Fork of github.com/did-method-plc/did-method-plc

Merge branch 'main' into bnewbold/doc-iteration

+3
.gitignore
···
\#*\#
*~
*.swp
+
+
# Don't ignore this file itself
+
!.gitignore
+18 -17
README.md
···
DID PLC is a self-authenticating [DID](https://www.w3.org/TR/did-core/) which is strongly-consistent, recoverable, and allows for key rotation.
-
An example DID is: `did:plc:yk4dd2qkboz2yv6tpubpc6co`
+
An example DID is: `did:plc:ewvi7nxzyoun6zhxrhs64oiz`
-
Control over a `did:plc` identity rests in a set of re-configurable "rotation" keys pairs. These keys can sign update "operations" to mutate the identity (including key rotations), with each operation referencing a prior version of the identity state by hash. Each identity starts from an initial "genesis" operation, and the hash of this initial object is what defines the DID itself (that is, the DID URI "identifier" string). A central "directory" server collects and validates operations, and maintains a transparent log of operations for each DID.
+
Control over a `did:plc` identity rests in a set of reconfigurable rotation keys pairs. These keys can sign update operations to mutate the identity (including key rotations), with each operation referencing a prior version of the identity state by hash. Each identity starts from an initial genesis operation, and the hash of this initial object is what defines the DID itself (that is, the DID URI identifier string). A central directory server collects and validates operations, and maintains a transparent log of operations for each DID.
+
+
This git repository contains a TypeScript reference implementation of the method (`@did-plc/lib`) and a directory server `@did-plc/server`, both in the `package/` directory. The `go-didplc/`directory is intended to hold a golang implementation.
## Motivation
-
[Bluesky](https://blueskyweb.xyz/) developed DID PLC when designing the [AT Protocol](https://atproto.com) ("atproto") because we were not satisfied with any of the existing DID methods.
-
We wanted a strongly consistent, highly available, recoverable, and cryptographically secure method with fast and cheap propagation of updates.
+
[Bluesky PBC](https://blueskyweb.xyz/) developed DID PLC when designing the [AT Protocol](https://atproto.com) (atproto) because we were not satisfied with any of the existing DID methods. We wanted a strongly consistent, highly available, recoverable, and cryptographically secure method with fast and cheap propagation of updates.
-
We originally titled the method "Placeholder", because we didn't want it to stick around forever in its current form. We are actively hoping to replace it with or evolve it into something less centralized - likely a permissioned DID consortium. That being said, we do intend to support `did:plc` in the current form until after any successor is deployed, with a reasonable grace period. We would also provide a migration route to allow continued use of existing `did:plc` identifiers.
+
We originally titled the method "placeholder", because we didn't want it to stick around forever in its current form. We are actively hoping to replace it with or evolve it into something less centralized - likely a permissioned DID consortium. That being said, we do intend to support `did:plc` in the current form until after any successor is deployed, with a reasonable grace period. We would also provide a migration route to allow continued use of existing `did:plc` identifiers.
## How it works
···
- `alsoKnownAs` (array of strings): priority-ordered list of URIs which indicate other names or aliases associated with the DID identifier
- `services` (map with string keys; values are maps with `type` and `endpoint` string fields): a set of service / URL mappings. the key strings should not include a `#` prefix; that will be added when rendering the DID document.
-
Every update "operation" to the DID identifier, including the initial creation operation ("genesis" operation), contains all of the above information, except for the `did` field. The DID itself is generated from a hash of the signed genesis operation (details described below), which makes the DID entirely self-certifying. Updates after initial creation contain a pointer to the most-recent previous operation (by hash).
+
Every update operation to the DID identifier, including the initial creation operation (the genesis operation), contains all of the above information, except for the `did` field. The DID itself is generated from a hash of the signed genesis operation (details described below), which makes the DID entirely self-certifying. Updates after initial creation contain a pointer to the most-recent previous operation (by hash).
-
"Operations" are signed and submitted to the central PLC directory server over an un-authenticated HTTP request. The PLC server validates operations against any and all existing operations on the DID (including signature validation, recovery time windows, etc), and either rejects the operation or accepts and permanently stores the operation, along with a server-generated timestamp.
+
Operations are signed and submitted to the central PLC directory server over an un-authenticated HTTP request. The PLC server validates operations against any and all existing operations on the DID (including signature validation, recovery time windows, etc), and either rejects the operation or accepts and permanently stores the operation, along with a server-generated timestamp.
-
A special operation type is a "tombstone", which clears all of the data fields and permanently "de-activates" the DID. Note that the usual recovery time window applies to "tombstone" operations.
+
A special operation type is a "tombstone", which clears all of the data fields and permanently deactivates the DID. Note that the usual recovery time window applies to tombstone operations.
-
Note that `rotationKeys` and `verificationMethods` ("signing keys") may have public keys which are re-used across many accounts. There is not necessarily a one-to-one mapping between a DID and either "rotation" keys or "signing" keys.
+
Note that `rotationKeys` and `verificationMethods` (signing keys) may have public keys which are re-used across many accounts. There is not necessarily a one-to-one mapping between a DID and either rotation keys or signing keys.
-
Only `secp256k1` ("k256") and NIST P-256 ("p256") keys are currently supported, for both "rotation" and "signing" keys.
+
Only `secp256k1` ("k256") and NIST P-256 ("p256") keys are currently supported, for both rotation and signing keys.
### Use with AT Protocol
The following information should be included for use with atproto:
-
- `verificationMethods`: an `atproto` entry with a "blessed" public key type, to be used as a "signing key" for authenticating updates to the account's repository. the signing key does not have any control over the DID identity unless also included in the `rotationKeys` list. best practice is to maintain separation between rotation keys and atproto signing keys
-
- `alsoKnownAs`: should include an `at://` URI indicating a "handle" (hostname) for the account. note that the handle/DID mapping needs to be validated bi-directionally (via handle resolution), and needs to be re-verified periodically
+
- `verificationMethods`: an `atproto` entry with a "blessed" public key type, to be used as a signing key for authenticating updates to the account's repository. The signing key does not have any control over the DID identity unless also included in the `rotationKeys` list. Best practice is to maintain separation between rotation keys and atproto signing keys.
+
- `alsoKnownAs`: should include an `at://` URI indicating a handle (hostname) for the account. Note that the handle/DID mapping needs to be validated bi-directionally (via handle resolution), and needs to be re-verified periodically
- `services`: an `atproto_pds` entry with an `AtprotoPersonalDataServer` type and http/https URL `endpoint` indicating the account's current PDS hostname. for example, `https://pds.example.com` (no `/xrpc/` suffix needed).
### Operation Serialization, Signing, and Validation
-
There are a couple variations on the "operation" data object schema. The operations are also serialized both as simple JSON objects, or binary DAG-CBOR encoding for the purpose of hashing or signing.
+
There are a couple variations on the operation data object schema. The operations are also serialized both as simple JSON objects, or binary DAG-CBOR encoding for the purpose of hashing or signing.
A regular creation or update operation contains the following fields:
···
- `verificationMethods` (mapping of string keys and values): as described above
- `alsoKnownAs` (array of strings): as described above
- `services` (mapping of string keys and object values): as described above
-
- `prev` (string, nullable): a "CID" hash pointer to a previous operation if an update, or `null` for a creation. if `null`, the key should actually be part of the object, with value `null`, not simply omitted. in DAG-CBOR encoding, the CID is string-encoded, not a binary IPLD "Link"
+
- `prev` (string, nullable): a CID hash pointer to a previous operation if an update, or `null` for a creation. If `null`, the key should actually be part of the object, with value `null`, not simply omitted. In DAG-CBOR encoding, the CID is string-encoded, not a binary IPLD "Link"
- `sig` (string): signature of the operation in `base64url` encoding
A tombstone operation contains:
···
## Possible Future Changes
-
The set of allowed ("blessed") public key cryptographic algorithms (aka, curves) may expanded over time, slowly. Likewise, support for additional "blessed" CID types and parameters may be expanded over time, slowly.
+
The set of allowed ("blessed") public key cryptographic algorithms (aka, curves) may expanded over time, slowly. Likewise, support for additional blessed CID types and parameters may be expanded over time, slowly.
The recovery time window may become configurable, within constraints, as part of the DID metadata itself.
Support for "DID Controller Delegation" could be useful (eg, in the context of atproto PDS hosts), and may be incorporated.
-
In the context of atproto, support for multiple "handles" for the same DID is being considered, with a single "primary" handle. But no final decision has been made yet.
+
In the context of atproto, support for multiple handles for the same DID is being considered, with a single primary handle. But no final decision has been made yet.
We welcome proposals for small additions to make `did:plc` more generic and reusable for applications other than atproto. But no promises: atproto will remain the focus for the near future.
-
Moving governance of the `did:plc` method, and operation of registry servers, out of the sole control of Bluesky PBLLC is something we are enthusiastic about. Audit log snapshots, mirroring, and automated third-party auditing have all been considered as mechanisms to mitigate the centralized nature of the PLC server.
+
We are enthusiastic about the prospect of moving governance of the `did:plc` method, and operation of registry servers, out of the sole control of Bluesky PBC. Audit log snapshots, mirroring, and automated third-party auditing have all been considered as mechanisms to mitigate the centralized nature of the PLC server.
The size of the `verificationMethods`, `alsoKnownAs`, and `service` mappings/arrays may be specifically constrained. And the maximum DAG-CBOR size may be constrained.
+4
go-didplc/.gitignore
···
+
/webplc
+
/plan.txt
+
!static/.well-known/
+
!.gitignore
+42
go-didplc/Makefile
···
+
+
SHELL = /bin/bash
+
.SHELLFLAGS = -o pipefail -c
+
+
.PHONY: help
+
help: ## Print info about all commands
+
@echo "Commands:"
+
@echo
+
@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf " \033[01;32m%-20s\033[0m %s\n", $$1, $$2}'
+
+
.PHONY: build
+
build: ## Build all executables
+
go build ./cmd/webplc
+
+
.PHONY: test
+
test: ## Run all tests
+
go test ./...
+
+
.PHONY: coverage-html
+
coverage-html: ## Generate test coverage report and open in browser
+
go test ./... -coverpkg=./... -coverprofile=test-coverage.out
+
go tool cover -html=test-coverage.out
+
+
.PHONY: lint
+
lint: ## Verify code style and run static checks
+
go vet ./...
+
test -z $(gofmt -l ./...)
+
+
.PHONY: fmt
+
fmt: ## Run syntax re-formatting (modify in place)
+
go fmt ./...
+
+
.PHONY: check
+
check: ## Compile everything, checking syntax (does not output binaries)
+
go build ./...
+
+
.env:
+
if [ ! -f ".env" ]; then cp example.dev.env .env; fi
+
+
.PHONY: run-dev-webplc
+
run-dev-webplc: .env ## Runs 'bskyweb' for local dev
+
GOLOG_LOG_LEVEL=info go run ./cmd/webplc serve --debug
+23
go-didplc/README.md
···
+
+
`go-didplc`: did:plc in golang
+
==============================
+
+
This golang package will eventually be an implementation of the did:plc specification in golang, including at a minimum verification of DID documents from a PLC operation log.
+
+
For now it primarily contains a basic website for the PLC directory, allowing lookup of individual DID documents.
+
+
+
## Developer Quickstart
+
+
Install golang. We are generally using v1.20+.
+
+
In this directory (`go-didplc/`):
+
+
# re-build and run daemon
+
go run ./cmd/webplc serve
+
+
# build and output a binary
+
go build -o webplc ./cmd/webplc/
+
+
The easiest way to configure the daemon is to copy `example.env` to `.env` and
+
fill in auth values there.
+60
go-didplc/cmd/webplc/main.go
···
+
package main
+
+
import (
+
"os"
+
+
_ "github.com/joho/godotenv/autoload"
+
+
logging "github.com/ipfs/go-log"
+
"github.com/urfave/cli/v2"
+
)
+
+
var log = logging.Logger("webplc")
+
+
func init() {
+
logging.SetAllLoggers(logging.LevelDebug)
+
//logging.SetAllLoggers(logging.LevelWarn)
+
}
+
+
func main() {
+
run(os.Args)
+
}
+
+
func run(args []string) {
+
+
app := cli.App{
+
Name: "webplc",
+
Usage: "web server for bsky.app web app (SPA)",
+
}
+
+
app.Commands = []*cli.Command{
+
&cli.Command{
+
Name: "serve",
+
Usage: "run the web server",
+
Action: serve,
+
Flags: []cli.Flag{
+
&cli.StringFlag{
+
Name: "plc-host",
+
Usage: "method, hostname, and port of PLC instance",
+
Value: "https://plc.directory",
+
EnvVars: []string{"ATP_PLC_HOST"},
+
},
+
&cli.StringFlag{
+
Name: "http-address",
+
Usage: "Specify the local IP/port to bind to",
+
Required: false,
+
Value: ":8700",
+
EnvVars: []string{"HTTP_ADDRESS"},
+
},
+
&cli.BoolFlag{
+
Name: "debug",
+
Usage: "Enable debug mode",
+
Value: false,
+
Required: false,
+
EnvVars: []string{"DEBUG"},
+
},
+
},
+
},
+
}
+
app.RunAndExitOnError()
+
}
+82
go-didplc/cmd/webplc/renderer.go
···
+
package main
+
+
import (
+
"bytes"
+
"embed"
+
"errors"
+
"fmt"
+
"io"
+
"path/filepath"
+
+
"github.com/flosch/pongo2/v6"
+
"github.com/labstack/echo/v4"
+
)
+
+
type RendererLoader struct {
+
prefix string
+
fs *embed.FS
+
}
+
+
func NewRendererLoader(prefix string, fs *embed.FS) pongo2.TemplateLoader {
+
return &RendererLoader{
+
prefix: prefix,
+
fs: fs,
+
}
+
}
+
func (l *RendererLoader) Abs(_, name string) string {
+
// TODO: remove this workaround
+
// Figure out why this method is being called
+
// twice on template names resulting in a failure to resolve
+
// the template name.
+
if filepath.HasPrefix(name, l.prefix) {
+
return name
+
}
+
return filepath.Join(l.prefix, name)
+
}
+
+
func (l *RendererLoader) Get(path string) (io.Reader, error) {
+
b, err := l.fs.ReadFile(path)
+
if err != nil {
+
return nil, fmt.Errorf("reading template %q failed: %w", path, err)
+
}
+
return bytes.NewReader(b), nil
+
}
+
+
type Renderer struct {
+
TemplateSet *pongo2.TemplateSet
+
Debug bool
+
}
+
+
func NewRenderer(prefix string, fs *embed.FS, debug bool) *Renderer {
+
return &Renderer{
+
TemplateSet: pongo2.NewSet(prefix, NewRendererLoader(prefix, fs)),
+
Debug: debug,
+
}
+
}
+
+
func (r Renderer) Render(w io.Writer, name string, data interface{}, c echo.Context) error {
+
var ctx pongo2.Context
+
+
if data != nil {
+
var ok bool
+
ctx, ok = data.(pongo2.Context)
+
if !ok {
+
return errors.New("no pongo2.Context data was passed")
+
}
+
}
+
+
var t *pongo2.Template
+
var err error
+
+
if r.Debug {
+
t, err = pongo2.FromFile(name)
+
} else {
+
t, err = r.TemplateSet.FromFile(name)
+
}
+
+
if err != nil {
+
return err
+
}
+
+
return t.ExecuteWriter(ctx, w)
+
}
+77
go-didplc/cmd/webplc/resolve.go
···
+
package main
+
+
import (
+
"encoding/json"
+
"fmt"
+
"io"
+
"net/http"
+
)
+
+
type VerificationMethod struct {
+
Id string `json:"id"`
+
Type string `json:"type"`
+
Controller string `json:"controller"`
+
PublicKeyMultibase string `json:"publicKeyMultibase"`
+
}
+
+
type DidService struct {
+
Id string `json:"id"`
+
Type string `json:"type"`
+
ServiceEndpoint string `json:"serviceEndpoint"`
+
}
+
+
type DidDoc struct {
+
AlsoKnownAs []string `json:"alsoKnownAs"`
+
VerificationMethod []VerificationMethod `json:"verificationMethod"`
+
Service []DidService `json:"service"`
+
}
+
+
type ResolutionResult struct {
+
Doc *DidDoc
+
DocJson *string
+
StatusCode int
+
}
+
+
func ResolveDidPlc(client *http.Client, plc_host, did string) (*ResolutionResult, error) {
+
result := ResolutionResult{}
+
res, err := client.Get(fmt.Sprintf("%s/%s", plc_host, did))
+
if err != nil {
+
return nil, fmt.Errorf("error making http request: %v", err)
+
}
+
defer res.Body.Close()
+
log.Debugf("PLC resolution result status=%d did=%s", res.StatusCode, did)
+
+
result.StatusCode = res.StatusCode
+
if res.StatusCode == 404 || res.StatusCode == 410 {
+
return &result, nil
+
} else if res.StatusCode != 200 {
+
return &result, nil
+
}
+
+
respBytes, err := io.ReadAll(res.Body)
+
if err != nil {
+
return nil, fmt.Errorf("failed to read PLC result body: %v", err)
+
}
+
+
doc := DidDoc{}
+
err = json.Unmarshal(respBytes, &doc)
+
if err != nil {
+
return nil, fmt.Errorf("failed to parse DID Document JSON: %v", err)
+
}
+
result.Doc = &doc
+
+
// parse and re-serialize JSON in pretty (indent) style
+
var data map[string]interface{}
+
err = json.Unmarshal(respBytes, &data)
+
if err != nil {
+
return nil, fmt.Errorf("failed to parse DID Document JSON: %v", err)
+
}
+
indentJson, err := json.MarshalIndent(data, "", " ")
+
if err != nil {
+
return nil, fmt.Errorf("failed to parse DID Document JSON: %v", err)
+
}
+
s := string(indentJson)
+
result.DocJson = &s
+
+
return &result, nil
+
}
+274
go-didplc/cmd/webplc/server.go
···
+
package main
+
+
import (
+
"context"
+
"embed"
+
"errors"
+
"fmt"
+
"io/fs"
+
"net/http"
+
"os"
+
"os/signal"
+
"strings"
+
"syscall"
+
"time"
+
+
"github.com/flosch/pongo2/v6"
+
"github.com/klauspost/compress/gzhttp"
+
"github.com/klauspost/compress/gzip"
+
"github.com/labstack/echo/v4"
+
"github.com/labstack/echo/v4/middleware"
+
"github.com/russross/blackfriday/v2"
+
"github.com/urfave/cli/v2"
+
)
+
+
//go:embed templates/*
+
var TemplateFS embed.FS
+
+
//go:embed static/*
+
var StaticFS embed.FS
+
+
//go:embed spec/v0.1/did-plc.md
+
var specZeroOneMarkdown []byte
+
+
//go:embed spec/plc-server-openapi3.yaml
+
var apiOpenapiYaml []byte
+
+
type Server struct {
+
echo *echo.Echo
+
httpd *http.Server
+
client *http.Client
+
plcHost string
+
}
+
+
func serve(cctx *cli.Context) error {
+
debug := cctx.Bool("debug")
+
httpAddress := cctx.String("http-address")
+
+
// Echo
+
e := echo.New()
+
+
// create a new session (no auth)
+
client := http.Client{
+
Transport: &http.Transport{
+
Proxy: http.ProxyFromEnvironment,
+
ForceAttemptHTTP2: true,
+
MaxIdleConns: 100,
+
IdleConnTimeout: 90 * time.Second,
+
TLSHandshakeTimeout: 10 * time.Second,
+
ExpectContinueTimeout: 1 * time.Second,
+
},
+
}
+
+
// httpd variable
+
var (
+
httpTimeout = 2 * time.Minute
+
httpMaxHeaderBytes = 2 * (1024 * 1024)
+
gzipMinSizeBytes = 1024 * 2
+
gzipCompressionLevel = gzip.BestSpeed
+
gzipExceptMIMETypes = []string{"image/png"}
+
)
+
+
// Wrap the server handler in a gzip handler to compress larger responses.
+
gzipHandler, err := gzhttp.NewWrapper(
+
gzhttp.MinSize(gzipMinSizeBytes),
+
gzhttp.CompressionLevel(gzipCompressionLevel),
+
gzhttp.ExceptContentTypes(gzipExceptMIMETypes),
+
)
+
if err != nil {
+
return err
+
}
+
+
server := &Server{
+
echo: e,
+
client: &client,
+
plcHost: cctx.String("plc-host"),
+
}
+
+
server.httpd = &http.Server{
+
Handler: gzipHandler(server),
+
Addr: httpAddress,
+
WriteTimeout: httpTimeout,
+
ReadTimeout: httpTimeout,
+
MaxHeaderBytes: httpMaxHeaderBytes,
+
}
+
+
e.HideBanner = true
+
// SECURITY: Do not modify without due consideration.
+
e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
+
ContentTypeNosniff: "nosniff",
+
XFrameOptions: "SAMEORIGIN",
+
HSTSMaxAge: 31536000, // 365 days
+
// TODO:
+
// ContentSecurityPolicy
+
// XSSProtection
+
}))
+
e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
+
// Don't log requests for static content.
+
Skipper: func(c echo.Context) bool {
+
return strings.HasPrefix(c.Request().URL.Path, "/static")
+
},
+
}))
+
e.Renderer = NewRenderer("templates/", &TemplateFS, debug)
+
e.HTTPErrorHandler = server.errorHandler
+
+
// redirect trailing slash to non-trailing slash.
+
// all of our current endpoints have no trailing slash.
+
e.Use(middleware.RemoveTrailingSlashWithConfig(middleware.TrailingSlashConfig{
+
RedirectCode: http.StatusFound,
+
}))
+
+
staticHandler := http.FileServer(func() http.FileSystem {
+
if debug {
+
log.Debugf("serving static file from the local file system")
+
return http.FS(os.DirFS("static"))
+
}
+
fsys, err := fs.Sub(StaticFS, "static")
+
if err != nil {
+
log.Fatal(err)
+
}
+
return http.FS(fsys)
+
}())
+
+
// static file routes
+
e.GET("/robots.txt", echo.WrapHandler(staticHandler))
+
e.GET("/favicon.ico", echo.WrapHandler(staticHandler))
+
e.GET("/static/*", echo.WrapHandler(http.StripPrefix("/static/", staticHandler)))
+
e.GET("/.well-known/*", echo.WrapHandler(staticHandler))
+
e.GET("/security.txt", func(c echo.Context) error {
+
return c.Redirect(http.StatusMovedPermanently, "/.well-known/security.txt")
+
})
+
+
// meta stuff
+
e.GET("/_health", server.WebHealth)
+
e.GET("/healthz", server.WebHealth)
+
+
// actual pages/views
+
e.GET("/", server.WebHome)
+
e.GET("/resolve", server.WebResolve)
+
e.GET("/did/:did", server.WebDid)
+
e.GET("/spec/v0.1/did-plc", server.WebSpecZeroOne)
+
e.GET("/api/redoc", server.WebRedoc)
+
e.GET("/api/plc-server-openapi3.yaml", server.WebOpenapiYaml)
+
+
// Start the server.
+
log.Infof("starting server address=%s", httpAddress)
+
go func() {
+
if err := server.httpd.ListenAndServe(); err != nil {
+
if !errors.Is(err, http.ErrServerClosed) {
+
log.Errorf("HTTP server shutting down unexpectedly: %s", err)
+
}
+
}
+
}()
+
+
// Wait for a signal to exit.
+
log.Info("registering OS exit signal handler")
+
quit := make(chan struct{})
+
exitSignals := make(chan os.Signal, 1)
+
signal.Notify(exitSignals, syscall.SIGINT, syscall.SIGTERM)
+
go func() {
+
sig := <-exitSignals
+
log.Infof("received OS exit signal: %s", sig)
+
+
// Shut down the HTTP server.
