@hashgraphonline/standards-sdk 0.1.158 → 0.1.160

package/dist/es/standards-sdk.es61.js

@@ -1,37 +1,185 @@
-class IssuerRegistry {
-  constructor() {
-    this.issuers = [];
+import { nodeDnsTxtLookup } from "./standards-sdk.es64.js";
+import { isFqdn, normalizeDomain, parseSemicolonFields } from "./standards-sdk.es164.js";
+const AID_DNS_WEB_PROFILE_ID = "hcs-14.profile.aid-dns-web";
+function buildErrorProfile(uaid, code, message, details) {
+  const error = {
+    code,
+    message,
+    details
+  };
+  return {
+    id: uaid,
+    error,
+    metadata: {
+      profile: AID_DNS_WEB_PROFILE_ID,
+      resolved: false
+    }
+  };
+}
+function parseRecord(rawRecord, supportedSchemes) {
+  const fields = parseSemicolonFields(rawRecord);
+  const version = fields["v"];
+  const protocol = fields["p"] ?? fields["proto"];
+  const endpoint = fields["u"];
+  if (!version || !protocol || !endpoint) {
+    return { code: "ERR_INVALID_AID_RECORD" };
+  }
+  if (!version.toLowerCase().startsWith("aid")) {
+    return { code: "ERR_INVALID_AID_RECORD" };
+  }
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(endpoint);
+  } catch {
+    return { code: "ERR_ENDPOINT_INVALID" };
   }
-  register(issuer) {
-    this.issuers.push(issuer);
+  const scheme = parsedUrl.protocol.replace(/:$/, "").toLowerCase();
+  if (!supportedSchemes.has(scheme)) {
+    return { code: "ERR_ENDPOINT_INVALID" };
   }
-  list() {
-    return [...this.issuers];
+  return {
+    record: {
+      version,
+      protocol,
+      endpoint: parsedUrl.toString(),
+      publicKey: fields["k"],
+      keyId: fields["i"]
+    }
+  };
+}
+function deterministicRecordKey(record) {
+  return `${record.protocol}|${record.endpoint}|${record.publicKey ?? ""}|${record.keyId ?? ""}`;
+}
+function verificationMethodForLevel(verificationLevel) {
+  if (verificationLevel === "cryptographic") {
+    return "aid-pka";
   }
-  /** Return issuers that support a given DID method. */
-  filterByDidMethod(method) {
-    return this.issuers.filter((i) => i.meta.didMethods.includes(method));
+  if (verificationLevel === "metadata") {
+    return "metadata-match";
   }
-  /** Return issuers that advertise a specific CAIP-2 network. */
-  filterByCaip2(network) {
-    return this.issuers.filter((i) => i.meta.caip2Networks?.includes(network));
+  return void 0;
+}
+class AidDnsWebProfileResolver {
+  constructor(options = {}) {
+    this.profile = AID_DNS_WEB_PROFILE_ID;
+    this.meta = {
+      id: "hcs-14/aid-dns-web",
+      didMethods: ["*"],
+      displayName: "HCS-14 AID DNS/Web Profile",
+      description: "Resolves uaid:aid identifiers via _agent.<nativeId> DNS TXT records and protocol endpoint hints."
+    };
+    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;
+    this.supportedSchemes = new Set(
+      (options.supportedUriSchemes ?? ["https", "http", "wss", "ws"]).map(
+        (scheme) => scheme.toLowerCase()
+      )
+    );
+    this.metadataVerifier = options.metadataVerifier;
+    this.cryptographicVerifier = options.cryptographicVerifier;
   }
-  /** Generic predicate-based filter. */
-  filter(predicate) {
-    return this.issuers.filter(predicate);
+  supports(_uaid, parsed) {
+    if (parsed.method !== "aid") {
+      return false;
+    }
+    const nativeId = parsed.params["nativeId"];
+    return !!nativeId && isFqdn(nativeId);
   }
-  async issue(request) {
-    for (const issuer of this.issuers) {
-      if (issuer.supports(request.method)) {
-        return issuer.issue(request);
+  async resolveProfile(uaid, context) {
+    const parsed = context.parsedUaid;
+    if (parsed.method !== "aid") {
+      return null;
+    }
+    const nativeId = parsed.params["nativeId"];
+    if (!nativeId || !isFqdn(nativeId)) {
+      return null;
+    }
+    const normalizedNativeId = normalizeDomain(nativeId);
+    const dnsName = `_agent.${normalizedNativeId}`;
+    const txtRecords = await this.dnsLookup(dnsName);
+    if (txtRecords.length === 0) {
+      return null;
+    }
+    const parsedRecords = txtRecords.map(
+      (record) => parseRecord(record, this.supportedSchemes)
+    );
+    const validRecords = parsedRecords.filter(
+      (result) => "record" in result
+    ).map((result) => result.record);
+    if (validRecords.length === 0) {
+      const endpointInvalid = parsedRecords.some(
+        (result) => !("record" in result) && result.code === "ERR_ENDPOINT_INVALID"
+      );
+      return buildErrorProfile(
+        uaid,
+        endpointInvalid ? "ERR_ENDPOINT_INVALID" : "ERR_INVALID_AID_RECORD",
+        endpointInvalid ? "AID DNS record endpoint URI is invalid or unsupported." : "AID DNS TXT payload is malformed or unsupported.",
+        { dnsName }
+      );
+    }
+    const selectedRecord = [...validRecords].sort(
+      (a, b) => deterministicRecordKey(a).localeCompare(deterministicRecordKey(b))
+    )[0];
+    const verificationInput = {
+      uaid,
+      protocol: selectedRecord.protocol,
+      endpoint: selectedRecord.endpoint,
+      record: selectedRecord
+    };
+    let verificationLevel = "none";
+    if (this.metadataVerifier) {
+      const metadataVerified = await this.metadataVerifier(verificationInput);
+      if (!metadataVerified) {
+        return buildErrorProfile(
+          uaid,
+          "ERR_VERIFICATION_FAILED",
+          "AID metadata verification failed.",
+          { dnsName }
+        );
+      }
+      verificationLevel = "metadata";
+    }
+    if (selectedRecord.publicKey && this.cryptographicVerifier) {
+      const cryptographicVerified = await this.cryptographicVerifier(verificationInput);
+      if (!cryptographicVerified) {
+        return buildErrorProfile(
+          uaid,
+          "ERR_VERIFICATION_FAILED",
+          "AID cryptographic verification failed.",
+          { dnsName }
+        );
       }
+      verificationLevel = "cryptographic";
     }
-    throw new Error(`No issuer registered for method: ${request.method}`);
+    const did = context.did ?? void 0;
+    const alsoKnownAs = did ? [did] : void 0;
+    return {
+      id: uaid,
+      did,
+      alsoKnownAs,
+      service: [
+        {
+          id: `${uaid}#aid-endpoint`,
+          type: "AIDService",
+          serviceEndpoint: selectedRecord.endpoint
+        }
+      ],
+      metadata: {
+        profile: AID_DNS_WEB_PROFILE_ID,
+        resolved: true,
+        endpoint: selectedRecord.endpoint,
+        protocol: selectedRecord.protocol,
