Master (#1262)

* clear * feat: Add everything * fix: Commenht
2026-08-02 17:31:39 +00:00 · 2025-10-03 14:45:52 -04:00
parent 43b4a11c06
commit 13e6c3e84d
1935 changed files with 655061 additions and 40058 deletions
@@ -7,7 +7,5 @@ import "cosmos/app/v1alpha1/module.proto";
 // Module is the app config object of the module.
 // Learn more: https://docs.cosmos.network/main/building-modules/depinject
 message Module {
-  option (cosmos.app.v1alpha1.module) = {
-    go_import : "github.com/sonr-io/snrd"
-  };
+  option (cosmos.app.v1alpha1.module) = {go_import: "github.com/sonr-io/sonr"};
 }
@@ -0,0 +1,65 @@
+syntax = "proto3";
+
+package svc.v1;
+
+option go_package = "github.com/sonr-io/sonr/x/svc/types";
+
+import "gogoproto/gogo.proto";
+import "google/protobuf/timestamp.proto";
+
+// EventDomainVerificationInitiated is emitted when domain verification is initiated
+message EventDomainVerificationInitiated {
+  // Domain being verified
+  string domain = 1;
+  
+  // Verification ID
+  string verification_id = 2;
+  
+  // Verification challenge
+  string challenge = 3;
+  
+  // Initiator address
+  string initiator = 4;
+  
+  // Block height
+  uint64 block_height = 5;
+}
+
+// EventDomainVerified is emitted when a domain is successfully verified
+message EventDomainVerified {
+  // Domain that was verified
+  string domain = 1;
+  
+  // Verification ID
+  string verification_id = 2;
+  
+  // Verifier address
+  string verifier = 3;
+  
+  // Verification timestamp
+  google.protobuf.Timestamp verified_at = 4 [(gogoproto.stdtime) = true, (gogoproto.nullable) = false];
+  
+  // Block height
+  uint64 block_height = 5;
+}
+
+// EventServiceRegistered is emitted when a service is registered
+message EventServiceRegistered {
+  // Service ID
+  string service_id = 1;
+  
+  // Associated domain
+  string domain = 2;
+  
+  // Owner DID
+  string owner = 3;
+  
+  // Service endpoints
+  repeated string endpoints = 4;
+  
+  // Service metadata (JSON string)
+  string metadata = 5;
+  
+  // Block height
+  uint64 block_height = 6;
+}
@@ -1,54 +1,81 @@
 syntax = "proto3";
 package svc.v1;

-import "gogoproto/gogo.proto";
 import "amino/amino.proto";
+import "gogoproto/gogo.proto";
+import "cosmos/base/v1beta1/coin.proto";
+import "cosmos_proto/cosmos.proto";
+import "svc/v1/state.proto";

-option go_package = "github.com/sonr-io/snrd/x/svc/types";
+option go_package = "github.com/sonr-io/sonr/x/svc/types";

 // GenesisState defines the module genesis state
 message GenesisState {
  // Params defines all the parameters of the module.
-  Params params = 1 [ (gogoproto.nullable) = false ];
+  Params params = 1 [(gogoproto.nullable) = false];
+  
+  // Service capabilities stored in the module
+  repeated ServiceCapability capabilities = 2 [(gogoproto.nullable) = false];
 }

 // Params defines the set of module parameters.
 message Params {
-  option (amino.name) = "service/params";
+  option (amino.name) = "svc/params";
  option (gogoproto.equal) = true;
  option (gogoproto.goproto_stringer) = false;

-  repeated Attenuation attenuations = 1;
-}
+  // Service Limits
+  // Maximum number of services that can be registered per account
+  uint32 max_services_per_account = 1;
+  // Maximum number of domains that can be bound to a single service
+  uint32 max_domains_per_service = 2;
+  // Maximum number of endpoints that can be registered per service
+  uint32 max_endpoints_per_service = 3;

