+            "Provided data for NeedCASAnnouncement is not a CAS announcement.",
+            INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        const announcementHash = canonicalHash(data, { encoding: "hex" });
+        if (announcementHash !== need.announcementHash) {
+          throw new ResolveError(
+            `CAS announcement hash mismatch: expected ${need.announcementHash}, got ${announcementHash}.`,
+            INVALID_DID_UPDATE,
+            { expected: need.announcementHash, actual: announcementHash }
+          );
+        }
+        this.#sidecarData.casMap.set(announcementHash, data);
         break;
       }
       case "NeedSignedUpdate": {
-        const update = data;
-        this.#sidecarData.updateMap.set(canonicalHash(update, { encoding: "hex" }), update);
+        if (!isSignedBTCR2Update(data)) {
+          throw new ResolveError(
+            "Provided data for NeedSignedUpdate is not a signed BTCR2 update.",
+            INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        const updateHash = canonicalHash(data, { encoding: "hex" });
+        if (updateHash !== need.updateHash) {
+          throw new ResolveError(
+            `Signed update hash mismatch: expected ${need.updateHash}, got ${updateHash}.`,
+            INVALID_DID_UPDATE,
+            { expected: need.updateHash, actual: updateHash }
+          );
+        }
+        this.#sidecarData.updateMap.set(updateHash, data);
         break;
       }
       case "NeedSMTProof": {
-        const smtNeed = need;
-        const proof = data;
-        const proofIdHex = encode(decode(proof.id, "base64urlnopad"), "hex");
-        if (proofIdHex !== smtNeed.smtRootHash) {
+        if (!isSMTProof(data)) {
+          throw new ResolveError(
+            "Provided data for NeedSMTProof is not an SMT proof.",
+            INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        const proofIdHex = encode(decode(data.id, "base64urlnopad"), "hex");
+        if (proofIdHex !== need.smtRootHash) {
           throw new ResolveError(
-            `SMT proof root hash mismatch: expected ${smtNeed.smtRootHash}, got ${proofIdHex}`,
+            `SMT proof root hash mismatch: expected ${need.smtRootHash}, got ${proofIdHex}`,
             INVALID_DID_UPDATE,
-            { expected: smtNeed.smtRootHash, actual: proofIdHex }
+            { expected: need.smtRootHash, actual: proofIdHex }
           );
         }
-        this.#sidecarData.smtMap.set(smtNeed.smtRootHash, proof);
+        this.#sidecarData.smtMap.set(need.smtRootHash, data);
         break;
       }
     }
@@ -119825,6 +119899,7 @@ export {
   CASBeaconError,
   CHANGE_OUTPUT_VBYTES,
   DEFAULT_FEE_ESTIMATOR,
+  DEFAULT_MAX_DISCOVERY_ROUNDS,
   DID_REGEX,
   DUST_LIMIT_SATS,
   DidBtcr2,

package/dist/cjs/index.js

@@ -42,6 +42,7 @@ __export(index_exports, {
   CASBeaconError: () => CASBeaconError,
   CHANGE_OUTPUT_VBYTES: () => CHANGE_OUTPUT_VBYTES,
   DEFAULT_FEE_ESTIMATOR: () => DEFAULT_FEE_ESTIMATOR,
+  DEFAULT_MAX_DISCOVERY_ROUNDS: () => DEFAULT_MAX_DISCOVERY_ROUNDS,
   DID_REGEX: () => DID_REGEX,
   DUST_LIMIT_SATS: () => DUST_LIMIT_SATS,
   DidBtcr2: () => DidBtcr2,
@@ -2913,7 +2914,8 @@ var DidBtcr2 = class {
     return new Resolver(didComponents, sidecarData, currentDocument, {
       versionId: resolutionOptions.versionId,
       versionTime: resolutionOptions.versionTime,
-      genesisDocument: resolutionOptions.sidecar?.genesisDocument
+      genesisDocument: resolutionOptions.sidecar?.genesisDocument,
+      maxDiscoveryRounds: resolutionOptions.maxDiscoveryRounds
     });
   }
   /**
@@ -3022,6 +3024,21 @@ var DidBtcr2 = class {
 
 // src/core/resolver.ts
 var import_utils6 = require("@noble/curves/utils.js");
+var DEFAULT_MAX_DISCOVERY_ROUNDS = 10;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isCASAnnouncement(value) {
+  return isRecord(value) && Object.values(value).every((v) => typeof v === "string");
+}
+function isSignedBTCR2Update(value) {
+  if (!isRecord(value)) return false;
+  return Array.isArray(value.patch) && typeof value.sourceHash === "string" && typeof value.targetHash === "string" && typeof value.targetVersionId === "number" && isRecord(value.proof);
+}
+function isSMTProof(value) {
+  if (!isRecord(value)) return false;
+  return typeof value.id === "string" && typeof value.collapsed === "string" && Array.isArray(value.hashes);
+}
 var Resolver = class _Resolver {
   // --- Immutable inputs ---
   #didComponents;
@@ -3039,6 +3056,10 @@ var Resolver = class _Resolver {
   #requestCache = /* @__PURE__ */ new Set();
   #unsortedUpdates = [];
   #resolvedResponse = null;
+  /** Upper bound on multi-round beacon-discovery passes; see {@link DEFAULT_MAX_DISCOVERY_ROUNDS}. */
+  #maxDiscoveryRounds;
+  /** Count of beacon-discovery passes driven by updates adding new beacon services. */
+  #discoveryRounds = 0;
   /**
    * @internal Use {@link DidBtcr2.resolve} to create instances.