+        verification: {
+          level: verificationLevel,
+          method: verificationMethodForLevel(verificationLevel)
+        },
+        verificationLevel,
+        precedenceSource: "dns"
+      }
+    };
   }
 }
-const defaultIssuerRegistry = new IssuerRegistry();
 export {
-  IssuerRegistry,
-  defaultIssuerRegistry
+  AID_DNS_WEB_PROFILE_ID,
+  AidDnsWebProfileResolver
 };
 //# sourceMappingURL=standards-sdk.es61.js.map

package/dist/es/standards-sdk.es61.js.map

@@ -1 +1 @@
-{"version":3,"file":"standards-sdk.es61.js","sources":["../../src/hcs-14/issuers/registry.ts"],"sourcesContent":["/**\n * Issuer registry for HCS-14 DID adapters.\n */\n\nimport { DidIssueRequest, DidIssuer, IssuerRegistryApi } from './types';\n\nexport class IssuerRegistry implements IssuerRegistryApi {\n  private issuers: DidIssuer[] = [];\n\n  register(issuer: DidIssuer): void {\n    this.issuers.push(issuer);\n  }\n\n  list(): DidIssuer[] {\n    return [...this.issuers];\n  }\n\n  /** Return issuers that support a given DID method. */\n  filterByDidMethod(method: string): DidIssuer[] {\n    return this.issuers.filter(i => i.meta.didMethods.includes(method));\n  }\n\n  /** Return issuers that advertise a specific CAIP-2 network. */\n  filterByCaip2(network: string): DidIssuer[] {\n    return this.issuers.filter(i => i.meta.caip2Networks?.includes(network));\n  }\n\n  /** Generic predicate-based filter. */\n  filter(predicate: (issuer: DidIssuer) => boolean): DidIssuer[] {\n    return this.issuers.filter(predicate);\n  }\n\n  async issue(request: DidIssueRequest): Promise<string> {\n    for (const issuer of this.issuers) {\n      if (issuer.supports(request.method)) {\n        return issuer.issue(request);\n      }\n    }\n    throw new Error(`No issuer registered for method: ${request.method}`);\n  }\n}\n\nexport const defaultIssuerRegistry = new IssuerRegistry();\n"],"names":[],"mappings":"AAMO,MAAM,eAA4C;AAAA,EAAlD,cAAA;AACL,SAAQ,UAAuB,CAAA;AAAA,EAAC;AAAA,EAEhC,SAAS,QAAyB;AAChC,SAAK,QAAQ,KAAK,MAAM;AAAA,EAC1B;AAAA,EAEA,OAAoB;AAClB,WAAO,CAAC,GAAG,KAAK,OAAO;AAAA,EACzB;AAAA;AAAA,EAGA,kBAAkB,QAA6B;AAC7C,WAAO,KAAK,QAAQ,OAAO,CAAA,MAAK,EAAE,KAAK,WAAW,SAAS,MAAM,CAAC;AAAA,EACpE;AAAA;AAAA,EAGA,cAAc,SAA8B;AAC1C,WAAO,KAAK,QAAQ,OAAO,CAAA,MAAK,EAAE,KAAK,eAAe,SAAS,OAAO,CAAC;AAAA,EACzE;AAAA;AAAA,EAGA,OAAO,WAAwD;AAC7D,WAAO,KAAK,QAAQ,OAAO,SAAS;AAAA,EACtC;AAAA,EAEA,MAAM,MAAM,SAA2C;AACrD,eAAW,UAAU,KAAK,SAAS;AACjC,UAAI,OAAO,SAAS,QAAQ,MAAM,GAAG;AACnC,eAAO,OAAO,MAAM,OAAO;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,IAAI,MAAM,oCAAoC,QAAQ,MAAM,EAAE;AAAA,EACtE;AACF;AAEO,MAAM,wBAAwB,IAAI,eAAA;"}
+{"version":3,"file":"standards-sdk.es61.js","sources":["../../src/hcs-14/resolvers/aid-dns-web-profile.ts"],"sourcesContent":["import type {\n  DidResolutionProfile,\n  ProfileResolutionError,\n  UaidProfileResolver,\n  UaidProfileResolverContext,\n} from './types';\nimport type { AdapterMeta } from '../adapters/types';\nimport { nodeDnsTxtLookup, type DnsTxtLookup } from './dns';\nimport { isFqdn, normalizeDomain, parseSemicolonFields } from './profile-utils';\n\nexport const AID_DNS_WEB_PROFILE_ID = 'hcs-14.profile.aid-dns-web';\n\ninterface AidDnsRecord {\n  version: string;\n  protocol: string;\n  endpoint: string;\n  publicKey?: string;\n  keyId?: string;\n}\n\ninterface AidDnsRecordParseError {\n  code: 'ERR_INVALID_AID_RECORD' | 'ERR_ENDPOINT_INVALID';\n}\n\ninterface AidDnsRecordParseSuccess {\n  record: AidDnsRecord;\n}\n\ntype AidDnsRecordParseResult =\n  | AidDnsRecordParseError\n  | AidDnsRecordParseSuccess;\n\ninterface AidDnsVerificationInput {\n  uaid: string;\n  protocol: string;\n  endpoint: string;\n  record: AidDnsRecord;\n}\n\ntype AidDnsVerification = (input: AidDnsVerificationInput) => Promise<boolean>;\n\nexport interface AidDnsWebResolverOptions {\n  dnsLookup?: DnsTxtLookup;\n  supportedUriSchemes?: string[];\n  metadataVerifier?: AidDnsVerification;\n  cryptographicVerifier?: AidDnsVerification;\n}\n\nfunction buildErrorProfile(\n  uaid: string,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>,\n): DidResolutionProfile {\n  const error: ProfileResolutionError = {\n    code,\n    message,\n    details,\n  };\n\n  return {\n    id: uaid,\n    error,\n    metadata: {\n      profile: AID_DNS_WEB_PROFILE_ID,\n      resolved: false,\n    },\n  };\n}\n\nfunction parseRecord(\n  rawRecord: string,\n  supportedSchemes: Set<string>,\n): AidDnsRecordParseResult {\n  const fields = parseSemicolonFields(rawRecord);\n  const version = fields['v'];\n  const protocol = fields['p'] ?? fields['proto'];\n  const endpoint = fields['u'];\n\n  if (!version || !protocol || !endpoint) {\n    return { code: 'ERR_INVALID_AID_RECORD' };\n  }\n  if (!version.toLowerCase().startsWith('aid')) {\n    return { code: 'ERR_INVALID_AID_RECORD' };\n  }\n\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(endpoint);\n  } catch {\n    return { code: 'ERR_ENDPOINT_INVALID' };\n  }\n\n  const scheme = parsedUrl.protocol.replace(/:$/, '').toLowerCase();\n  if (!supportedSchemes.has(scheme)) {\n    return { code: 'ERR_ENDPOINT_INVALID' };\n  }\n\n  return {\n    record: {\n      version,\n      protocol,\n      endpoint: parsedUrl.toString(),\n      publicKey: fields['k'],\n      keyId: fields['i'],\n    },\n  };\n}\n\nfunction deterministicRecordKey(record: AidDnsRecord): string {\n  return `${record.protocol}|${record.endpoint}|${record.publicKey ?? ''}|${record.keyId ?? ''}`;\n}\n\nfunction verificationMethodForLevel(\n  verificationLevel: 'none' | 'metadata' | 'cryptographic',\n): 'aid-pka' | 'metadata-match' | undefined {\n  if (verificationLevel === 'cryptographic') {\n    return 'aid-pka';\n  }\n  if (verificationLevel === 'metadata') {\n    return 'metadata-match';\n  }\n  return undefined;\n}\n\nexport class AidDnsWebProfileResolver implements UaidProfileResolver {\n  readonly profile = AID_DNS_WEB_PROFILE_ID;\n\n  readonly meta: AdapterMeta = {\n    id: 'hcs-14/aid-dns-web',\n    didMethods: ['*'],\n    displayName: 'HCS-14 AID DNS/Web Profile',\n    description:\n      'Resolves uaid:aid identifiers via _agent.