+
if err := server.Shutdown(); err != nil {
+
log.Errorf("HTTP server shutdown error: %s", err)
+
}
+
+
// Trigger the return that causes an exit.
+
close(quit)
+
}()
+
<-quit
+
log.Infof("graceful shutdown complete")
+
return nil
+
}
+
+
func (srv *Server) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+
srv.echo.ServeHTTP(rw, req)
+
}
+
+
func (srv *Server) Shutdown() error {
+
log.Info("shutting down")
+
+
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+
defer cancel()
+
+
return srv.httpd.Shutdown(ctx)
+
}
+
+
func (srv *Server) errorHandler(err error, c echo.Context) {
+
code := http.StatusInternalServerError
+
errorMessage := ""
+
if he, ok := err.(*echo.HTTPError); ok {
+
code = he.Code
+
if he.Message != nil {
+
errorMessage = fmt.Sprintf("%s", he.Message)
+
}
+
}
+
c.Logger().Error(err)
+
data := pongo2.Context{
+
"statusCode": code,
+
"errorMessage": errorMessage,
+
}
+
if err = c.Render(code, "templates/error.html", data); err != nil {
+
c.Logger().Error(err)
+
}
+
}
+
+
func (srv *Server) WebHome(c echo.Context) error {
+
data := pongo2.Context{}
+
return c.Render(http.StatusOK, "templates/home.html", data)
+
}
+
+
func (srv *Server) WebSpecZeroOne(c echo.Context) error {
+
data := pongo2.Context{}
+
data["html_title"] = "did:plc Specification v0.1"
+
data["markdown_html"] = string(blackfriday.Run(specZeroOneMarkdown))
+
return c.Render(http.StatusOK, "templates/markdown.html", data)
+
}
+
+
func (srv *Server) WebHealth(c echo.Context) error {
+
resp := map[string]interface{}{
+
"status": "ok",
+
}
+
return c.JSON(http.StatusOK, resp)
+
}
+
+
func (srv *Server) WebOpenapiYaml(c echo.Context) error {
+
return c.Blob(http.StatusOK, "text/yaml", apiOpenapiYaml)
+
}
+
+
func (srv *Server) WebRedoc(c echo.Context) error {
+
data := pongo2.Context{}
+
return c.Render(http.StatusOK, "templates/redoc.html", data)
+
}
+
+
func (srv *Server) WebResolve(c echo.Context) error {
+
data := pongo2.Context{}
+
did := c.QueryParam("did")
+
if did != "" {
+
return c.Redirect(http.StatusMovedPermanently, "/did/"+did)
+
}
+
return c.Render(http.StatusOK, "templates/resolve.html", data)
+
}
+
+
func (srv *Server) WebDid(c echo.Context) error {
+
data := pongo2.Context{}
+
did := c.Param("did")
+
data["did"] = did
+
if !strings.HasPrefix(did, "did:plc:") {
+
return echo.NewHTTPError(http.StatusBadRequest, fmt.Errorf("Not a valid DID PLC identifier: %s", did))
+
}
+
res, err := ResolveDidPlc(srv.client, srv.plcHost, did)
+
if err != nil {
+
return err
+
}
+
if res.StatusCode == 404 {
+
return echo.NewHTTPError(http.StatusNotFound, fmt.Errorf("DID not in PLC directory: %s", did))
+
}
+
if res.StatusCode == 410 {
+
return echo.NewHTTPError(http.StatusNotFound, fmt.Errorf("DID has been permanently deleted: %s", did))
+
}
+
data["result"] = res
+
return c.Render(http.StatusOK, "templates/did.html", data)
+
}
+458
go-didplc/cmd/webplc/spec/plc-server-openapi3.yaml
···
+
openapi: 3.0.0
+
info:
+
title: "did:plc Directory Server API"
+
version: 0.1
+
contact:
+
name: "Protocol Team at Bluesky"
+
email: "protocol@blueskyweb.xyz"
+
url: "https://web.plc.directory"
+
description: |
+
DID PLC is a self-authenticating [DID](https://www.w3.org/TR/did-core/) which is strongly-consistent, recoverable, and allows for key rotation.
+
+
The central directory server receives and persists self-signed operation logs for each DID, starting with a "genesis operation" which defined the DID identifier itself. This document describes the HTTP API for interacting with the directory server to resolve DID Document, fetch audit logs, and submit signed operations.
+
+
The HTTP API is permissionless, but only valid (correctly signed) operations are accepted. Reasonable rate-limits are applied, but they should not interfer with account recovery in most situations.
+
servers:
+
- url: https://plc.directory
+
+
paths:
+
/{did}:
+
get:
+
description: "Resolve DID Document for the indicated DID"
+
operationId: ResolveDid
+
parameters:
+
- name: did
+
in: path
+
required: true
+
schema:
+
type: string
+
responses:
+
'200':
+
description: "Success, returned DID Document"
+
content:
+
application/did+ld+json:
+
schema:
+
$ref: '#/components/schemas/DidDocument'
+
'404':
+
$ref: '#/components/responses/404DidNotFound'
+
'410':
+
$ref: '#/components/responses/410DidNotAvailable'
+
x-codeSamples:
+
- lang: Shell
+
label: curl
+
source: |
+
curl -s https://plc.directory/did:plc:pyc2ihzpelxtg4cdkfzbhcv4 | jq .
+
- lang: Python
+
label: Python
+
source: |
+
import requests
+
+
did = "did:plc:pyc2ihzpelxtg4cdkfzbhcv4"
+
resp = requests.get(f"https://plc.directory/{did}")
+
resp.raise_for_status()
+
print(resp.json())
+
post:
+
description: "Create new PLC Operation for the indicated DID"
+
operationId: CreatePlcOp
+
parameters:
+
- name: did
+
in: path
+
required: true
+
schema:
+
type: string
+
requestBody:
+
required: true
+
content:
+
application/json:
+
schema:
+
$ref: '#/components/schemas/Operation'
+
responses:
+
'200':
+
description: "Success, operation validated and persisted"
+
# TODO: what is returned here?
+
'400':
+
$ref: '#/components/responses/400BadOperation'
+
'404':
+
$ref: '#/components/responses/404DidNotFound'
+
'410':
+
$ref: '#/components/responses/410DidNotAvailable'
+
/{did}/log:
+
get:
+
description: "Get Current PLC Operation Chain"
+
operationId: GetPlcOpLog
+
parameters:
+
- name: did
+
in: path
+
required: true
+
schema:
+
type: string
+
responses:
+
'200':
+
description: "Success, retured operation log"
+
content:
+
application/json:
+
schema:
+
type: array
+
items:
+
$ref: '#/components/schemas/Operation'
+
'404':
+
$ref: '#/components/responses/404DidNotFound'
+
/{did}/log/audit:
+
get:
+
description: "Get PLC Operation Audit Log"
+
operationId: GetPlcAuditLog
+
parameters:
+
- name: did
+
in: path
+
required: true
+
schema:
+
type: string
+
responses:
+
'200':
+
description: "Success, retured audit log"
+
content:
+
application/json:
+
schema:
+
type: array
+
items:
+
$ref: '#/components/schemas/LogEntry'
+
'404':
+
$ref: '#/components/responses/404DidNotFound'
+
/{did}/log/last:
+
get:
+
description: "Get Latest PLC Operation"
+
operationId: GetLastOp
+
parameters:
+
- name: did
+
in: path
+
required: true
+
schema:
+
type: string
+
responses:
+
'200':
+
description: "Success, returned latest operation"
+
content:
+
application/json:
+
schema:
+
$ref: '#/components/schemas/LogEntry'
+
'404':
+
$ref: '#/components/responses/404DidNotFound'
+
/{did}/data:
+
get:
+
description: "Get Current PLC Data for the indicated DID"
+
operationId: GetPlcData
+
parameters:
+
- name: did
+
in: path
+
required: true
+
schema:
+
type: string
+
responses:
+
'200':
+
description: "Success, retured current PLC data"
+
# TODO: basically just an op, but missing some fields? sigh.
+
'404':
+
$ref: '#/components/responses/404DidNotFound'
+
'410':
+
$ref: '#/components/responses/410DidNotAvailable'
+
/export:
+
get:
+
description: "Bulk fetch PLC Operations for all DIDs, with pagination, in JSON Lines format"
+
operationId: Export
+
parameters:
+
- name: count
+
in: query
+
schema:
+
type: integer
+
default: 10
+
maximum: 1000
+
- name: after
+
in: query
+
schema:
+
type: string
+
format: date-time
+
description: "Return only operations after this indexed timestamp"
+
responses:
+
'200':
+
description: "Success, returned batch of operations"
+
content:
+
application/jsonlines:
+
description: "Newline-delimited JSON file, with a separate JSON object on each line"
+
schema:
+
$ref: '#/components/schemas/LogEntry'
+
'400':
+
$ref: '#/components/responses/400BadRequest'
+
+
components:
+
responses:
+
404DidNotFound:
+
description: "DID Not Found"
+
content:
+
application/json:
+
schema:
+
type: object
+
properties:
+
message:
+
type: string
+
example:
+
message: "DID not registered: did:plc:ewvi7nxzyoun6zhxrhs64oiz"
+
410DidNotAvailable:
+
description: "DID Not Available (Tombstone)"
+
content:
+
application/json:
+
schema:
+
type: object
+
properties:
+
message:
+
type: string
+
example:
+
message: "DID not available: did:plc:ewvi7nxzyoun6zhxrhs64oiz"
+
400BadOperation:
+
description: "Invalid PLC Operation"
+
content:
+
application/json:
+
schema:
+
type: object
+
properties:
+
message:
+
type: string
+
example:
+
message: "Invalid Signature"
+
400BadRequest:
+
description: "Bad Request"
+
content:
+
application/json:
+
schema:
+
type: object
+
properties:
+
message:
+
type: string
+
example:
+
message: "Invalid Query Parameter"
+
schemas:
+
Operation:
+
oneOf:
+
- $ref: '#/components/schemas/PlcOp'
+
- $ref: '#/components/schemas/TombstoneOp'
+
- $ref: '#/components/schemas/LegacyCreateOp'
+
discriminator:
+
propertyName: type
+
mapping:
+
plc_operation: '#/components/schemas/PlcOp'
+
plc_tombstone: '#/components/schemas/TombstoneOp'
+
create: '#/components/schemas/LegacyCreateOp'
+
PlcOp:
+
type: object
+
description: "Regular PLC operation. Can be a genesis operation (create DID, no 'prev' field), or a data update."
+
required:
+
- type
+
- rotationKeys
+
- verificationMethods
+
- alsoKnownAs
+
- services
+
- prev
+
- sig
+
properties:
+
type:
+
type: string
+
rotationKeys:
+
type: array
+
items:
+
type: string
+
description: "Ordered set (no duplicates) of cryptographic public keys in did:key format"
+
verificationMethods:
+
type: object
+
description: "Map (object) of application-specific cryptographic public keys in did:key format"
+
alsoKnownAs:
+
type: array
+
items:
+
type: string
+
description: "Ordered set (no duplicates) of aliases and names for this account, in the form of URIs"
+
services:
+
type: object
+
description: "Map (object) of application-specific service endpoints for this account"
+
prev:
+
type: string
+
nullable: true
+
description: "Strong reference (hash) of preceeding operation for this DID, in string CID format. Null for genesis operation"
+
sig:
+
type: string
+
description: "Cryptographic signature of this object, with base64 string encoding"
+
example:
+
type: "plc_operation"
+
services:
+
atproto_pds:
+
type: "AtprotoPersonalDataServer"
+
endpoint: "https://bsky.social"
+
alsoKnownAs:
+
- "at://atproto.com"
+
rotationKeys:
+
- "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg"
+
- "did:key:zQ3shpKnbdPx3g3CmPf5cRVTPe1HtSwVn5ish3wSnDPQCbLJK"
+
verificationMethods:
+
atproto: "did:key:zQ3shXjHeiBuRCKmM36cuYnm7YEMzhGnCmCyW92sRJ9pribSF"
+
+
TombstoneOp:
+
type: object
+
description: "Special operation which deactives (revokes) the DID. This is permanent once the recovery window expires."
+
required:
+
- type
+
- prev
+
- sig
+
properties:
+
type:
+
type: string
+
prev:
+
type: string
+
description: "Strong reference (hash) of preceeding operation for this DID, in string CID format"
+
sig:
+
type: string
+
description: "Cryptographic signature of this object, with base64 string encoding"
+
example:
+
type: "plc_tombstone"
+
prev: "bafyreid6awsb6lzc54zxaq2roijyvpbjp5d6mii2xyztn55yli7htyjgqy"
+
sig: "41iJmrPRUTIi24HBduzgoavjOibAx2yFJ2p1d7zTN6ZmMgjSaTF8dJf0HtdU4EBNUBTWq33PZyh5tyb1bJq3Fw"
+
+
LegacyCreateOp:
+
type: object
+
description: "Obsolete PLC genesis operations, which must still be supported to ensure all did:plc identifiers can be resolved correctly."
+
required:
+
- type
+
- signingKey
+
- recoveryKey
+
- handle
+
- service
+
- prev
+
- sig
+
properties:
+
type:
+
type: string
+
signingKey:
+
type: string
+
description: "atproto cryptographic public key in did:key format"
+
recoveryKey:
+
type: string
+
description: "PLC recovery cryptographic public key in did:key format"
+
handle:
+
type: string
+
description: "atproto handle as AT-URI (at://)"
+
service:
+
type: string
+
description: "atproto_pds service endpoint URL"
+
prev:
+
type: string
+
nullable: true
+
description: "Strong reference (hash) of preceeding operation for this DID, in string CID format"
+
sig:
+
type: string
+
description: "Cryptographic signature of this object, with base64 string encoding"
+
example:
+
type: "create"
+
signingKey: "did:key:zQ3shP5TBe1sQfSttXty15FAEHV1DZgcxRZNxvEWnPfLFwLxJ"
+
recoveryKey: "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg"
+
handle: "first-post.bsky.social"
+
service: "https://bsky.social"
+
prev: null
+
sig: "yvN4nQYWTZTDl9nKSSyC5EC3nsF5g4S56OmRg9G6_-pM6FCItV2U2u14riiMGyHiCD86l6O-1xC5MPwf8vVsRw"
+
+
LogEntry:
+
type: object
+
required:
+
- did
+
- operation
+
- cid
+
- nullified
+
- createdAt
+
properties:
+
did:
+
type: string
+
description: "DID that this operation applies to"
+
operation:
+
$ref: "#/components/schemas/Operation"
+
cid:
+
type: cid
+
description: "Hash of the operation, in string CID format"
+
nullified:
+
type: bool
+
description: "Whether this operation is included in the current operation chain, or has been overridden"
+
createdAt:
+
type: string
+
format: date-time
+
description: "Timestamp when this operation was received by the directory server"
+
example:
+
did: "did:plc:ewvi7nxzyoun6zhxrhs64oiz"
+
operation:
+
sig: "lza4at_jCtGo_TYgL5PC1ZNP7lhF4DV8H50LWHhvdHcB143x1wEwqZ43xvV36Pws6OOnJLJrkibEUFDFqkhIhg"
+
prev: null
+
type: "plc_operation"
+
services:
+
atproto_pds:
+
type: "AtprotoPersonalDataServer"
+
endpoint: "https://bsky.social"
+
alsoKnownAs:
+
- "at://atprotocol.bsky.social"
+
rotationKeys:
+
- "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg"
+
- "did:key:zQ3shpKnbdPx3g3CmPf5cRVTPe1HtSwVn5ish3wSnDPQCbLJK"
+
verificationMethods:
+
atproto: "did:key:zQ3shXjHeiBuRCKmM36cuYnm7YEMzhGnCmCyW92sRJ9pribSF"
+
cid: "bafyreibfvkh3n6odvdpwj54j4xxdsgnn4zo5utbyf7z7nfbyikhtygzjcq"
+
nullified: false
+
createdAt: "2023-04-26T06:19:25.508Z"
+
+
DidDocument:
+
type: object
+
required:
+
- id
+
properties:
+
id:
+
type: string
+
example: "did:plc:ewvi7nxzyoun6zhxrhs64oiz"
+
alsoKnownAs:
+
type: array
+
description: "Ordered set (no duplicates) of aliases and names for this account, in the form of URIs"
+
items:
+
type: string
+
example: "at://atproto.com"
+
verificationMethods:
+
type: array
+
items:
+
type: object
+
required:
+
- id
+
- type
+
- controller
+
- publicKeyMultibase
+
properties:
+
id:
+
type: string
+
type:
+
type: string
+
controller:
+
type: string
+
publicKeyMultibase:
+
type: string
+
example:
+
id: "#atproto"
+
type: "EcdsaSecp256k1VerificationKey2019"
+
controller: "did:plc:ewvi7nxzyoun6zhxrhs64oiz"
+
publicKeyMultibase: "zQYEBzXeuTM9UR3rfvNag6L3RNAs5pQZyYPsomTsgQhsxLdEgCrPTLgFna8yqCnxPpNT7DBk6Ym3dgPKNu86vt9GR"
+
service:
+
type: array
+
items:
+
type: object
+
required:
+
- id
+
- type
+
- serviceEndpoint
+
properties:
+
id:
+
type: string
+
type:
+
type: string
+
serviceEndpoint:
+
type: string
+
example:
+
id: "#atproto_pds"
+
type: "AtprotoPersonalDataServer"
+
serviceEndpoint: "https://bsky.social"
+392
go-didplc/cmd/webplc/spec/v0.1/did-plc.md
···
+
+
# `did:plc` Method Specification
+
+
**Version:** v0.1 (May 2023)
+
+
DID PLC is a self-authenticating [DID](https://www.w3.org/TR/did-core/) which is strongly-consistent, recoverable, and allows for key rotation.
+
+
An example DID is: `did:plc:ewvi7nxzyoun6zhxrhs64oiz`
+
+
Control over a `did:plc` identity rests in a set of reconfigurable rotation keys pairs. These keys can sign update operations to mutate the identity (including key rotations), with each operation referencing a prior version of the identity state by hash. Each identity starts from an initial genesis operation, and the hash of this initial object is what defines the DID itself (that is, the DID URI identifier string). A central directory server collects and validates operations, and maintains a transparent log of operations for each DID.
+
+
## How it works
+
+
The core data fields associated with an active `did:plc` identifier at any point in time are listed below. The encoding and structure differs somewhat from DID document formatting and semantics, but this information is sufficient to render a valid DID document.
+
+
- `did` (string): the full DID identifier
+
- `rotationKeys` (array of strings): priority-ordered list of public keys in `did:key` encoding. must include least 1 key and at most 5 keys, with no duplication. control of the DID identifier rests in these keys. not included in DID document.
+
- `verificationMethods` (map with string keys and values): a set service / public key mappings. the values are public keys `did:key` encoding; they get re-encoded in "multibase" form when rendered in DID document. the key strings should not include a `#` prefix; that will be added when rendering the DID document. used to generate `verificationMethods` of DID document. these keys do not have control over the DID document
+
- `alsoKnownAs` (array of strings): priority-ordered list of URIs which indicate other names or aliases associated with the DID identifier
+
- `services` (map with string keys; values are maps with `type` and `endpoint` string fields): a set of service / URL mappings. the key strings should not include a `#` prefix; that will be added when rendering the DID document.
+
+
Every update operation to the DID identifier, including the initial creation operation (the genesis operation), contains all of the above information, except for the `did` field. The DID itself is generated from a hash of the signed genesis operation (details described below), which makes the DID entirely self-certifying. Updates after initial creation contain a pointer to the most-recent previous operation (by hash).
+
+
Operations are signed and submitted to the central PLC directory server over an un-authenticated HTTP request. The PLC server validates operations against any and all existing operations on the DID (including signature validation, recovery time windows, etc), and either rejects the operation or accepts and permanently stores the operation, along with a server-generated timestamp.
+
+
A special operation type is a "tombstone", which clears all of the data fields and permanently deactivates the DID. Note that the usual recovery time window applies to tombstone operations.
+
+
Note that `rotationKeys` and `verificationMethods` (signing keys) may have public keys which are re-used across many accounts. There is not necessarily a one-to-one mapping between a DID and either rotation keys or signing keys.
+
+
Only `secp256k1` ("k256") and NIST P-256 ("p256") keys are currently supported, for both rotation and signing keys.
+
+
### Use with AT Protocol
+
+
The following information should be included for use with atproto:
+
+
- `verificationMethods`: an `atproto` entry with a "blessed" public key type, to be used as a signing key for authenticating updates to the account's repository. The signing key does not have any control over the DID identity unless also included in the `rotationKeys` list. Best practice is to maintain separation between rotation keys and atproto signing keys.
+
- `alsoKnownAs`: should include an `at://` URI indicating a handle (hostname) for the account. Note that the handle/DID mapping needs to be validated bi-directionally (via handle resolution), and needs to be re-verified periodically
+
- `services`: an `atproto_pds` entry with an `AtprotoPersonalDataServer` type and http/https URL `endpoint` indicating the account's current PDS hostname. for example, `https://pds.example.com` (no `/xrpc/` suffix needed).
+
+
### Operation Serialization, Signing, and Validation
+
+
There are a couple variations on the operation data object schema. The operations are also serialized both as simple JSON objects, or binary DAG-CBOR encoding for the purpose of hashing or signing.
+
+
A regular creation or update operation contains the following fields:
+
+
- `type` (string): with fixed value `plc_operation`
+
- `rotationKeys` (array of strings): as described above
+
- `verificationMethods` (mapping of string keys and values): as described above
+
- `alsoKnownAs` (array of strings): as described above
+
- `services` (mapping of string keys and object values): as described above
+
- `prev` (string, nullable): a CID hash pointer to a previous operation if an update, or `null` for a creation. If `null`, the key should actually be part of the object, with value `null`, not simply omitted. In DAG-CBOR encoding, the CID is string-encoded, not a binary IPLD "Link"
+
- `sig` (string): signature of the operation in `base64url` encoding
+
+
A tombstone operation contains:
+
+
- `type` (string): with fixed value `plc_tombstone`
+
- `prev` (string): same as above, but not nullable
+
- `sig` (string): signature of the operation (same as above)
+
+
There is also a deprecated legacy operation format, supported *only* for creation ("genesis") operations:
+
+
- `type` (string): with fixed value `create`
+
- `signingKey` (string): single `did:key` value (not an array of strings)
+
- `recoveryKey` (string): single `did:key` value (not an array of strings); and note "recovery" terminology, not "rotation"
+
- `handle` (string): single value, indicating atproto handle, instead of `alsoKnownAs`. bare handle, with no `at://` prefix
+
- `service` (string): single value, http/https URL of atproto PDS
+
- `prev` (null): always include, but always with value `null`
+
- `sig` (string): signature of the operation (same as above)
+
+
Legacy `create` operations are stored in the PLC registry and may be returned in responses, so validating software needs to support that format. Conversion of the legacy format to "regular" operation format is relatively straight-forward, but there exist many `did:plc` identifiers where the DID identifier itself is based on the hash of the old format, so they will unfortunately be around forever.
+
+
The process for signing and hashing operation objects is to first encode them in the DAG-CBOR binary serialization format. [DAG-CBOR](https://ipld.io/specs/codecs/dag-cbor/spec/) is a restricted subset of the Concise Binary Object Representation (CBOR), an IETF standard (RFC 8949), with semantics and value types similar to JSON.
+
+
As an anti-abuse mechanism, operations have a maximum size when encoded as DAG-CBOR. The current limit is 7500 bytes.
+
+
For signatures, the object is first encoded as DAG-CBOR *without* the `sig` field at all (as opposed to a `null` value in that field). Those bytes are signed, and then the signature bytes are encoded as a string using `base64url` encoding. The `sig` value is then populated with the string. In strongly typed programming languages it is a best practice to have distinct "signed" and "unsigned" types.