-// Attenuation defines the attenuation of a resource
-message Attenuation {
-  Resource resource = 1;
-  repeated Capability capabilities = 2;
-}
+  // Timeouts and Intervals (in seconds)
+  // Time allowed for domain ownership verification before expiry
+  int64 domain_verification_timeout = 4;
+  // Interval between service health checks
+  int64 service_health_check_interval = 5;
+  // Default expiration time for capabilities if not specified
+  int64 capability_default_expiration = 6;

-// Capability reprensents the available capabilities of a decentralized web node
-message Capability {
-  string name = 1;
-  string parent = 2;
-  string description = 3;
-  repeated string resources = 4;
-}
+  // Economic Parameters
+  // Fee required to register a new service
+  cosmos.base.v1beta1.Coin service_registration_fee = 7
+      [(gogoproto.nullable) = false];
+  // Fee required to verify domain ownership
+  cosmos.base.v1beta1.Coin domain_verification_fee = 8
+      [(gogoproto.nullable) = false];
+  // Minimum stake required to keep a service active
+  cosmos.base.v1beta1.Coin min_service_stake = 9
+      [(gogoproto.nullable) = false];

-// Resource reprensents the available resources of a decentralized web node
-message Resource {
-  string kind = 1;
-  string template = 2;
-}
+  // UCAN and Capability Settings
+  // Maximum depth of delegation chains for capabilities
+  uint32 max_delegation_chain_depth = 10;
+  // Maximum lifetime for UCAN tokens (in seconds)
+  int64 ucan_max_lifetime = 11;
+  // Minimum lifetime for UCAN tokens (in seconds)
+  int64 ucan_min_lifetime = 12;
+  // List of supported signature algorithms for UCAN
+  repeated string supported_signature_algorithms = 13;

-// Service defines a Decentralized Service on the Sonr Blockchain
-message Service {
-  string id = 1;
-  string authority = 2;
-  repeated string origins = 3;
-  string name = 4;
-  string description = 5;
-  repeated Attenuation attenuations = 6;
-  repeated string tags = 7;
-  int64 expiry_height = 8;
-}
+  // Validation Rules
+  // Whether to require cryptographic proof of domain ownership
+  bool require_domain_ownership_proof = 14;
+  // Whether to require HTTPS for service endpoints
+  bool require_https = 15;
+  // Whether to allow localhost domains for development
+  bool allow_localhost = 16;
+  // Maximum length for service description text
+  uint32 max_service_description_length = 17;
+
+  // Rate Limiting
+  // Maximum number of service registrations allowed per block
+  uint32 max_registrations_per_block = 18;
+  // Maximum number of service updates allowed per block
+  uint32 max_updates_per_block = 19;
+  // Maximum number of capability grants allowed per block
+  uint32 max_capability_grants_per_block = 20;
+}
@@ -3,8 +3,9 @@ package svc.v1;

 import "google/api/annotations.proto";
 import "svc/v1/genesis.proto";
+import "svc/v1/state.proto";

-option go_package = "github.com/sonr-io/snrd/x/svc/types";
+option go_package = "github.com/sonr-io/sonr/x/svc/types";

 // Query provides defines the gRPC querier service.
 service Query {
@@ -13,14 +14,44 @@ service Query {
    option (google.api.http).get = "/svc/v1/params";
  }

-  // OriginExists queries if a given origin exists.
-  rpc OriginExists(QueryOriginExistsRequest) returns (QueryOriginExistsResponse) {
-    option (google.api.http).get = "/svc/v1/origins/{origin}";
+  // DomainVerification queries domain verification status by domain name.
+  //
+  // {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+  // It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+  //
+  // {{import "svc_docs.md"}}
+  rpc DomainVerification(QueryDomainVerificationRequest) returns (QueryDomainVerificationResponse) {
+    option (google.api.http).get = "/svc/v1/domain/{domain}";
  }