<nativeId> DNS TXT records and protocol endpoint hints.',\n  };\n\n  private readonly dnsLookup: DnsTxtLookup;\n  private readonly supportedSchemes: Set<string>;\n  private readonly metadataVerifier?: AidDnsVerification;\n  private readonly cryptographicVerifier?: AidDnsVerification;\n\n  constructor(options: AidDnsWebResolverOptions = {}) {\n    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;\n    this.supportedSchemes = new Set(\n      (options.supportedUriSchemes ?? ['https', 'http', 'wss', 'ws']).map(\n        scheme => scheme.toLowerCase(),\n      ),\n    );\n    this.metadataVerifier = options.metadataVerifier;\n    this.cryptographicVerifier = options.cryptographicVerifier;\n  }\n\n  supports(\n    _uaid: string,\n    parsed: UaidProfileResolverContext['parsedUaid'],\n  ): boolean {\n    if (parsed.method !== 'aid') {\n      return false;\n    }\n    const nativeId = parsed.params['nativeId'];\n    return !!nativeId && isFqdn(nativeId);\n  }\n\n  async resolveProfile(\n    uaid: string,\n    context: UaidProfileResolverContext,\n  ): Promise<DidResolutionProfile | null> {\n    const parsed = context.parsedUaid;\n    if (parsed.method !== 'aid') {\n      return null;\n    }\n\n    const nativeId = parsed.params['nativeId'];\n    if (!nativeId || !isFqdn(nativeId)) {\n      return null;\n    }\n\n    const normalizedNativeId = normalizeDomain(nativeId);\n    const dnsName = `_agent.${normalizedNativeId}`;\n    const txtRecords = await this.dnsLookup(dnsName);\n    if (txtRecords.length === 0) {\n      return null;\n    }\n\n    const parsedRecords = txtRecords.map(record =>\n      parseRecord(record, this.supportedSchemes),\n    );\n    const validRecords = parsedRecords\n      .filter(\n        (result): result is AidDnsRecordParseSuccess => 'record' in result,\n      )\n      .map(result => result.record);\n\n    if (validRecords.length === 0) {\n      const endpointInvalid = parsedRecords.some(\n        result =>\n          !('record' in result) && result.code === 'ERR_ENDPOINT_INVALID',\n      );\n      return buildErrorProfile(\n        uaid,\n        endpointInvalid ? 'ERR_ENDPOINT_INVALID' : 'ERR_INVALID_AID_RECORD',\n        endpointInvalid\n          ? 'AID DNS record endpoint URI is invalid or unsupported.'\n          : 'AID DNS TXT payload is malformed or unsupported.',\n        { dnsName },\n      );\n    }\n\n    const selectedRecord = [...validRecords].sort((a, b) =>\n      deterministicRecordKey(a).localeCompare(deterministicRecordKey(b)),\n    )[0];\n\n    const verificationInput: AidDnsVerificationInput = {\n      uaid,\n      protocol: selectedRecord.protocol,\n      endpoint: selectedRecord.endpoint,\n      record: selectedRecord,\n    };\n\n    let verificationLevel: 'none' | 'metadata' | 'cryptographic' = 'none';\n\n    if (this.metadataVerifier) {\n      const metadataVerified = await this.metadataVerifier(verificationInput);\n      if (!metadataVerified) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERIFICATION_FAILED',\n          'AID metadata verification failed.',\n          { dnsName },\n        );\n      }\n      verificationLevel = 'metadata';\n    }\n\n    if (selectedRecord.publicKey && this.cryptographicVerifier) {\n      const cryptographicVerified =\n        await this.cryptographicVerifier(verificationInput);\n      if (!cryptographicVerified) {\n        return buildErrorProfile(\n          uaid,\n          'ERR_VERIFICATION_FAILED',\n          'AID cryptographic verification failed.',\n          { dnsName },\n        );\n      }\n      verificationLevel = 'cryptographic';\n    }\n\n    const did = context.did ?? undefined;\n    const alsoKnownAs = did ? [did] : undefined;\n\n    return {\n      id: uaid,\n      did,\n      alsoKnownAs,\n      service: [\n        {\n          id: `${uaid}#aid-endpoint`,\n          type: 'AIDService',\n          serviceEndpoint: selectedRecord.endpoint,\n        },\n      ],\n      metadata: {\n        profile: AID_DNS_WEB_PROFILE_ID,\n        resolved: true,\n        endpoint: selectedRecord.endpoint,\n        protocol: selectedRecord.protocol,\n        verification: {\n          level: verificationLevel,\n          method: verificationMethodForLevel(verificationLevel),\n        },\n        verificationLevel,\n        precedenceSource: 'dns',\n      },\n    };\n  }\n}\n"],"names":[],"mappings":";;AAUO,MAAM,yBAAyB;AAsCtC,SAAS,kBACP,MACA,MACA,SACA,SACsB;AACtB,QAAM,QAAgC;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAGF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,UAAU;AAAA,IAAA;AAAA,EACZ;AAEJ;AAEA,SAAS,YACP,WACA,kBACyB;AACzB,QAAM,SAAS,qBAAqB,SAAS;AAC7C,QAAM,UAAU,OAAO,GAAG;AAC1B,QAAM,WAAW,OAAO,GAAG,KAAK,OAAO,OAAO;AAC9C,QAAM,WAAW,OAAO,GAAG;AAE3B,MAAI,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU;AACtC,WAAO,EAAE,MAAM,yBAAA;AAAA,EACjB;AACA,MAAI,CAAC,QAAQ,YAAA,EAAc,WAAW,KAAK,GAAG;AAC5C,WAAO,EAAE,MAAM,yBAAA;AAAA,EACjB;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,QAAQ;AAAA,EAC9B,QAAQ;AACN,WAAO,EAAE,MAAM,uBAAA;AAAA,EACjB;AAEA,QAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,EAAE,EAAE,YAAA;AACpD,MAAI,CAAC,iBAAiB,IAAI,MAAM,GAAG;AACjC,WAAO,EAAE,MAAM,uBAAA;AAAA,EACjB;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA,UAAU,UAAU,SAAA;AAAA,MACpB,WAAW,OAAO,GAAG;AAAA,MACrB,OAAO,OAAO,GAAG;AAAA,IAAA;AAAA,EACnB;AAEJ;AAEA,SAAS,uBAAuB,QAA8B;AAC5D,SAAO,GAAG,OAAO,QAAQ,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,EAAE,IAAI,OAAO,SAAS,EAAE;AAC9F;AAEA,SAAS,2BACP,mBAC0C;AAC1C,MAAI,sBAAsB,iBAAiB;AACzC,WAAO;AAAA,EACT;AACA,MAAI,sBAAsB,YAAY;AACpC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,MAAM,yBAAwD;AAAA,EAgBnE,YAAY,UAAoC,IAAI;AAfpD,SAAS,UAAU;AAEnB,SAAS,OAAoB;AAAA,MAC3B,IAAI;AAAA,MACJ,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa;AAAA,MACb,aACE;AAAA,IAAA;AASF,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,mBAAmB,IAAI;AAAA,OACzB,QAAQ,uBAAuB,CAAC,SAAS,QAAQ,OAAO,IAAI,GAAG;AAAA,QAC9D,CAAA,WAAU,OAAO,YAAA;AAAA,MAAY;AAAA,IAC/B;AAEF,SAAK,mBAAmB,QAAQ;AAChC,SAAK,wBAAwB,QAAQ;AAAA,EACvC;AAAA,EAEA,SACE,OACA,QACS;AACT,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,WAAO,CAAC,CAAC,YAAY,OAAO,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,eACJ,MACA,SACsC;AACtC,UAAM,SAAS,QAAQ;AACvB,QAAI,OAAO,WAAW,OAAO;AAC3B,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,QAAI,CAAC,YAAY,CAAC,OAAO,QAAQ,GAAG;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,qBAAqB,gBAAgB,QAAQ;AACnD,UAAM,UAAU,UAAU,kBAAkB;AAC5C,UAAM,aAAa,MAAM,KAAK,UAAU,OAAO;AAC/C,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO;AAAA,IACT;AAEA,UAAM,gBAAgB,WAAW;AAAA,MAAI,CAAA,WACnC,YAAY,QAAQ,KAAK,gBAAgB;AAAA,IAAA;AAE3C,UAAM,eAAe,cAClB;AAAA,MACC,CAAC,WAA+C,YAAY;AAAA,IAAA,EAE7D,IAAI,CAAA,WAAU,OAAO,MAAM;AAE9B,QAAI,aAAa,WAAW,GAAG;AAC7B,YAAM,kBAAkB,cAAc;AAAA,QACpC,CAAA,WACE,EAAE,YAAY,WAAW,OAAO,SAAS;AAAA,MAAA;AAE7C,aAAO;AAAA,QACL;AAAA,QACA,kBAAkB,yBAAyB;AAAA,QAC3C,kBACI,2DACA;AAAA,QACJ,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,iBAAiB,CAAC,GAAG,YAAY,EAAE;AAAA,MAAK,CAAC,GAAG,MAChD,uBAAuB,CAAC,EAAE,cAAc,uBAAuB,CAAC,CAAC;AAAA,IAAA,EACjE,CAAC;AAEH,UAAM,oBAA6C;AAAA,MACjD;AAAA,MACA,UAAU,eAAe;AAAA,MACzB,UAAU,eAAe;AAAA,MACzB,QAAQ;AAAA,IAAA;AAGV,QAAI,oBAA2D;AAE/D,QAAI,KAAK,kBAAkB;AACzB,YAAM,mBAAmB,MAAM,KAAK,iBAAiB,iBAAiB;AACtE,UAAI,CAAC,kBAAkB;AACrB,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,QAAA;AAAA,QAAQ;AAAA,MAEd;AACA,0BAAoB;AAAA,IACtB;AAEA,QAAI,eAAe,aAAa,KAAK,uBAAuB;AAC1D,YAAM,wBACJ,MAAM,KAAK,sBAAsB,iBAAiB;AACpD,UAAI,CAAC,uBAAuB;AAC1B,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,QAAA;AAAA,QAAQ;AAAA,MAEd;AACA,0BAAoB;AAAA,IACtB;AAEA,UAAM,MAAM,QAAQ,OAAO;AAC3B,UAAM,cAAc,MAAM,CAAC,GAAG,IAAI;AAElC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,SAAS;AAAA,QACP;AAAA,UACE,IAAI,GAAG,IAAI;AAAA,UACX,MAAM;AAAA,UACN,iBAAiB,eAAe;AAAA,QAAA;AAAA,MAClC;AAAA,MAEF,UAAU;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU,eAAe;AAAA,QACzB,UAAU,eAAe;AAAA,QACzB,cAAc;AAAA,UACZ,OAAO;AAAA,UACP,QAAQ,2BAA2B,iBAAiB;AAAA,QAAA;AAAA,QAEtD;AAAA,QACA,kBAAkB;AAAA,MAAA;AAAA,IACpB;AAAA,EAEJ;AACF;"}

package/dist/es/standards-sdk.es62.js

@@ -1,99 +1,226 @@
-import { optionalImport } from "./standards-sdk.es150.js";
-const hieroRegistrarModuleId = ["@hiero-did-sdk", "registrar"].join("/");
-let registrarPromise = null;
-function toAccountIdString(value) {
-  if (typeof value === "string" && value.trim()) {
-    return value;
+import { nodeDnsTxtLookup } from "./standards-sdk.es64.js";
+import { uaidTargetFromParsed, isFqdn, normalizeDomain, buildCanonicalUaid, parseSemicolonFields } from "./standards-sdk.es164.js";
+import { AID_DNS_WEB_PROFILE_ID } from "./standards-sdk.es61.js";
+import { UAID_DID_RESOLUTION_PROFILE_ID } from "./standards-sdk.es63.js";
+const UAID_DNS_WEB_PROFILE_ID = "hcs-14.profile.uaid-dns-web";
+function buildErrorProfile(uaid, code, message, details) {
+  const error = {
+    code,
+    message,
+    details
+  };
+  return {
+    id: uaid,
+    error,
+    metadata: {
+      profile: UAID_DNS_WEB_PROFILE_ID,
+      resolved: false
+    }
+  };
+}
+function canonicalizeNativeDomainParams(params) {
+  const next = { ...params };
+  const nativeId = next["nativeId"];
+  if (nativeId && isFqdn(nativeId)) {
+    next["nativeId"] = normalizeDomain(nativeId);
   }
-  if (value && typeof value.toString === "function") {
-    const result = value.toString();
-    return typeof result === "string" && result.trim() ? result : null;
+  const domain = next["domain"];
+  if (domain && isFqdn(domain)) {
+    next["domain"] = normalizeDomain(domain);
   }
-  return null;
+  return next;
 }
-function createHieroPublisher(client) {
+function validateRecordFields(fields, queriedNativeId) {
+  const target = fields["target"];
+  const id = fields["id"];
+  const uid = fields["uid"];
+  const proto = fields["proto"];
+  const nativeId = fields["nativeId"];
+  if (target !== "aid" && target !== "did") {
+    return null;
+  }
+  if (!id || !uid || !proto || !nativeId) {
+    return null;
+  }
+  if (normalizeDomain(nativeId) !== queriedNativeId) {
+    return null;
+  }
+  if ("registry" in fields && !fields["registry"]) {
+    return null;
+  }
+  const did = fields["did"];
+  if (did && (target !== "did" || !did.startsWith("did:"))) {
+    return null;
+  }
+  const params = {
+    uid,
+    proto,
+    nativeId
+  };
+  if (fields["registry"]) {
+    params["registry"] = fields["registry"];
+  }
+  if (fields["domain"]) {
+    params["domain"] = fields["domain"];
+  }
+  if (fields["src"]) {
+    params["src"] = fields["src"];
+  }
   return {
-    network: () => {
-      const ledgerId = client.ledgerId;
-      if (!ledgerId) {
-        throw new Error("Hedera SDK Client must be configured with a network");
-      }
-      if (ledgerId.isMainnet()) return "mainnet";
-      if (ledgerId.isTestnet()) return "testnet";
-      if (ledgerId.isPreviewnet()) return "previewnet";
-      if (ledgerId.isLocalNode()) return "local-node";
-      throw new Error(`Unknown network, ledger ID: ${ledgerId.toString()}`);
-    },
-    publicKey: () => {
-      if (!client.operatorPublicKey) {
-        throw new Error(
-          "Hedera SDK Client must be configured with an operator account"
-        );
-      }
-      return client.operatorPublicKey;
-    },
-    publish: async (transaction) => {
-      const current = typeof transaction.getAutoRenewAccountId === "function" ? transaction.getAutoRenewAccountId() : null;
-      const autoRenewAccountId = toAccountIdString(client.operatorAccountId);
-      if (!current && autoRenewAccountId && typeof transaction.setAutoRenewAccountId === "function") {
-        transaction.setAutoRenewAccountId(autoRenewAccountId);
-      }
-      const response = await transaction.freezeWith(client).execute(client);
-      return response.getReceipt(client);
-    }
+    target,
+    id,
+    uid,
+    proto,
+    nativeId,
+    registry: fields["registry"],
+    domain: fields["domain"],
+    src: fields["src"],
+    did,
+    memo: fields["m"],
+    reconstructedUaid: buildCanonicalUaid(
+      target,
+      id,
+      canonicalizeNativeDomainParams(params)
+    )
   };
 }
-async function loadCreateDID() {
-  if (!registrarPromise) {
-    registrarPromise = optionalImport(
-      hieroRegistrarModuleId,
-      { preferImport: true }
-    ).then((mod) => mod?.createDID ?? null);
+function selectFollowupProfiles(target) {
+  if (target === "aid") {
+    return [AID_DNS_WEB_PROFILE_ID];
   }
-  return registrarPromise;
+  return [UAID_DID_RESOLUTION_PROFILE_ID];
 }
-class HederaHieroIssuer {
-  constructor() {
+class UaidDnsWebProfileResolver {
+  constructor(options = {}) {
+    this.profile = UAID_DNS_WEB_PROFILE_ID;
     this.meta = {
-      id: "hedera/hiero",
-      didMethods: ["hedera"],
-      caip2Networks: [
-        "hedera:mainnet",
-        "hedera:testnet",
-        "hedera:previewnet",
-        "hedera:devnet"
-      ],
-      caip10Namespaces: ["hedera"],
-      displayName: "Hedera (Hiero Registrar)",
-      description: "Issues did:hedera identifiers using the Hiero DID registrar.",
-      homepage: "https://github.com/hiero-ledger/hiero-did-sdk-js"
+      id: "hcs-14/uaid-dns-web",
+      didMethods: ["*"],
+      displayName: "HCS-14 UAID DNS TXT Profile",
+      description: "Binds UAIDs to DNS TXT records at _uaid.<nativeId> and can continue to follow-up profile resolution."