+
+
When working with signatures, note that ECDSA signatures are not necessarily *deterministic* or *unique*. That is, the same key signing the same bytes *might* generate the same signature every time, or it might generate a *different* signature every time, depending on the cryptographic library and configuration. In some cases it is also easy for a third party to take a valid signature and transform it in to a new, distinct signature, which also validates. Be sure to always use the "validate signature" routine from a cryptographic library, instead of re-signing bytes and directly comparing the signature bytes.
+
+
For `prev` references, the SHA-256 of the previous operation's bytes are encoded as a "[CID](https://github.com/multiformats/cid)", with the following parameters:
+
+
- CIDv1
+
- `base32` multibase encoding (prefix: `b`)
+
- `dag-cbor` multibase type (code: 0x71)
+
- `sha-256` multihash (code: 0x12)
+
+
Rotation keys are serialized as strings using [did:key](https://w3c-ccg.github.io/did-method-key/), and only `secp256k1` ("k256") and NIST P-256 ("p256") are currently supported.
+
+
The signing keys (`verificationMethods`) are also serialized using `did:key` in operations. When rendered in a DID document, signing keys are represented as objects, with the actual keys in multibase encoding, as required by the DID Core specification.
+
+
The DID itself is derived from the hash of the first operation in the log, called the "genesis" operation. The signed operation is encoded in DAG-CBOR; the bytes are hashed with SHA-256; the hash bytes are `base32`-encoded (not hex encoded) as a string; and that string is truncated to 24 chars to yield the "identifier" segment of the DID.
+
+
In pseudo-code:
+
`did:plc:${base32Encode(sha256(createOp)).slice(0,24)}`
+
+
### Identifier Syntax
+
+
The DID PLC method name is `plc`. The identifier part is 24 characters long, including only characters from the `base32` encoding set. An example is `did:plc:yk4dd2qkboz2yv6tpubpc6co`. This means:
+
+
- the overall identifier length is 32 characters
+
- the entire identifier is lower-case (and should be normalized to lower-case)
+
- the entire identifier is ASCII, and includes only the characters `a-z`, `0-9`, and `:` (and does not even use digits `0189`)
+
+
+
### Key Rotation & Account Recovery
+
+
Any key specified in `rotationKeys` has the ability to sign operations for the DID document.
+
+
The set of rotation keys for a DID is not included in the DID document. They are an internal detail of PLC, and are stored in the operation log.
+
+
Keys are listed in the `rotationKeys` field of operations in order of descending authority.
+
+
The PLC server provides a 72hr window during which a higher authority rotation key can "rewrite" history, clobbering any operations (or chain of operations) signed by a lower-authority rotation key.
+
+
To do so, that key must sign a new operation that points to the CID of the last "valid" operation - ie the fork point.
+
The PLC server will accept this recovery operation as long as:
+
+
- it is submitted within 72hrs of the referenced operation
+
- the key used for the signature has a lower index in the `rotationKeys` array than the key that signed the to-be-invalidated operation
+
+
+
### Privacy and Security Concerns
+
+
The full history of DID operations and updates, including timestamps, is permanently publicly accessible. This is true even after DID deactivation. It is important to recognize (and communicate to account holders) that any personally identifiable information (PII) encoded in `alsoKnownAs` URIs will be publicly visible even after DID deactivation, and can not be redacted or purged.
+
+
In the context of atproto, this includes the full history of handle updates and PDS locations (URLs) over time. To be explicit, it does not include any other account metadata such as email addresses or IP addresses. Handle history could potentially de-anonymize account holders if they switch handles between a known identity and an anonymous or pseudonymous identity.
+
+
The PLC server does not cross-validate `alsoKnownAs` or `service` entries in operations. This means that any DID can "claim" to have any identity, or to have an active account with any service (identified by URL). This data should *not* be trusted without bi-directionally verification, for example using handle resolution.
+
+
The timestamp metadata encoded in the PLC audit log could be cross-verified against network traffic or other information to de-anonymize account holders. It also makes the "identity creation date" public.
+
+
If "rotation" and "signing" keys are re-used across multiple account, it could reveal non-public identity details or relationships. For example, if two individuals cross-share rotation keys as a trusted backup, that information is public. If device-local recovery or signing keys are uniquely shared by two identifiers, that would indicate that those identities may actually be the same person.
+
+
+
#### PLC Server Trust Model
+
+
The PLC server has a public endpoint to receive operation objects from any client (without authentication). The server verifies operations, orders them according to recovery rules, and makes the log of operations publicly available.
+
+
The operation log is self-certifying, and contains all the information needed to construct (or verify) the the current state of the DID document.
+
+
Some trust is required in the PLC server. Its attacks are limited to:
+
+
- Denial of service: rejecting valid operations, or refusing to serve some information about the DID
+
- Misordering: In the event of a fork in DID document history, the server could choose to serve the "wrong" fork
+
+
+
### DID Creation
+
+
To summarize the process of creating a new `did:plc` identifier:
+
+
- collect values for all of the core data fields, including generating new secure key pairs if necessary
+
- construct an "unsigned" regular operation object. include a `prev` field with `null` value. do not use the deprecated/legacy operation format for new DID creations
+
- serialize the "unsigned" operation with DAG-CBOR, and sign the resulting bytes with one of the initial `rotationKeys`. encode the signature as `base64url`, and use that to construct a "signed" operation object
+
- serialize the "signed" operation with DAG-CBOR, take the SHA-256 hash of those bytes, and encode the hash bytes in `base32`. use the first 24 characters to generate DID value (`did:plc:<hashchars>`)
+
- serialize the "signed" operation as simple JSON, and submit it via HTTP POST to `https://plc.directory/:did`
+
- if the HTTP status code is successful, the DID has been registered
+
+
When "signing" using a "`rotationKey`", what is meant is to sign using the private key associated the public key in the `rotationKey` list.
+
+
### DID Update
+
+
To summarize the process of updating a new `did:plc` identifier:
+
+
- if the current DID state isn't known, fetch the current state from `https://plc.directory/:did/data`
+
- if the most recent valid DID operation CID (hash) isn't known, fetch the audit log from `https://plc.directory/:did/log/audit`, identify the most recent valid operation, and get the `cid` value. if this is a recovery operation, the relevant "valid" operation to fork from may not be the most recent in the audit log
+
- collect updated values for all of the core data fields, including generating new secure key pairs if necessary (eg, key rotation)
+
- construct an "unsigned" regular operation object. include a `prev` field with the CID (hash) of the previous valid operation
+
- serialize the "unsigned" operation with DAG-CBOR, and sign the resulting bytes with one of the previously-existing `rotationKeys`. encode the signature as `base64url`, and use that to construct a "signed" operation object
+
- serialize the "signed" operation as simple JSON, and submit it via HTTP POST to `https://plc.directory/:did`
+
- if the HTTP status code is successful, the DID has been updated
+
- the DID update may be nullified by a "rotation" operation during the recovery window (currently 72hr)
+
+
### DID Deactivation
+
+
To summarize the process of de-activating an existing `did:plc` identifier:
+
+
- if the most recent valid DID operation CID (hash) isn't known, fetch the audit log from `https://plc.directory/:did/log/audit`, identify the most recent valid operation, and get the `cid` value
+
- construct an "unsigned" tombstone operation object. include a `prev` field with the CID (hash) of the previous valid operation
+
- serialize the "unsigned" tombstone operation with DAG-CBOR, and sign the resulting bytes with one of the previously-existing `rotationKeys`. encode the signature as `base64url`, and use that to construct a "signed" tombstone operation object
+
- serialize the "signed" tombstone operation as simple JSON, and submit it via HTTP POST to `https://plc.directory/:did`
+
- if the HTTP status code is successful, the DID has been deactivated
+
- the DID deactivation may be nullified by a "rotation" operation during the recovery window (currently 72hr)
+
+
### DID Resolution
+
+
PLC DIDs are resolved to a DID document (JSON) by making simple HTTP GET request to the PLC server. The resolution endpoint is: `https://plc.directory/:did`
+
+
The PLC-specific state data (based on the most recent operation) can be fetched as a JSON object at: `https://plc.directory/:did/data`
+
+
+
### Audit Logs
+
+
As an additional check against abuse by the PLC server, and to promote resiliency, the set of all identifiers is enumerable, and the set of all operations for all identifiers (even "nullified" operations) can be enumerated and audited.
+
+
The log of currently-valid operations for a given DID, as JSON, can be found at: `https://plc.directory/:did/log/audit`
+
+
The audit history of a given DID (complete with timestamps and invalidated forked histories), as JSON, can be found at: `https://plc.directory/:did/log/audit`
+
+
To fully validate a DID document against the operation log:
+
+
- fetch the full audit log
+
- for the genesis operation, validate the DID
+
- note that the genesis operation may be in deprecated/legacy format, and should be encoded and verified in that format
+
- see the "DID Creation" section above for details
+
- for each operation in the log, validate signatures:
+
- identify the set of valid `rotationKeys` at that point of time: either the initial keys for a "genesis" operation, or the keys in the `prev` operation
+
- remove any `sig` field and serialize the "unsigned" operation with DAG-CBOR, yielding bytes
+
- decode the `base64url` `sig` field to bytes
+
- for each of the `rotationKeys`, attempt to verify the signature against the "unsigned" bytes
+
- if no key matches, there has been a trust violation; the PLC server should never have accepted the operation
+
- verify the correctness of "nullified" operations and the current active operation log using the rules around rotation keys and recovery windows
+
+
The complete log of operations for all DIDs on the PLC server can be enumerated efficiently:
+
+
- HTTP endpoint: `https://plc.directory/export`
+
- output format: [JSON lines](https://jsonlines.org/)
+
- `count` query parameter, as an integer, maximum 1000 lines per request
+
- `after` query parameter, based on `createdAt` timestamp, for pagination
+
+
+
## Example
+
+
```ts
+
// note: we use shorthand for keys for ease of reference, but consider them valid did:keys
+
+
// Genesis operation
+
const genesisOp = {
+
type: 'plc_operation',
+
verificationMethods: {
+
atproto: "did:key:zSigningKey"
+
},
+
rotationKeys: [
+
"did:key:zRecoveryKey",
+
"did:key:zRotationKey"
+
],
+
alsoKnownAs: [
+
"at://alice.test"
+
],
+
services: {
+
atproto_pds: {
+
type: "AtprotoPersonalDataServer",
+
endpoint: "https://example.test"
+
}
+
},
+
prev: null,
+
sig: 'sig_from_did:key:zRotationKey'
+
}
+
+
// Operation to update recovery key
+
const updateKeys = {
+
type: 'plc_operation',
+
verificationMethods: {
+
atproto: "did:key:zSigningKey"
+
},
+
rotationKeys: [
+
"did:key:zNewRecoveryKey",
+
"did:key:zRotationKey"
+
],
+
alsoKnownAs: [
+
"at://alice.test"
+
],
+
services: {
+
atproto_pds: {
+
type: "AtprotoPersonalDataServer",
+
endpoint: "https://example.test"
+
}
+
},
+
prev: CID(genesisOp),
+
sig: 'sig_from_did:key:zRotationKey'
+
}
+
+
// Invalid operation that will be rejected
+
// because did:key:zAttackerKey is not listed in rotationKeys
+
const invalidUpdate = {
+
type: 'plc_operation',
+
verificationMethods: {
+
atproto: "did:key:zAttackerKey"
+
},
+
rotationKeys: [
+
"did:key:zAttackerKey"
+
],
+
alsoKnownAs: [
+
"at://bob.test"
+
],
+
services: {
+
atproto_pds: {
+
type: "AtprotoPersonalDataServer",
+
endpoint: "https://example.test"
+
}
+
},
+
prev: CID(updateKeys),
+
sig: 'sig_from_did:key:zAttackerKey'
+
}
+
+
// Valid recovery operation that "undoes" updateKeys
+
const recoveryOp = {
+
type: 'plc_operation',
+
verificationMethods: {
+
atproto: "did:key:zSigningKey"
+
},
+
rotationKeys: [
+
"did:key:zRecoveryKey"
+
],
+
alsoKnownAs: [
+
"at://alice.test"
+
],
+
services: {
+
atproto_pds: {
+
type: "AtprotoPersonalDataServer",
+
endpoint: "https://example.test"
+
}
+
},
+
prev: CID(genesisOp),
+
sig: 'sig_from_did:key:zRecoveryKey'
+
}
+
```
+
+
## Presentation as DID Document
+
+
The following data:
+
+
```ts
+
{
+
did: 'did:plc:7iza6de2dwap2sbkpav7c6c6',
+
verificationMethods: {
+
atproto: 'did:key:zDnaeh9v2RmcMo13Du2d6pjUf5bZwtauYxj3n9dYjw4EZUAR7'
+
},
+
rotationKeys: [
+
'did:key:zDnaedvvAsDE6H3BDdBejpx9ve2Tz95cymyCAKF66JbyMh1Lt',
+
'did:key:zDnaeh9v2RmcMo13Du2d6pjUf5bZwtauYxj3n9dYjw4EZUAR7'
+
],
+
alsoKnownAs: [
+
'at://alice.test'
+
],
+
services: {
+
atproto_pds: {
+
type: "AtprotoPersonalDataServer",
+
endpoint: "https://example.test"
+
}
+
}
+
}
+
```
+
+
Will be presented as the following DID document:
+
+
```ts
+
{
+
'@context': [
+
'https://www.w3.org/ns/did/v1',
+
'https://w3id.org/security/suites/ecdsa-2019/v1'
+
],
+
id: 'did:plc:7iza6de2dwap2sbkpav7c6c6',
+
alsoKnownAs: [ 'at://alice.test' ],
+
verificationMethod: [
+
{
+
id: '#atproto',
+
type: 'EcdsaSecp256r1VerificationKey2019',
+
controller: 'did:plc:7iza6de2dwap2sbkpav7c6c6',
+
publicKeyMultibase: 'zSSa7w8s5aApu6td45gWTAAFkqCnaWY6ZsJ8DpyzDdYmVy4fARKqbn5F1UYBUMeVvYTBsoSoLvZnPdjd3pVHbmAHP'
+
}
+
],
+
service: [
+
{
+
id: '#atproto_pds',
+
type: 'AtprotoPersonalDataServer',
+
serviceEndpoint: 'https://example2.com'
+
}
+
]
+
}
+
```
+
+
## Possible Future Changes
+
+
The set of allowed ("blessed") public key cryptographic algorithms (aka, curves) may expanded over time, slowly. Likewise, support for additional blessed CID types and parameters may be expanded over time, slowly.
+
+
The recovery time window may become configurable, within constraints, as part of the DID metadata itself.
+
+
Support for "DID Controller Delegation" could be useful (eg, in the context of atproto PDS hosts), and may be incorporated.
+
+
In the context of atproto, support for multiple handles for the same DID is being considered, with a single primary handle. But no final decision has been made yet.
+
+
We welcome proposals for small additions to make `did:plc` more generic and reusable for applications other than atproto. But no promises: atproto will remain the focus for the near future.
+
+
We are enthusiastic about the prospect of moving governance of the `did:plc` method, and operation of registry servers, out of the sole control of Bluesky PBC. Audit log snapshots, mirroring, and automated third-party auditing have all been considered as mechanisms to mitigate the centralized nature of the PLC server.
+
+
The size of the `verificationMethods`, `alsoKnownAs`, and `service` mappings/arrays may be specifically constrained. And the maximum DAG-CBOR size may be constrained.
+
+
As an anti-abuse mechanisms, the PLC server load balancer restricts the number of HTTP requests per time window. The limits are generous, and operating large services or scraping the operation log should not run in to limits. Specific per-DID limits on operation rate may be introduced over time. For example, no more than N operations per DID per rotation key per 24 hour window.
+
+
A "DID PLC history explorer" web interface would make the public nature of the DID audit log more publicly understandable.
+
+
It is concievable that longer DID PLCs, with more of the SHA-256 characters, will be supported in the future. It is also concievable that a different hash algorithm would be allowed. Any such changes would allow existing DIDs in their existing syntax to continue being used.
+3
go-didplc/cmd/webplc/static/.well-known/security.txt
···
+
Contact: mailto:security@bsky.app
+
Preferred-Languages: en
+
Canonical: https://web.plc.directory/.well-known/security.txt
+5
go-didplc/cmd/webplc/static/pico.min.css
···
+
@charset "UTF-8";/*!
+
* Pico CSS v1.5.10 (https://picocss.com)
+
* Copyright 2019-2023 - Licensed under MIT
+
*/:root{--font-family:system-ui,-apple-system,"Segoe UI","Roboto","Ubuntu","Cantarell","Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--line-height:1.5;--font-weight:400;--font-size:16px;--border-radius:0.25rem;--border-width:1px;--outline-width:3px;--spacing:1rem;--typography-spacing-vertical:1.5rem;--block-spacing-vertical:calc(var(--spacing) * 2);--block-spacing-horizontal:var(--spacing);--grid-spacing-vertical:0;--grid-spacing-horizontal:var(--spacing);--form-element-spacing-vertical:0.75rem;--form-element-spacing-horizontal:1rem;--nav-element-spacing-vertical:1rem;--nav-element-spacing-horizontal:0.5rem;--nav-link-spacing-vertical:0.5rem;--nav-link-spacing-horizontal:0.5rem;--form-label-font-weight:var(--font-weight);--transition:0.2s ease-in-out;--modal-overlay-backdrop-filter:blur(0.25rem)}@media (min-width:576px){:root{--font-size:17px}}@media (min-width:768px){:root{--font-size:18px}}@media (min-width:992px){:root{--font-size:19px}}@media (min-width:1200px){:root{--font-size:20px}}@media (min-width:576px){body>footer,body>header,body>main,section{--block-spacing-vertical:calc(var(--spacing) * 2.5)}}@media (min-width:768px){body>footer,body>header,body>main,section{--block-spacing-vertical:calc(var(--spacing) * 3)}}@media (min-width:992px){body>footer,body>header,body>main,section{--block-spacing-vertical:calc(var(--spacing) * 3.5)}}@media (min-width:1200px){body>footer,body>header,body>main,section{--block-spacing-vertical:calc(var(--spacing) * 4)}}@media (min-width:576px){article{--block-spacing-horizontal:calc(var(--spacing) * 1.25)}}@media (min-width:768px){article{--block-spacing-horizontal:calc(var(--spacing) * 1.5)}}@media (min-width:992px){article{--block-spacing-horizontal:calc(var(--spacing) * 1.75)}}@media (min-width:1200px){article{--block-spacing-horizontal:calc(var(--spacing) * 2)}}dialog>article{--block-spacing-vertical:calc(var(--spacing) * 2);--block-spacing-horizontal:var(--spacing)}@media (min-width:576px){dialog>article{--block-spacing-vertical:calc(var(--spacing) * 2.5);--block-spacing-horizontal:calc(var(--spacing) * 1.25)}}@media (min-width:768px){dialog>article{--block-spacing-vertical:calc(var(--spacing) * 3);--block-spacing-horizontal:calc(var(--spacing) * 1.5)}}a{--text-decoration:none}a.contrast,a.secondary{--text-decoration:underline}small{--font-size:0.875em}h1,h2,h3,h4,h5,h6{--font-weight:700}h1{--font-size:2rem;--typography-spacing-vertical:3rem}h2{--font-size:1.75rem;--typography-spacing-vertical:2.625rem}h3{--font-size:1.5rem;--typography-spacing-vertical:2.25rem}h4{--font-size:1.25rem;--typography-spacing-vertical:1.874rem}h5{--font-size:1.125rem;--typography-spacing-vertical:1.6875rem}[type=checkbox],[type=radio]{--border-width:2px}[type=checkbox][role=switch]{--border-width:3px}tfoot td,tfoot th,thead td,thead th{--border-width:3px}:not(thead,tfoot)>*>td{--font-size:0.875em}code,kbd,pre,samp{--font-family:"Menlo","Consolas","Roboto Mono","Ubuntu Monospace","Noto Mono","Oxygen Mono","Liberation Mono",monospace,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}kbd{--font-weight:bolder}:root:not([data-theme=dark]),[data-theme=light]{--background-color:#fff;--color:hsl(205, 20%, 32%);--h1-color:hsl(205, 30%, 15%);--h2-color:#24333e;--h3-color:hsl(205, 25%, 23%);--h4-color:#374956;--h5-color:hsl(205, 20%, 32%);--h6-color:#4d606d;--muted-color:hsl(205, 10%, 50%);--muted-border-color:hsl(205, 20%, 94%);--primary:hsl(195, 85%, 41%);--primary-hover:hsl(195, 90%, 32%);--primary-focus:rgba(16, 149, 193, 0.125);--primary-inverse:#fff;--secondary:hsl(205, 15%, 41%);--secondary-hover:hsl(205, 20%, 32%);--secondary-focus:rgba(89, 107, 120, 0.125);--secondary-inverse:#fff;--contrast:hsl(205, 30%, 15%);--contrast-hover:#000;--contrast-focus:rgba(89, 107, 120, 0.125);--contrast-inverse:#fff;--mark-background-color:#fff2ca;--mark-color:#543a26;--ins-color:#388e3c;--del-color:#c62828;--blockquote-border-color:var(--muted-border-color);--blockquote-footer-color:var(--muted-color);--button-box-shadow:0 0 0 rgba(0, 0, 0, 0);--button-hover-box-shadow:0 0 0 rgba(0, 0, 0, 0);--form-element-background-color:transparent;--form-element-border-color:hsl(205, 14%, 68%);--form-element-color:var(--color);--form-element-placeholder-color:var(--muted-color);--form-element-active-background-color:transparent;--form-element-active-border-color:var(--primary);--form-element-focus-color:var(--primary-focus);--form-element-disabled-background-color:hsl(205, 18%, 86%);--form-element-disabled-border-color:hsl(205, 14%, 68%);--form-element-disabled-opacity:0.5;--form-element-invalid-border-color:#c62828;--form-element-invalid-active-border-color:#d32f2f;--form-element-invalid-focus-color:rgba(211, 47, 47, 0.125);--form-element-valid-border-color:#388e3c;--form-element-valid-active-border-color:#43a047;--form-element-valid-focus-color:rgba(67, 160, 71, 0.125);--switch-background-color:hsl(205, 16%, 77%);--switch-color:var(--primary-inverse);--switch-checked-background-color:var(--primary);--range-border-color:hsl(205, 18%, 86%);--range-active-border-color:hsl(205, 16%, 77%);--range-thumb-border-color:var(--background-color);--range-thumb-color:var(--secondary);--range-thumb-hover-color:var(--secondary-hover);--range-thumb-active-color:var(--primary);--table-border-color:var(--muted-border-color);--table-row-stripped-background-color:#f6f8f9;--code-background-color:hsl(205, 20%, 94%);--code-color:var(--muted-color);--code-kbd-background-color:var(--contrast);--code-kbd-color:var(--contrast-inverse);--code-tag-color:hsl(330, 