-  // ResolveOrigin queries the domain of a given service and returns its record with capabilities.
-  rpc ResolveOrigin(QueryResolveOriginRequest) returns (QueryResolveOriginResponse) {
-    option (google.api.http).get = "/svc/v1/origins/{origin}/record";
+  // Service queries service information by service ID.
+  rpc Service(QueryServiceRequest) returns (QueryServiceResponse) {
+    option (google.api.http).get = "/svc/v1/service/{service_id}";
+  }
+
+  // ServicesByOwner queries all services owned by a specific address.
+  rpc ServicesByOwner(QueryServicesByOwnerRequest) returns (QueryServicesByOwnerResponse) {
+    option (google.api.http).get = "/svc/v1/services/owner/{owner}";
+  }
+
+  // ServicesByDomain queries services bound to a specific domain.
+  rpc ServicesByDomain(QueryServicesByDomainRequest) returns (QueryServicesByDomainResponse) {
+    option (google.api.http).get = "/svc/v1/services/domain/{domain}";
+  }
+
+  // ServiceOIDCDiscovery queries OIDC discovery configuration for a service
+  rpc ServiceOIDCDiscovery(QueryServiceOIDCDiscoveryRequest) returns (QueryServiceOIDCDiscoveryResponse) {
+    option (google.api.http).get = "/svc/v1/service/{service_id}/oidc/discovery";
+  }
+
+  // ServiceOIDCJWKS queries OIDC JWKS for a service
+  rpc ServiceOIDCJWKS(QueryServiceOIDCJWKSRequest) returns (QueryServiceOIDCJWKSResponse) {
+    option (google.api.http).get = "/svc/v1/service/{service_id}/oidc/jwks";
+  }
+
+  // ServiceOIDCMetadata queries OIDC metadata for a service
+  rpc ServiceOIDCMetadata(QueryServiceOIDCMetadataRequest) returns (QueryServiceOIDCMetadataResponse) {
+    option (google.api.http).get = "/svc/v1/service/{service_id}/oidc/metadata";
  }
 }

@@ -33,26 +64,161 @@ message QueryParamsResponse {
  Params params = 1;
 }

-// QueryOriginExistsRequest is the request type for the Query/OriginExists RPC method.
-message QueryOriginExistsRequest {
-  // origin is the origin to query.
-  string origin = 1;
+// QueryDomainVerificationRequest is the request type for the
+// Query/DomainVerification RPC method.
+message QueryDomainVerificationRequest {
+  string domain = 1;
 }

-// QueryOriginExistsResponse is the response type for the Query/OriginExists RPC method.
-message QueryOriginExistsResponse {
-  // exists is the boolean value representing whether the origin exists.
-  bool exists = 1;
+// QueryDomainVerificationResponse is the response type for the
+// Query/DomainVerification RPC method.
+message QueryDomainVerificationResponse {
+  DomainVerification domain_verification = 1;
 }

-// QueryResolveOriginRequest is the request type for the Query/ResolveOrigin RPC method.
-message QueryResolveOriginRequest {
-  // origin is the origin to query.
-  string origin = 1;
+// QueryServiceRequest is the request type for the Query/Service RPC method.
+message QueryServiceRequest {
+  string service_id = 1;
 }

