Module did

Expand description

Minting and validating the did:web identifiers that agents get.

Structs§

AccountDid: A validated did:web belonging to one agent.
Zone: The DNS zone agents are minted under, plus the port their PDS listens on during development.
ZoneRegistry: Several Zones under one server. They may nest — a zone at dev.agents.bot under a deployment that also mints from agents.bot is fine — because nesting is not actually ambiguous: a wildcard certificate matches exactly one label, so *.agents.bot covers foo.agents.bot and does not cover foo.dev.agents.bot. The two namespaces do not intersect. The single point of contact between them is dev.agents.bot itself, which the outer zone could otherwise mint as an agent name, and that is guarded separately — by reserving the inner zone’s apex label in the outer zone’s own name registry, not by refusing the pair here. What this type does check is what only a set of zones can violate: the same hostname configured twice.

DID_JSON_PATH 🔒: Path the DID document is served at, per the did:web method.
DID_WEB_PREFIX 🔒: The prefix every DID this crate handles starts with.
ENCODED_COLON 🔒: The only percent escape an atproto did:web may contain: the colon that separates a bare loopback hostname from its port. Uppercase hex only, because the spec says “DIDs are case-sensitive” and implementations “should reject DIDs with invalid casing” — one spelling keeps comparison a byte compare.
MAX_DID_LENGTH: Hard cap on DID length, from the atproto DID specification: “DID identifiers do not generally have a maximum length restriction, but in the context of atproto, there is a current hard limit of 2048 characters.”
RESOLVE_PORTS: The environment variable naming which port a loopback hostname’s documents answer on, as host=port pairs separated by commas.

account_name: How a person reads an account’s name in a command’s output.
canonical_did: A DID from a URL, spelled the way this project stores it.
decode_authority 🔒: Turns the method-specific identifier into a decoded host or host:port.
did_web_for_host: The did:web a hostname spells.
host_without_port: A hostname without the port it is reached on.
hostname_is_at_or_below: Whether host is ancestor or a subdomain of it.
is_loopback_host: Whether a hostname resolves to this machine.
is_loopback_literal: Whether a hostname is one of the bare loopback names the atproto profile permits a port on.
parse_port 🔒: Reads the port half of a decoded authority, in one spelling only.
resolve_port: The port RESOLVE_PORTS gives host, if it gives one.
validate_did: Checks a string against the generic atproto DID syntax rules.
validate_hostname 🔒: Checks a decoded hostname: lowercase DNS labels, no empties, no .arpa.
validate_label: Checks one DNS label. Uppercase is rejected rather than normalized: a DID is compared byte for byte across the network, so two spellings of one identity would be two identities.