40%, 50%);--code-property-color:hsl(185, 40%, 40%);--code-value-color:hsl(40, 20%, 50%);--code-comment-color:hsl(205, 14%, 68%);--accordion-border-color:var(--muted-border-color);--accordion-close-summary-color:var(--color);--accordion-open-summary-color:var(--muted-color);--card-background-color:var(--background-color);--card-border-color:var(--muted-border-color);--card-box-shadow:0.0145rem 0.029rem 0.174rem rgba(27, 40, 50, 0.01698),0.0335rem 0.067rem 0.402rem rgba(27, 40, 50, 0.024),0.0625rem 0.125rem 0.75rem rgba(27, 40, 50, 0.03),0.1125rem 0.225rem 1.35rem rgba(27, 40, 50, 0.036),0.2085rem 0.417rem 2.502rem rgba(27, 40, 50, 0.04302),0.5rem 1rem 6rem rgba(27, 40, 50, 0.06),0 0 0 0.0625rem rgba(27, 40, 50, 0.015);--card-sectionning-background-color:#fbfbfc;--dropdown-background-color:#fbfbfc;--dropdown-border-color:#e1e6eb;--dropdown-box-shadow:var(--card-box-shadow);--dropdown-color:var(--color);--dropdown-hover-background-color:hsl(205, 20%, 94%);--modal-overlay-background-color:rgba(213, 220, 226, 0.7);--progress-background-color:hsl(205, 18%, 86%);--progress-color:var(--primary);--loading-spinner-opacity:0.5;--tooltip-background-color:var(--contrast);--tooltip-color:var(--contrast-inverse);--icon-checkbox:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(65, 84, 98)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron-button:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron-button-inverse:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-close:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(115, 130, 140)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='18' y1='6' x2='6' y2='18'%3E%3C/line%3E%3Cline x1='6' y1='6' x2='18' y2='18'%3E%3C/line%3E%3C/svg%3E");--icon-date:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(65, 84, 98)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Crect x='3' y='4' width='18' height='18' rx='2' ry='2'%3E%3C/rect%3E%3Cline x1='16' y1='2' x2='16' y2='6'%3E%3C/line%3E%3Cline x1='8' y1='2' x2='8' y2='6'%3E%3C/line%3E%3Cline x1='3' y1='10' x2='21' y2='10'%3E%3C/line%3E%3C/svg%3E");--icon-invalid:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(198, 40, 40)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cline x1='12' y1='8' x2='12' y2='12'%3E%3C/line%3E%3Cline x1='12' y1='16' x2='12.01' y2='16'%3E%3C/line%3E%3C/svg%3E");--icon-minus:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='5' y1='12' x2='19' y2='12'%3E%3C/line%3E%3C/svg%3E");--icon-search:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(65, 84, 98)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='11' cy='11' r='8'%3E%3C/circle%3E%3Cline x1='21' y1='21' x2='16.65' y2='16.65'%3E%3C/line%3E%3C/svg%3E");--icon-time:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(65, 84, 98)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cpolyline points='12 6 12 12 16 14'%3E%3C/polyline%3E%3C/svg%3E");--icon-valid:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(56, 142, 60)' stroke-width='3' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E");color-scheme:light}@media only screen and (prefers-color-scheme:dark){:root:not([data-theme]){--background-color:#11191f;--color:hsl(205, 16%, 77%);--h1-color:hsl(205, 20%, 94%);--h2-color:#e1e6eb;--h3-color:hsl(205, 18%, 86%);--h4-color:#c8d1d8;--h5-color:hsl(205, 16%, 77%);--h6-color:#afbbc4;--muted-color:hsl(205, 10%, 50%);--muted-border-color:#1f2d38;--primary:hsl(195, 85%, 41%);--primary-hover:hsl(195, 80%, 50%);--primary-focus:rgba(16, 149, 193, 0.25);--primary-inverse:#fff;--secondary:hsl(205, 15%, 41%);--secondary-hover:hsl(205, 10%, 50%);--secondary-focus:rgba(115, 130, 140, 0.25);--secondary-inverse:#fff;--contrast:hsl(205, 20%, 94%);--contrast-hover:#fff;--contrast-focus:rgba(115, 130, 140, 0.25);--contrast-inverse:#000;--mark-background-color:#d1c284;--mark-color:#11191f;--ins-color:#388e3c;--del-color:#c62828;--blockquote-border-color:var(--muted-border-color);--blockquote-footer-color:var(--muted-color);--button-box-shadow:0 0 0 rgba(0, 0, 0, 0);--button-hover-box-shadow:0 0 0 rgba(0, 0, 0, 0);--form-element-background-color:#11191f;--form-element-border-color:#374956;--form-element-color:var(--color);--form-element-placeholder-color:var(--muted-color);--form-element-active-background-color:var(--form-element-background-color);--form-element-active-border-color:var(--primary);--form-element-focus-color:var(--primary-focus);--form-element-disabled-background-color:hsl(205, 25%, 23%);--form-element-disabled-border-color:hsl(205, 20%, 32%);--form-element-disabled-opacity:0.5;--form-element-invalid-border-color:#b71c1c;--form-element-invalid-active-border-color:#c62828;--form-element-invalid-focus-color:rgba(198, 40, 40, 0.25);--form-element-valid-border-color:#2e7d32;--form-element-valid-active-border-color:#388e3c;--form-element-valid-focus-color:rgba(56, 142, 60, 0.25);--switch-background-color:#374956;--switch-color:var(--primary-inverse);--switch-checked-background-color:var(--primary);--range-border-color:#24333e;--range-active-border-color:hsl(205, 25%, 23%);--range-thumb-border-color:var(--background-color);--range-thumb-color:var(--secondary);--range-thumb-hover-color:var(--secondary-hover);--range-thumb-active-color:var(--primary);--table-border-color:var(--muted-border-color);--table-row-stripped-background-color:rgba(115, 130, 140, 0.05);--code-background-color:#18232c;--code-color:var(--muted-color);--code-kbd-background-color:var(--contrast);--code-kbd-color:var(--contrast-inverse);--code-tag-color:hsl(330, 30%, 50%);--code-property-color:hsl(185, 30%, 50%);--code-value-color:hsl(40, 10%, 50%);--code-comment-color:#4d606d;--accordion-border-color:var(--muted-border-color);--accordion-active-summary-color:var(--primary);--accordion-close-summary-color:var(--color);--accordion-open-summary-color:var(--muted-color);--card-background-color:#141e26;--card-border-color:var(--card-background-color);--card-box-shadow:0.0145rem 0.029rem 0.174rem rgba(0, 0, 0, 0.01698),0.0335rem 0.067rem 0.402rem rgba(0, 0, 0, 0.024),0.0625rem 0.125rem 0.75rem rgba(0, 0, 0, 0.03),0.1125rem 0.225rem 1.35rem rgba(0, 0, 0, 0.036),0.2085rem 0.417rem 2.502rem rgba(0, 0, 0, 0.04302),0.5rem 1rem 6rem rgba(0, 0, 0, 0.06),0 0 0 0.0625rem rgba(0, 0, 0, 0.015);--card-sectionning-background-color:#18232c;--dropdown-background-color:hsl(205, 30%, 15%);--dropdown-border-color:#24333e;--dropdown-box-shadow:var(--card-box-shadow);--dropdown-color:var(--color);--dropdown-hover-background-color:rgba(36, 51, 62, 0.75);--modal-overlay-background-color:rgba(36, 51, 62, 0.8);--progress-background-color:#24333e;--progress-color:var(--primary);--loading-spinner-opacity:0.5;--tooltip-background-color:var(--contrast);--tooltip-color:var(--contrast-inverse);--icon-checkbox:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron-button:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron-button-inverse:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(0, 0, 0)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-close:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(115, 130, 140)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='18' y1='6' x2='6' y2='18'%3E%3C/line%3E%3Cline x1='6' y1='6' x2='18' y2='18'%3E%3C/line%3E%3C/svg%3E");--icon-date:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Crect x='3' y='4' width='18' height='18' rx='2' ry='2'%3E%3C/rect%3E%3Cline x1='16' y1='2' x2='16' y2='6'%3E%3C/line%3E%3Cline x1='8' y1='2' x2='8' y2='6'%3E%3C/line%3E%3Cline x1='3' y1='10' x2='21' y2='10'%3E%3C/line%3E%3C/svg%3E");--icon-invalid:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(183, 28, 28)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cline x1='12' y1='8' x2='12' y2='12'%3E%3C/line%3E%3Cline x1='12' y1='16' x2='12.01' y2='16'%3E%3C/line%3E%3C/svg%3E");--icon-minus:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='5' y1='12' x2='19' y2='12'%3E%3C/line%3E%3C/svg%3E");--icon-search:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='11' cy='11' r='8'%3E%3C/circle%3E%3Cline x1='21' y1='21' x2='16.65' y2='16.65'%3E%3C/line%3E%3C/svg%3E");--icon-time:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cpolyline points='12 6 12 12 16 14'%3E%3C/polyline%3E%3C/svg%3E");--icon-valid:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(46, 125, 50)' stroke-width='3' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E");color-scheme:dark}}[data-theme=dark]{--background-color:#11191f;--color:hsl(205, 16%, 77%);--h1-color:hsl(205, 20%, 94%);--h2-color:#e1e6eb;--h3-color:hsl(205, 18%, 86%);--h4-color:#c8d1d8;--h5-color:hsl(205, 16%, 77%);--h6-color:#afbbc4;--muted-color:hsl(205, 10%, 50%);--muted-border-color:#1f2d38;--primary:hsl(195, 85%, 41%);--primary-hover:hsl(195, 80%, 50%);--primary-focus:rgba(16, 149, 193, 0.25);--primary-inverse:#fff;--secondary:hsl(205, 15%, 41%);--secondary-hover:hsl(205, 10%, 50%);--secondary-focus:rgba(115, 130, 140, 0.25);--secondary-inverse:#fff;--contrast:hsl(205, 20%, 94%);--contrast-hover:#fff;--contrast-focus:rgba(115, 130, 140, 0.25);--contrast-inverse:#000;--mark-background-color:#d1c284;--mark-color:#11191f;--ins-color:#388e3c;--del-color:#c62828;--blockquote-border-color:var(--muted-border-color);--blockquote-footer-color:var(--muted-color);--button-box-shadow:0 0 0 rgba(0, 0, 0, 0);--button-hover-box-shadow:0 0 0 rgba(0, 0, 0, 0);--form-element-background-color:#11191f;--form-element-border-color:#374956;--form-element-color:var(--color);--form-element-placeholder-color:var(--muted-color);--form-element-active-background-color:var(--form-element-background-color);--form-element-active-border-color:var(--primary);--form-element-focus-color:var(--primary-focus);--form-element-disabled-background-color:hsl(205, 25%, 23%);--form-element-disabled-border-color:hsl(205, 20%, 32%);--form-element-disabled-opacity:0.5;--form-element-invalid-border-color:#b71c1c;--form-element-invalid-active-border-color:#c62828;--form-element-invalid-focus-color:rgba(198, 40, 40, 0.25);--form-element-valid-border-color:#2e7d32;--form-element-valid-active-border-color:#388e3c;--form-element-valid-focus-color:rgba(56, 142, 60, 0.25);--switch-background-color:#374956;--switch-color:var(--primary-inverse);--switch-checked-background-color:var(--primary);--range-border-color:#24333e;--range-active-border-color:hsl(205, 25%, 23%);--range-thumb-border-color:var(--background-color);--range-thumb-color:var(--secondary);--range-thumb-hover-color:var(--secondary-hover);--range-thumb-active-color:var(--primary);--table-border-color:var(--muted-border-color);--table-row-stripped-background-color:rgba(115, 130, 140, 0.05);--code-background-color:#18232c;--code-color:var(--muted-color);--code-kbd-background-color:var(--contrast);--code-kbd-color:var(--contrast-inverse);--code-tag-color:hsl(330, 30%, 50%);--code-property-color:hsl(185, 30%, 50%);--code-value-color:hsl(40, 10%, 50%);--code-comment-color:#4d606d;--accordion-border-color:var(--muted-border-color);--accordion-active-summary-color:var(--primary);--accordion-close-summary-color:var(--color);--accordion-open-summary-color:var(--muted-color);--card-background-color:#141e26;--card-border-color:var(--card-background-color);--card-box-shadow:0.0145rem 0.029rem 0.174rem rgba(0, 0, 0, 0.01698),0.0335rem 0.067rem 0.402rem rgba(0, 0, 0, 0.024),0.0625rem 0.125rem 0.75rem rgba(0, 0, 0, 0.03),0.1125rem 0.225rem 1.35rem rgba(0, 0, 0, 0.036),0.2085rem 0.417rem 2.502rem rgba(0, 0, 0, 0.04302),0.5rem 1rem 6rem rgba(0, 0, 0, 0.06),0 0 0 0.0625rem rgba(0, 0, 0, 0.015);--card-sectionning-background-color:#18232c;--dropdown-background-color:hsl(205, 30%, 15%);--dropdown-border-color:#24333e;--dropdown-box-shadow:var(--card-box-shadow);--dropdown-color:var(--color);--dropdown-hover-background-color:rgba(36, 51, 62, 0.75);--modal-overlay-background-color:rgba(36, 51, 62, 0.8);--progress-background-color:#24333e;--progress-color:var(--primary);--loading-spinner-opacity:0.5;--tooltip-background-color:var(--contrast);--tooltip-color:var(--contrast-inverse);--icon-checkbox:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron-button:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-chevron-button-inverse:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(0, 0, 0)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='6 9 12 15 18 9'%3E%3C/polyline%3E%3C/svg%3E");--icon-close:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(115, 130, 140)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='18' y1='6' x2='6' y2='18'%3E%3C/line%3E%3Cline x1='6' y1='6' x2='18' y2='18'%3E%3C/line%3E%3C/svg%3E");--icon-date:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Crect x='3' y='4' width='18' height='18' rx='2' ry='2'%3E%3C/rect%3E%3Cline x1='16' y1='2' x2='16' y2='6'%3E%3C/line%3E%3Cline x1='8' y1='2' x2='8' y2='6'%3E%3C/line%3E%3Cline x1='3' y1='10' x2='21' y2='10'%3E%3C/line%3E%3C/svg%3E");--icon-invalid:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(183, 28, 28)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cline x1='12' y1='8' x2='12' y2='12'%3E%3C/line%3E%3Cline x1='12' y1='16' x2='12.01' y2='16'%3E%3C/line%3E%3C/svg%3E");--icon-minus:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(255, 255, 255)' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'%3E%3Cline x1='5' y1='12' x2='19' y2='12'%3E%3C/line%3E%3C/svg%3E");--icon-search:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='11' cy='11' r='8'%3E%3C/circle%3E%3Cline x1='21' y1='21' x2='16.65' y2='16.65'%3E%3C/line%3E%3C/svg%3E");--icon-time:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(162, 175, 185)' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'%3E%3C/circle%3E%3Cpolyline points='12 6 12 12 16 14'%3E%3C/polyline%3E%3C/svg%3E");--icon-valid:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24' fill='none' stroke='rgb(46, 125, 50)' stroke-width='3' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E");color-scheme:dark}[type=checkbox],[type=radio],[type=range],progress{accent-color:var(--primary)}*,::after,::before{box-sizing:border-box;background-repeat:no-repeat}::after,::before{text-decoration:inherit;vertical-align:inherit}:where(:root){-webkit-tap-highlight-color:transparent;-webkit-text-size-adjust:100%;-moz-text-size-adjust:100%;text-size-adjust:100%;background-color:var(--background-color);color:var(--color);font-weight:var(--font-weight);font-size:var(--font-size);line-height:var(--line-height);font-family:var(--font-family);text-rendering:optimizeLegibility;overflow-wrap:break-word;cursor:default;-moz-tab-size:4;-o-tab-size:4;tab-size:4}main{display:block}body{width:100%;margin:0}body>footer,body>header,body>main{width:100%;margin-right:auto;margin-left:auto;padding:var(--block-spacing-vertical) 0}.container,.container-fluid{width:100%;margin-right:auto;margin-left:auto;padding-right:var(--spacing);padding-left:var(--spacing)}@media (min-width:576px){.container{max-width:510px;padding-right:0;padding-left:0}}@media (min-width:768px){.container{max-width:700px}}@media (min-width:992px){.container{max-width:920px}}@media (min-width:1200px){.container{max-width:1130px}}section{margin-bottom:var(--block-spacing-vertical)}.grid{grid-column-gap:var(--grid-spacing-horizontal);grid-row-gap:var(--grid-spacing-vertical);display:grid;grid-template-columns:1fr;margin:0}@media (min-width:992px){.grid{grid-template-columns:repeat(auto-fit,minmax(0%,1fr))}}.grid>*{min-width:0}figure{display:block;margin:0;padding:0;overflow-x:auto}figure figcaption{padding:calc(var(--spacing) * .5) 0;color:var(--muted-color)}b,strong{font-weight:bolder}sub,sup{position:relative;font-size:.75em;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}address,blockquote,dl,figure,form,ol,p,pre,table,ul{margin-top:0;margin-bottom:var(--typography-spacing-vertical);color:var(--color);font-style:normal;font-weight:var(--font-weight);font-size:var(--font-size)}[role=link],a{--color:var(--primary);--background-color:transparent;outline:0;background-color:var(--background-color);color:var(--color);-webkit-text-decoration:var(--text-decoration);text-decoration:var(--text-decoration);transition:background-color var(--transition),color var(--transition),box-shadow var(--transition),-webkit-text-decoration var(--transition);transition:background-color var(--transition),color var(--transition),text-decoration var(--transition),box-shadow var(--transition);transition:background-color var(--transition),color var(--transition),text-decoration var(--transition),box-shadow var(--transition),-webkit-text-decoration var(--transition)}[role=link]:is([aria-current],:hover,:active,:focus),a:is([aria-current],:hover,:active,:focus){--color:var(--primary-hover);--text-decoration:underline}[role=link]:focus,a:focus{--background-color:var(--primary-focus)}[role=link].secondary,a.secondary{--color:var(--secondary)}[role=link].secondary:is([aria-current],:hover,:active,:focus),a.secondary:is([aria-current],:hover,:active,:focus){--color:var(--secondary-hover)}[role=link].secondary:focus,a.secondary:focus{--background-color:var(--secondary-focus)}[role=link].contrast,a.contrast{--color:var(--contrast)}[role=link].contrast:is([aria-current],:hover,:active,:focus),a.contrast:is([aria-current],:hover,:active,:focus){--color:var(--contrast-hover)}[role=link].contrast:focus,a.contrast:focus{--background-color:var(--contrast-focus)}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:var(--typography-spacing-vertical);color:var(--color);font-weight:var(--font-weight);font-size:var(--font-size);font-family:var(--font-family)}h1{--color:var(--h1-color)}h2{--color:var(--h2-color)}h3{--color:var(--h3-color)}h4{--color:var(--h4-color)}h5{--color:var(--h5-color)}h6{--color:var(--h6-color)}:where(address,blockquote,dl,figure,form,ol,p,pre,table,ul)~:is(h1,h2,h3,h4,h5,h6){margin-top:var(--typography-spacing-vertical)}.headings,hgroup{margin-bottom:var(--typography-spacing-vertical)}.headings>*,hgroup>*{margin-bottom:0}.headings>:last-child,hgroup>:last-child{--color:var(--muted-color);--font-weight:unset;font-size:1rem;font-family:unset}p{margin-bottom:var(--typography-spacing-vertical)}small{font-size:var(--font-size)}:where(dl,ol,ul){padding-right:0;padding-left:var(--spacing);-webkit-padding-start:var(--spacing);padding-inline-start:var(--spacing);-webkit-padding-end:0;padding-inline-end:0}:where(dl,ol,ul) li{margin-bottom:calc(var(--typography-spacing-vertical) * .25)}:where(dl,ol,ul) :is(dl,ol,ul){margin:0;margin-top:calc(var(--typography-spacing-vertical) * .25)}ul li{list-style:square}mark{padding:.125rem .25rem;background-color:var(--mark-background-color);color:var(--mark-color);vertical-align:baseline}blockquote{display:block;margin:var(--typography-spacing-vertical) 0;padding:var(--spacing);border-right:none;border-left:.25rem solid var(--blockquote-border-color);-webkit-border-start:0.25rem solid var(--blockquote-border-color);border-inline-start:0.25rem solid var(--blockquote-border-color);-webkit-border-end:none;border-inline-end:none}blockquote footer{margin-top:calc(var(--typography-spacing-vertical) * .5);color:var(--blockquote-footer-color)}abbr[title]{border-bottom:1px dotted;text-decoration:none;cursor:help}ins{color:var(--ins-color);text-decoration:none}del{color:var(--del-color)}::-moz-selection{background-color:var(--primary-focus)}::selection{background-color:var(--primary-focus)}:where(audio,canvas,iframe,img,svg,video){vertical-align:middle}audio,video{display:inline-block}audio:not([controls]){display:none;height:0}:where(iframe){border-style:none}img{max-width:100%;height:auto;border-style:none}:where(svg:not([fill])){fill:currentColor}svg:not(:root){overflow:hidden}button{margin:0;overflow:visible;font-family:inherit;text-transform:none}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}button{display:block;width:100%;margin-bottom:var(--spacing)}[role=button]{display:inline-block;text-decoration:none}[role=button],button,input[type=button],input[type=reset],input[type=submit]{--background-color:var(--primary);--border-color:var(--primary);--color:var(--primary-inverse);--box-shadow:var(--button-box-shadow, 0 0 0 rgba(0, 0, 0, 0));padding:var(--form-element-spacing-vertical) var(--form-element-spacing-horizontal);border:var(--border-width) solid var(--border-color);border-radius:var(--border-radius);outline:0;background-color:var(--background-color);box-shadow:var(--box-shadow);color:var(--color);font-weight:var(--font-weight);font-size:1rem;line-height:var(--line-height);text-align:center;cursor:pointer;transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition)}[role=button]:is([aria-current],:hover,:active,:focus),button:is([aria-current],:hover,:active,:focus),input[type=button]:is([aria-current],:hover,:active,:focus),input[type=reset]:is([aria-current],:hover,:active,:focus),input[type=submit]:is([aria-current],:hover,:active,:focus){--background-color:var(--primary-hover);--border-color:var(--primary-hover);--box-shadow:var(--button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0));--color:var(--primary-inverse)}[role=button]:focus,button:focus,input[type=button]:focus,input[type=reset]:focus,input[type=submit]:focus{--box-shadow:var(--button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0)),0 0 0 var(--outline-width) var(--primary-focus)}:is(button,input[type=submit],input[type=button],[role=button]).secondary,input[type=reset]{--background-color:var(--secondary);--border-color:var(--secondary);--color:var(--secondary-inverse);cursor:pointer}:is(button,input[type=submit],input[type=button],[role=button]).secondary:is([aria-current],:hover,:active,:focus),input[type=reset]:is([aria-current],:hover,:active,:focus){--background-color:var(--secondary-hover);--border-color:var(--secondary-hover);--color:var(--secondary-inverse)}:is(button,input[type=submit],input[type=button],[role=button]).secondary:focus,input[type=reset]:focus{--box-shadow:var(--button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0)),0 0 0 var(--outline-width) var(--secondary-focus)}:is(button,input[type=submit],input[type=button],[role=button]).contrast{--background-color:var(--contrast);--border-color:var(--contrast);--color:var(--contrast-inverse)}:is(button,input[type=submit],input[type=button],[role=button]).contrast:is([aria-current],:hover,:active,:focus){--background-color:var(--contrast-hover);--border-color:var(--contrast-hover);--color:var(--contrast-inverse)}:is(button,input[type=submit],input[type=button],[role=button]).contrast:focus{--box-shadow:var(--button-hover-box-shadow, 