@oma3/omatrust 0.1.0-alpha.0 → 0.1.0-alpha.10

package/dist/index.js

@@ -1,4 +1,4 @@
-import { keccak256, toUtf8Bytes, getAddress, isAddress, sha256, ZeroAddress, Signature, Contract, formatUnits, verifyTypedData, hexlify, randomBytes, id } from 'ethers';
+import { keccak256, toUtf8Bytes, isAddress, getAddress, sha256, ZeroAddress, Signature, formatUnits, verifyTypedData, hexlify, randomBytes, id, Contract, Interface } from 'ethers';
 import canonicalize from 'canonicalize';
 import { SchemaEncoder, EAS } from '@ethereum-attestation-service/eas-sdk';
 import { resolveTxt } from 'dns/promises';
@@ -152,7 +152,7 @@ function extractDidIdentifier(did) {
 }
 function normalizeDomain(domain) {
   assertString(domain, "domain", "INVALID_DID");
-  return domain.trim().toLowerCase().replace(/\.$/, "");
+  return domain.trim().toLowerCase().replace(/\.$/, "").replace(/^www\./, "");
 }
 function normalizeDidWeb(input) {
   assertString(input, "input", "INVALID_DID");
@@ -241,8 +241,7 @@ function computeDidAddress(didHash) {
   if (!/^0x[0-9a-fA-F]{64}$/.test(didHash)) {
     throw new OmaTrustError("INVALID_DID", "didHash must be 32-byte hex", { didHash });
   }
-  const truncated = `0x${didHash.slice(-40)}`;
-  return getAddress(truncated);
+  return `0x${didHash.slice(-40).toLowerCase()}`;
 }
 function didToAddress(did) {
   return computeDidAddress(computeDidHash(did));
@@ -356,6 +355,7 @@ function hashCanonicalizedJson(obj, algorithm) {
 var reputation_exports = {};
 __export(reputation_exports, {
   buildDelegatedAttestationTypedData: () => buildDelegatedAttestationTypedData,
+  buildDelegatedTypedDataFromEncoded: () => buildDelegatedTypedDataFromEncoded,
   buildDnsTxtRecord: () => buildDnsTxtRecord,
   buildEip712Domain: () => buildEip712Domain,
   calculateAverageUserReviewRating: () => calculateAverageUserReviewRating,
@@ -379,6 +379,7 @@ __export(reputation_exports, {
   formatSchemaUid: () => formatSchemaUid,
   formatTransferAmount: () => formatTransferAmount,
   getAttestation: () => getAttestation,
+  getAttestationsByAttester: () => getAttestationsByAttester,
   getAttestationsForDid: () => getAttestationsForDid,
   getChainConstants: () => getChainConstants,
   getExplorerAddressUrl: () => getExplorerAddressUrl,
@@ -394,16 +395,22 @@ __export(reputation_exports, {
   normalizeSchema: () => normalizeSchema,
   parseDnsTxtRecord: () => parseDnsTxtRecord,
   prepareDelegatedAttestation: () => prepareDelegatedAttestation,
+  revokeAttestation: () => revokeAttestation,
   schemaToString: () => schemaToString,
   splitSignature: () => splitSignature,
   submitAttestation: () => submitAttestation,
   submitDelegatedAttestation: () => submitDelegatedAttestation,
+  validateAttestationData: () => validateAttestationData,
   verifyAttestation: () => verifyAttestation,
   verifyDidDocumentControllerDid: () => verifyDidDocumentControllerDid,
+  verifyDidJsonControllerDid: () => verifyDidJsonControllerDid,
+  verifyDidPkhOwnership: () => verifyDidPkhOwnership,
+  verifyDidWebOwnership: () => verifyDidWebOwnership,
   verifyDnsTxtControllerDid: () => verifyDnsTxtControllerDid,
   verifyEip712Signature: () => verifyEip712Signature,
   verifyProof: () => verifyProof,
-  verifySchemaExists: () => verifySchemaExists
+  verifySchemaExists: () => verifySchemaExists,
+  verifySubjectOwnership: () => verifySubjectOwnership
 });
 function normalizeSchema(schema) {
   if (Array.isArray(schema)) {
@@ -439,6 +446,13 @@ function encodeAttestationData(schema, data) {
   if (!data || typeof data !== "object") {
     throw new OmaTrustError("INVALID_INPUT", "data must be an object");
   }
+  const validationErrors = validateAttestationData(schema, data);
+  if (validationErrors.length > 0) {
+    const summary = validationErrors.map((error) => `Field "${error.schemaFieldName}" (${error.expectedType}) got ${error.providedType}`).join("; ");
+    throw new OmaTrustError("INVALID_INPUT", `Attestation data validation failed: ${summary}`, {
+      errors: validationErrors
+    });
+  }
   const fields = normalizeSchema(schema);
   const schemaString = schemaToString(fields);
   const encoder = new SchemaEncoder(schemaString);
@@ -451,6 +465,99 @@ function encodeAttestationData(schema, data) {
   );
   return encoded;
 }
+function getActualType(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (value === void 0) {