-// QueryResolveOriginResponse is the response type for the Query/ResolveOrigin RPC method.
-message QueryResolveOriginResponse {
-  // record is the record of the origin.
-  Service record = 1;
+// QueryServiceResponse is the response type for the Query/Service RPC method.
+message QueryServiceResponse {
+  Service service = 1;
+}
+
+// QueryServicesByOwnerRequest is the request type for the Query/ServicesByOwner
+// RPC method.
+message QueryServicesByOwnerRequest {
+  string owner = 1;
+}
+
+// QueryServicesByOwnerResponse is the response type for the
+// Query/ServicesByOwner RPC method.
+message QueryServicesByOwnerResponse {
+  repeated Service services = 1;
+}
+
+// QueryServicesByDomainRequest is the request type for the
+// Query/ServicesByDomain RPC method.
+message QueryServicesByDomainRequest {
+  string domain = 1;
+}
+
+// QueryServicesByDomainResponse is the response type for the
+// Query/ServicesByDomain RPC method.
+message QueryServicesByDomainResponse {
+  repeated Service services = 1;
+}
+
+// QueryServiceOIDCDiscoveryRequest is the request type for the
+// Query/ServiceOIDCDiscovery RPC method.
+message QueryServiceOIDCDiscoveryRequest {
+  string service_id = 1;
+}
+
+// QueryServiceOIDCDiscoveryResponse is the response type for the
+// Query/ServiceOIDCDiscovery RPC method.
+// This response follows the OpenID Connect Discovery 1.0 specification
+message QueryServiceOIDCDiscoveryResponse {
+  // The issuer identifier
+  string issuer = 1;
+  
+  // URL of the authorization endpoint
+  string authorization_endpoint = 2;
+  
+  // URL of the token endpoint
+  string token_endpoint = 3;
+  
+  // URL of the JSON Web Key Set
+  string jwks_uri = 4;
+  
+  // URL of the UserInfo endpoint
+  string userinfo_endpoint = 5;
+  
+  // URL for the registration endpoint
+  string registration_endpoint = 6;
+  
+  // JSON array containing a list of the OAuth 2.0 scope values
+  repeated string scopes_supported = 7;
+  
+  // JSON array containing a list of the OAuth 2.0 response_type values
+  repeated string response_types_supported = 8;
+  
+  // JSON array containing a list of the OAuth 2.0 grant_type values
+  repeated string grant_types_supported = 9;
+  
+  // JSON array containing a list of the JWS signing algorithms
+  repeated string id_token_signing_alg_values_supported = 10;
+  
+  // JSON array containing a list of the Subject Identifier types
+  repeated string subject_types_supported = 11;
+  
+  // JSON array containing a list of client authentication methods
+  repeated string token_endpoint_auth_methods_supported = 12;
+  
+  // JSON array containing a list of the Claim Names
+  repeated string claims_supported = 13;
+  
+  // JSON array containing a list of the OAuth 2.0 response_mode values
+  repeated string response_modes_supported = 14;
+  
+  // Service URL for documentation
+  string service_documentation = 15;
+  
+  // Languages supported for the UI
+  repeated string ui_locales_supported = 16;
+  
+  // Languages supported for claims
+  repeated string claims_locales_supported = 17;
+  
+  // Boolean value specifying whether the OP supports use of the request parameter
+  bool request_parameter_supported = 18;
+  
+  // Boolean value specifying whether the OP supports use of the request_uri parameter
+  bool request_uri_parameter_supported = 19;
+  
+  // Boolean value specifying whether the OP requires any request_uri values
+  bool require_request_uri_registration = 20;
+  
+  // URL that the OP provides to the person registering the Client
+  string op_policy_uri = 21;
+  
+  // URL that the OP provides to the person registering the Client
+  string op_tos_uri = 22;
+}
+
+// QueryServiceOIDCJWKSRequest is the request type for the
+// Query/ServiceOIDCJWKS RPC method.
+message QueryServiceOIDCJWKSRequest {
+  string service_id = 1;
+}
+
+// QueryServiceOIDCJWKSResponse is the response type for the
+// Query/ServiceOIDCJWKS RPC method.
+// This response follows the JSON Web Key Set specification
+message QueryServiceOIDCJWKSResponse {
+  // Array of JWK values
+  repeated JWK keys = 1;
+}
+
+// QueryServiceOIDCMetadataRequest is the request type for the
+// Query/ServiceOIDCMetadata RPC method.
+message QueryServiceOIDCMetadataRequest {
+  string service_id = 1;
+}
+
+// QueryServiceOIDCMetadataResponse is the response type for the
+// Query/ServiceOIDCMetadata RPC method.
+message QueryServiceOIDCMetadataResponse {
+  // Service-specific OIDC metadata
+  ServiceOIDCConfig config = 1;
+  
+  // The verified domain of the service
+  string verified_domain = 2;
+  
+  // Service status
+  ServiceStatus service_status = 3;
+  
+  // Additional metadata as key-value pairs
+  map<string, string> metadata = 4;
 }
@@ -3,55 +3,299 @@ package svc.v1;

 import "cosmos/orm/v1/orm.proto";

-option go_package = "github.com/sonr-io/snrd/x/svc/types";
-
+option go_package = "github.com/sonr-io/sonr/x/svc/types";