     };
+    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;
+    this.dnssecValidation = options.dnssecValidation;
+    this.requireFullResolution = options.requireFullResolution ?? false;
+    this.enableFollowupResolution = options.enableFollowupResolution ?? true;
   }
-  supports(method) {
-    return method === "hedera";
+  supports(_uaid, parsed) {
+    const target = uaidTargetFromParsed(parsed);
+    if (target !== "aid" && target !== "did") {
+      return false;
+    }
+    const nativeId = parsed.params["nativeId"];
+    return !!nativeId && isFqdn(nativeId);
   }
-  async issue(request) {
-    if (request.method !== "hedera") {
-      throw new Error('HederaHieroIssuer only handles method "hedera"');
+  async resolveProfile(uaid, context) {
+    const parsed = context.parsedUaid;
+    const nativeId = parsed.params["nativeId"];
+    if (!nativeId || !isFqdn(nativeId)) {
+      return null;
     }
-    if (!("client" in request)) {
-      throw new Error("Hedera client is required to issue did:hedera");
+    const normalizedNativeId = normalizeDomain(nativeId);
+    const dnsName = `_uaid.${normalizedNativeId}`;
+    const inputCanonical = buildCanonicalUaid(
+      uaidTargetFromParsed(parsed),
+      parsed.id,
+      canonicalizeNativeDomainParams(parsed.params)
+    );
+    const txtRecords = await this.dnsLookup(dnsName);
+    if (txtRecords.length === 0) {
+      return null;
     }
-    const createDID = await loadCreateDID();
-    if (!createDID) {
-      throw new Error(
-        "Hiero registrar unavailable. Ensure @hiero-did-sdk/registrar is installed."
+    const parsedRecords = txtRecords.map((record) => parseSemicolonFields(record)).map((fields) => validateRecordFields(fields, normalizedNativeId));
+    const validRecords = parsedRecords.filter(
+      (record) => record !== null
+    );
+    if (validRecords.length === 0) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_INVALID_UAID_DNS_RECORD",
+        "DNS TXT payload at _uaid record is invalid.",
+        { dnsName }
       );
     }
-    const client = request.client;
-    const did = await createDID(
-      {},
-      { publisher: createHieroPublisher(client) }
+    const matchingRecords = validRecords.filter(
+      (record) => record.target === uaidTargetFromParsed(parsed) && record.id === parsed.id && record.reconstructedUaid === inputCanonical
     );
-    return did.did;
+    if (matchingRecords.length === 0) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_UAID_MISMATCH",
+        "DNS TXT payload does not match the input UAID after canonical reconstruction.",
+        {
+          dnsName,
+          inputCanonical
+        }
+      );
+    }
+    const selected = [...matchingRecords].sort(
+      (a, b) => a.reconstructedUaid.localeCompare(b.reconstructedUaid)
+    )[0];
+    const dnssecValidated = this.dnssecValidation ? await this.dnssecValidation(dnsName) : false;
+    const verificationLevel = dnssecValidated ? "dns-binding-dnssec" : "dns-binding";
+    if (this.enableFollowupResolution) {
+      const followupProfiles = selectFollowupProfiles(selected.target);
+      for (const followupProfileId of followupProfiles) {
+        const followup = await context.resolveUaidProfileById(
+          followupProfileId,
+          uaid
+        );
+        if (!followup) {
+          continue;
+        }
+        if (followup.error || followup.metadata?.resolved === false) {
+          return buildErrorProfile(
+            uaid,
+            "ERR_FOLLOWUP_RESOLUTION_FAILED",
+            "Follow-up profile resolution failed after successful DNS binding.",
+            {
+              followupProfileId,
+              dnsName
+            }
+          );
+        }
+        return {
+          ...followup,
+          metadata: {
+            ...followup.metadata,
+            profile: UAID_DNS_WEB_PROFILE_ID,
+            resolved: true,
+            verificationLevel,
+            reconstructedUaid: selected.reconstructedUaid,
+            selectedFollowupProfile: followupProfileId,
+            resolutionMode: "full-resolution"
+          }
+        };
+      }
+    }
+    if (this.requireFullResolution) {
+      return buildErrorProfile(
+        uaid,
+        "ERR_NO_FOLLOWUP_PROFILE",
+        "Resolver policy requires full resolution, but no supported follow-up profile was available.",
+        { dnsName }
+      );
+    }
+    const did = selected.did ?? context.did ?? void 0;
+    const alsoKnownAs = did ? [did] : void 0;
+    return {
+      id: uaid,
+      did,
+      alsoKnownAs,
+      metadata: {
+        profile: UAID_DNS_WEB_PROFILE_ID,
+        resolved: true,
+        reconstructedUaid: selected.reconstructedUaid,
+        verificationLevel,
+        resolutionMode: "dns-binding-only"
+      }
+    };
   }
 }
 export {
-  HederaHieroIssuer
+  UAID_DNS_WEB_PROFILE_ID,
+  UaidDnsWebProfileResolver
 };
 //# sourceMappingURL=standards-sdk.es62.js.map

package/dist/es/standards-sdk.es62.js.map

@@ -1 +1 @@
-{"version":3,"file":"standards-sdk.es62.js","sources":["../../src/hcs-14/issuers/hiero.ts"],"sourcesContent":["import { DidIssueRequest, DidIssueRequestHedera, DidIssuer } from './types';\nimport type { AdapterMeta } from '../adapters/types';\nimport { optionalImport } from '../../utils/dynamic-import';\nimport type { PublicKey, TransactionReceipt } from '@hashgraph/sdk';\n\ntype CreateDID = typeof import('@hiero-did-sdk/registrar').createDID;\ntype HieroRegistrarModule = typeof import('@hiero-did-sdk/registrar');\n\nconst hieroRegistrarModuleId = ['@hiero-did-sdk', 'registrar'].join('/');\n\nlet registrarPromise: Promise<CreateDID | null> | null = null;\n\ntype PublisherClientLike = {\n  ledgerId?: {\n    isMainnet: () => boolean;\n    isTestnet: () => boolean;\n    isPreviewnet: () => boolean;\n    isLocalNode: () => boolean;\n    toString: () => string;\n  };\n  operatorPublicKey?: PublicKey;\n  operatorAccountId?: { toString: () => string };\n};\n\ntype AutoRenewTransactionLike = {\n  getAutoRenewAccountId?: () => unknown;\n  setAutoRenewAccountId?: (value: string) => void;\n  freezeWith: (client: PublisherClientLike) => {\n    execute: (client: PublisherClientLike) => Promise<{\n      getReceipt: (client: PublisherClientLike) => Promise<TransactionReceipt>;\n    }>;\n  };\n};\n\nfunction toAccountIdString(value: unknown): string | null {\n  if (typeof value === 'string' && value.trim()) {\n    return value;\n  }\n\n  if (\n    value &&\n    typeof (value as { toString?: () => string }).toString === 'function'\n  ) {\n    const result = (value as { toString: () => string }).toString();\n    return typeof result === 'string' && result.trim() ? result : null;\n  }\n\n  return null;\n}\n\nfunction createHieroPublisher(client: PublisherClientLike) {\n  return {\n    network: () => {\n      const ledgerId = client.ledgerId;\n      if (!ledgerId) {\n        throw new Error('Hedera SDK Client must be configured with a network');\n      }\n      if (ledgerId.isMainnet()) return 'mainnet';\n      if (ledgerId.isTestnet()) return 'testnet';\n      if (ledgerId.isPreviewnet()) return 'previewnet';\n      if (ledgerId.isLocalNode()) return 'local-node';\n      throw new Error(`Unknown network, ledger ID: ${ledgerId.toString()}`);\n    },\n    publicKey: () => {\n      if (!client.operatorPublicKey) {\n        throw new Error(\n          'Hedera SDK Client must be configured with an operator account',\n        );\n      }\n      return client.operatorPublicKey;\n    },\n    publish: async (transaction: AutoRenewTransactionLike) => {\n      const current =\n        typeof transaction.getAutoRenewAccountId === 'function'\n          ? transaction.getAutoRenewAccountId()\n          : null;\n      const autoRenewAccountId = toAccountIdString(client.operatorAccountId);\n\n      if (\n        !current &&\n        autoRenewAccountId &&\n        typeof transaction.setAutoRenewAccountId === 'function'\n      ) {\n        transaction.setAutoRenewAccountId(autoRenewAccountId);\n      }\n\n      const response = await transaction.freezeWith(client).execute(client);\n      return response.getReceipt(client);\n    },\n  };\n}\n\nasync function loadCreateDID(): Promise<CreateDID | null> {\n  if (!registrarPromise) {\n    // Prefer ESM to keep @hashgraph/sdk classes consistent across caller + registrar.\n    registrarPromise = optionalImport<HieroRegistrarModule>(\n      hieroRegistrarModuleId,\n      { preferImport: true },\n    ).then(mod => mod?.createDID ?? null);\n  }\n  return registrarPromise;\n}\n\nexport class HederaHieroIssuer implements DidIssuer {\n  readonly meta: AdapterMeta = {\n    id: 'hedera/hiero',\n    didMethods: ['hedera'],\n    caip2Networks: [\n      'hedera:mainnet',\n      'hedera:testnet',\n      'hedera:previewnet',\n      'hedera:devnet',\n    ],\n    caip10Namespaces: ['hedera'],\n    displayName: 'Hedera (Hiero Registrar)',\n    description: 'Issues did:hedera identifiers using the Hiero DID registrar.',\n    homepage: 'https://github.com/hiero-ledger/hiero-did-sdk-js',\n  };\n\n  supports(method: string): boolean {\n    return method === 'hedera';\n  }\n\n  async issue(request: DidIssueRequest): Promise<string> {\n    if (request.method !== 'hedera') {\n      throw new Error('HederaHieroIssuer only handles method \"hedera\"');\n    }\n    if (!('client' in request)) {\n      throw new Error('Hedera client is required to issue did:hedera');\n    }\n    const createDID = await loadCreateDID();\n    if (!createDID) {\n      throw new Error(\n        'Hiero registrar unavailable. Ensure @hiero-did-sdk/registrar is installed.',\n      );\n    }\n    const client = (request as DidIssueRequestHedera).client;\n    const did = await createDID(\n      {},\n      { publisher: createHieroPublisher(client) },\n    );\n    return did.did;\n  }\n}\n"],"names":[],"mappings":";AAQA,MAAM,yBAAyB,CAAC,kBAAkB,WAAW,EAAE,KAAK,GAAG;AAEvE,IAAI,mBAAqD;AAwBzD,SAAS,kBAAkB,OAA+B;AACxD,MAAI,OAAO,UAAU,YAAY,MAAM,QAAQ;AAC7C,WAAO;AAAA,EACT;AAEA,MACE,SACA,OAAQ,MAAsC,aAAa,YAC3D;AACA,UAAM,SAAU,MAAqC,SAAA;AACrD,WAAO,OAAO,WAAW,YAAY,OAAO,KAAA,IAAS,SAAS;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,SAAS,qBAAqB,QAA6B;AACzD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,YAAM,WAAW,OAAO;AACxB,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,MAAM,qDAAqD;AAAA,MACvE;AACA,UAAI,SAAS,UAAA,EAAa,QAAO;AACjC,UAAI,SAAS,UAAA,EAAa,QAAO;AACjC,UAAI,SAAS,aAAA,EAAgB,QAAO;AACpC,UAAI,SAAS,YAAA,EAAe,QAAO;AACnC,YAAM,IAAI,MAAM,+BAA+B,SAAS,SAAA,CAAU,EAAE;AAAA,IACtE;AAAA,IACA,WAAW,MAAM;AACf,UAAI,CAAC,OAAO,mBAAmB;AAC7B,cAAM,IAAI;AAAA,UACR;AAAA,QAAA;AAAA,MAEJ;AACA,aAAO,OAAO;AAAA,IAChB;AAAA,IACA,SAAS,OAAO,gBAA0C;AACxD,YAAM,UACJ,OAAO,YAAY,0BAA0B,aACzC,YAAY,0BACZ;AACN,YAAM,qBAAqB,kBAAkB,OAAO,iBAAiB;AAErE,UACE,CAAC,WACD,sBACA,OAAO,YAAY,0BAA0B,YAC7C;AACA,oBAAY,sBAAsB,kBAAkB;AAAA,MACtD;AAEA,YAAM,WAAW,MAAM,YAAY,WAAW,MAAM,EAAE,QAAQ,MAAM;AACpE,aAAO,SAAS,WAAW,MAAM;AAAA,IACnC;AAAA,EAAA;AAEJ;AAEA,eAAe,gBAA2C;AACxD,MAAI,CAAC,kBAAkB;AAErB,uBAAmB;AAAA,MACjB;AAAA,MACA,EAAE,cAAc,KAAA;AAAA,IAAK,EACrB,KAAK,CAAA,QAAO,KAAK,aAAa,IAAI;AAAA,EACtC;AACA,SAAO;AACT;AAEO,MAAM,kBAAuC;AAAA,EAA7C,cAAA;AACL,SAAS,OAAoB;AAAA,MAC3B,IAAI;AAAA,MACJ,YAAY,CAAC,QAAQ;AAAA,MACrB,eAAe;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,MAEF,kBAAkB,CAAC,QAAQ;AAAA,MAC3B,aAAa;AAAA,MACb,aAAa;AAAA,MACb,UAAU;AAAA,IAAA;AAAA,EACZ;AAAA,EAEA,SAAS,QAAyB;AAChC,WAAO,WAAW;AAAA,EACpB;AAAA,EAEA,MAAM,MAAM,SAA2C;AACrD,QAAI,QAAQ,WAAW,UAAU;AAC/B,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,QAAI,EAAE,YAAY,UAAU;AAC1B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AACA,UAAM,YAAY,MAAM,cAAA;AACxB,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AACA,UAAM,SAAU,QAAkC;AAClD,UAAM,MAAM,MAAM;AAAA,MAChB,CAAA;AAAA,MACA,EAAE,WAAW,qBAAqB,MAAM,EAAA;AAAA,IAAE;AAE5C,WAAO,IAAI;AAAA,EACb;AACF;"}