+    return "undefined";
+  }
+  if (Array.isArray(value)) {
+    return "array";
+  }
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? "number" : "non-finite-number";
+  }
+  return typeof value;
+}
+function isNumericValue(value, allowNegative) {
+  if (typeof value === "bigint") {
+    return allowNegative || value >= 0n;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || !Number.isInteger(value)) {
+      return false;
+    }
+    return allowNegative || value >= 0;
+  }
+  if (typeof value === "string") {
+    if (value.length === 0) {
+      return false;
+    }
+    const pattern = allowNegative ? /^-?\d+$/ : /^\d+$/;
+    return pattern.test(value);
+  }
+  return false;
+}
+function isHex(value) {
+  return typeof value === "string" && /^0x[0-9a-fA-F]*$/.test(value);
+}
+function validateFieldValue(type, value) {
+  const normalizedType = type.trim().toLowerCase();
+  const bytesNMatch = normalizedType.match(/^bytes([1-9]|[12]\d|3[0-2])$/);
+  if (/^uint\d*$/.test(normalizedType)) {
+    return isNumericValue(value, false);
+  }
+  if (/^int\d*$/.test(normalizedType)) {
+    return isNumericValue(value, true);
+  }
+  if (normalizedType === "string") {
+    return typeof value === "string";
+  }
+  if (normalizedType === "string[]") {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+  }
+  if (normalizedType === "bool") {
+    return typeof value === "boolean";
+  }
+  if (normalizedType === "address") {
+    return typeof value === "string" && isAddress(value);
+  }
+  if (normalizedType === "bytes") {
+    return isHex(value) && (value.length - 2) % 2 === 0;
+  }
+  if (bytesNMatch) {
+    const expectedBytes = Number(bytesNMatch[1]);
+    return isHex(value) && value.length === 2 + expectedBytes * 2;
+  }
+  return true;
+}
+function validateAttestationData(schema, data) {
+  if (!data || typeof data !== "object") {
+    return [{
+      schemaFieldName: "data",
+      expectedType: "object",
+      providedType: getActualType(data),
+      providedValue: data
+    }];
+  }
+  const fields = normalizeSchema(schema);
+  const errors = [];
+  for (const field of fields) {
+    const value = data[field.name];
+    const isValid = validateFieldValue(field.type, value);
+    if (isValid) {
+      continue;
+    }
+    errors.push({
+      schemaFieldName: field.name,
+      expectedType: field.type,
+      providedType: getActualType(value),
+      providedValue: value
+    });
+  }
+  return errors;
+}
 function decodeAttestationData(schema, encodedData) {
   if (typeof encodedData !== "string" || !encodedData.startsWith("0x")) {
     throw new OmaTrustError("INVALID_INPUT", "encodedData must be a hex string");
@@ -471,22 +578,11 @@ function decodeAttestationData(schema, encodedData) {
   return result;
 }
 function extractExpirationTime(data) {
-  const keys = ["expirationTime", "expiration", "validUntil", "expiresAt", "expires"];
-  for (const key of keys) {
-    const value = data[key];
-    if (value === void 0 || value === null) {
-      continue;
-    }
-    if (typeof value === "bigint") {
-      return value;
-    }
-    if (typeof value === "number") {
-      return value;
-    }
-    if (typeof value === "string" && /^\d+$/.test(value)) {
-      return BigInt(value);
-    }
-  }
+  const value = data["expiresAt"];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value === "bigint") return value;
+  if (typeof value === "number") return value;
+  if (typeof value === "string" && /^\d+$/.test(value)) return BigInt(value);
   return void 0;
 }
 var ZERO_UID = "0x0000000000000000000000000000000000000000000000000000000000000000";
@@ -527,6 +623,53 @@ function resolveRecipientAddress(data) {
   return ZeroAddress;
 }
 
+// src/reputation/eas-adapter.ts
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object";
+}
+function isHex32(value) {
+  return typeof value === "string" && /^0x[0-9a-fA-F]{64}$/.test(value);
+}
+function getEasTransactionReceipt(tx) {
+  if (!isRecord(tx)) {
+    return void 0;
+  }
+  const candidates = [tx.receipt, tx.tx, tx.transaction];
+  for (const candidate of candidates) {
+    if (isRecord(candidate)) {
+      return candidate;
+    }
+  }
+  return void 0;
+}
+function getEasTransactionHash(tx) {
+  const receipt = getEasTransactionReceipt(tx);
+  if (receipt) {
+    const receiptHash = receipt.hash;