 // https://github.com/cosmos/cosmos-sdk/blob/main/orm/README.md

-message Domain {
+// Service represents a registered service with domain binding and UCAN
+// capabilities
+message Service {
  option (cosmos.orm.v1.table) = {
    id: 1
-    primary_key: {
-      fields: "id"
-      auto_increment: true
-    }
-    index: {
-      id: 1
-      fields: "origin"
-      unique: true
-    }
-  };
-
-  uint64 id = 1;
-  string origin = 2;
-  string name = 3;
-  string description = 4;
-  string category = 5;
-  string icon = 6;
-  repeated string tags = 7;
-}
-
-// Metadata represents a DID alias
-message Metadata {
-  option (cosmos.orm.v1.table) = {
-    id: 2
    primary_key: {fields: "id"}
    index: {
      id: 1
-      fields: "subject,origin"
+      fields: "domain"
+      unique: true
+    }
+    index: {
+      id: 2
+      fields: "owner"
+    }
+    index: {
+      id: 3
+      fields: "status"
+    }
+  };
+
+  // Unique identifier for the service
+  string id = 1;
+
+  // DNS-verified domain bound to this service
+  string domain = 2;
+
+  // Owner address who registered the service
+  string owner = 3;
+
+  // IPFS CID of the UCAN root capability for this service
+  string root_capability_cid = 4;
+
+  // List of permissions granted to this service
+  repeated string permissions = 5;
+
+  // Current status of the service
+  ServiceStatus status = 6;
+
+  // Unix timestamp when the service was registered
+  int64 created_at = 7;
+
+  // Unix timestamp of last update
+  int64 updated_at = 8;
+}
+
+// DomainVerification represents a domain ownership verification record
+message DomainVerification {
+  option (cosmos.orm.v1.table) = {
+    id: 2
+    primary_key: {fields: "domain"}
+    index: {
+      id: 1
+      fields: "owner"
+    }
+    index: {
+      id: 2
+      fields: "status"
+    }
+  };
+
+  // The domain being verified (e.g., "example.com")
+  string domain = 1;
+
+  // The owner's address who initiated the verification
+  string owner = 2;
+
+  // Unique verification token to be placed in DNS TXT record
+  string verification_token = 3;
+
+  // Current status of domain verification
+  DomainVerificationStatus status = 4;
+
+  // Unix timestamp when the verification expires if not completed
+  int64 expires_at = 5;
+
+  // Unix timestamp when the domain was verified (if applicable)
+  int64 verified_at = 6;
+}
+
+// DomainVerificationStatus represents the current state of domain verification
+enum DomainVerificationStatus {
+  // Pending verification - DNS TXT record not yet confirmed
+  DOMAIN_VERIFICATION_STATUS_PENDING = 0;
+
+  // Successfully verified - DNS TXT record confirmed
+  DOMAIN_VERIFICATION_STATUS_VERIFIED = 1;
+
+  // Verification expired - exceeded time limit
+  DOMAIN_VERIFICATION_STATUS_EXPIRED = 2;
+
+  // Verification failed - DNS lookup failed or record mismatch
+  DOMAIN_VERIFICATION_STATUS_FAILED = 3;
+}
+
+// ServiceCapability represents a service-specific capability with permissions
+message ServiceCapability {
+  option (cosmos.orm.v1.table) = {
+    id: 3
+    primary_key: {fields: "capability_id"}
+    index: {
+      id: 1
+      fields: "service_id"
+    }
+    index: {
+      id: 2
+      fields: "owner"
+    }
+    index: {
+      id: 3
+      fields: "revoked"
+    }
+  };
+
+  // Unique identifier for the capability
+  string capability_id = 1;
+
+  // Service ID this capability belongs to
+  string service_id = 2;
+
+  // DNS domain associated with the capability
+  string domain = 3;
+
+  // List of abilities/actions granted by this capability
+  repeated string abilities = 4;
+
+  // Owner address who holds this capability
+  string owner = 5;
+
+  // Unix timestamp when the capability was created
+  int64 created_at = 6;
+
+  // Unix timestamp when the capability expires (0 for no expiration)
+  int64 expires_at = 7;
+
+  // Whether this capability has been revoked
+  bool revoked = 8;
+}
+
+// ServiceResource represents a resource that can be accessed with capabilities
+message ServiceResource {
+  option (cosmos.orm.v1.table) = {
+    id: 4
+    primary_key: {fields: "resource_id"}
+    index: {
+      id: 1
+      fields: "service_id"
+    }
+    index: {
+      id: 2
+      fields: "resource_type"
+    }
+  };
+
+  // Unique identifier for the resource
+  string resource_id = 1;
+
+  // Service ID this resource belongs to
+  string service_id = 2;
+
+  // Type of resource (e.g., "api", "data", "file")
+  string resource_type = 3;
+
+  // List of abilities that can be performed on this resource
+  repeated string allowed_abilities = 4;
+
+  // Additional metadata for the resource
+  map<string, string> metadata = 5;
+}
+
+// ServiceStatus represents the operational state of a service
+enum ServiceStatus {
+  // Service is active and operational
+  SERVICE_STATUS_ACTIVE = 0;
+
+  // Service is temporarily suspended
+  SERVICE_STATUS_SUSPENDED = 1;
+
+  // Service has been permanently revoked
+  SERVICE_STATUS_REVOKED = 2;
+}
+
+// ServiceOIDCConfig represents OpenID Connect configuration for a service
+message ServiceOIDCConfig {
+  option (cosmos.orm.v1.table) = {
+    id: 5
+    primary_key: {fields: "service_id"}
+    index: {
+      id: 1
+      fields: "issuer"
      unique: true
    }
  };