0 0 0 rgba(0, 0, 0, 0)),0 0 0 var(--outline-width) var(--contrast-focus)}:is(button,input[type=submit],input[type=button],[role=button]).outline,input[type=reset].outline{--background-color:transparent;--color:var(--primary)}:is(button,input[type=submit],input[type=button],[role=button]).outline:is([aria-current],:hover,:active,:focus),input[type=reset].outline:is([aria-current],:hover,:active,:focus){--background-color:transparent;--color:var(--primary-hover)}:is(button,input[type=submit],input[type=button],[role=button]).outline.secondary,input[type=reset].outline{--color:var(--secondary)}:is(button,input[type=submit],input[type=button],[role=button]).outline.secondary:is([aria-current],:hover,:active,:focus),input[type=reset].outline:is([aria-current],:hover,:active,:focus){--color:var(--secondary-hover)}:is(button,input[type=submit],input[type=button],[role=button]).outline.contrast{--color:var(--contrast)}:is(button,input[type=submit],input[type=button],[role=button]).outline.contrast:is([aria-current],:hover,:active,:focus){--color:var(--contrast-hover)}:where(button,[type=submit],[type=button],[type=reset],[role=button])[disabled],:where(fieldset[disabled]) :is(button,[type=submit],[type=button],[type=reset],[role=button]),a[role=button]:not([href]){opacity:.5;pointer-events:none}input,optgroup,select,textarea{margin:0;font-size:1rem;line-height:var(--line-height);font-family:inherit;letter-spacing:inherit}input{overflow:visible}select{text-transform:none}legend{max-width:100%;padding:0;color:inherit;white-space:normal}textarea{overflow:auto}[type=checkbox],[type=radio]{padding:0}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}::-moz-focus-inner{padding:0;border-style:none}:-moz-focusring{outline:0}:-moz-ui-invalid{box-shadow:none}::-ms-expand{display:none}[type=file],[type=range]{padding:0;border-width:0}input:not([type=checkbox],[type=radio],[type=range]){height:calc(1rem * var(--line-height) + var(--form-element-spacing-vertical) * 2 + var(--border-width) * 2)}fieldset{margin:0;margin-bottom:var(--spacing);padding:0;border:0}fieldset legend,label{display:block;margin-bottom:calc(var(--spacing) * .25);font-weight:var(--form-label-font-weight,var(--font-weight))}input:not([type=checkbox],[type=radio]),select,textarea{width:100%}input:not([type=checkbox],[type=radio],[type=range],[type=file]),select,textarea{-webkit-appearance:none;-moz-appearance:none;appearance:none;padding:var(--form-element-spacing-vertical) var(--form-element-spacing-horizontal)}input,select,textarea{--background-color:var(--form-element-background-color);--border-color:var(--form-element-border-color);--color:var(--form-element-color);--box-shadow:none;border:var(--border-width) solid var(--border-color);border-radius:var(--border-radius);outline:0;background-color:var(--background-color);box-shadow:var(--box-shadow);color:var(--color);font-weight:var(--font-weight);transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition)}:where(select,textarea):is(:active,:focus),input:not([type=submit],[type=button],[type=reset],[type=checkbox],[type=radio],[readonly]):is(:active,:focus){--background-color:var(--form-element-active-background-color)}:where(select,textarea):is(:active,:focus),input:not([type=submit],[type=button],[type=reset],[role=switch],[readonly]):is(:active,:focus){--border-color:var(--form-element-active-border-color)}input:not([type=submit],[type=button],[type=reset],[type=range],[type=file],[readonly]):focus,select:focus,textarea:focus{--box-shadow:0 0 0 var(--outline-width) var(--form-element-focus-color)}:where(fieldset[disabled]) :is(input:not([type=submit],[type=button],[type=reset]),select,textarea),input:not([type=submit],[type=button],[type=reset])[disabled],select[disabled],textarea[disabled]{--background-color:var(--form-element-disabled-background-color);--border-color:var(--form-element-disabled-border-color);opacity:var(--form-element-disabled-opacity);pointer-events:none}:where(input,select,textarea):not([type=checkbox],[type=radio],[type=date],[type=datetime-local],[type=month],[type=time],[type=week])[aria-invalid]{padding-right:calc(var(--form-element-spacing-horizontal) + 1.5rem)!important;padding-left:var(--form-element-spacing-horizontal);-webkit-padding-start:var(--form-element-spacing-horizontal)!important;padding-inline-start:var(--form-element-spacing-horizontal)!important;-webkit-padding-end:calc(var(--form-element-spacing-horizontal) + 1.5rem)!important;padding-inline-end:calc(var(--form-element-spacing-horizontal) + 1.5rem)!important;background-position:center right .75rem;background-size:1rem auto;background-repeat:no-repeat}:where(input,select,textarea):not([type=checkbox],[type=radio],[type=date],[type=datetime-local],[type=month],[type=time],[type=week])[aria-invalid=false]{background-image:var(--icon-valid)}:where(input,select,textarea):not([type=checkbox],[type=radio],[type=date],[type=datetime-local],[type=month],[type=time],[type=week])[aria-invalid=true]{background-image:var(--icon-invalid)}:where(input,select,textarea)[aria-invalid=false]{--border-color:var(--form-element-valid-border-color)}:where(input,select,textarea)[aria-invalid=false]:is(:active,:focus){--border-color:var(--form-element-valid-active-border-color)!important;--box-shadow:0 0 0 var(--outline-width) var(--form-element-valid-focus-color)!important}:where(input,select,textarea)[aria-invalid=true]{--border-color:var(--form-element-invalid-border-color)}:where(input,select,textarea)[aria-invalid=true]:is(:active,:focus){--border-color:var(--form-element-invalid-active-border-color)!important;--box-shadow:0 0 0 var(--outline-width) var(--form-element-invalid-focus-color)!important}[dir=rtl] :where(input,select,textarea):not([type=checkbox],[type=radio]):is([aria-invalid],[aria-invalid=true],[aria-invalid=false]){background-position:center left .75rem}input::-webkit-input-placeholder,input::placeholder,select:invalid,textarea::-webkit-input-placeholder,textarea::placeholder{color:var(--form-element-placeholder-color);opacity:1}input:not([type=checkbox],[type=radio]),select,textarea{margin-bottom:var(--spacing)}select::-ms-expand{border:0;background-color:transparent}select:not([multiple],[size]){padding-right:calc(var(--form-element-spacing-horizontal) + 1.5rem);padding-left:var(--form-element-spacing-horizontal);-webkit-padding-start:var(--form-element-spacing-horizontal);padding-inline-start:var(--form-element-spacing-horizontal);-webkit-padding-end:calc(var(--form-element-spacing-horizontal) + 1.5rem);padding-inline-end:calc(var(--form-element-spacing-horizontal) + 1.5rem);background-image:var(--icon-chevron);background-position:center right .75rem;background-size:1rem auto;background-repeat:no-repeat}[dir=rtl] select:not([multiple],[size]){background-position:center left .75rem}:where(input,select,textarea,.grid)+small{display:block;width:100%;margin-top:calc(var(--spacing) * -.75);margin-bottom:var(--spacing);color:var(--muted-color)}label>:where(input,select,textarea){margin-top:calc(var(--spacing) * .25)}[type=checkbox],[type=radio]{-webkit-appearance:none;-moz-appearance:none;appearance:none;width:1.25em;height:1.25em;margin-top:-.125em;margin-right:.375em;margin-left:0;-webkit-margin-start:0;margin-inline-start:0;-webkit-margin-end:.375em;margin-inline-end:.375em;border-width:var(--border-width);font-size:inherit;vertical-align:middle;cursor:pointer}[type=checkbox]::-ms-check,[type=radio]::-ms-check{display:none}[type=checkbox]:checked,[type=checkbox]:checked:active,[type=checkbox]:checked:focus,[type=radio]:checked,[type=radio]:checked:active,[type=radio]:checked:focus{--background-color:var(--primary);--border-color:var(--primary);background-image:var(--icon-checkbox);background-position:center;background-size:.75em auto;background-repeat:no-repeat}[type=checkbox]~label,[type=radio]~label{display:inline-block;margin-right:.375em;margin-bottom:0;cursor:pointer}[type=checkbox]:indeterminate{--background-color:var(--primary);--border-color:var(--primary);background-image:var(--icon-minus);background-position:center;background-size:.75em auto;background-repeat:no-repeat}[type=radio]{border-radius:50%}[type=radio]:checked,[type=radio]:checked:active,[type=radio]:checked:focus{--background-color:var(--primary-inverse);border-width:.35em;background-image:none}[type=checkbox][role=switch]{--background-color:var(--switch-background-color);--border-color:var(--switch-background-color);--color:var(--switch-color);width:2.25em;height:1.25em;border:var(--border-width) solid var(--border-color);border-radius:1.25em;background-color:var(--background-color);line-height:1.25em}[type=checkbox][role=switch]:focus{--background-color:var(--switch-background-color);--border-color:var(--switch-background-color)}[type=checkbox][role=switch]:checked{--background-color:var(--switch-checked-background-color);--border-color:var(--switch-checked-background-color)}[type=checkbox][role=switch]:before{display:block;width:calc(1.25em - (var(--border-width) * 2));height:100%;border-radius:50%;background-color:var(--color);content:"";transition:margin .1s ease-in-out}[type=checkbox][role=switch]:checked{background-image:none}[type=checkbox][role=switch]:checked::before{margin-left:calc(1.125em - var(--border-width));-webkit-margin-start:calc(1.125em - var(--border-width));margin-inline-start:calc(1.125em - var(--border-width))}[type=checkbox]:checked[aria-invalid=false],[type=checkbox][aria-invalid=false],[type=checkbox][role=switch]:checked[aria-invalid=false],[type=checkbox][role=switch][aria-invalid=false],[type=radio]:checked[aria-invalid=false],[type=radio][aria-invalid=false]{--border-color:var(--form-element-valid-border-color)}[type=checkbox]:checked[aria-invalid=true],[type=checkbox][aria-invalid=true],[type=checkbox][role=switch]:checked[aria-invalid=true],[type=checkbox][role=switch][aria-invalid=true],[type=radio]:checked[aria-invalid=true],[type=radio][aria-invalid=true]{--border-color:var(--form-element-invalid-border-color)}[type=color]::-webkit-color-swatch-wrapper{padding:0}[type=color]::-moz-focus-inner{padding:0}[type=color]::-webkit-color-swatch{border:0;border-radius:calc(var(--border-radius) * .5)}[type=color]::-moz-color-swatch{border:0;border-radius:calc(var(--border-radius) * .5)}input:not([type=checkbox],[type=radio],[type=range],[type=file]):is([type=date],[type=datetime-local],[type=month],[type=time],[type=week]){--icon-position:0.75rem;--icon-width:1rem;padding-right:calc(var(--icon-width) + var(--icon-position));background-image:var(--icon-date);background-position:center right var(--icon-position);background-size:var(--icon-width) auto;background-repeat:no-repeat}input:not([type=checkbox],[type=radio],[type=range],[type=file])[type=time]{background-image:var(--icon-time)}[type=date]::-webkit-calendar-picker-indicator,[type=datetime-local]::-webkit-calendar-picker-indicator,[type=month]::-webkit-calendar-picker-indicator,[type=time]::-webkit-calendar-picker-indicator,[type=week]::-webkit-calendar-picker-indicator{width:var(--icon-width);margin-right:calc(var(--icon-width) * -1);margin-left:var(--icon-position);opacity:0}[dir=rtl] :is([type=date],[type=datetime-local],[type=month],[type=time],[type=week]){text-align:right}@-moz-document url-prefix(){[type=date],[type=datetime-local],[type=month],[type=time],[type=week]{padding-right:var(--form-element-spacing-horizontal)!important;background-image:none!important}}[type=file]{--color:var(--muted-color);padding:calc(var(--form-element-spacing-vertical) * .5) 0;border:0;border-radius:0;background:0 0}[type=file]::file-selector-button{--background-color:var(--secondary);--border-color:var(--secondary);--color:var(--secondary-inverse);margin-right:calc(var(--spacing)/ 2);margin-left:0;-webkit-margin-start:0;margin-inline-start:0;-webkit-margin-end:calc(var(--spacing)/ 2);margin-inline-end:calc(var(--spacing)/ 2);padding:calc(var(--form-element-spacing-vertical) * .5) calc(var(--form-element-spacing-horizontal) * .5);border:var(--border-width) solid var(--border-color);border-radius:var(--border-radius);outline:0;background-color:var(--background-color);box-shadow:var(--box-shadow);color:var(--color);font-weight:var(--font-weight);font-size:1rem;line-height:var(--line-height);text-align:center;cursor:pointer;transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition)}[type=file]::file-selector-button:is(:hover,:active,:focus){--background-color:var(--secondary-hover);--border-color:var(--secondary-hover)}[type=file]::-webkit-file-upload-button{--background-color:var(--secondary);--border-color:var(--secondary);--color:var(--secondary-inverse);margin-right:calc(var(--spacing)/ 2);margin-left:0;-webkit-margin-start:0;margin-inline-start:0;-webkit-margin-end:calc(var(--spacing)/ 2);margin-inline-end:calc(var(--spacing)/ 2);padding:calc(var(--form-element-spacing-vertical) * .5) calc(var(--form-element-spacing-horizontal) * .5);border:var(--border-width) solid var(--border-color);border-radius:var(--border-radius);outline:0;background-color:var(--background-color);box-shadow:var(--box-shadow);color:var(--color);font-weight:var(--font-weight);font-size:1rem;line-height:var(--line-height);text-align:center;cursor:pointer;-webkit-transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition);transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition)}[type=file]::-webkit-file-upload-button:is(:hover,:active,:focus){--background-color:var(--secondary-hover);--border-color:var(--secondary-hover)}[type=file]::-ms-browse{--background-color:var(--secondary);--border-color:var(--secondary);--color:var(--secondary-inverse);margin-right:calc(var(--spacing)/ 2);margin-left:0;margin-inline-start:0;margin-inline-end:calc(var(--spacing)/ 2);padding:calc(var(--form-element-spacing-vertical) * .5) calc(var(--form-element-spacing-horizontal) * .5);border:var(--border-width) solid var(--border-color);border-radius:var(--border-radius);outline:0;background-color:var(--background-color);box-shadow:var(--box-shadow);color:var(--color);font-weight:var(--font-weight);font-size:1rem;line-height:var(--line-height);text-align:center;cursor:pointer;-ms-transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition);transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition)}[type=file]::-ms-browse:is(:hover,:active,:focus){--background-color:var(--secondary-hover);--border-color:var(--secondary-hover)}[type=range]{-webkit-appearance:none;-moz-appearance:none;appearance:none;width:100%;height:1.25rem;background:0 0}[type=range]::-webkit-slider-runnable-track{width:100%;height:.25rem;border-radius:var(--border-radius);background-color:var(--range-border-color);-webkit-transition:background-color var(--transition),box-shadow var(--transition);transition:background-color var(--transition),box-shadow var(--transition)}[type=range]::-moz-range-track{width:100%;height:.25rem;border-radius:var(--border-radius);background-color:var(--range-border-color);-moz-transition:background-color var(--transition),box-shadow var(--transition);transition:background-color var(--transition),box-shadow var(--transition)}[type=range]::-ms-track{width:100%;height:.25rem;border-radius:var(--border-radius);background-color:var(--range-border-color);-ms-transition:background-color var(--transition),box-shadow var(--transition);transition:background-color var(--transition),box-shadow var(--transition)}[type=range]::-webkit-slider-thumb{-webkit-appearance:none;width:1.25rem;height:1.25rem;margin-top:-.5rem;border:2px solid var(--range-thumb-border-color);border-radius:50%;background-color:var(--range-thumb-color);cursor:pointer;-webkit-transition:background-color var(--transition),transform var(--transition);transition:background-color var(--transition),transform var(--transition)}[type=range]::-moz-range-thumb{-webkit-appearance:none;width:1.25rem;height:1.25rem;margin-top:-.5rem;border:2px solid var(--range-thumb-border-color);border-radius:50%;background-color:var(--range-thumb-color);cursor:pointer;-moz-transition:background-color var(--transition),transform var(--transition);transition:background-color var(--transition),transform var(--transition)}[type=range]::-ms-thumb{-webkit-appearance:none;width:1.25rem;height:1.25rem;margin-top:-.5rem;border:2px solid var(--range-thumb-border-color);border-radius:50%;background-color:var(--range-thumb-color);cursor:pointer;-ms-transition:background-color var(--transition),transform var(--transition);transition:background-color var(--transition),transform var(--transition)}[type=range]:focus,[type=range]:hover{--range-border-color:var(--range-active-border-color);--range-thumb-color:var(--range-thumb-hover-color)}[type=range]:active{--range-thumb-color:var(--range-thumb-active-color)}[type=range]:active::-webkit-slider-thumb{transform:scale(1.25)}[type=range]:active::-moz-range-thumb{transform:scale(1.25)}[type=range]:active::-ms-thumb{transform:scale(1.25)}input:not([type=checkbox],[type=radio],[type=range],[type=file])[type=search]{-webkit-padding-start:calc(var(--form-element-spacing-horizontal) + 1.75rem);padding-inline-start:calc(var(--form-element-spacing-horizontal) + 1.75rem);border-radius:5rem;background-image:var(--icon-search);background-position:center left 1.125rem;background-size:1rem auto;background-repeat:no-repeat}input:not([type=checkbox],[type=radio],[type=range],[type=file])[type=search][aria-invalid]{-webkit-padding-start:calc(var(--form-element-spacing-horizontal) + 1.75rem)!important;padding-inline-start:calc(var(--form-element-spacing-horizontal) + 1.75rem)!important;background-position:center left 1.125rem,center right .75rem}input:not([type=checkbox],[type=radio],[type=range],[type=file])[type=search][aria-invalid=false]{background-image:var(--icon-search),var(--icon-valid)}input:not([type=checkbox],[type=radio],[type=range],[type=file])[type=search][aria-invalid=true]{background-image:var(--icon-search),var(--icon-invalid)}[type=search]::-webkit-search-cancel-button{-webkit-appearance:none;display:none}[dir=rtl] :where(input):not([type=checkbox],[type=radio],[type=range],[type=file])[type=search]{background-position:center right 1.125rem}[dir=rtl] :where(input):not([type=checkbox],[type=radio],[type=range],[type=file])[type=search][aria-invalid]{background-position:center right 1.125rem,center left .75rem}:where(table){width:100%;border-collapse:collapse;border-spacing:0;text-indent:0}td,th{padding:calc(var(--spacing)/ 2) var(--spacing);border-bottom:var(--border-width) solid var(--table-border-color);color:var(--color);font-weight:var(--font-weight);font-size:var(--font-size);text-align:left;text-align:start}tfoot td,tfoot th{border-top:var(--border-width) solid var(--table-border-color);border-bottom:0}table[role=grid] tbody tr:nth-child(odd){background-color:var(--table-row-stripped-background-color)}code,kbd,pre,samp{font-size:.875em;font-family:var(--font-family)}pre{-ms-overflow-style:scrollbar;overflow:auto}code,kbd,pre{border-radius:var(--border-radius);background:var(--code-background-color);color:var(--code-color);font-weight:var(--font-weight);line-height:initial}code,kbd{display:inline-block;padding:.375rem .5rem}pre{display:block;margin-bottom:var(--spacing);overflow-x:auto}pre>code{display:block;padding:var(--spacing);background:0 0;font-size:14px;line-height:var(--line-height)}code b{color:var(--code-tag-color);font-weight:var(--font-weight)}code i{color:var(--code-property-color);font-style:normal}code u{color:var(--code-value-color);text-decoration:none}code em{color:var(--code-comment-color);font-style:normal}kbd{background-color:var(--code-kbd-background-color);color:var(--code-kbd-color);vertical-align:baseline}hr{height:0;border:0;border-top:1px solid var(--muted-border-color);color:inherit}[hidden],template{display:none!important}canvas{display:inline-block}details{display:block;margin-bottom:var(--spacing);padding-bottom:var(--spacing);border-bottom:var(--border-width) solid var(--accordion-border-color)}details summary{line-height:1rem;list-style-type:none;cursor:pointer;transition:color var(--transition)}details summary:not([role]){color:var(--accordion-close-summary-color)}details summary::-webkit-details-marker{display:none}details summary::marker{display:none}details summary::-moz-list-bullet{list-style-type:none}details summary::after{display:block;width:1rem;height:1rem;-webkit-margin-start:calc(var(--spacing,1rem) * 0.5);margin-inline-start:calc(var(--spacing,1rem) * .5);float:right;transform:rotate(-90deg);background-image:var(--icon-chevron);background-position:right center;background-size:1rem auto;background-repeat:no-repeat;content:"";transition:transform var(--transition)}details summary:focus{outline:0}details summary:focus:not([role=button]){color:var(--accordion-active-summary-color)}details summary[role=button]{width:100%;text-align:left}details summary[role=button]::after{height:calc(1rem * var(--line-height,1.5));background-image:var(--icon-chevron-button)}details summary[role=button]:not(.outline).contrast::after{background-image:var(--icon-chevron-button-inverse)}details[open]>summary{margin-bottom:calc(var(--spacing))}details[open]>summary:not([role]):not(:focus){color:var(--accordion-open-summary-color)}details[open]>summary::after{transform:rotate(0)}[dir=rtl] details summary{text-align:right}[dir=rtl] details summary::after{float:left;background-position:left center}article{margin:var(--block-spacing-vertical) 0;padding:var(--block-spacing-vertical) var(--block-spacing-horizontal);border-radius:var(--border-radius);background:var(--card-background-color);box-shadow:var(--card-box-shadow)}article>footer,article>header{margin-right:calc(var(--block-spacing-horizontal) * -1);margin-left:calc(var(--block-spacing-horizontal) * -1);padding:calc(var(--block-spacing-vertical) * .66) var(--block-spacing-horizontal);background-color:var(--card-sectionning-background-color)}article>header{margin-top:calc(var(--block-spacing-vertical) * -1);margin-bottom:var(--block-spacing-vertical);border-bottom:var(--border-width) solid var(--card-border-color);border-top-right-radius:var(--border-radius);border-top-left-radius:var(--border-radius)}article>footer{margin-top:var(--block-spacing-vertical);margin-bottom:calc(var(--block-spacing-vertical) * -1);border-top:var(--border-width) solid