+    if (isHex32(receiptHash)) {
+      return receiptHash;
+    }
+    const transactionHash = receipt.transactionHash;
+    if (isHex32(transactionHash)) {
+      return transactionHash;
+    }
+  }
+  if (isRecord(tx) && isHex32(tx.hash)) {
+    return tx.hash;
+  }
+  return void 0;
+}
+function isEasSchemaNotFoundError(err) {
+  if (!isRecord(err)) {
+    return false;
+  }
+  const message = err.message;
+  if (typeof message !== "string" || message.length === 0) {
+    return false;
+  }
+  return /schema not found/i.test(message);
+}
+
 // src/reputation/submit.ts
 async function submitAttestation(params) {
   if (!params || typeof params !== "object") {
@@ -557,25 +700,46 @@ async function submitAttestation(params) {
       }
     });
     const uid = await tx.wait();
-    const txAny = tx;
-    const txHash = txAny.tx?.hash ?? txAny.hash ?? txAny.transaction?.hash ?? ZERO_UID;
+    const txHash = getEasTransactionHash(tx) ?? ZERO_UID;
+    const receipt = getEasTransactionReceipt(tx);
     return {
       uid,
       txHash,
-      receipt: txAny.tx
+      receipt
     };
   } catch (err) {
     throw new OmaTrustError("NETWORK_ERROR", "Failed to submit attestation", { err });
   }
 }
-function buildDelegatedAttestationTypedData(params) {
-  const dataWithHash = withAutoSubjectDidHash(params.schema, params.data);
-  const encodedData = encodeAttestationData(params.schema, dataWithHash);
-  const recipient = resolveRecipientAddress(dataWithHash);
-  const expiration = toBigIntOrDefault(
-    params.expirationTime ?? extractExpirationTime(dataWithHash),
-    0n
-  );
+async function revokeAttestation(params) {
+  if (!params || typeof params !== "object") {
+    throw new OmaTrustError("INVALID_INPUT", "params must be provided");
+  }
+  if (!params.signer) {
+    throw new OmaTrustError("INVALID_INPUT", "signer is required");
+  }
+  const eas = new EAS(params.easContractAddress);
+  eas.connect(params.signer);
+  try {
+    const tx = await eas.revoke({
+      schema: params.schemaUid,
+      data: {
+        uid: params.uid,
+        value: toBigIntOrDefault(params.value, 0n)
+      }
+    });
+    await tx.wait();
+    const txHash = getEasTransactionHash(tx) ?? ZERO_UID;
+    const receipt = getEasTransactionReceipt(tx);
+    return {
+      txHash,
+      receipt
+    };
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to revoke attestation", { err });
+  }
+}
+function buildDelegatedTypedData(params) {
   return {
     domain: {
       name: "EAS",
@@ -600,17 +764,52 @@ function buildDelegatedAttestationTypedData(params) {
     message: {
       attester: params.attester,
       schema: params.schemaUid,
-      recipient,
-      expirationTime: expiration,
+      recipient: params.recipient,
+      expirationTime: toBigIntOrDefault(params.expirationTime, 0n),
       revocable: params.revocable ?? true,
       refUID: params.refUid ?? ZERO_UID,
-      data: encodedData,
+      data: params.encodedData,
       value: toBigIntOrDefault(params.value, 0n),
       nonce: toBigIntOrDefault(params.nonce, 0n),
       deadline: toBigIntOrDefault(params.deadline, BigInt(Math.floor(Date.now() / 1e3) + 600))
     }
   };
 }
+function buildDelegatedAttestationTypedData(params) {
+  const dataWithHash = withAutoSubjectDidHash(params.schema, params.data);
+  const encodedData = encodeAttestationData(params.schema, dataWithHash);
+  const recipient = resolveRecipientAddress(dataWithHash);
+  return buildDelegatedTypedData({
+    chainId: params.chainId,
+    easContractAddress: params.easContractAddress,
+    schemaUid: params.schemaUid,
+    encodedData,
+    recipient,
+    attester: params.attester,
+    nonce: params.nonce,
+    revocable: params.revocable,
+    expirationTime: params.expirationTime ?? extractExpirationTime(dataWithHash),
+    refUid: params.refUid,
+    value: params.value,
+    deadline: params.deadline
+  });
+}
+function buildDelegatedTypedDataFromEncoded(params) {
+  return buildDelegatedTypedData({
+    chainId: params.chainId,
+    easContractAddress: params.easContractAddress,
+    schemaUid: params.schemaUid,
+    encodedData: params.encodedData,
+    recipient: params.recipient,
+    attester: params.attester,
+    nonce: params.nonce,
+    revocable: params.revocable,
+    expirationTime: params.expirationTime,
+    refUid: params.refUid,
+    value: params.value,