+{"version":3,"file":"standards-sdk.es62.js","sources":["../../src/hcs-14/resolvers/uaid-dns-web-profile.ts"],"sourcesContent":["import type {\n  DidResolutionProfile,\n  ProfileResolutionError,\n  UaidProfileResolver,\n  UaidProfileResolverContext,\n} from './types';\nimport type { AdapterMeta } from '../adapters/types';\nimport { nodeDnsTxtLookup, type DnsTxtLookup } from './dns';\nimport {\n  buildCanonicalUaid,\n  isFqdn,\n  normalizeDomain,\n  parseSemicolonFields,\n  uaidTargetFromParsed,\n} from './profile-utils';\nimport { AID_DNS_WEB_PROFILE_ID } from './aid-dns-web-profile';\nimport { UAID_DID_RESOLUTION_PROFILE_ID } from './uaid-did-resolution-profile';\n\nexport const UAID_DNS_WEB_PROFILE_ID = 'hcs-14.profile.uaid-dns-web';\n\ninterface UaidDnsWebRecord {\n  target: 'aid' | 'did';\n  id: string;\n  uid: string;\n  proto: string;\n  nativeId: string;\n  registry?: string;\n  domain?: string;\n  src?: string;\n  did?: string;\n  memo?: string;\n  reconstructedUaid: string;\n}\n\nexport interface UaidDnsWebResolverOptions {\n  dnsLookup?: DnsTxtLookup;\n  dnssecValidation?: (hostname: string) => Promise<boolean>;\n  requireFullResolution?: boolean;\n  enableFollowupResolution?: boolean;\n}\n\nfunction buildErrorProfile(\n  uaid: string,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>,\n): DidResolutionProfile {\n  const error: ProfileResolutionError = {\n    code,\n    message,\n    details,\n  };\n\n  return {\n    id: uaid,\n    error,\n    metadata: {\n      profile: UAID_DNS_WEB_PROFILE_ID,\n      resolved: false,\n    },\n  };\n}\n\nfunction canonicalizeNativeDomainParams(\n  params: Record<string, string>,\n): Record<string, string> {\n  const next = { ...params };\n  const nativeId = next['nativeId'];\n  if (nativeId && isFqdn(nativeId)) {\n    next['nativeId'] = normalizeDomain(nativeId);\n  }\n  const domain = next['domain'];\n  if (domain && isFqdn(domain)) {\n    next['domain'] = normalizeDomain(domain);\n  }\n  return next;\n}\n\nfunction validateRecordFields(\n  fields: Record<string, string>,\n  queriedNativeId: string,\n): UaidDnsWebRecord | null {\n  const target = fields['target'];\n  const id = fields['id'];\n  const uid = fields['uid'];\n  const proto = fields['proto'];\n  const nativeId = fields['nativeId'];\n\n  if (target !== 'aid' && target !== 'did') {\n    return null;\n  }\n  if (!id || !uid || !proto || !nativeId) {\n    return null;\n  }\n  if (normalizeDomain(nativeId) !== queriedNativeId) {\n    return null;\n  }\n  if ('registry' in fields && !fields['registry']) {\n    return null;\n  }\n  const did = fields['did'];\n  if (did && (target !== 'did' || !did.startsWith('did:'))) {\n    return null;\n  }\n\n  const params: Record<string, string> = {\n    uid,\n    proto,\n    nativeId,\n  };\n  if (fields['registry']) {\n    params['registry'] = fields['registry'];\n  }\n  if (fields['domain']) {\n    params['domain'] = fields['domain'];\n  }\n  if (fields['src']) {\n    params['src'] = fields['src'];\n  }\n\n  return {\n    target,\n    id,\n    uid,\n    proto,\n    nativeId,\n    registry: fields['registry'],\n    domain: fields['domain'],\n    src: fields['src'],\n    did,\n    memo: fields['m'],\n    reconstructedUaid: buildCanonicalUaid(\n      target,\n      id,\n      canonicalizeNativeDomainParams(params),\n    ),\n  };\n}\n\nfunction selectFollowupProfiles(target: 'aid' | 'did'): string[] {\n  if (target === 'aid') {\n    return [AID_DNS_WEB_PROFILE_ID];\n  }\n  return [UAID_DID_RESOLUTION_PROFILE_ID];\n}\n\nexport class UaidDnsWebProfileResolver implements UaidProfileResolver {\n  readonly profile = UAID_DNS_WEB_PROFILE_ID;\n\n  readonly meta: AdapterMeta = {\n    id: 'hcs-14/uaid-dns-web',\n    didMethods: ['*'],\n    displayName: 'HCS-14 UAID DNS TXT Profile',\n    description:\n      'Binds UAIDs to DNS TXT records at _uaid.<nativeId> and can continue to follow-up profile resolution.',\n  };\n\n  private readonly dnsLookup: DnsTxtLookup;\n  private readonly dnssecValidation?: (hostname: string) => Promise<boolean>;\n  private readonly requireFullResolution: boolean;\n  private readonly enableFollowupResolution: boolean;\n\n  constructor(options: UaidDnsWebResolverOptions = {}) {\n    this.dnsLookup = options.dnsLookup ?? nodeDnsTxtLookup;\n    this.dnssecValidation = options.dnssecValidation;\n    this.requireFullResolution = options.requireFullResolution ?? false;\n    this.enableFollowupResolution = options.enableFollowupResolution ?? true;\n  }\n\n  supports(\n    _uaid: string,\n    parsed: UaidProfileResolverContext['parsedUaid'],\n  ): boolean {\n    const target = uaidTargetFromParsed(parsed);\n    if (target !== 'aid' && target !== 'did') {\n      return false;\n    }\n    const nativeId = parsed.params['nativeId'];\n    return !!nativeId && isFqdn(nativeId);\n  }\n\n  async resolveProfile(\n    uaid: string,\n    context: UaidProfileResolverContext,\n  ): Promise<DidResolutionProfile | null> {\n    const parsed = context.parsedUaid;\n    const nativeId = parsed.params['nativeId'];\n    if (!nativeId || !isFqdn(nativeId)) {\n      return null;\n    }\n\n    const normalizedNativeId = normalizeDomain(nativeId);\n    const dnsName = `_uaid.${normalizedNativeId}`;\n    const inputCanonical = buildCanonicalUaid(\n      uaidTargetFromParsed(parsed),\n      parsed.id,\n      canonicalizeNativeDomainParams(parsed.params),\n    );\n\n    const txtRecords = await this.dnsLookup(dnsName);\n    if (txtRecords.length === 0) {\n      return null;\n    }\n\n    const parsedRecords = txtRecords\n      .map(record => parseSemicolonFields(record))\n      .map(fields => validateRecordFields(fields, normalizedNativeId));\n    const validRecords = parsedRecords.filter(\n      (record): record is UaidDnsWebRecord => record !== null,\n    );\n\n    if (validRecords.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_INVALID_UAID_DNS_RECORD',\n        'DNS TXT payload at _uaid record is invalid.',\n        { dnsName },\n      );\n    }\n\n    const matchingRecords = validRecords.filter(\n      record =>\n        record.target === uaidTargetFromParsed(parsed) &&\n        record.id === parsed.id &&\n        record.reconstructedUaid === inputCanonical,\n    );\n\n    if (matchingRecords.length === 0) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_UAID_MISMATCH',\n        'DNS TXT payload does not match the input UAID after canonical reconstruction.',\n        {\n          dnsName,\n          inputCanonical,\n        },\n      );\n    }\n\n    const selected = [...matchingRecords].sort((a, b) =>\n      a.reconstructedUaid.localeCompare(b.reconstructedUaid),\n    )[0];\n\n    const dnssecValidated = this.dnssecValidation\n      ? await this.dnssecValidation(dnsName)\n      : false;\n    const verificationLevel = dnssecValidated\n      ? 