var(--card-border-color);border-bottom-right-radius:var(--border-radius);border-bottom-left-radius:var(--border-radius)}:root{--scrollbar-width:0px}dialog{display:flex;z-index:999;position:fixed;top:0;right:0;bottom:0;left:0;align-items:center;justify-content:center;width:inherit;min-width:100%;height:inherit;min-height:100%;padding:var(--spacing);border:0;-webkit-backdrop-filter:var(--modal-overlay-backdrop-filter);backdrop-filter:var(--modal-overlay-backdrop-filter);background-color:var(--modal-overlay-background-color);color:var(--color)}dialog article{max-height:calc(100vh - var(--spacing) * 2);overflow:auto}@media (min-width:576px){dialog article{max-width:510px}}@media (min-width:768px){dialog article{max-width:700px}}dialog article>footer,dialog article>header{padding:calc(var(--block-spacing-vertical) * .5) var(--block-spacing-horizontal)}dialog article>header .close{margin:0;margin-left:var(--spacing);float:right}dialog article>footer{text-align:right}dialog article>footer [role=button]{margin-bottom:0}dialog article>footer [role=button]:not(:first-of-type){margin-left:calc(var(--spacing) * .5)}dialog article p:last-of-type{margin:0}dialog article .close{display:block;width:1rem;height:1rem;margin-top:calc(var(--block-spacing-vertical) * -.5);margin-bottom:var(--typography-spacing-vertical);margin-left:auto;background-image:var(--icon-close);background-position:center;background-size:auto 1rem;background-repeat:no-repeat;opacity:.5;transition:opacity var(--transition)}dialog article .close:is([aria-current],:hover,:active,:focus){opacity:1}dialog:not([open]),dialog[open=false]{display:none}.modal-is-open{padding-right:var(--scrollbar-width,0);overflow:hidden;pointer-events:none;touch-action:none}.modal-is-open dialog{pointer-events:auto}:where(.modal-is-opening,.modal-is-closing) dialog,:where(.modal-is-opening,.modal-is-closing) dialog>article{animation-duration:.2s;animation-timing-function:ease-in-out;animation-fill-mode:both}:where(.modal-is-opening,.modal-is-closing) dialog{animation-duration:.8s;animation-name:modal-overlay}:where(.modal-is-opening,.modal-is-closing) dialog>article{animation-delay:.2s;animation-name:modal}.modal-is-closing dialog,.modal-is-closing dialog>article{animation-delay:0s;animation-direction:reverse}@keyframes modal-overlay{from{-webkit-backdrop-filter:none;backdrop-filter:none;background-color:transparent}}@keyframes modal{from{transform:translateY(-100%);opacity:0}}:where(nav li)::before{float:left;content:"​"}nav,nav ul{display:flex}nav{justify-content:space-between}nav ol,nav ul{align-items:center;margin-bottom:0;padding:0;list-style:none}nav ol:first-of-type,nav ul:first-of-type{margin-left:calc(var(--nav-element-spacing-horizontal) * -1)}nav ol:last-of-type,nav ul:last-of-type{margin-right:calc(var(--nav-element-spacing-horizontal) * -1)}nav li{display:inline-block;margin:0;padding:var(--nav-element-spacing-vertical) var(--nav-element-spacing-horizontal)}nav li>*{--spacing:0}nav :where(a,[role=link]){display:inline-block;margin:calc(var(--nav-link-spacing-vertical) * -1) calc(var(--nav-link-spacing-horizontal) * -1);padding:var(--nav-link-spacing-vertical) var(--nav-link-spacing-horizontal);border-radius:var(--border-radius);text-decoration:none}nav :where(a,[role=link]):is([aria-current],:hover,:active,:focus){text-decoration:none}nav[aria-label=breadcrumb]{align-items:center;justify-content:start}nav[aria-label=breadcrumb] ul li:not(:first-child){-webkit-margin-start:var(--nav-link-spacing-horizontal);margin-inline-start:var(--nav-link-spacing-horizontal)}nav[aria-label=breadcrumb] ul li:not(:last-child) ::after{position:absolute;width:calc(var(--nav-link-spacing-horizontal) * 2);-webkit-margin-start:calc(var(--nav-link-spacing-horizontal)/ 2);margin-inline-start:calc(var(--nav-link-spacing-horizontal)/ 2);content:"/";color:var(--muted-color);text-align:center}nav[aria-label=breadcrumb] a[aria-current]{background-color:transparent;color:inherit;text-decoration:none;pointer-events:none}nav [role=button]{margin-right:inherit;margin-left:inherit;padding:var(--nav-link-spacing-vertical) var(--nav-link-spacing-horizontal)}aside li,aside nav,aside ol,aside ul{display:block}aside li{padding:calc(var(--nav-element-spacing-vertical) * .5) var(--nav-element-spacing-horizontal)}aside li a{display:block}aside li [role=button]{margin:inherit}[dir=rtl] nav[aria-label=breadcrumb] ul li:not(:last-child) ::after{content:"\\"}progress{display:inline-block;vertical-align:baseline}progress{-webkit-appearance:none;-moz-appearance:none;display:inline-block;appearance:none;width:100%;height:.5rem;margin-bottom:calc(var(--spacing) * .5);overflow:hidden;border:0;border-radius:var(--border-radius);background-color:var(--progress-background-color);color:var(--progress-color)}progress::-webkit-progress-bar{border-radius:var(--border-radius);background:0 0}progress[value]::-webkit-progress-value{background-color:var(--progress-color)}progress::-moz-progress-bar{background-color:var(--progress-color)}@media (prefers-reduced-motion:no-preference){progress:indeterminate{background:var(--progress-background-color) linear-gradient(to right,var(--progress-color) 30%,var(--progress-background-color) 30%) top left/150% 150% no-repeat;animation:progress-indeterminate 1s linear infinite}progress:indeterminate[value]::-webkit-progress-value{background-color:transparent}progress:indeterminate::-moz-progress-bar{background-color:transparent}}@media (prefers-reduced-motion:no-preference){[dir=rtl] progress:indeterminate{animation-direction:reverse}}@keyframes progress-indeterminate{0%{background-position:200% 0}100%{background-position:-200% 0}}details[role=list],li[role=list]{position:relative}details[role=list] summary+ul,li[role=list]>ul{display:flex;z-index:99;position:absolute;top:auto;right:0;left:0;flex-direction:column;margin:0;padding:0;border:var(--border-width) solid var(--dropdown-border-color);border-radius:var(--border-radius);border-top-right-radius:0;border-top-left-radius:0;background-color:var(--dropdown-background-color);box-shadow:var(--card-box-shadow);color:var(--dropdown-color);white-space:nowrap}details[role=list] summary+ul li,li[role=list]>ul li{width:100%;margin-bottom:0;padding:calc(var(--form-element-spacing-vertical) * .5) var(--form-element-spacing-horizontal);list-style:none}details[role=list] summary+ul li:first-of-type,li[role=list]>ul li:first-of-type{margin-top:calc(var(--form-element-spacing-vertical) * .5)}details[role=list] summary+ul li:last-of-type,li[role=list]>ul li:last-of-type{margin-bottom:calc(var(--form-element-spacing-vertical) * .5)}details[role=list] summary+ul li a,li[role=list]>ul li a{display:block;margin:calc(var(--form-element-spacing-vertical) * -.5) calc(var(--form-element-spacing-horizontal) * -1);padding:calc(var(--form-element-spacing-vertical) * .5) var(--form-element-spacing-horizontal);overflow:hidden;color:var(--dropdown-color);text-decoration:none;text-overflow:ellipsis}details[role=list] summary+ul li a:hover,li[role=list]>ul li a:hover{background-color:var(--dropdown-hover-background-color)}details[role=list] summary::after,li[role=list]>a::after{display:block;width:1rem;height:calc(1rem * var(--line-height,1.5));-webkit-margin-start:0.5rem;margin-inline-start:.5rem;float:right;transform:rotate(0);background-position:right center;background-size:1rem auto;background-repeat:no-repeat;content:""}details[role=list]{padding:0;border-bottom:none}details[role=list] summary{margin-bottom:0}details[role=list] summary:not([role]){height:calc(1rem * var(--line-height) + var(--form-element-spacing-vertical) * 2 + var(--border-width) * 2);padding:var(--form-element-spacing-vertical) var(--form-element-spacing-horizontal);border:var(--border-width) solid var(--form-element-border-color);border-radius:var(--border-radius);background-color:var(--form-element-background-color);color:var(--form-element-placeholder-color);line-height:inherit;cursor:pointer;transition:background-color var(--transition),border-color var(--transition),color var(--transition),box-shadow var(--transition)}details[role=list] summary:not([role]):active,details[role=list] summary:not([role]):focus{border-color:var(--form-element-active-border-color);background-color:var(--form-element-active-background-color)}details[role=list] summary:not([role]):focus{box-shadow:0 0 0 var(--outline-width) var(--form-element-focus-color)}details[role=list][open] summary{border-bottom-right-radius:0;border-bottom-left-radius:0}details[role=list][open] summary::before{display:block;z-index:1;position:fixed;top:0;right:0;bottom:0;left:0;background:0 0;content:"";cursor:default}nav details[role=list] summary,nav li[role=list] a{display:flex;direction:ltr}nav details[role=list] summary+ul,nav li[role=list]>ul{min-width:-moz-fit-content;min-width:fit-content;border-radius:var(--border-radius)}nav details[role=list] summary+ul li a,nav li[role=list]>ul li a{border-radius:0}nav details[role=list] summary,nav details[role=list] summary:not([role]){height:auto;padding:var(--nav-link-spacing-vertical) var(--nav-link-spacing-horizontal)}nav details[role=list][open] summary{border-radius:var(--border-radius)}nav details[role=list] summary+ul{margin-top:var(--outline-width);-webkit-margin-start:0;margin-inline-start:0}nav details[role=list] summary[role=link]{margin-bottom:calc(var(--nav-link-spacing-vertical) * -1);line-height:var(--line-height)}nav details[role=list] summary[role=link]+ul{margin-top:calc(var(--nav-link-spacing-vertical) + var(--outline-width));-webkit-margin-start:calc(var(--nav-link-spacing-horizontal) * -1);margin-inline-start:calc(var(--nav-link-spacing-horizontal) * -1)}li[role=list] a:active~ul,li[role=list] a:focus~ul,li[role=list]:hover>ul{display:flex}li[role=list]>ul{display:none;margin-top:calc(var(--nav-link-spacing-vertical) + var(--outline-width));-webkit-margin-start:calc(var(--nav-element-spacing-horizontal) - var(--nav-link-spacing-horizontal));margin-inline-start:calc(var(--nav-element-spacing-horizontal) - var(--nav-link-spacing-horizontal))}li[role=list]>a::after{background-image:var(--icon-chevron)}label>details[role=list]{margin-top:calc(var(--spacing) * .25);margin-bottom:var(--spacing)}[aria-busy=true]{cursor:progress}[aria-busy=true]:not(input,select,textarea,html)::before{display:inline-block;width:1em;height:1em;border:.1875em solid currentColor;border-radius:1em;border-right-color:transparent;content:"";vertical-align:text-bottom;vertical-align:-.125em;animation:spinner .75s linear infinite;opacity:var(--loading-spinner-opacity)}[aria-busy=true]:not(input,select,textarea,html):not(:empty)::before{margin-right:calc(var(--spacing) * .5);margin-left:0;-webkit-margin-start:0;margin-inline-start:0;-webkit-margin-end:calc(var(--spacing) * .5);margin-inline-end:calc(var(--spacing) * .5)}[aria-busy=true]:not(input,select,textarea,html):empty{text-align:center}a[aria-busy=true],button[aria-busy=true],input[type=button][aria-busy=true],input[type=reset][aria-busy=true],input[type=submit][aria-busy=true]{pointer-events:none}@keyframes spinner{to{transform:rotate(360deg)}}[data-tooltip]{position:relative}[data-tooltip]:not(a,button,input){border-bottom:1px dotted;text-decoration:none;cursor:help}[data-tooltip]::after,[data-tooltip]::before,[data-tooltip][data-placement=top]::after,[data-tooltip][data-placement=top]::before{display:block;z-index:99;position:absolute;bottom:100%;left:50%;padding:.25rem .5rem;overflow:hidden;transform:translate(-50%,-.25rem);border-radius:var(--border-radius);background:var(--tooltip-background-color);content:attr(data-tooltip);color:var(--tooltip-color);font-style:normal;font-weight:var(--font-weight);font-size:.875rem;text-decoration:none;text-overflow:ellipsis;white-space:nowrap;opacity:0;pointer-events:none}[data-tooltip]::after,[data-tooltip][data-placement=top]::after{padding:0;transform:translate(-50%,0);border-top:.3rem solid;border-right:.3rem solid transparent;border-left:.3rem solid transparent;border-radius:0;background-color:transparent;content:"";color:var(--tooltip-background-color)}[data-tooltip][data-placement=bottom]::after,[data-tooltip][data-placement=bottom]::before{top:100%;bottom:auto;transform:translate(-50%,.25rem)}[data-tooltip][data-placement=bottom]:after{transform:translate(-50%,-.3rem);border:.3rem solid transparent;border-bottom:.3rem solid}[data-tooltip][data-placement=left]::after,[data-tooltip][data-placement=left]::before{top:50%;right:100%;bottom:auto;left:auto;transform:translate(-.25rem,-50%)}[data-tooltip][data-placement=left]:after{transform:translate(.3rem,-50%);border:.3rem solid transparent;border-left:.3rem solid}[data-tooltip][data-placement=right]::after,[data-tooltip][data-placement=right]::before{top:50%;right:auto;bottom:auto;left:100%;transform:translate(.25rem,-50%)}[data-tooltip][data-placement=right]:after{transform:translate(-.3rem,-50%);border:.3rem solid transparent;border-right:.3rem solid}[data-tooltip]:focus::after,[data-tooltip]:focus::before,[data-tooltip]:hover::after,[data-tooltip]:hover::before{opacity:1}@media (hover:hover) and (pointer:fine){[data-tooltip]:hover::after,[data-tooltip]:hover::before,[data-tooltip][data-placement=bottom]:focus::after,[data-tooltip][data-placement=bottom]:focus::before,[data-tooltip][data-placement=bottom]:hover [data-tooltip]:focus::after,[data-tooltip][data-placement=bottom]:hover [data-tooltip]:focus::before{animation-duration:.2s;animation-name:tooltip-slide-top}[data-tooltip]:hover::after,[data-tooltip][data-placement=bottom]:focus::after,[data-tooltip][data-placement=bottom]:hover [data-tooltip]:focus::after{animation-name:tooltip-caret-slide-top}[data-tooltip][data-placement=bottom]:focus::after,[data-tooltip][data-placement=bottom]:focus::before,[data-tooltip][data-placement=bottom]:hover::after,[data-tooltip][data-placement=bottom]:hover::before{animation-duration:.2s;animation-name:tooltip-slide-bottom}[data-tooltip][data-placement=bottom]:focus::after,[data-tooltip][data-placement=bottom]:hover::after{animation-name:tooltip-caret-slide-bottom}[data-tooltip][data-placement=left]:focus::after,[data-tooltip][data-placement=left]:focus::before,[data-tooltip][data-placement=left]:hover::after,[data-tooltip][data-placement=left]:hover::before{animation-duration:.2s;animation-name:tooltip-slide-left}[data-tooltip][data-placement=left]:focus::after,[data-tooltip][data-placement=left]:hover::after{animation-name:tooltip-caret-slide-left}[data-tooltip][data-placement=right]:focus::after,[data-tooltip][data-placement=right]:focus::before,[data-tooltip][data-placement=right]:hover::after,[data-tooltip][data-placement=right]:hover::before{animation-duration:.2s;animation-name:tooltip-slide-right}[data-tooltip][data-placement=right]:focus::after,[data-tooltip][data-placement=right]:hover::after{animation-name:tooltip-caret-slide-right}}@keyframes tooltip-slide-top{from{transform:translate(-50%,.75rem);opacity:0}to{transform:translate(-50%,-.25rem);opacity:1}}@keyframes tooltip-caret-slide-top{from{opacity:0}50%{transform:translate(-50%,-.25rem);opacity:0}to{transform:translate(-50%,0);opacity:1}}@keyframes tooltip-slide-bottom{from{transform:translate(-50%,-.75rem);opacity:0}to{transform:translate(-50%,.25rem);opacity:1}}@keyframes tooltip-caret-slide-bottom{from{opacity:0}50%{transform:translate(-50%,-.5rem);opacity:0}to{transform:translate(-50%,-.3rem);opacity:1}}@keyframes tooltip-slide-left{from{transform:translate(.75rem,-50%);opacity:0}to{transform:translate(-.25rem,-50%);opacity:1}}@keyframes tooltip-caret-slide-left{from{opacity:0}50%{transform:translate(.05rem,-50%);opacity:0}to{transform:translate(.3rem,-50%);opacity:1}}@keyframes tooltip-slide-right{from{transform:translate(-.75rem,-50%);opacity:0}to{transform:translate(.25rem,-50%);opacity:1}}@keyframes tooltip-caret-slide-right{from{opacity:0}50%{transform:translate(-.05rem,-50%);opacity:0}to{transform:translate(-.3rem,-50%);opacity:1}}[aria-controls]{cursor:pointer}[aria-disabled=true],[disabled]{cursor:not-allowed}[aria-hidden=false][hidden]{display:initial}[aria-hidden=false][hidden]:not(:focus){clip:rect(0,0,0,0);position:absolute}[tabindex],a,area,button,input,label,select,summary,textarea{-ms-touch-action:manipulation}[dir=rtl]{direction:rtl}@media (prefers-reduced-motion:reduce){:not([aria-busy=true]),:not([aria-busy=true])::after,:not([aria-busy=true])::before{background-attachment:initial!important;animation-duration:1ms!important;animation-delay:-1ms!important;animation-iteration-count:1!important;scroll-behavior:auto!important;transition-delay:0s!important;transition-duration:0s!important}}
+
/*# sourceMappingURL=pico.min.css.map */
+5
go-didplc/cmd/webplc/static/robots.txt
···
+
# Hello Friends!
+
+
# By default, may crawl anything on this domain. HTTP 429 ("backoff") status codes are used for rate-limiting. Up to a handful of concurrent requests should be ok.
+
User-Agent: *
+
Allow: /
+94
go-didplc/cmd/webplc/templates/base.html
···
+
<!doctype html>
+
<html lang="en">
+
<head>
+
<meta charset="utf-8">
+
<meta name="referrer" content="origin-when-cross-origin">
+
<meta name="viewport" content="width=device-width, initial-scale=1">
+
<link rel="stylesheet" href="/static/pico.min.css">
+
<title>{%- block head_title -%}did:plc Directory{%- endblock -%}</title>
+
<style>
+
html { position: relative; min-height: 100%; height: auto; }
+
body { margin-bottom: 3em; }
+
body > nav { background-color: var(--muted-border-color); }
+
body > footer { position: absolute; bottom: 0px; padding: 2em; background-color: var(--muted-border-color); }
+
thead th { font-weight: bold; }
+
main article { margin: 2.5rem 0; padding: 2rem; }
+
+
/* Green Light scheme (Default) */
+
/* Can be forced with data-theme="light" */
+
[data-theme="light"],
+
:root:not([data-theme="dark"]) {
+
--color: black;
+
--primary: #3949ab;
+
--primary-hover: #3f51b5;
+
--primary-focus: rgba(57, 73, 171, 0.125);
+
--primary-inverse: #FFF;
+
--code-color: var(--color);
+
}
+
+
/* Green Dark scheme (Auto) */
+
/* Automatically enabled if user has Dark mode enabled */
+
@media only screen and (prefers-color-scheme: dark) {
+
:root:not([data-theme]) {
+
--color: white;
+
--primary: #3949ab;
+
--primary-hover: #3f51b5;
+
--primary-focus: rgba(57, 73, 171, 0.25);
+
--primary-inverse: #FFF;
+
--code-color: var(--color);
+
}
+
}
+
+
/* Green Dark scheme (Forced) */
+
/* Enabled if forced with data-theme="dark" */
+
[data-theme="dark"] {
+
--color: white;
+
/* --muted-color: white; */
+
--primary: #3949ab;
+
--primary-hover: #3f51b5;
+
--primary-focus: rgba(57, 73, 171, 0.25);
+
--primary-inverse: #FFF;
+
--code-color: var(--color);
+
}
+
+
/* Green (Common styles) */
+
:root {
+
--form-element-active-border-color: var(--primary);
+
--form-element-focus-color: var(--primary-focus);
+
--switch-color: var(--primary-inverse);
+
--switch-checked-background-color: var(--primary);
+
}
+
</style>
+
{# <link rel="apple-touch-icon" sizes="180x180" href="/static/apple-touch-icon.png"> #}
+
{# <link rel="icon" type="image/png" sizes="32x32" href="/static/favicon-32x32.png"> #}
+
{# <link rel="icon" type="image/png" sizes="16x16" href="/static/favicon-16x16.png"> #}
+
{% block html_head_extra -%}{%- endblock %}
+
<meta name="application-name" name="DID PLC Directory">
+
<meta name="generator" name="webplc">
+
</head>
+
<body>
+
{%- block body_all %}
+
<nav class="container-fluid">
+
<ul>
+
<li><a href="/"><strong>did:plc</strong></a></li>
+
</ul>
+
<ul>
+
<li><a href="/resolve" >Lookup</a> </li>
+
<li><a href="/api/redoc" >API</a> </li>
+
<li><a href="/spec/v0.1/did-plc" >Specification</a> </li>
+
<li><a href="https://github.com/bluesky-social/did-method-plc">Code</a></li>
+
</ul>
+
</nav>
+
+
<main class="container">
+
{% block main %}{% endblock %}
+
</main>
+
+
<footer class="container-fluid">
+
<div class="container">
+
<small>Developed by <a href="https://blueskyweb.xyz">Bluesky PBC</a> for <a href="https://atproto.com">atproto</a></small>
+
</div>
+
</footer>
+
{% endblock -%}
+
</body>
+
</html>
+88
go-didplc/cmd/webplc/templates/did.html
···
+
{% extends "base.html" %}
+
+
{% block head_title -%}
+
{{ did }}
+
{%- endblock %}
+
+
{% block main -%}
+
<h3 style="font-family: monospace;">{{ did }}</h3>
+
+
{% if result.StatusCode == 200 %}
+
+
<article>
+
<h4 style="margin-bottom: 1em;">Names and Aliases</h4>
+
<div style="width: 100%; overflow-x: auto;">
+
<table role="grid" style="width: 100%;">
+
<thead>
+
<tr>
+
<th>URI</th>
+
</tr>
+
</thead>
+
<tbody style="font-family: monospace;">
+
{% for uri in result.Doc.AlsoKnownAs %}
+
<tr>
+
<td>{{ uri }}</td>
+
</tr>
+
{% endfor %}
+
</tbody>
+
</table>
+
</div>
+
</article>
+
+
<article>
+
<h4 style="margin-bottom: 1em;">Services</h4>
+
<div style="width: 100%; overflow-x: auto;">
+
<table role="grid" style="width: 100%;">
+
<thead>
+
<tr>
+
<th>ID</th>
+
<th>Type</th>
+
<th>URL</th>
+
</tr>
+
</thead>
+
<tbody style="font-family: monospace;">
+
{% for vm in result.Doc.Service %}
+
<tr>
+
<td>{{ vm.Id }}</td>
+
<td>{{ vm.Type }}</td>
+
<td>{{ vm.ServiceEndpoint }}</td>
+
</tr>
+
{% endfor %}
+
</tbody>
+
</table>
+
</div>
+
</article>
+
+
<article>
+
<h4 style="margin-bottom: 1em;">Verification Methods</h4>
+
<div style="width: 100%; overflow-x: auto;">
+
<table role="grid" style="width: 100%;">
+
<thead>
+
<tr>
+
<th>ID</th>
+
<th>Type</th>
+
<th>Public Key (multibase-encoded)</th>
+
</tr>
+
</thead>
+
<tbody style="font-family: monospace;">
+
{% for vm in result.Doc.VerificationMethod %}
+
<tr>
+
<td>{{ vm.Id }}</td>
+
<td>{{ vm.Type }}</td>
+
<td>{{ vm.PublicKeyMultibase }}</td>
+
</tr>
+
{% endfor %}
+
</tbody>
+
</table>
+
</div>
+
</article>
+
+
<article>
+
<h4>DID Document JSON</h4>
+
<pre><code>
+
{{- result.DocJson -}}
+
</code></pre>
+
</article>
+
{% endif %}
+
+
{%- endblock %}
+20
go-didplc/cmd/webplc/templates/error.html
···
+
{% extends "base.html" %}
+
+
{% block head_title %}Error {{ statusCode }} - did:plc{% endblock %}
+
+
{%- block main %}
+
{% if statusCode == 404 %}
+
<h1>404: Not Found</h1>
+
{% elif statusCode == 410 %}
+
<h1>410: Gone</h1>
+
{% elif statusCode == 400 %}
+
<h1>400: Bad Request</h1>
+
{% else %}
+
<h1>{{ statusCode }}: Server Error</h1>
+
{% endif %}
+
{% if errorMessage %}
+
<p>{{ errorMessage }}
+
{% else %}
+
<p>Sorry about that! Our <a href="https://status.bsky.app/">Status Page</a> might have more context.