    */
@@ -3048,6 +3069,7 @@ var Resolver = class _Resolver {
     this.#currentDocument = currentDocument;
     this.#versionId = options?.versionId;
     this.#versionTime = options?.versionTime;
+    this.#maxDiscoveryRounds = options?.maxDiscoveryRounds ?? DEFAULT_MAX_DISCOVERY_ROUNDS;
     if (options?.genesisDocument) {
       this.#providedGenesisDocument = options.genesisDocument;
     }
@@ -3362,6 +3384,13 @@ var Resolver = class _Resolver {
               return !this.#requestCache.has(address);
             });
             if (hasNewServices) {
+              if (++this.#discoveryRounds > this.#maxDiscoveryRounds) {
+                throw new import_common12.ResolveError(
+                  `Exceeded maximum beacon-discovery rounds (${this.#maxDiscoveryRounds}); the DID document may chain beacon services without terminating.`,
+                  import_common12.INVALID_DID_DOCUMENT,
+                  { maxDiscoveryRounds: this.#maxDiscoveryRounds }
+                );
+              }
               this.#phase = "BeaconDiscovery" /* BeaconDiscovery */;
               continue;
             }
@@ -3388,38 +3417,84 @@ var Resolver = class _Resolver {
   provide(need, data) {
     switch (need.kind) {
       case "NeedGenesisDocument": {
+        if (!isRecord(data)) {
+          throw new import_common12.ResolveError(
+            "Provided data for NeedGenesisDocument must be a document object.",
+            import_common12.INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
         this.#providedGenesisDocument = data;
         break;
       }
       case "NeedBeaconSignals": {
-        const signals = data;
-        for (const [service, serviceSignals] of signals) {
+        if (!(data instanceof Map)) {
+          throw new import_common12.ResolveError(
+            "Provided data for NeedBeaconSignals must be a Map of beacon services to signals.",
+            import_common12.INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        for (const [service, serviceSignals] of data) {
           this.#beaconServicesSignals.set(service, serviceSignals);
         }
         break;
       }
       case "NeedCASAnnouncement": {
-        const announcement = data;
-        this.#sidecarData.casMap.set((0, import_common12.canonicalHash)(announcement, { encoding: "hex" }), announcement);
+        if (!isCASAnnouncement(data)) {
+          throw new import_common12.ResolveError(
+            "Provided data for NeedCASAnnouncement is not a CAS announcement.",
+            import_common12.INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        const announcementHash = (0, import_common12.canonicalHash)(data, { encoding: "hex" });
+        if (announcementHash !== need.announcementHash) {
+          throw new import_common12.ResolveError(
+            `CAS announcement hash mismatch: expected ${need.announcementHash}, got ${announcementHash}.`,
+            import_common12.INVALID_DID_UPDATE,
+            { expected: need.announcementHash, actual: announcementHash }
+          );
+        }
+        this.#sidecarData.casMap.set(announcementHash, data);
         break;
       }
       case "NeedSignedUpdate": {
-        const update = data;
-        this.#sidecarData.updateMap.set((0, import_common12.canonicalHash)(update, { encoding: "hex" }), update);
+        if (!isSignedBTCR2Update(data)) {
+          throw new import_common12.ResolveError(
+            "Provided data for NeedSignedUpdate is not a signed BTCR2 update.",
+            import_common12.INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        const updateHash = (0, import_common12.canonicalHash)(data, { encoding: "hex" });
+        if (updateHash !== need.updateHash) {
+          throw new import_common12.ResolveError(
+            `Signed update hash mismatch: expected ${need.updateHash}, got ${updateHash}.`,
+            import_common12.INVALID_DID_UPDATE,
+            { expected: need.updateHash, actual: updateHash }
+          );
+        }
+        this.#sidecarData.updateMap.set(updateHash, data);
         break;
       }
       case "NeedSMTProof": {
-        const smtNeed = need;
-        const proof = data;
-        const proofIdHex = (0, import_common12.encode)((0, import_common12.decode)(proof.id, "base64urlnopad"), "hex");
-        if (proofIdHex !== smtNeed.smtRootHash) {
+        if (!isSMTProof(data)) {
+          throw new import_common12.ResolveError(
+            "Provided data for NeedSMTProof is not an SMT proof.",