'dns-binding-dnssec'\n      : 'dns-binding';\n\n    if (this.enableFollowupResolution) {\n      const followupProfiles = selectFollowupProfiles(selected.target);\n      for (const followupProfileId of followupProfiles) {\n        const followup = await context.resolveUaidProfileById(\n          followupProfileId,\n          uaid,\n        );\n        if (!followup) {\n          continue;\n        }\n        if (followup.error || followup.metadata?.resolved === false) {\n          return buildErrorProfile(\n            uaid,\n            'ERR_FOLLOWUP_RESOLUTION_FAILED',\n            'Follow-up profile resolution failed after successful DNS binding.',\n            {\n              followupProfileId,\n              dnsName,\n            },\n          );\n        }\n        return {\n          ...followup,\n          metadata: {\n            ...followup.metadata,\n            profile: UAID_DNS_WEB_PROFILE_ID,\n            resolved: true,\n            verificationLevel,\n            reconstructedUaid: selected.reconstructedUaid,\n            selectedFollowupProfile: followupProfileId,\n            resolutionMode: 'full-resolution',\n          },\n        };\n      }\n    }\n\n    if (this.requireFullResolution) {\n      return buildErrorProfile(\n        uaid,\n        'ERR_NO_FOLLOWUP_PROFILE',\n        'Resolver policy requires full resolution, but no supported follow-up profile was available.',\n        { dnsName },\n      );\n    }\n\n    const did = selected.did ?? context.did ?? undefined;\n    const alsoKnownAs = did ? [did] : undefined;\n\n    return {\n      id: uaid,\n      did,\n      alsoKnownAs,\n      metadata: {\n        profile: UAID_DNS_WEB_PROFILE_ID,\n        resolved: true,\n        reconstructedUaid: selected.reconstructedUaid,\n        verificationLevel,\n        resolutionMode: 'dns-binding-only',\n      },\n    };\n  }\n}\n"],"names":[],"mappings":";;;;AAkBO,MAAM,0BAA0B;AAuBvC,SAAS,kBACP,MACA,MACA,SACA,SACsB;AACtB,QAAM,QAAgC;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAGF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,UAAU;AAAA,IAAA;AAAA,EACZ;AAEJ;AAEA,SAAS,+BACP,QACwB;AACxB,QAAM,OAAO,EAAE,GAAG,OAAA;AAClB,QAAM,WAAW,KAAK,UAAU;AAChC,MAAI,YAAY,OAAO,QAAQ,GAAG;AAChC,SAAK,UAAU,IAAI,gBAAgB,QAAQ;AAAA,EAC7C;AACA,QAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,UAAU,OAAO,MAAM,GAAG;AAC5B,SAAK,QAAQ,IAAI,gBAAgB,MAAM;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,qBACP,QACA,iBACyB;AACzB,QAAM,SAAS,OAAO,QAAQ;AAC9B,QAAM,KAAK,OAAO,IAAI;AACtB,QAAM,MAAM,OAAO,KAAK;AACxB,QAAM,QAAQ,OAAO,OAAO;AAC5B,QAAM,WAAW,OAAO,UAAU;AAElC,MAAI,WAAW,SAAS,WAAW,OAAO;AACxC,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU;AACtC,WAAO;AAAA,EACT;AACA,MAAI,gBAAgB,QAAQ,MAAM,iBAAiB;AACjD,WAAO;AAAA,EACT;AACA,MAAI,cAAc,UAAU,CAAC,OAAO,UAAU,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,MAAM,OAAO,KAAK;AACxB,MAAI,QAAQ,WAAW,SAAS,CAAC,IAAI,WAAW,MAAM,IAAI;AACxD,WAAO;AAAA,EACT;AAEA,QAAM,SAAiC;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,UAAU,IAAI,OAAO,UAAU;AAAA,EACxC;AACA,MAAI,OAAO,QAAQ,GAAG;AACpB,WAAO,QAAQ,IAAI,OAAO,QAAQ;AAAA,EACpC;AACA,MAAI,OAAO,KAAK,GAAG;AACjB,WAAO,KAAK,IAAI,OAAO,KAAK;AAAA,EAC9B;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,OAAO,UAAU;AAAA,IAC3B,QAAQ,OAAO,QAAQ;AAAA,IACvB,KAAK,OAAO,KAAK;AAAA,IACjB;AAAA,IACA,MAAM,OAAO,GAAG;AAAA,IAChB,mBAAmB;AAAA,MACjB;AAAA,MACA;AAAA,MACA,+BAA+B,MAAM;AAAA,IAAA;AAAA,EACvC;AAEJ;AAEA,SAAS,uBAAuB,QAAiC;AAC/D,MAAI,WAAW,OAAO;AACpB,WAAO,CAAC,sBAAsB;AAAA,EAChC;AACA,SAAO,CAAC,8BAA8B;AACxC;AAEO,MAAM,0BAAyD;AAAA,EAgBpE,YAAY,UAAqC,IAAI;AAfrD,SAAS,UAAU;AAEnB,SAAS,OAAoB;AAAA,MAC3B,IAAI;AAAA,MACJ,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa;AAAA,MACb,aACE;AAAA,IAAA;AASF,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,mBAAmB,QAAQ;AAChC,SAAK,wBAAwB,QAAQ,yBAAyB;AAC9D,SAAK,2BAA2B,QAAQ,4BAA4B;AAAA,EACtE;AAAA,EAEA,SACE,OACA,QACS;AACT,UAAM,SAAS,qBAAqB,MAAM;AAC1C,QAAI,WAAW,SAAS,WAAW,OAAO;AACxC,aAAO;AAAA,IACT;AACA,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,WAAO,CAAC,CAAC,YAAY,OAAO,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,eACJ,MACA,SACsC;AACtC,UAAM,SAAS,QAAQ;AACvB,UAAM,WAAW,OAAO,OAAO,UAAU;AACzC,QAAI,CAAC,YAAY,CAAC,OAAO,QAAQ,GAAG;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,qBAAqB,gBAAgB,QAAQ;AACnD,UAAM,UAAU,SAAS,kBAAkB;AAC3C,UAAM,iBAAiB;AAAA,MACrB,qBAAqB,MAAM;AAAA,MAC3B,OAAO;AAAA,MACP,+BAA+B,OAAO,MAAM;AAAA,IAAA;AAG9C,UAAM,aAAa,MAAM,KAAK,UAAU,OAAO;AAC/C,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO;AAAA,IACT;AAEA,UAAM,gBAAgB,WACnB,IAAI,CAAA,WAAU,qBAAqB,MAAM,CAAC,EAC1C,IAAI,CAAA,WAAU,qBAAqB,QAAQ,kBAAkB,CAAC;AACjE,UAAM,eAAe,cAAc;AAAA,MACjC,CAAC,WAAuC,WAAW;AAAA,IAAA;AAGrD,QAAI,aAAa,WAAW,GAAG;AAC7B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,kBAAkB,aAAa;AAAA,MACnC,CAAA,WACE,OAAO,WAAW,qBAAqB,MAAM,KAC7C,OAAO,OAAO,OAAO,MACrB,OAAO,sBAAsB;AAAA,IAAA;AAGjC,QAAI,gBAAgB,WAAW,GAAG;AAChC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,QAAA;AAAA,MACF;AAAA,IAEJ;AAEA,UAAM,WAAW,CAAC,GAAG,eAAe,EAAE;AAAA,MAAK,CAAC,GAAG,MAC7C,EAAE,kBAAkB,cAAc,EAAE,iBAAiB;AAAA,IAAA,EACrD,CAAC;AAEH,UAAM,kBAAkB,KAAK,mBACzB,MAAM,KAAK,iBAAiB,OAAO,IACnC;AACJ,UAAM,oBAAoB,kBACtB,uBACA;AAEJ,QAAI,KAAK,0BAA0B;AACjC,YAAM,mBAAmB,uBAAuB,SAAS,MAAM;AAC/D,iBAAW,qBAAqB,kBAAkB;AAChD,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAEF,YAAI,CAAC,UAAU;AACb;AAAA,QACF;AACA,YAAI,SAAS,SAAS,SAAS,UAAU,aAAa,OAAO;AAC3D,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,cACE;AAAA,cACA;AAAA,YAAA;AAAA,UACF;AAAA,QAEJ;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,UAAU;AAAA,YACR,GAAG,SAAS;AAAA,YACZ,SAAS;AAAA,YACT,UAAU;AAAA,YACV;AAAA,YACA,mBAAmB,SAAS;AAAA,YAC5B,yBAAyB;AAAA,YACzB,gBAAgB;AAAA,UAAA;AAAA,QAClB;AAAA,MAEJ;AAAA,IACF;AAEA,QAAI,KAAK,uBAAuB;AAC9B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,QAAA;AAAA,MAAQ;AAAA,IAEd;AAEA,UAAM,MAAM,SAAS,OAAO,QAAQ,OAAO;AAC3C,UAAM,cAAc,MAAM,CAAC,GAAG,IAAI;AAElC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,UAAU;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,mBAAmB,SAAS;AAAA,QAC5B;AAAA,QACA,gBAAgB;AAAA,MAAA;AAAA,IAClB;AAAA,EAEJ;AACF;"}