+    deadline: params.deadline
+  });
+}
 function splitSignature(signature) {
   try {
     const parsed = Signature.from(signature);
@@ -687,7 +886,14 @@ async function submitDelegatedAttestation(params) {
 var EAS_EVENT_ABI = [
   "event Attested(address indexed recipient, address indexed attester, bytes32 uid, bytes32 indexed schemaUID)"
 ];
-function parseAttestation(attestation, schema) {
+function parseEventTxHash(event) {
+  const txHash = event.transactionHash;
+  if (typeof txHash !== "string") {
+    return void 0;
+  }
+  return /^0x[0-9a-fA-F]{64}$/.test(txHash) ? txHash : void 0;
+}
+function parseAttestation(attestation, schema, txHash) {
   const rawData = attestation.data ?? "0x";
   const decoded = schema ? decodeAttestationData(schema, rawData) : {};
   const toBigIntSafe = (value) => {
@@ -707,6 +913,7 @@ function parseAttestation(attestation, schema) {
     schema: attestation.schema,
     attester: attestation.attester,
     recipient: attestation.recipient,
+    txHash,
     revocable: Boolean(attestation.revocable),
     revocationTime: toBigIntSafe(attestation.revocationTime),
     expirationTime: toBigIntSafe(attestation.expirationTime),
@@ -732,21 +939,18 @@ async function getAttestation(params) {
     throw new OmaTrustError("NETWORK_ERROR", "Failed to read attestation", { err });
   }
 }
-async function getAttestationsForDid(params) {
-  const provider = params.provider;
-  const contract = new Contract(params.easContractAddress, EAS_EVENT_ABI, provider);
-  const toBlock = params.toBlock ?? await provider.getBlockNumber();
-  const fromBlock = params.fromBlock ?? Math.max(0, toBlock - 5e4);
-  const filter = contract.filters.Attested(didToAddress(params.did));
+async function queryAttestationEvents(easContractAddress, provider, fromBlock, toBlock, options) {
+  const contract = new Contract(easContractAddress, EAS_EVENT_ABI, provider);
+  const filter = contract.filters.Attested(options?.recipient ?? null, options?.attester ?? null);
   let events;
   try {
     events = await contract.queryFilter(filter, fromBlock, toBlock);
   } catch (err) {
     throw new OmaTrustError("NETWORK_ERROR", "Failed to query attestation events", { err });
   }
-  const eas = new EAS(params.easContractAddress);
+  const eas = new EAS(easContractAddress);
   eas.connect(provider);
-  const schemaFilter = params.schemas?.map((schema) => schema.toLowerCase());
+  const schemaFilter = options?.schemas?.map((s) => s.toLowerCase());
   const results = [];
   for (const event of events) {
     if (!("args" in event && Array.isArray(event.args))) {
@@ -765,11 +969,39 @@ async function getAttestationsForDid(params) {
     if (!attestation || !attestation.uid) {
       continue;
     }
-    results.push(parseAttestation(attestation));
+    results.push(parseAttestation(attestation, void 0, parseEventTxHash(event)));
   }
   results.sort((a, b) => Number(b.time - a.time));
   return results;
 }
+async function getAttestationsForDid(params) {
+  const provider = params.provider;
+  const toBlock = params.toBlock ?? await provider.getBlockNumber();
+  const fromBlock = params.fromBlock ?? Math.max(0, toBlock - 5e4);
+  return queryAttestationEvents(
+    params.easContractAddress,
+    provider,
+    fromBlock,
+    toBlock,
+    { recipient: didToAddress(params.did), schemas: params.schemas }
+  );
+}
+async function getAttestationsByAttester(params) {
+  const provider = params.provider;
+  const toBlock = params.toBlock ?? await provider.getBlockNumber();
+  const fromBlock = params.fromBlock ?? Math.max(0, toBlock - 5e4);
+  if (params.limit !== void 0 && params.limit <= 0) {
+    return [];
+  }
+  const results = await queryAttestationEvents(
+    params.easContractAddress,
+    provider,
+    fromBlock,
+    toBlock,
+    { attester: params.attester, schemas: params.schemas }
+  );
+  return params.limit !== void 0 ? results.slice(0, params.limit) : results;
+}
 async function listAttestations(params) {
   const limit = params.limit ?? 20;
   if (limit <= 0) {
@@ -780,34 +1012,15 @@ async function listAttestations(params) {
 }
 async function getLatestAttestations(params) {
   const provider = params.provider;
-  const contract = new Contract(params.easContractAddress, EAS_EVENT_ABI, provider);
-  const currentBlock = await provider.getBlockNumber();