+
{% endif %}
+
{% endblock -%}
+26
go-didplc/cmd/webplc/templates/home.html
···
+
{% extends "base.html" %}
+
+
{% block main -%}
+
<hgroup>
+
<h1>DID PLC Directory</h1>
+
<h3>A self-authenticating Decentralized Identifier (DID) system which is strongly-consistent, recoverable, and allows for key rotation</h3>
+
</hgroup>
+
+
<p>PLC is a persistent global identifier system, which allows accounts to retain relationships while changing names or migrating between service providers. It makes use of cryptography and gives individuals (or organizations) direct control and ownership over their identitifier, but does not make use of any blockchain or cryptocurrency technology, and is inexpensive enough to provide as a no-cost service.</p>
+
+
<p>PLC is a method which implements the W3C Decentralized Identifier (DID) standard. This means it is interoperable and resuable by other applications and organization.</p>
+
+
<p>Bluesky PBC developed DID Placeholder when designing the AT Protocol (atproto) because we were not satisfied with any of the existing DID methods. We wanted a strongly consistent, highly available, recoverable, and cryptographically secure method with fast and cheap propagation of updates.</p>
+
+
<p>While PLC originally stood for "placeholder", the system has been in production use for several months, with over half a million registered accounts in the atproto network as of August 2023. While it is conceivable that the method will evolve or be replaced over time by a successor method, we feel that the current system provides value and is worth consideration as a persistent identifier for other applications.</p>
+
+
<article>
+
<h3>For Developers</h3>
+
<p>DID resolution can be as simple as:
+
<pre><code>curl -s "https://plc.directory/did:plc:ewvi7nxzyoun6zhxrhs64oiz" | jq .</pre></code>
+
<p>Jump in to the <a href="/spec/v0.1/did-plc">specification</a> to understand how to verify self-certifying operation logs.
+
</p>
+
<p>Check out the <a href="/api/redoc">HTTP API documentation</a> (generated from an OpenAPI schema) for details on how to submit operations, fetch the current DID document, or get a paginated export of all operations for all accounts.</p>
+
</article>
+
+
{%- endblock %}
+9
go-didplc/cmd/webplc/templates/markdown.html
···
+
{% extends "base.html" %}
+
+
{% block head_title %}
+
{{ html_title }}
+
{% endblock %}
+
+
{% block main -%}
+
{{ markdown_html|safe }}
+
{%- endblock %}
+21
go-didplc/cmd/webplc/templates/redoc.html
···
+
<!DOCTYPE html>
+
<html>
+
<head>
+
<title>Redoc</title>
+
<!-- needed for adaptive design -->
+
<meta charset="utf-8"/>
+
<meta name="viewport" content="width=device-width, initial-scale=1">
+
<link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet">
+
<!-- Redoc doesn't change outer page styles -->
+
<style>
+
body {
+
margin: 0;
+
padding: 0;
+
}
+
</style>
+
</head>
+
<body>
+
<redoc spec-url='/api/plc-server-openapi3.yaml'></redoc>
+
<script src="https://cdn.redoc.ly/redoc/latest/bundles/redoc.standalone.js"> </script>
+
</body>
+
</html>
+13
go-didplc/cmd/webplc/templates/resolve.html
···
+
{% extends "base.html" %}
+
+
{% block head_title %}
+
Resolve did:plc
+
{% endblock %}
+
+
{% block main -%}
+
<h2>Resolve a did:plc Identifier</h2>
+
<form action="/resolve" method="get">
+
<input type="search" name="did" placeholder="did:plc: [...]" style="width: 100%;">
+
</form>
+
<p>Example: <a href="/did/did:plc:ewvi7nxzyoun6zhxrhs64oiz"><code>did:plc:ewvi7nxzyoun6zhxrhs64oiz</code></a>
+
{%- endblock %}
+3
go-didplc/example.dev.env
···
+
ATP_PLC_HOST='http://localhost:2582'
+
DEBUG='true'
+
GOLOG_LOG_LEVEL=debug
+4
go-didplc/example.env
···
+
#ATP_PLC_HOST='https://plc.directory'
+
#HTTP_ADDRESS=':8700'
+
#DEBUG='false'
+
#GOLOG_LOG_LEVEL=warn
+35
go-didplc/go.mod
···
+
module github.com/bluesky-social/did-method-plc/webplc
+
+
go 1.20
+
+
require (
+
github.com/flosch/pongo2/v6 v6.0.0
+
github.com/ipfs/go-log v1.0.5
+
github.com/joho/godotenv v1.5.1
+
github.com/klauspost/compress v1.16.7
+
github.com/labstack/echo/v4 v4.11.1
+
github.com/urfave/cli/v2 v2.25.7
+
)
+
+
require (
+
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+
github.com/gogo/protobuf v1.3.2 // indirect
+
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
+
github.com/ipfs/go-log/v2 v2.1.3 // indirect
+
github.com/labstack/gommon v0.4.0 // indirect
+
github.com/mattn/go-colorable v0.1.13 // indirect
+
github.com/mattn/go-isatty v0.0.19 // indirect
+
github.com/opentracing/opentracing-go v1.2.0 // indirect
+
github.com/russross/blackfriday/v2 v2.1.0 // indirect
+
github.com/valyala/bytebufferpool v1.0.0 // indirect
+
github.com/valyala/fasttemplate v1.2.2 // indirect
+
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
+
go.uber.org/atomic v1.7.0 // indirect
+
go.uber.org/multierr v1.6.0 // indirect
+
go.uber.org/zap v1.16.0 // indirect
+
golang.org/x/crypto v0.11.0 // indirect
+
golang.org/x/net v0.12.0 // indirect
+
golang.org/x/sys v0.10.0 // indirect
+
golang.org/x/text v0.11.0 // indirect
+
golang.org/x/time v0.3.0 // indirect
+
)
+136
go-didplc/go.sum
···
+
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+
github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+
github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
+
github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+
github.com/flosch/pongo2/v6 v6.0.0 h1:lsGru8IAzHgIAw6H2m4PCyleO58I40ow6apih0WprMU=
+
github.com/flosch/pongo2/v6 v6.0.0/go.mod h1:CuDpFm47R0uGGE7z13/tTlt1Y6zdxvr2RLT5LJhsHEU=
+
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
+
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
+
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+
github.com/ipfs/go-log v1.0.5 h1:2dOuUCB1Z7uoczMWgAyDck5JLb72zHzrMnGnCNNbvY8=
+
github.com/ipfs/go-log v1.0.5/go.mod h1:j0b8ZoR+7+R99LD9jZ6+AJsrzkPbSXbZfGakb5JPtIo=
+
github.com/ipfs/go-log/v2 v2.1.3 h1:1iS3IU7aXRlbgUpN8yTTpJ53NXYjAe37vcI5+5nYrzk=
+
github.com/ipfs/go-log/v2 v2.1.3/go.mod h1:/8d0SH3Su5Ooc31QlL1WysJhvyOTDCjcCZ9Axpmri6g=
+
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+
github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
+
github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+
github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
+
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+
github.com/labstack/echo/v4 v4.11.1 h1:dEpLU2FLg4UVmvCGPuk/APjlH6GDpbEPti61srUUUs4=
+
github.com/labstack/echo/v4 v4.11.1/go.mod h1:YuYRTSM3CHs2ybfrL8Px48bO6BAnYIN4l8wSTMP6BDQ=
+
github.com/labstack/gommon v0.4.0 h1:y7cvthEAEbU0yHOf4axH8ZG2NH8knB9iNSoTO8dyIk8=
+
github.com/labstack/gommon v0.4.0/go.mod h1:uW6kP17uPlLJsD3ijUYn3/M5bAxtlZhMI6m3MFxTMTM=
+
github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+
github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+
github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+
github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+
github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
+
github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
+
github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+
github.com/urfave/cli/v2 v2.25.7 h1:VAzn5oq403l5pHjc4OhD54+XGO9cdKVL/7lDjF+iKUs=
+
github.com/urfave/cli/v2 v2.25.7/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
+
github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
+
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
+
github.com/valyala/fasttemplate v1.2.1/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
+
github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
+
github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
+
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
+
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
+
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+
go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+
go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+
go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+
go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+
go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
+
go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+
go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+
go.uber.org/zap v1.16.0 h1:uFRZXykJGK9lLY4HtgSw44DnIcAM+kRBP7x5m+NpAOM=
+
go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
+
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+
golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
+
golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+
golang.org/x/lint v0.0.0-20190930215403-16217165b5de h1:5hukYrvBGR8/eNkX5mdUezrA6JiaEZDtJb9Ei+1LlBs=
+
golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+
golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+
golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
+
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+
golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
+
golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
+
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+
golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+
golang.org/x/sys v0.0.0-20211103235746-7861aae1554b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+
golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
+
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
+
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+
golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+
golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+
golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+
golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
+
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+
gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+
honnef.co/go/tools v0.0.1-2019.2.3 h1:3JgtbtFHMiCmsznwGVTUWbgGov+pVqnlf1dEJTNAXeM=
+
honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+1
go-didplc/static
···
+
cmd/webplc/static/
+1
go-didplc/templates
···
+
cmd/webplc/templates/
+1 -1
package.json
···
"name": "did-method-plc",
"version": "0.0.1",
"repository": "git@github.com:bluesky-social/did-method-plc.git",
-
"author": "Bluesky PBLLC <hello@blueskyweb.xyz>",
+
"author": "Bluesky PBC <hello@blueskyweb.xyz>",
"license": "MIT",
"private": true,
"engines": {
+50 -1
packages/lib/README.md
···
-
# DID PLC Library
+
+
@did-plc/lib - DID PLC Typescript Client Library
+
================================================
+
+
[![NPM](https://img.shields.io/npm/v/@did-plc/lib)](https://www.npmjs.com/package/@did-plc/lib)
+
[![Github CI Status](https://github.com/bluesky-social/did-method-plc/actions/workflows/repo.yaml/badge.svg)](https://github.com/bluesky-social/did-method-plc/actions/workflows/repo.yaml)
+
+
This library provides both a simple client for the PLC directory, and an implementation of the PLC method itself (using a cryptographically signed operation log).
+
+
## Client Usage
+
+
Fetching account data from directory:
+
+
```typescript
+
import * as plc from '@did-plc/lib'
+
+
client = new plc.Client('https://plc.directory')
+
+
let exampleDid = 'did:plc:yk4dd2qkboz2yv6tpubpc6co'
+
+
// current account data, in terse object format
+
const data = await client.getDocumentData(exampleDid)
+
+
// or, the full DID Document
+
const didDoc = await client.getDocument(exampleDid)
+
```
+
+
Registering a new DID PLC:
+
+
```typescript
+
import { Secp256k1Keypair } from '@atproto/crypto'
+
import * as plc from '@did-plc/lib'
+
+
// please test against a sandbox or local development server
+
client = new plc.Client('http://localhost:2582')
+
+
let signingKey = await Secp256k1Keypair.create()
+
let rotationKey = await Secp256k1Keypair.create()
+
+
did = await client.createDid({
+
signingKey: signingKey.did(),
+
handle: 'handle.example.com',
+
pds: 'https://pds.example.com',
+
rotationKeys: [rotationKey.did()],
+
signer: rotationKey,
+
})
+
```
+
## License
+
+
MIT / Apache 2.0 dual-licensed.
+16 -4
packages/lib/package.json
···
{
"name": "@did-plc/lib",
"version": "0.0.4",
-
"main": "src/index.ts",
"license": "MIT",
+
"description": "DID PLC Typescript Client Library",
+
"keywords": [
+
"did-plc",
+
"did",
+
"atproto"
+
],
+
"homepage": "https://web.plc.directory",
+
"repository": {
+
"type": "git",
+
"url": "https://github.com/bluesky-social/did-method-plc",
+
"directory": "packages/lib"
+
},
+
"main": "dist/index.js",
"scripts": {
"test": "jest",
"prettier": "prettier --check src/",
···
"postpublish": "npm run update-main-to-src"
},
"dependencies": {
-
"@atproto/common": "0.1.1",
-
"@atproto/crypto": "0.1.0",
+
"@atproto/common": "0.3.0",
+
"@atproto/crypto": "0.2.2",
"@ipld/dag-cbor": "^7.0.3",
"axios": "^1.3.4",
"multiformats": "^9.6.4",
"uint8arrays": "3.0.0",
-
"zod": "^3.14.2"
+
"zod": "^3.21.4"
},
"devDependencies": {
"eslint-plugin-prettier": "^4.2.1"
-8
packages/lib/src/data.ts
···
import * as t from './types'
import {
assureValidCreationOp,
-
assureValidOp,
assureValidSig,
normalizeOp,
} from './operations'
···
ops: t.IndexedOperation[],
proposed: t.CompatibleOpOrTombstone,
): Promise<{ nullified: CID[]; prev: CID | null }> => {
-
if (check.is(proposed, t.def.createOpV1)) {
-
const normalized = normalizeOp(proposed)
-
await assureValidOp(normalized)
-
} else {
-
await assureValidOp(proposed)
-
}
-
// special case if account creation
if (ops.length === 0) {
await assureValidCreationOp(did, proposed)
+2 -2
packages/lib/src/document.ts
···
import * as crypto from '@atproto/crypto'
import * as t from './types'
import { UnsupportedKeyError } from './error'
-
import { ParsedDidKey } from '@atproto/crypto'
+
import { ParsedMultikey } from '@atproto/crypto'
export const formatDidDoc = (data: t.DocumentData): t.DidDocument => {
const context = [
···
}
const formatKeyAndContext = (key: string): KeyAndContext => {
-
let keyInfo: ParsedDidKey
+
let keyInfo: ParsedMultikey
try {
keyInfo = crypto.parseDidKey(key)
} catch (err) {
+1 -25
packages/lib/src/operations.ts
···
import * as cbor from '@ipld/dag-cbor'
import { CID } from 'multiformats/cid'
import * as uint8arrays from 'uint8arrays'
-
import { Keypair, parseDidKey, sha256, verifySignature } from '@atproto/crypto'
+
import { Keypair, sha256, verifySignature } from '@atproto/crypto'
import { check, cidForCbor } from '@atproto/common'
import * as t from './types'
import {
···
ImproperOperationError,
InvalidSignatureError,
MisorderedOperationError,
-
UnsupportedKeyError,
} from './error'
export const didForCreateOp = async (op: t.CompatibleOp) => {
···
// Verifying operations/signatures
// ---------------------------
-
export const assureValidOp = async (op: t.OpOrTombstone) => {
-
if (check.is(op, t.def.tombstone)) {
-
return true
-
}
-
// ensure we support the op's keys
-
const keys = [...Object.values(op.verificationMethods), ...op.rotationKeys]
-
await Promise.all(
-
keys.map(async (k) => {
-
try {
-
parseDidKey(k)
-
} catch (err) {
-
throw new UnsupportedKeyError(k, err)
-
}
-
}),
-
)
-
if (op.rotationKeys.length > 5) {
-
throw new ImproperOperationError('too many rotation keys', op)
-
} else if (op.rotationKeys.length < 1) {
-
throw new ImproperOperationError('need at least one rotation key', op)
-
}
-
}
-
export const assureValidCreationOp = async (
did: string,
op: t.CompatibleOpOrTombstone,
···
throw new MisorderedOperationError()
}
const normalized = normalizeOp(op)
-
await assureValidOp(normalized)
await assureValidSig(normalized.rotationKeys, op)
const expectedDid = await didForCreateOp(op)
if (expectedDid !== did) {
+18 -14
packages/lib/src/types.ts
···
const createOpV1 = unsignedCreateOpV1.extend({ sig: z.string() })
export type CreateOpV1 = z.infer<typeof createOpV1>
-
const unsignedOperation = z.object({
-
type: z.literal('plc_operation'),
-
rotationKeys: z.array(z.string()),
-
verificationMethods: z.record(z.string()),
-
alsoKnownAs: z.array(z.string()),
-
services: z.record(service),
-
prev: z.string().nullable(),
-
})
+
const unsignedOperation = z
+
.object({
+
type: z.literal('plc_operation'),
+
rotationKeys: z.array(z.string()),
+
verificationMethods: z.record(z.string()),
+
alsoKnownAs: z.array(z.string()),
+
services: z.record(service),
+
prev: z.string().nullable(),
+
})
+
.strict()
export type UnsignedOperation = z.infer<typeof unsignedOperation>
-
const operation = unsignedOperation.extend({ sig: z.string() })
+
const operation = unsignedOperation.extend({ sig: z.string() }).strict()
export type Operation = z.infer<typeof operation>
-
const unsignedTombstone = z.object({
-
type: z.literal('plc_tombstone'),
-
prev: z.string(),
-
})
+
const unsignedTombstone = z
+
.object({
+
type: z.literal('plc_tombstone'),
+
prev: z.string(),
+
})
+
.strict()
export type UnsignedTombstone = z.infer<typeof unsignedTombstone>
-
const tombstone = unsignedTombstone.extend({ sig: z.string() })
+
const tombstone = unsignedTombstone.extend({ sig: z.string() }).strict()
export type Tombstone = z.infer<typeof tombstone>
const opOrTombstone = z.union([operation, tombstone])
+3 -3
packages/lib/tests/data.test.ts
···
import { check, cidForCbor } from '@atproto/common'
-
import { EcdsaKeypair, Secp256k1Keypair } from '@atproto/crypto'
+
import { P256Keypair, Secp256k1Keypair } from '@atproto/crypto'
import {
GenesisHashError,
ImproperOperationError,
···
let signingKey: Secp256k1Keypair
let rotationKey1: Secp256k1Keypair
-
let rotationKey2: EcdsaKeypair
+
let rotationKey2: P256Keypair
let did: string
let handle = 'at://alice.example.com'
let atpPds = 'https://example.com'
···
beforeAll(async () => {
signingKey = await Secp256k1Keypair.create()
rotationKey1 = await Secp256k1Keypair.create()
-
rotationKey2 = await EcdsaKeypair.create()
+
rotationKey2 = await P256Keypair.create()
})
const lastOp = () => {
+3 -3
packages/lib/tests/document.test.ts
···
-
import { EcdsaKeypair, parseDidKey, Secp256k1Keypair } from '@atproto/crypto'
+
import { P256Keypair, parseDidKey, Secp256k1Keypair } from '@atproto/crypto'
import * as document from '../src/document'
import * as t from '../src/types'
describe('document', () => {
it('formats a valid DID document', async () => {
const atprotoKey = await Secp256k1Keypair.create()
-
const otherKey = await EcdsaKeypair.create()
+
const otherKey = await P256Keypair.create()
const rotate1 = await Secp256k1Keypair.create()
-
const rotate2 = await EcdsaKeypair.create()
+
const rotate2 = await P256Keypair.create()
const alsoKnownAs = ['at://alice.test', 'https://bob.test']
const atpPds = 'https://example.com'
const otherService = 'https://other.com'
+5 -5
packages/lib/tests/recovery.test.ts
···
import { cidForCbor, DAY, HOUR } from '@atproto/common'
-
import { EcdsaKeypair, Keypair, Secp256k1Keypair } from '@atproto/crypto'
+
import { P256Keypair, Keypair, Secp256k1Keypair } from '@atproto/crypto'
import { CID } from 'multiformats/cid'
import { InvalidSignatureError, LateRecoveryError } from '../src'
import * as data from '../src/data'
···
describe('plc recovery', () => {
let signingKey: Secp256k1Keypair
let rotationKey1: Secp256k1Keypair
-
let rotationKey2: EcdsaKeypair
-
let rotationKey3: EcdsaKeypair
+
let rotationKey2: P256Keypair
+
let rotationKey3: P256Keypair
let did: string
const handle = 'alice.example.com'
const atpPds = 'https://example.com'
···
beforeAll(async () => {
signingKey = await Secp256k1Keypair.create()
rotationKey1 = await Secp256k1Keypair.create()
-
rotationKey2 = await EcdsaKeypair.create()
-
rotationKey3 = await EcdsaKeypair.create()
+
rotationKey2 = await P256Keypair.create()
+
rotationKey3 = await P256Keypair.create()
})
const formatIndexed = async (
+11 -1
packages/server/README.md
···
-
# DID PLC Server
+
+
@did-plc/server - DID PLC Directory Service
+
===========================================
+
+
Reference implementation of the PLC DID method, in Typescript.
+
+
This is the software that runs the <https://plc.directory> service.
+
+
## License
+
+
MIT / Apache 2.0 dual-licensed.