+            import_common12.INVALID_DID_UPDATE,
+            { kind: need.kind }
+          );
+        }
+        const proofIdHex = (0, import_common12.encode)((0, import_common12.decode)(data.id, "base64urlnopad"), "hex");
+        if (proofIdHex !== need.smtRootHash) {
           throw new import_common12.ResolveError(
-            `SMT proof root hash mismatch: expected ${smtNeed.smtRootHash}, got ${proofIdHex}`,
+            `SMT proof root hash mismatch: expected ${need.smtRootHash}, got ${proofIdHex}`,
             import_common12.INVALID_DID_UPDATE,
-            { expected: smtNeed.smtRootHash, actual: proofIdHex }
+            { expected: need.smtRootHash, actual: proofIdHex }
           );
         }
-        this.#sidecarData.smtMap.set(smtNeed.smtRootHash, proof);
+        this.#sidecarData.smtMap.set(need.smtRootHash, data);
         break;
       }
     }
@@ -3494,6 +3569,7 @@ var DidDocumentBuilder = class {
   CASBeaconError,
   CHANGE_OUTPUT_VBYTES,
   DEFAULT_FEE_ESTIMATOR,
+  DEFAULT_MAX_DISCOVERY_ROUNDS,
   DID_REGEX,
   DUST_LIMIT_SATS,
   DidBtcr2,

package/dist/esm/core/resolver.js

@@ -9,6 +9,42 @@ import { BeaconFactory } from './beacon/factory.js';
 import { BeaconUtils } from './beacon/utils.js';
 import { Identifier } from './identifier.js';
 import { equalBytes } from '@noble/curves/utils.js';
+/**
+ * Default upper bound on multi-round beacon discovery. Each round applies the
+ * updates found so far and looks for beacon services those updates added; a
+ * document whose updates keep adding services would otherwise loop unbounded.
+ * Overridable via `ResolutionOptions.maxDiscoveryRounds`.
+ */
+export const DEFAULT_MAX_DISCOVERY_ROUNDS = 10;
+// ─── provide() payload guards ────────────────────────────────────────────────
+// Runtime shape checks so a malformed payload fails fast at the provide()
+// boundary rather than flowing downstream as an unchecked `as` cast.
+/** True if `value` is a non-null, non-array object. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** True if `value` has the shape of a CAS Announcement (a flat record of string hashes). */
+function isCASAnnouncement(value) {
+    return isRecord(value) && Object.values(value).every(v => typeof v === 'string');
+}
+/** True if `value` has the shape of a signed BTCR2 update. */
+function isSignedBTCR2Update(value) {
+    if (!isRecord(value))
+        return false;
+    return Array.isArray(value.patch)
+        && typeof value.sourceHash === 'string'
+        && typeof value.targetHash === 'string'
+        && typeof value.targetVersionId === 'number'
+        && isRecord(value.proof);
+}
+/** True if `value` has the shape of an SMT inclusion / non-inclusion proof. */
+function isSMTProof(value) {
+    if (!isRecord(value))
+        return false;
+    return typeof value.id === 'string'
+        && typeof value.collapsed === 'string'
+        && Array.isArray(value.hashes);
+}
 /**
  * Different possible Resolver states representing phases in the resolution process.
  */
@@ -59,6 +95,10 @@ export class Resolver {
     #requestCache = new Set();
     #unsortedUpdates = [];
     #resolvedResponse = null;
+    /** Upper bound on multi-round beacon-discovery passes; see {@link DEFAULT_MAX_DISCOVERY_ROUNDS}. */
+    #maxDiscoveryRounds;
+    /** Count of beacon-discovery passes driven by updates adding new beacon services. */
+    #discoveryRounds = 0;
     /**
      * @internal Use {@link DidBtcr2.resolve} to create instances.
      */
@@ -68,6 +108,7 @@ export class Resolver {
         this.#currentDocument = currentDocument;
         this.#versionId = options?.versionId;
         this.#versionTime = options?.versionTime;
+        this.#maxDiscoveryRounds = options?.maxDiscoveryRounds ?? DEFAULT_MAX_DISCOVERY_ROUNDS;
         // If a genesis document was provided (from sidecar), pre-seed it for validation
         if (options?.genesisDocument) {
             this.#providedGenesisDocument = options.genesisDocument;
@@ -430,6 +471,13 @@ export class Resolver {
                             return !this.#requestCache.has(address);
                         });
                         if (hasNewServices) {
+                            // Bound multi-round discovery: a document whose updates keep adding
+                            // beacon services would otherwise loop without end. Fail closed once
+                            // the configured number of rounds is exceeded.