-  const fromBlock = params.fromBlock ?? Math.max(0, currentBlock - 5e4);
-  const events = await contract.queryFilter(contract.filters.Attested(), fromBlock, currentBlock);
-  const eas = new EAS(params.easContractAddress);
-  eas.connect(provider);
-  const schemaFilter = params.schemas?.map((schema) => schema.toLowerCase());
-  const results = [];
-  for (const event of events) {
-    if (!("args" in event && Array.isArray(event.args))) {
-      continue;
-    }
-    const args = event.args;
-    const uid = args?.[2];
-    const schemaUid = args?.[3];
-    if (!uid || !schemaUid) {
-      continue;
-    }
-    if (schemaFilter && !schemaFilter.includes(schemaUid.toLowerCase())) {
-      continue;
-    }
-    const attestation = await eas.getAttestation(uid);
-    if (!attestation || !attestation.uid) {
-      continue;
-    }
-    results.push(parseAttestation(attestation));
-  }
-  results.sort((a, b) => Number(b.time - a.time));
+  const toBlock = await provider.getBlockNumber();
+  const fromBlock = params.fromBlock ?? Math.max(0, toBlock - 5e4);
+  const results = await queryAttestationEvents(
+    params.easContractAddress,
+    provider,
+    fromBlock,
+    toBlock,
+    { schemas: params.schemas }
+  );
   return results.slice(0, params.limit ?? 20);
 }
 function deduplicateReviews(attestations) {
@@ -1069,6 +1282,13 @@ function verifyDidDocumentControllerDid(didDocument, expectedControllerDid) {
     reason: `No matching address found in DID document (expected ${expectedAddress})`
   };
 }
+async function verifyDidJsonControllerDid(domain, expectedControllerDid, options = {}) {
+  if (!domain || typeof domain !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
+  }
+  const didDocument = options.fetchDidDocument ? await options.fetchDidDocument(domain) : await fetchDidDocument(domain);
+  return verifyDidDocumentControllerDid(didDocument, expectedControllerDid);
+}
 function buildEip712Domain(name, version, chainId, verifyingContract) {
   return { name, version, chainId, verifyingContract };
 }
@@ -1101,6 +1321,8 @@ function verifyEip712Signature(typedData, signature) {
     throw new OmaTrustError("INVALID_INPUT", "Failed to verify EIP-712 signature", { err });
   }
 }
+
+// src/reputation/proof/dns-txt-record.ts
 function parseDnsTxtRecord(record) {
   if (!record || typeof record !== "string") {
     throw new OmaTrustError("INVALID_INPUT", "record must be a non-empty string", { record });
@@ -1128,27 +1350,6 @@ function buildDnsTxtRecord(controllerDid) {
   const normalized = normalizeDid(controllerDid);
   return `v=1;controller=${normalized}`;
 }
-async function verifyDnsTxtControllerDid(domain, expectedControllerDid) {
-  if (!domain || typeof domain !== "string") {
-    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
-  }
-  const expected = normalizeDid(expectedControllerDid);
-  const host = `_omatrust.${domain.toLowerCase().replace(/\.$/, "")}`;
-  let records;
-  try {
-    records = await resolveTxt(host);
-  } catch (err) {
-    throw new OmaTrustError("NETWORK_ERROR", "Failed to resolve DNS TXT records", { domain, err });
-  }
-  for (const recordParts of records) {
-    const record = recordParts.join("");
-    const parsed = parseDnsTxtRecord(record);
-    if (parsed.version === "1" && parsed.controller && normalizeDid(parsed.controller) === expected) {
-      return { valid: true, record };
-    }
-  }
-  return { valid: false, reason: "No TXT record matched expected controller DID" };
-}
 
 // src/reputation/verify.ts
 function parseChainId(input) {
@@ -1429,6 +1630,9 @@ async function getSchemaDetails(schemaRegistry, schemaUid) {
       revocable: Boolean(details.revocable)
     };
   } catch (err) {
+    if (isEasSchemaNotFoundError(err)) {
+      throw new OmaTrustError("SCHEMA_NOT_FOUND", "Schema was not found", { schemaUid });
+    }
     if (err instanceof OmaTrustError) {
       throw err;
     }
@@ -1612,6 +1816,366 @@ function createEvidencePointerProof(url) {
     issuedAt: Math.floor(Date.now() / 1e3)
   };
 }
+async function verifyDnsTxtControllerDid(domain, expectedControllerDid, options = {}) {
+  if (!domain || typeof domain !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
+  }
+  const expected = normalizeDid(expectedControllerDid);
+  const prefix = options.recordPrefix ?? "_controllers";
+  const host = `${prefix}.${domain.toLowerCase().replace(/\.$/, "")}`;