+15 -3
packages/server/package.json
···
{
"name": "@did-plc/server",
"version": "0.0.1",
-
"main": "dist/index.js",
"license": "MIT",
+
"description": "DID PLC Directory Service",
+
"keywords": [
+
"did-plc",
+
"did",
+
"atproto"
+
],
+
"homepage": "https://web.plc.directory",
+
"repository": {
+
"type": "git",
+
"url": "https://github.com/bluesky-social/did-method-plc",
+
"directory": "packages/server"
+
},
+
"main": "dist/index.js",
"scripts": {
"start": "node dist/bin.js",
"test": "./pg/with-test-db.sh jest",
···
"postpublish": "npm run update-main-to-src"
},
"dependencies": {
-
"@atproto/common": "0.1.1",
-
"@atproto/crypto": "0.1.0",
+
"@atproto/common": "0.3.0",
+
"@atproto/crypto": "0.2.2",
"@did-plc/lib": "*",
"axios": "^1.3.4",
"cors": "^2.8.5",
+147
packages/server/src/constraints.ts
···
+
import { DAY, HOUR, cborEncode, check } from '@atproto/common'
+
import * as plc from '@did-plc/lib'
+
import { ServerError } from './error'
+
import { parseDidKey } from '@atproto/crypto'
+
+
const MAX_OP_BYTES = 4000
+
const MAX_AKA_ENTRIES = 10
+
const MAX_AKA_LENGTH = 256
+
const MAX_ROTATION_ENTRIES = 10
+
const MAX_SERVICE_ENTRIES = 10
+
const MAX_SERVICE_TYPE_LENGTH = 256
+
const MAX_SERVICE_ENDPOINT_LENGTH = 512
+
const MAX_ID_LENGTH = 32
+
+
export function assertValidIncomingOp(
+
op: unknown,
+
): asserts op is plc.OpOrTombstone {
+
const byteLength = cborEncode(op).byteLength
+
if (byteLength > MAX_OP_BYTES) {
+
throw new ServerError(
+
400,
+
`Operation too large (${MAX_OP_BYTES} bytes maximum in cbor encoding)`,
+
)
+
}
+
if (!check.is(op, plc.def.opOrTombstone)) {
+
throw new ServerError(400, `Not a valid operation: ${JSON.stringify(op)}`)
+
}
+
if (op.type === 'plc_tombstone') {
+
return
+
}
+
if (op.alsoKnownAs.length > MAX_AKA_ENTRIES) {
+
throw new ServerError(
+
400,
+
`To many alsoKnownAs entries (max ${MAX_AKA_ENTRIES})`,
+
)
+
}
+
const akaDupe: Record<string, boolean> = {}
+
for (const aka of op.alsoKnownAs) {
+
if (aka.length > MAX_AKA_LENGTH) {
+
throw new ServerError(
+
400,
+
`alsoKnownAs entry too long (max ${MAX_AKA_LENGTH}): ${aka}`,
+
)
+
}
+
if (akaDupe[aka]) {
+
throw new ServerError(400, `duplicate alsoKnownAs entry: ${aka}`)
+
} else {
+
akaDupe[aka] = true
+
}
+
}
+
if (op.rotationKeys.length > MAX_ROTATION_ENTRIES) {
+
throw new ServerError(
+
400,
+
`Too many rotationKey entries (max ${MAX_ROTATION_ENTRIES})`,
+
)
+
}
+
for (const key of op.rotationKeys) {
+
try {
+
parseDidKey(key)
+
} catch (err) {
+
throw new ServerError(400, `Invalid rotationKey: ${key}`)
+
}
+
}
+
const serviceEntries = Object.entries(op.services)
+
if (serviceEntries.length > MAX_SERVICE_ENTRIES) {
+
throw new ServerError(
+
400,
+
`To many service entries (max ${MAX_SERVICE_ENTRIES})`,
+
)
+
}
+
for (const [id, service] of serviceEntries) {
+
if (id.length > MAX_ID_LENGTH) {
+
throw new ServerError(
+
400,
+
`Service id too long (max ${MAX_ID_LENGTH}): ${id}`,
+
)
+
}
+
if (service.type.length > MAX_SERVICE_TYPE_LENGTH) {
+
throw new ServerError(
+
400,
+
`Service type too long (max ${MAX_SERVICE_TYPE_LENGTH})`,
+
)
+
}
+
if (service.endpoint.length > MAX_SERVICE_ENDPOINT_LENGTH) {
+
throw new ServerError(
+
400,
+
`Service endpoint too long (max ${MAX_SERVICE_ENDPOINT_LENGTH})`,
+
)
+
}
+
}
+
const verifyMethods = Object.entries(op.verificationMethods)
+
for (const [id, key] of verifyMethods) {
+
if (id.length > MAX_ID_LENGTH) {
+
throw new ServerError(
+
400,
+
`Verification Method id too long (max ${MAX_ID_LENGTH}): ${id}`,
+
)
+
}
+
try {
+
parseDidKey(key)
+
} catch (err) {
+
throw new ServerError(400, `Invalid verificationMethod key: ${key}`)
+
}
+
}
+
}
+
+
const HOUR_LIMIT = 10
+
const DAY_LIMIT = 30
+
const WEEK_LIMIT = 100
+
+
export const enforceOpsRateLimit = (ops: plc.IndexedOperation[]) => {
+
const hourAgo = new Date(Date.now() - HOUR)
+
const dayAgo = new Date(Date.now() - DAY)
+
const weekAgo = new Date(Date.now() - DAY * 7)
+
let withinHour = 0
+
let withinDay = 0
+
let withinWeek = 0
+
for (const op of ops) {
+
if (op.createdAt > weekAgo) {
+
withinWeek++
+
if (withinWeek >= WEEK_LIMIT) {
+
throw new ServerError(
+
400,
+
`To many operations within last week (max ${WEEK_LIMIT})`,
+
)
+
}
+
}
+
if (op.createdAt > dayAgo) {
+
withinDay++
+
if (withinDay >= DAY_LIMIT) {
+
throw new ServerError(
+
400,
+
`To many operations within last day (max ${DAY_LIMIT})`,
+
)
+
}
+
}
+
if (op.createdAt > hourAgo) {
+
withinHour++
+
if (withinHour >= HOUR_LIMIT) {
+
throw new ServerError(
+
400,
+
`To many operations within last hour (max ${HOUR_LIMIT})`,
+
)
+
}
+
}
+
}
+
}
+6
packages/server/src/db/index.ts
···
import * as migrations from '../migrations'
import { DatabaseSchema, PlcDatabase } from './types'
import MockDatabase from './mock'
+
import { enforceOpsRateLimit } from '../constraints'
export * from './mock'
export * from './types'
···
const ops = await this.indexedOpsForDid(did)
// throws if invalid
const { nullified, prev } = await plc.assureValidNextOp(did, ops, proposed)
+
// do not enforce rate limits on recovery operations to prevent DDOS by a bad actor
+
if (nullified.length === 0) {
+
enforceOpsRateLimit(ops)
+
}
+
const cid = await cidForCbor(proposed)
await this.db.transaction().execute(async (tx) => {
+4 -10
packages/server/src/routes.ts
···
import express from 'express'
-
import { cborEncode, check } from '@atproto/common'
import * as plc from '@did-plc/lib'
import { ServerError } from './error'
import { AppContext } from './context'
+
import { assertValidIncomingOp } from './constraints'
export const createRouter = (ctx: AppContext): express.Router => {
const router = express.Router()
router.get('/', async function (req, res) {
-
// HTTP temporary redirect to project git repo
-
res.redirect(302, 'https://github.com/bluesky-social/did-method-plc')
+
// HTTP temporary redirect to project homepage
+
res.redirect(302, 'https://web.plc.directory')
})
router.get('/_health', async function (req, res) {
···
router.post('/:did', async function (req, res) {
const { did } = req.params
const op = req.body
-
const byteLength = cborEncode(op).byteLength
-
if (byteLength > 7500) {
-
throw new ServerError(400, 'Operation too large')
-
}
-
if (!check.is(op, plc.def.compatibleOpOrTombstone)) {
-
throw new ServerError(400, `Not a valid operation: ${JSON.stringify(op)}`)
-
}
+
assertValidIncomingOp(op)
await ctx.db.validateAndAddOp(did, op)
res.sendStatus(200)
})
+19 -18
packages/server/tests/server.test.ts
···
-
import { EcdsaKeypair } from '@atproto/crypto'
+
import { P256Keypair } from '@atproto/crypto'
import * as plc from '@did-plc/lib'
import { CloseFn, runTestServer } from './_util'
import { check } from '@atproto/common'
···
let db: Database
let client: plc.Client
-
let signingKey: EcdsaKeypair
-
let rotationKey1: EcdsaKeypair
-
let rotationKey2: EcdsaKeypair
+
let signingKey: P256Keypair
+
let rotationKey1: P256Keypair
+
let rotationKey2: P256Keypair
let did: string
···
db = server.db
close = server.close
client = new plc.Client(server.url)
-
signingKey = await EcdsaKeypair.create()
-
rotationKey1 = await EcdsaKeypair.create()
-
rotationKey2 = await EcdsaKeypair.create()
+
signingKey = await P256Keypair.create()
+
rotationKey1 = await P256Keypair.create()
+
rotationKey2 = await P256Keypair.create()
})
afterAll(async () => {
···
})
it('can perform some updates', async () => {
-
const newRotationKey = await EcdsaKeypair.create()
-
signingKey = await EcdsaKeypair.create()
+
const newRotationKey = await P256Keypair.create()
+
signingKey = await P256Keypair.create()
handle = 'at://ali.example2.com'
atpPds = 'https://example2.com'
···
})
it('rejects on bad updates', async () => {
-
const newKey = await EcdsaKeypair.create()
+
const newKey = await P256Keypair.create()
const operation = client.updateAtprotoKey(did, newKey, newKey.did())
await expect(operation).rejects.toThrow()
})
it('allows for recovery through a forked history', async () => {
-
const attackerKey = await EcdsaKeypair.create()
+
const attackerKey = await P256Keypair.create()
await client.updateRotationKeys(did, rotationKey2, [attackerKey.did()])
-
const newKey = await EcdsaKeypair.create()
+
const newKey = await P256Keypair.create()
const ops = await client.getOperationLog(did)
const forkPoint = ops.at(-2)
if (!check.is(forkPoint, plc.def.operation)) {
···
it('handles concurrent requests to many docs', async () => {
const COUNT = 20
-
const keys: EcdsaKeypair[] = []
+
const keys: P256Keypair[] = []
for (let i = 0; i < COUNT; i++) {
-
keys.push(await EcdsaKeypair.create())
+
keys.push(await P256Keypair.create())
}
await Promise.all(
keys.map(async (key, index) => {
···
it('resolves races into a coherent history with no forks', async () => {
const COUNT = 20
-
const keys: EcdsaKeypair[] = []
+
const keys: P256Keypair[] = []
for (let i = 0; i < COUNT; i++) {
-
keys.push(await EcdsaKeypair.create())
+
keys.push(await P256Keypair.create())
}
// const prev = await client.getPrev(did)
···
}
})
-
it('still allows create v1s', async () => {
+
it('disallows create v1s', async () => {
const createV1 = await plc.deprecatedSignCreate(
{
type: 'create',
···
signingKey,
)
const did = await didForCreateOp(createV1)
-
await client.sendOperation(did, createV1 as any)
+
const attempt = client.sendOperation(did, createV1 as any)
+
await expect(attempt).rejects.toThrow()
})
it('healthcheck succeeds when database is available.', async () => {
+121 -32
yarn.lock
···
"@jridgewell/gen-mapping" "^0.1.0"
"@jridgewell/trace-mapping" "^0.3.9"
-
"@atproto/common@0.1.1":
-
version "0.1.1"
-
resolved "https://registry.yarnpkg.com/@atproto/common/-/common-0.1.1.tgz#ec33a3b4995c91d3ad2e90fc4cdbc65284ceff84"
-
integrity sha512-GYwot5wF/z8iYGSPjrLHuratLc0CVgovmwfJss7+BUOB6y2/Vw8+1Vw0n9DDI0gb5vmx3UI8z0uJgC8aa8yuJg==
+
"@atproto/common-web@*":
+
version "0.2.0"
+
resolved "https://registry.yarnpkg.com/@atproto/common-web/-/common-web-0.2.0.tgz#8420da28e89dac64ad2a11b6ff10a4023c67151f"
+
integrity sha512-ugKrT8CWf6PDsZ29VOhOCs5K4z9BAFIV7SxPXA+MHC7pINqQ+wyjIq+DtUI8kmUSce1dTqc/lMN1akf/W5whVQ==
+
dependencies:
+
graphemer "^1.4.0"
+
multiformats "^9.6.4"
+
uint8arrays "3.0.0"
+
zod "^3.21.4"
+
+
"@atproto/common@0.3.0":
+
version "0.3.0"
+
resolved "https://registry.yarnpkg.com/@atproto/common/-/common-0.3.0.tgz#6ddb0a9bedbf9058353a241b056ae83539da3539"
+
integrity sha512-R5d50Da63wQdAYaHe+rne5nM/rSYIWBaDZtVKpluysG86U1rRIgrG4qEQ/tNDt6WzYcxKXkX4EOeVvGtav2twg==
dependencies:
+
"@atproto/common-web" "*"
"@ipld/dag-cbor" "^7.0.3"
+
cbor-x "^1.5.1"
multiformats "^9.6.4"
pino "^8.6.1"
-
zod "^3.14.2"
-
"@atproto/crypto@0.1.0":
-
version "0.1.0"
-
resolved "https://registry.yarnpkg.com/@atproto/crypto/-/crypto-0.1.0.tgz#bc73a479f9dbe06fa025301c182d7f7ab01bc568"
-
integrity sha512-9xgFEPtsCiJEPt9o3HtJT30IdFTGw5cQRSJVIy5CFhqBA4vDLcdXiRDLCjkzHEVbtNCsHUW6CrlfOgbeLPcmcg==
+
"@atproto/crypto@0.2.2":
+
version "0.2.2"
+
resolved "https://registry.yarnpkg.com/@atproto/crypto/-/crypto-0.2.2.tgz#9832dda885512a36401d24f95990489f521593ef"
+
integrity sha512-yepwM6pLPw/bT7Nl0nfDw251yVDpuhc0llOgD8YdCapUAH7pIn4dBcMgXiA9UzQaHA7OC9ByO5IdGPrMN/DmZw==
dependencies:
-
"@noble/secp256k1" "^1.7.0"
-
big-integer "^1.6.51"
-
multiformats "^9.6.4"
-
one-webcrypto "^1.0.3"
+
"@noble/curves" "^1.1.0"
+
"@noble/hashes" "^1.3.1"
uint8arrays "3.0.0"
"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.12.13", "@babel/code-frame@^7.18.6":
···
version "0.2.3"
resolved "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz"
integrity sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==
+
+
"@cbor-extract/cbor-extract-darwin-arm64@2.1.1":
+
version "2.1.1"
+
resolved "https://registry.yarnpkg.com/@cbor-extract/cbor-extract-darwin-arm64/-/cbor-extract-darwin-arm64-2.1.1.tgz#5721f6dd3feae0b96d23122853ce977e0671b7a6"
+
integrity sha512-blVBy5MXz6m36Vx0DfLd7PChOQKEs8lK2bD1WJn/vVgG4FXZiZmZb2GECHFvVPA5T7OnODd9xZiL3nMCv6QUhA==
+
+
"@cbor-extract/cbor-extract-darwin-x64@2.1.1":
+
version "2.1.1"
+
resolved "https://registry.yarnpkg.com/@cbor-extract/cbor-extract-darwin-x64/-/cbor-extract-darwin-x64-2.1.1.tgz#c25e7d0133950d87d101d7b3afafea8d50d83f5f"
+
integrity sha512-h6KFOzqk8jXTvkOftyRIWGrd7sKQzQv2jVdTL9nKSf3D2drCvQB/LHUxAOpPXo3pv2clDtKs3xnHalpEh3rDsw==
+
+
"@cbor-extract/cbor-extract-linux-arm64@2.1.1":
+
version "2.1.1"
+
resolved "https://registry.yarnpkg.com/@cbor-extract/cbor-extract-linux-arm64/-/cbor-extract-linux-arm64-2.1.1.tgz#48f78e7d8f0fcc84ed074b6bfa6d15dd83187c63"
+
integrity sha512-SxAaRcYf8S0QHaMc7gvRSiTSr7nUYMqbUdErBEu+HYA4Q6UNydx1VwFE68hGcp1qvxcy9yT5U7gA+a5XikfwSQ==
+
+
"@cbor-extract/cbor-extract-linux-arm@2.1.1":
+
version "2.1.1"
+
resolved "https://registry.yarnpkg.com/@cbor-extract/cbor-extract-linux-arm/-/cbor-extract-linux-arm-2.1.1.tgz#7507d346389cb682e44fab8fae9534edd52e2e41"
+
integrity sha512-ds0uikdcIGUjPyraV4oJqyVE5gl/qYBpa/Wnh6l6xLE2lj/hwnjT2XcZCChdXwW/YFZ1LUHs6waoYN8PmK0nKQ==
+
+
"@cbor-extract/cbor-extract-linux-x64@2.1.1":
+
version "2.1.1"
+
resolved "https://registry.yarnpkg.com/@cbor-extract/cbor-extract-linux-x64/-/cbor-extract-linux-x64-2.1.1.tgz#b7c1d2be61c58ec18d58afbad52411ded63cd4cd"
+
integrity sha512-GVK+8fNIE9lJQHAlhOROYiI0Yd4bAZ4u++C2ZjlkS3YmO6hi+FUxe6Dqm+OKWTcMpL/l71N6CQAmaRcb4zyJuA==
+
+
"@cbor-extract/cbor-extract-win32-x64@2.1.1":
+
version "2.1.1"
+
resolved "https://registry.yarnpkg.com/@cbor-extract/cbor-extract-win32-x64/-/cbor-extract-win32-x64-2.1.1.tgz#21b11a1a3f18c3e7d62fd5f87438b7ed2c64c1f7"
+
integrity sha512-2Niq1C41dCRIDeD8LddiH+mxGlO7HJ612Ll3D/E73ZWBmycued+8ghTr/Ho3CMOWPUEr08XtyBMVXAjqF+TcKw==
"@cspotcode/source-map-support@^0.8.0":
version "0.8.1"
···
npmlog "^4.1.2"
write-file-atomic "^3.0.3"
-
"@noble/secp256k1@^1.7.0":
-
version "1.7.0"
-
resolved "https://registry.npmjs.org/@noble/secp256k1/-/secp256k1-1.7.0.tgz"
-
integrity sha512-kbacwGSsH/CTout0ZnZWxnW1B+jH/7r/WAAKLBtrRJ/+CUH7lgmQzl3GTrQua3SGKWNSDsS6lmjnDpIJ5Dxyaw==
+
"@noble/curves@^1.1.0":
+
version "1.2.0"
+
resolved "https://registry.yarnpkg.com/@noble/curves/-/curves-1.2.0.tgz#92d7e12e4e49b23105a2555c6984d41733d65c35"
+
integrity sha512-oYclrNgRaM9SsBUBVbb8M6DTV7ZHRTKugureoYEncY5c65HOmRzvSiTE3y5CYaPYJA/GVkrhXEoF0M3Ya9PMnw==
+
dependencies:
+
"@noble/hashes" "1.3.2"
+
+
"@noble/hashes@1.3.2", "@noble/hashes@^1.3.1":
+
version "1.3.2"
+
resolved "https://registry.yarnpkg.com/@noble/hashes/-/hashes-1.3.2.tgz#6f26dbc8fbc7205873ce3cee2f690eba0d421b39"
+
integrity sha512-MVC8EAQp7MvEcm30KWENFjgR+Mkmf+D189XJTkFIlwohU5hcBbn1ZkKq7KVTi2Hme3PMGF390DaL52beVrIihQ==
"@nodelib/fs.scandir@2.1.5":
version "2.1.5"
···
resolved "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.2.tgz"
integrity sha512-3pZEU3NT5BFUo/AD5ERPWOgQOCZITni6iavr5AUw5AUwQjMlI0kzu5btnyD39AF0gUEsDPwJT+oY1ORBJijPjQ==
-
big-integer@^1.6.51:
-
version "1.6.51"
-
resolved "https://registry.npmjs.org/big-integer/-/big-integer-1.6.51.tgz"
-
integrity sha512-GPEid2Y9QU1Exl1rpO9B2IPJGHPSupF5GnVIP0blYvNOMer2bTvSWs1jGOUg04hTmu67nmLsQ9TBo1puaotBHg==
-
body-parser@1.20.1:
version "1.20.1"
resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.1.tgz#b1812a8912c195cd371a3ee5e66faa2338a5c668"
···
resolved "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz"
integrity sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==
+
cbor-extract@^2.1.1:
+
version "2.1.1"
+
resolved "https://registry.yarnpkg.com/cbor-extract/-/cbor-extract-2.1.1.tgz#f154b31529fdb6b7c70fb3ca448f44eda96a1b42"
+
integrity sha512-1UX977+L+zOJHsp0mWFG13GLwO6ucKgSmSW6JTl8B9GUvACvHeIVpFqhU92299Z6PfD09aTXDell5p+lp1rUFA==
+
dependencies:
+
node-gyp-build-optional-packages "5.0.3"
+
optionalDependencies:
+
"@cbor-extract/cbor-extract-darwin-arm64" "2.1.1"
+
"@cbor-extract/cbor-extract-darwin-x64" "2.1.1"
+
"@cbor-extract/cbor-extract-linux-arm" "2.1.1"
+
"@cbor-extract/cbor-extract-linux-arm64" "2.1.1"
+
"@cbor-extract/cbor-extract-linux-x64" "2.1.1"
+
"@cbor-extract/cbor-extract-win32-x64" "2.1.1"
+
+
cbor-x@^1.5.1:
+
version "1.5.4"
+
resolved "https://registry.yarnpkg.com/cbor-x/-/cbor-x-1.5.4.tgz#8f0754fa8589cbd7339b613b2b5717d133508e98"
+
integrity sha512-PVKILDn+Rf6MRhhcyzGXi5eizn1i0i3F8Fe6UMMxXBnWkalq9+C5+VTmlIjAYM4iF2IYF2N+zToqAfYOp+3rfw==
+
optionalDependencies:
+
cbor-extract "^2.1.1"
+
cborg@^1.6.0:
version "1.9.5"
resolved "https://registry.npmjs.org/cborg/-/cborg-1.9.5.tgz"
···
integrity sha512-tE7ztYzXHIeyvc7N+hR3oi7FIbf/NIjVP9hmAt3yMXzrQ072/fpjGLx2GxNxGxUl5V73MEqYzioOMoVhGMJ5cA==
dependencies:
is-obj "^2.0.0"
+
+
dotenv@^16.0.0:
+
version "16.3.1"
+
resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-16.3.1.tgz#369034de7d7e5b120972693352a3bf112172cc3e"
+
integrity sha512-IPzF4w4/Rd94bA9imS68tZBaYyBWSCE47V1RGuMrB94iyTOIEwRmVL2x/4An+6mETpLrKJ5hQkB8W4kFAadeIQ==
dotenv@^16.0.3:
version "16.0.3"
···
resolved "https://registry.npmjs.org/grapheme-splitter/-/grapheme-splitter-1.0.4.tgz"
integrity sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==
+
graphemer@^1.4.0:
+
version "1.4.0"
+
resolved "https://registry.yarnpkg.com/graphemer/-/graphemer-1.4.0.tgz#fb2f1d55e0e3a1849aeffc90c4fa0dd53a0e66c6"
+
integrity sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==
+
handlebars@^4.7.7:
version "4.7.7"
resolved "https://registry.npmjs.org/handlebars/-/handlebars-4.7.7.tgz"
···
dependencies:
whatwg-url "^5.0.0"
+
node-gyp-build-optional-packages@5.0.3:
+
version "5.0.3"
+
resolved "https://registry.yarnpkg.com/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.0.3.tgz#92a89d400352c44ad3975010368072b41ad66c17"
+
integrity sha512-k75jcVzk5wnnc/FMxsf4udAoTEUv2jY3ycfdSd3yWu6Cnd1oee6/CfZJApyscA4FJOmdoixWwiwOyf16RzD5JA==
+
node-gyp@^5.0.2:
version "5.1.1"
resolved "https://registry.npmjs.org/node-gyp/-/node-gyp-5.1.1.tgz"
···
integrity sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==
dependencies:
wrappy "1"
-
-
one-webcrypto@^1.0.3:
-
version "1.0.3"
-
resolved "https://registry.npmjs.org/one-webcrypto/-/one-webcrypto-1.0.3.tgz"
-
integrity sha512-fu9ywBVBPx0gS9K0etIROTiCkvI5S1TDjFsYFb3rC1ewFxeOqsbzq7aIMBHsYfrTHBcGXJaONXXjTl8B01cW1Q==
onetime@^5.1.0, onetime@^5.1.2:
version "5.1.2"
···
resolved "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-6.0.0.tgz"
integrity sha512-mMMOwSKrmyl+Y12Ri2xhH1lbzQxwwpuru9VjyJpgFIH4asSj88F2csdMwN6+M5g1Ll4rmsYghHLQJw81tgZ7LQ==
-
pino@^8.0.0, pino@^8.11.0, pino@^8.6.1:
+
pino@^8.0.0, pino@^8.11.0:
version "8.11.0"
resolved "https://registry.yarnpkg.com/pino/-/pino-8.11.0.tgz#2a91f454106b13e708a66c74ebc1c2ab7ab38498"
integrity sha512-Z2eKSvlrl2rH8p5eveNUnTdd4AjJk8tAsLkHYZQKGHP4WTh2Gi1cOSOs3eWPqaj+niS3gj4UkoreoaWgF3ZWYg==
···
sonic-boom "^3.1.0"
thread-stream "^2.0.0"
+
pino@^8.6.1:
+
version "8.15.0"
+
resolved "https://registry.yarnpkg.com/pino/-/pino-8.15.0.tgz#67c61d5e397bf297e5a0433976a7f7b8aa6f876b"
+
integrity sha512-olUADJByk4twxccmAxb1RiGKOSvddHugCV3wkqjyv+3Sooa2KLrmXrKEWOKi0XPCLasRR5jBXxioE1jxUa4KzQ==
+
dependencies:
+
atomic-sleep "^1.0.0"
+
fast-redact "^3.1.1"
+
on-exit-leak-free "^2.1.0"
+
pino-abstract-transport v1.0.0
+
pino-std-serializers "^6.0.0"
+
process-warning "^2.0.0"
+
quick-format-unescaped "^4.0.3"
+
real-require "^0.2.0"
+
safe-stable-stringify "^2.3.1"
+
sonic-boom "^3.1.0"
+
thread-stream "^2.0.0"
+
pirates@^4.0.4:
version "4.0.5"
resolved "https://registry.npmjs.org/pirates/-/pirates-4.0.5.tgz"
···
resolved "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz"
integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==
-
zod@^3.14.2:
-
version "3.19.1"
-
resolved "https://registry.npmjs.org/zod/-/zod-3.19.1.tgz"
-
integrity sha512-LYjZsEDhCdYET9ikFu6dVPGp2YH9DegXjdJToSzD9rO6fy4qiRYFoyEYwps88OseJlPyl2NOe2iJuhEhL7IpEA==
+
zod@^3.21.4:
+
version "3.22.2"
+
resolved "https://registry.yarnpkg.com/zod/-/zod-3.22.2.tgz#3add8c682b7077c05ac6f979fea6998b573e157b"
+
integrity sha512-wvWkphh5WQsJbVk1tbx1l1Ly4yg+XecD+Mq280uBGt9wa5BKSWf4Mhp6GmrkPixhMxmabYY7RbzlwVP32pbGCg==