-  // The unique identifier of the alias
-  string id = 1;
-
-  // The alias of the DID
-  string subject = 2;
-
-  // Origin of the alias
-  string origin = 3;
-
-  // Controller of the alias
-  string controller = 4;
+  // Service ID this OIDC config belongs to
+  string service_id = 1;
+  
+  // OIDC issuer URL (must match the service's verified domain)
+  string issuer = 2;
+  
+  // Authorization endpoint URL
+  string authorization_endpoint = 3;
+  
+  // Token endpoint URL
+  string token_endpoint = 4;
+  
+  // JWKS URI for public key retrieval
+  string jwks_uri = 5;
+  
+  // UserInfo endpoint URL
+  string userinfo_endpoint = 6;
+  
+  // Supported OIDC scopes for this service
+  repeated string scopes_supported = 7;
+  
+  // Supported response types
+  repeated string response_types_supported = 8;
+  
+  // Supported grant types
+  repeated string grant_types_supported = 9;
+  
+  // ID token signing algorithm values supported
+  repeated string id_token_signing_alg_values_supported = 10;
+  
+  // Subject types supported
+  repeated string subject_types_supported = 11;
+  
+  // Token endpoint auth methods supported
+  repeated string token_endpoint_auth_methods_supported = 12;
+  
+  // Claims supported in ID tokens
+  repeated string claims_supported = 13;
+  
+  // Response modes supported
+  repeated string response_modes_supported = 14;
+  
+  // Additional OIDC metadata as key-value pairs
+  map<string, string> metadata = 15;
+  
+  // Unix timestamp when this config was created
+  int64 created_at = 16;
+  
+  // Unix timestamp when this config was last updated
+  int64 updated_at = 17;
+}
+
+// JWK represents a JSON Web Key for OIDC
+message JWK {
+  // Key type (e.g., "RSA", "EC")
+  string kty = 1;
+  
+  // Key use (e.g., "sig", "enc")
+  string use = 2;
+  
+  // Key ID
+  string kid = 3;
+  
+  // Algorithm (e.g., "RS256", "ES256")
+  string alg = 4;
+  
+  // RSA modulus (for RSA keys)
+  string n = 5;
+  
+  // RSA exponent (for RSA keys)
+  string e = 6;
+  
+  // Elliptic curve (for EC keys)
+  string crv = 7;
+  
+  // X coordinate (for EC keys)
+  string x = 8;
+  
+  // Y coordinate (for EC keys)
+  string y = 9;
+}
+
+// ServiceJWKS represents the JSON Web Key Set for a service
+message ServiceJWKS {
+  option (cosmos.orm.v1.table) = {
+    id: 6
+    primary_key: {fields: "service_id"}
+  };
+
+  // Service ID this JWKS belongs to
+  string service_id = 1;
+  
+  // List of public keys
+  repeated JWK keys = 2;
+  
+  // Unix timestamp when this JWKS was last rotated
+  int64 rotated_at = 3;
 }
@@ -0,0 +1,93 @@
+## Overview
+The SVC (Service) module manages service registration with domain verification and UCAN-based authorization.
+
+## Request: {{.RequestType.Name}}
+
+| Field ID | Name | Type | Description |
+| -------- | ---- | ---- | ----------- | {{range .RequestType.Fields}}
+| {{.Number}} | {{.Name}} | {{if eq .Label.String "LABEL_REPEATED"}}[]{{end}}{{.Type}} | {{fieldcomments .Message .}} | {{end}}
+
+## Response: {{.ResponseType.Name}}
+