+  let records;
+  try {
+    records = await (options.resolveTxt ?? resolveTxt)(host);
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to resolve DNS TXT records", { domain, err });
+  }
+  for (const recordParts of records) {
+    const record = recordParts.join("");
+    const parsed = parseDnsTxtRecord(record);
+    if (parsed.version === "1" && parsed.controller && normalizeDid(parsed.controller) === expected) {
+      return { valid: true, record };
+    }
+  }
+  return { valid: false, reason: "No TXT record matched expected controller DID" };
+}
+
+// src/reputation/proof/dns-txt-shared.ts
+async function verifyDnsTxtControllerDid2(domain, expectedControllerDid, options = {}) {
+  if (!domain || typeof domain !== "string") {
+    throw new OmaTrustError("INVALID_INPUT", "domain must be a non-empty string", { domain });
+  }
+  if (!options.resolveTxt) {
+    throw new OmaTrustError("NETWORK_ERROR", "No DNS TXT resolver was provided", { domain });
+  }
+  const expected = normalizeDid(expectedControllerDid);
+  const prefix = options.recordPrefix ?? "_controllers";
+  const host = `${prefix}.${domain.toLowerCase().replace(/\.$/, "")}`;
+  let records;
+  try {
+    records = await options.resolveTxt(host);
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to resolve DNS TXT records", { domain, err });
+  }
+  for (const recordParts of records) {
+    const record = recordParts.join("");
+    const parsed = parseDnsTxtRecord(record);
+    if (parsed.version === "1" && parsed.controller && normalizeDid(parsed.controller) === expected) {
+      return { valid: true, record };
+    }
+  }
+  return { valid: false, reason: "No TXT record matched expected controller DID" };
+}
+
+// src/reputation/proof/subject-ownership.ts
+var EIP1967_ADMIN_SLOT = "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103";
+var OWNERSHIP_PATTERNS = [
+  { method: "owner", signature: "function owner() view returns (address)" },
+  { method: "admin", signature: "function admin() view returns (address)" },
+  { method: "getOwner", signature: "function getOwner() view returns (address)" }
+];
+function assertConnectedWalletDid(input) {
+  const normalized = normalizeDid(input);
+  if (extractDidMethod(normalized) !== "pkh") {
+    throw new OmaTrustError("INVALID_INPUT", "connectedWalletDid must be a did:pkh DID", {
+      connectedWalletDid: input
+    });
+  }
+  return normalized;
+}
+function normalizeSubjectDid(input) {
+  return normalizeDid(input);
+}
+async function readAddressFromContract(provider, contractAddress, signature, method) {
+  try {
+    const iface = new Interface([signature]);
+    const data = iface.encodeFunctionData(method, []);
+    const result = await provider.call({ to: contractAddress, data });
+    const [value] = iface.decodeFunctionResult(method, result);
+    if (typeof value === "string" && isAddress(value) && value !== ZeroAddress) {
+      return getAddress(value);
+    }
+  } catch {
+  }
+  return null;
+}
+async function discoverControllingWallet(provider, contractAddress, chainId) {
+  for (const pattern of OWNERSHIP_PATTERNS) {
+    const address = await readAddressFromContract(
+      provider,
+      contractAddress,
+      pattern.signature,
+      pattern.method
+    );
+    if (address) {
+      return buildEvmDidPkh(chainId, address);
+    }
+  }
+  try {
+    const adminValue = await provider.getStorage(contractAddress, EIP1967_ADMIN_SLOT);
+    if (adminValue && adminValue !== "0x" && adminValue !== "0x0000000000000000000000000000000000000000000000000000000000000000") {
+      const adminAddress = getAddress(`0x${adminValue.slice(-40)}`);
+      if (adminAddress !== ZeroAddress) {
+        return buildEvmDidPkh(chainId, adminAddress);
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+async function verifyDidWebOwnership(params) {
+  const subjectDid = normalizeSubjectDid(params.subjectDid);
+  const connectedWalletDid = assertConnectedWalletDid(params.connectedWalletDid);
+  const domain = getDomainFromDidWeb(subjectDid);
+  if (!domain) {
+    throw new OmaTrustError("INVALID_INPUT", "subjectDid must be a did:web DID", {
+      subjectDid: params.subjectDid
+    });
+  }
+  let dnsReason;
+  try {
+    const dnsResult = await verifyDnsTxtControllerDid2(domain, connectedWalletDid, {
+      resolveTxt: params.resolveTxt,