+                            if (++this.#discoveryRounds > this.#maxDiscoveryRounds) {
+                                throw new ResolveError(`Exceeded maximum beacon-discovery rounds (${this.#maxDiscoveryRounds}); `
+                                    + 'the DID document may chain beacon services without terminating.', INVALID_DID_DOCUMENT, { maxDiscoveryRounds: this.#maxDiscoveryRounds });
+                            }
                             // Loop back to discover signals for new beacon services
                             this.#phase = ResolverPhase.BeaconDiscovery;
                             continue;
@@ -457,35 +505,57 @@ export class Resolver {
     provide(need, data) {
         switch (need.kind) {
             case 'NeedGenesisDocument': {
+                if (!isRecord(data)) {
+                    throw new ResolveError('Provided data for NeedGenesisDocument must be a document object.', INVALID_DID_UPDATE, { kind: need.kind });
+                }
                 this.#providedGenesisDocument = data;
                 break;
             }
             case 'NeedBeaconSignals': {
-                const signals = data;
-                for (const [service, serviceSignals] of signals) {
+                if (!(data instanceof Map)) {
+                    throw new ResolveError('Provided data for NeedBeaconSignals must be a Map of beacon services to signals.', INVALID_DID_UPDATE, { kind: need.kind });
+                }
+                for (const [service, serviceSignals] of data) {
                     this.#beaconServicesSignals.set(service, serviceSignals);
                 }
                 break;
             }
             case 'NeedCASAnnouncement': {
-                const announcement = data;
-                this.#sidecarData.casMap.set(canonicalHash(announcement, { encoding: 'hex' }), announcement);
+                if (!isCASAnnouncement(data)) {
+                    throw new ResolveError('Provided data for NeedCASAnnouncement is not a CAS announcement.', INVALID_DID_UPDATE, { kind: need.kind });
+                }
+                // Fail fast if the provided announcement is not the one the on-chain
+                // signal requested: its canonical hash must equal the need's hash.
+                const announcementHash = canonicalHash(data, { encoding: 'hex' });
+                if (announcementHash !== need.announcementHash) {
+                    throw new ResolveError(`CAS announcement hash mismatch: expected ${need.announcementHash}, got ${announcementHash}.`, INVALID_DID_UPDATE, { expected: need.announcementHash, actual: announcementHash });
+                }
+                this.#sidecarData.casMap.set(announcementHash, data);
                 break;
             }
             case 'NeedSignedUpdate': {
-                const update = data;
-                this.#sidecarData.updateMap.set(canonicalHash(update, { encoding: 'hex' }), update);
+                if (!isSignedBTCR2Update(data)) {
+                    throw new ResolveError('Provided data for NeedSignedUpdate is not a signed BTCR2 update.', INVALID_DID_UPDATE, { kind: need.kind });
+                }
+                // Fail fast if the provided update is not the one the on-chain signal
+                // requested: its canonical hash must equal the need's hash.
+                const updateHash = canonicalHash(data, { encoding: 'hex' });
+                if (updateHash !== need.updateHash) {
+                    throw new ResolveError(`Signed update hash mismatch: expected ${need.updateHash}, got ${updateHash}.`, INVALID_DID_UPDATE, { expected: need.updateHash, actual: updateHash });
+                }
+                this.#sidecarData.updateMap.set(updateHash, data);
                 break;
             }
             case 'NeedSMTProof': {
-                const smtNeed = need;
-                const proof = data;
+                if (!isSMTProof(data)) {
+                    throw new ResolveError('Provided data for NeedSMTProof is not an SMT proof.', INVALID_DID_UPDATE, { kind: need.kind });
+                }
                 // proof.id is base64url per spec; smtRootHash is the hex on-chain signal.
-                const proofIdHex = encodeHash(decodeHash(proof.id, 'base64urlnopad'), 'hex');
-                if (proofIdHex !== smtNeed.smtRootHash) {
-                    throw new ResolveError(`SMT proof root hash mismatch: expected ${smtNeed.smtRootHash}, got ${proofIdHex}`, INVALID_DID_UPDATE, { expected: smtNeed.smtRootHash, actual: proofIdHex });
+                const proofIdHex = encodeHash(decodeHash(data.id, 'base64urlnopad'), 'hex');
+                if (proofIdHex !== need.smtRootHash) {
+                    throw new ResolveError(`SMT proof root hash mismatch: expected ${need.smtRootHash}, got ${proofIdHex}`, INVALID_DID_UPDATE, { expected: need.smtRootHash, actual: proofIdHex });
                 }
-                this.#sidecarData.smtMap.set(smtNeed.smtRootHash, proof);
+                this.#sidecarData.smtMap.set(need.smtRootHash, data);
                 break;
             }
         }