+| Field ID | Name | Type | Description |
+| -------- | ---- | ---- | ----------- | {{range .ResponseType.Fields}}
+| {{.Number}} | {{.Name}} | {{if eq .Label.String "LABEL_REPEATED"}}[]{{end}}{{.Type}} | {{fieldcomments .Message .}} | {{end}}
+
+## Implementation Details
+
+{{if eq .MethodDescriptorProto.Name "InitiateDomainVerification"}}
+- Starts domain ownership verification process
+- Generates unique verification token
+- Requires DNS TXT record setup
+- Provides clear instructions for domain setup
+{{else if eq .MethodDescriptorProto.Name "VerifyDomain"}}
+- Validates DNS TXT records for domain ownership
+- Checks for correct verification token
+- Establishes trust for service binding
+- One-time verification persists on-chain
+{{else if eq .MethodDescriptorProto.Name "RegisterService"}}
+- Registers services with verified domains
+- Binds service to specific domain endpoints
+- Establishes permission boundaries
+- Creates root capability with UCAN
+{{else if eq .MethodDescriptorProto.Name "Params"}}
+- Returns module configuration parameters
+- Shows verification timeout settings
+- Lists supported service types
+{{else if eq .MethodDescriptorProto.Name "DomainVerification"}}
+- Queries domain verification status
+- Returns verification token if pending
+- Shows verification timestamp if completed
+{{else if eq .MethodDescriptorProto.Name "Service"}}
+- Retrieves service details by ID
+- Returns bound domain and permissions
+- Shows UCAN capability chain
+{{else if eq .MethodDescriptorProto.Name "ServicesByOwner"}}
+- Lists all services owned by an address
+- Useful for service management interfaces
+- Returns service metadata and status
+{{else if eq .MethodDescriptorProto.Name "ServicesByDomain"}}
+- Finds services bound to a domain
+- Supports service discovery by domain
+- Returns active service endpoints
+{{end}}
+
+## Domain Verification Process
+
+1. **Initiate**: Generate verification token
+2. **Configure**: Add DNS TXT record with token
+3. **Verify**: Check DNS records for ownership proof
+4. **Register**: Bind services to verified domain
+
+## UCAN Authorization
+
+- **Delegation Chain**: Hierarchical permission delegation
+- **Capability-based**: Fine-grained access control
+- **JWT Format**: Standard token representation
+- **Root Capabilities**: Stored on IPFS with CID reference
+
+## Security Features
+
+- Domain ownership verification prevents impersonation
+- UCAN tokens enable secure delegation
+- Permission scoping limits service capabilities
+- On-chain verification audit trail
+
+## Usage Examples
+
+```bash
+# Initiate domain verification
+snrd tx svc initiate-domain-verification example.com
+
+# Verify domain ownership
+snrd tx svc verify-domain example.com
+
+# Register service
+snrd tx svc register-service service-1 example.com --permissions read,write
+
+# Query verification status
+snrd query svc domain example.com
+
+# List services for domain
+snrd query svc services-by-domain example.com
+```
@@ -2,11 +2,11 @@ syntax = "proto3";
 package svc.v1;