+      recordPrefix: params.recordPrefix
+    });
+    if (dnsResult.valid) {
+      return {
+        valid: true,
+        method: "dns",
+        details: `Verified via DNS TXT record at ${params.recordPrefix ?? "_controllers"}.${domain}`,
+        subjectDid,
+        connectedWalletDid
+      };
+    }
+    dnsReason = dnsResult.reason;
+  } catch (error) {
+    dnsReason = error instanceof Error ? error.message : "DNS TXT verification failed";
+  }
+  let didDocReason;
+  try {
+    const didDocumentResult = await verifyDidJsonControllerDid(domain, connectedWalletDid, {
+      fetchDidDocument: params.fetchDidDocument
+    });
+    if (didDocumentResult.valid) {
+      return {
+        valid: true,
+        method: "did-document",
+        details: `Verified via DID document at https://${domain}/.well-known/did.json`,
+        subjectDid,
+        connectedWalletDid
+      };
+    }
+    didDocReason = didDocumentResult.reason;
+  } catch (error) {
+    didDocReason = error instanceof Error ? error.message : "DID document verification failed";
+  }
+  return {
+    valid: false,
+    reason: "DID ownership verification failed",
+    details: `DNS check: ${dnsReason ?? "failed"}. DID document check: ${didDocReason ?? "failed"}.`,
+    subjectDid,
+    connectedWalletDid
+  };
+}
+async function verifyDidPkhOwnership(params) {
+  const subjectDid = normalizeSubjectDid(params.subjectDid);
+  const connectedWalletDid = assertConnectedWalletDid(params.connectedWalletDid);
+  if (!isEvmDidPkh(subjectDid)) {
+    throw new OmaTrustError("INVALID_INPUT", "subjectDid must be an EVM did:pkh DID", {
+      subjectDid: params.subjectDid
+    });
+  }
+  const subjectAddress = getAddressFromDidPkh(subjectDid);
+  const connectedWalletAddress = getAddressFromDidPkh(connectedWalletDid);
+  const chainIdRaw = getChainIdFromDidPkh(subjectDid);
+  if (!subjectAddress || !connectedWalletAddress || !chainIdRaw) {
+    throw new OmaTrustError("INVALID_INPUT", "Could not parse did:pkh ownership inputs", {
+      subjectDid: params.subjectDid,
+      connectedWalletDid: params.connectedWalletDid
+    });
+  }
+  const chainId = Number(chainIdRaw);
+  if (!Number.isFinite(chainId)) {
+    throw new OmaTrustError("INVALID_INPUT", "Invalid chain id in subjectDid", {
+      subjectDid: params.subjectDid
+    });
+  }
+  const code = await params.provider.getCode(subjectAddress);
+  const isContract = code !== "0x" && code !== "0x0";
+  if (!isContract) {
+    if (getAddress(subjectAddress) === getAddress(connectedWalletAddress)) {
+      return {
+        valid: true,
+        method: "wallet",
+        details: "Verified direct wallet ownership from matching did:pkh subject and connected wallet",
+        subjectDid,
+        connectedWalletDid
+      };
+    }
+    return {
+      valid: false,
+      reason: "EOA did:pkh subject does not match connected wallet",
+      details: "For direct wallet did:pkh subjects, connectedWalletDid must match the subject DID.",
+      subjectDid,
+      connectedWalletDid
+    };
+  }
+  const controllingWalletDid = await discoverControllingWallet(params.provider, subjectAddress, chainId);
+  if (params.txHash) {
+    if (!controllingWalletDid) {
+      return {
+        valid: false,
+        reason: "Could not discover controlling wallet",
+        details: "Contract does not expose owner/admin/getOwner or a readable EIP-1967 admin slot for transfer verification.",
+        subjectDid,
+        connectedWalletDid
+      };
+    }
+    const tx = await params.provider.getTransaction(params.txHash);
+    if (!tx) {
+      return {
+        valid: false,
+        reason: "Transaction not found",
+        details: `Transaction ${params.txHash} was not found on chain ${chainId}.`,
+        subjectDid,
+        connectedWalletDid,
+        controllingWalletDid
+      };
+    }
+    const receipt = await params.provider.getTransactionReceipt(params.txHash);
+    if (!receipt) {
+      return {
+        valid: false,
+        reason: "Transaction not confirmed",
+        details: "Transaction exists but is not yet confirmed.",
+        subjectDid,
+        connectedWalletDid,
+        controllingWalletDid
+      };
+    }
+    const controllingWalletAddress = getAddressFromDidPkh(controllingWalletDid);
+    if (!tx.from || !controllingWalletAddress || getAddress(tx.from) !== getAddress(controllingWalletAddress)) {
+      return {
+        valid: false,
+        reason: "Wrong sender",
+        details: `Transfer must originate from controlling wallet ${controllingWalletDid}.`,
+        subjectDid,
+        connectedWalletDid,
+        controllingWalletDid
+      };
+    }
+    if (!tx.to || getAddress(tx.to) !== getAddress(connectedWalletAddress)) {
+      return {
+        valid: false,
+        reason: "Wrong recipient",
+        details: `Transfer must be sent to connected wallet ${connectedWalletDid}.`,
+        subjectDid,
+        connectedWalletDid,
+        controllingWalletDid
+      };
+    }
+    const expectedAmount = calculateTransferAmount(
+      subjectDid,
+      connectedWalletDid,
+      chainId,
+      "shared-control"
+    );
+    const actualValue = BigInt(tx.value ?? 0n);
+    if (actualValue !== expectedAmount) {
+      return {
+        valid: false,
+        reason: "Wrong amount",
+        details: `Transfer amount ${actualValue.toString()} does not match expected proof amount ${expectedAmount.toString()}.`,
+        subjectDid,
+        connectedWalletDid,
+        controllingWalletDid
+      };
+    }
+    await params.provider.getBlockNumber();
+    await params.provider.getBlock(receipt.blockNumber);
+    return {
+      valid: true,
+      method: "transfer",
+      details: `Verified via transfer proof ${params.txHash}.`,
+      subjectDid,
+      connectedWalletDid,
+      controllingWalletDid
+    };
+  }
+  for (const pattern of OWNERSHIP_PATTERNS) {
+    const ownerAddress = await readAddressFromContract(
+      params.provider,
+      subjectAddress,
+      pattern.signature,
+      pattern.method
+    );
+    if (ownerAddress && getAddress(ownerAddress) === getAddress(connectedWalletAddress)) {
+      return {
+        valid: true,
+        method: "contract",
+        details: `Verified via ${pattern.method}() ownership check.`,
+        subjectDid,
+        connectedWalletDid,
+        controllingWalletDid: controllingWalletDid ?? void 0
+      };
+    }
+  }
+  try {
+    const adminValue = await params.provider.getStorage(subjectAddress, EIP1967_ADMIN_SLOT);
+    if (adminValue && adminValue !== "0x" && adminValue !== "0x0000000000000000000000000000000000000000000000000000000000000000") {
+      const adminAddress = getAddress(`0x${adminValue.slice(-40)}`);
+      if (adminAddress === getAddress(connectedWalletAddress)) {
+        return {
+          valid: true,
+          method: "contract",
+          details: "Verified via EIP-1967 admin slot.",
+          subjectDid,
+          connectedWalletDid,
+          controllingWalletDid: controllingWalletDid ?? buildEvmDidPkh(chainId, adminAddress)
+        };
+      }
+    }
+  } catch {
+  }
+  if (getAddress(subjectAddress) === getAddress(connectedWalletAddress) && controllingWalletDid) {
+    return {
+      valid: true,
+      method: "minting-wallet",
+      details: `Verified because connected wallet matches the contract DID address. Controlling wallet is ${controllingWalletDid}.`,
+      subjectDid,
+      connectedWalletDid,
+      controllingWalletDid
+    };
+  }
+  return {
+    valid: false,
+    reason: "Contract ownership verification failed",
+    details: controllingWalletDid ? `Connected wallet ${connectedWalletDid} does not match the controlling wallet ${controllingWalletDid} or the subject contract address ${subjectDid}.` : `Could not match connected wallet ${connectedWalletDid} to contract ownership for ${subjectDid}.`,
+    subjectDid,
+    connectedWalletDid,
+    controllingWalletDid: controllingWalletDid ?? void 0
+  };
+}
+async function verifySubjectOwnership(params) {
+  const subjectDid = normalizeSubjectDid(params.subjectDid);
+  const method = extractDidMethod(subjectDid);
+  if (method === "web") {
+    return verifyDidWebOwnership(params);
+  }
+  if (method === "pkh") {
+    const didPkhParams = params;
+    if (!didPkhParams.provider) {
+      throw new OmaTrustError(
+        "INVALID_INPUT",
+        "provider is required for did:pkh ownership verification",
+        { subjectDid }
+      );
+    }
+    return verifyDidPkhOwnership(didPkhParams);
+  }
+  throw new OmaTrustError("INVALID_INPUT", "Unsupported DID type for ownership verification", {
+    subjectDid
+  });
+}
 
 // src/app-registry/index.ts
 var app_registry_exports = {};