 import "cosmos/msg/v1/msg.proto";
-import "svc/v1/genesis.proto";
-import "gogoproto/gogo.proto";
 import "cosmos_proto/cosmos.proto";
+import "gogoproto/gogo.proto";
+import "svc/v1/genesis.proto";

-option go_package = "github.com/sonr-io/snrd/x/svc/types";
+option go_package = "github.com/sonr-io/sonr/x/svc/types";

 // Msg defines the Msg service.
 service Msg {
@@ -17,8 +17,18 @@ service Msg {
  // Since: cosmos-sdk 0.47
  rpc UpdateParams(MsgUpdateParams) returns (MsgUpdateParamsResponse);

-  // RegisterService initializes a Service with a given permission scope and
-  // URI. The domain must have a valid TXT record containing the public key.
+  // InitiateDomainVerification starts the domain verification process
+  //
+  // {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+  // It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+  //
+  // {{import "svc_docs.md"}}
+  rpc InitiateDomainVerification(MsgInitiateDomainVerification) returns (MsgInitiateDomainVerificationResponse);
+
+  // VerifyDomain completes domain verification by checking DNS TXT records
+  rpc VerifyDomain(MsgVerifyDomain) returns (MsgVerifyDomainResponse);
+
+  // RegisterService registers a new service with verified domain binding
  rpc RegisterService(MsgRegisterService) returns (MsgRegisterServiceResponse);
 }

@@ -43,20 +53,72 @@ message MsgUpdateParams {
 // Since: cosmos-sdk 0.47
 message MsgUpdateParamsResponse {}

-// MsgRegisterService is the message type for the RegisterService RPC.
+// MsgInitiateDomainVerification initiates domain ownership verification
+message MsgInitiateDomainVerification {
+  option (cosmos.msg.v1.signer) = "creator";
+
+  // Address of the user initiating domain verification
+  string creator = 1 [(cosmos_proto.scalar) = "cosmos.AddressString"];
+
+  // Domain to be verified (e.g., "example.com")
+  string domain = 2;
+}
+
+// MsgInitiateDomainVerificationResponse defines the response for domain
+// verification initiation
+message MsgInitiateDomainVerificationResponse {
+  // Verification token to be placed in DNS TXT record
+  string verification_token = 1;
+
+  // Instructions for DNS TXT record setup
+  string dns_instruction = 2;
+}
+
+// MsgVerifyDomain verifies domain ownership by checking DNS TXT records
+message MsgVerifyDomain {
+  option (cosmos.msg.v1.signer) = "creator";
+
+  // Address of the user verifying domain ownership
+  string creator = 1 [(cosmos_proto.scalar) = "cosmos.AddressString"];
+
+  // Domain to be verified
+  string domain = 2;
+}
+
+// MsgVerifyDomainResponse defines the response for domain verification
+message MsgVerifyDomainResponse {
+  // Whether verification was successful
+  bool verified = 1;
+
+  // Message describing verification result
+  string message = 2;
+}
+
+// MsgRegisterService registers a new service with verified domain binding
 message MsgRegisterService {
-  option (cosmos.msg.v1.signer) = "controller";
+  option (cosmos.msg.v1.signer) = "creator";

-  // authority is the address of the governance account.
-  string controller = 1 [(cosmos_proto.scalar) = "cosmos.AddressString"];
+  // Address of the service owner
+  string creator = 1 [(cosmos_proto.scalar) = "cosmos.AddressString"];

-  // origin is the origin of the request in wildcard form. Requires valid TXT
-  // record in DNS.
-  Service service = 2;
+  // Unique identifier for the service
+  string service_id = 2;
+
+  // Verified domain to bind to this service
+  string domain = 3;
+
+  // List of permissions requested for this service
+  repeated string requested_permissions = 4;
+
+  // UCAN delegation chain for authorization (JWT-encoded)
+  string ucan_delegation_chain = 5;
 }

-// MsgRegisterServiceResponse is the response type for the RegisterService RPC.
+// MsgRegisterServiceResponse defines the response for service registration
 message MsgRegisterServiceResponse {
-  bool success = 1;
-  string did = 2;
+  // IPFS CID of the generated root capability
+  string root_capability_cid = 1;
+
+  // Service registration details
+  string service_id = 2;
 }