master -> develop (#20)

* Squash merge develop into master

* feat: add automated production release workflow

* feat: add Gitflow workflow for syncing branches

* ci: update workflow runner to latest ubuntu version

* feat: enable buf.build publishing on master and develop branches

---------

Co-authored-by: Prad Nukala <prad@sonr.io>

x/did/builder/api.go

@@ -0,0 +1,251 @@
+package builder
+
+import (
+	"encoding/base64"
+	"fmt"
+
+	"github.com/go-webauthn/webauthn/protocol"
+
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+	didv1 "github.com/onsonr/sonr/api/did/v1"
+	"github.com/onsonr/sonr/x/did/types"
+)
+
+func APIFormatDIDNamespace(namespace types.DIDNamespace) didv1.DIDNamespace {
+	return didv1.DIDNamespace(namespace)
+}
+
+func APIFormatDIDNamespaces(namespaces []types.DIDNamespace) []didv1.DIDNamespace {
+	var s []didv1.DIDNamespace
+	for _, namespace := range namespaces {
+		s = append(s, APIFormatDIDNamespace(namespace))
+	}
+	return s
+}
+
+func APIFormatKeyRole(role types.KeyRole) didv1.KeyRole {
+	return didv1.KeyRole(role)
+}
+
+func APIFormatKeyAlgorithm(algorithm types.KeyAlgorithm) didv1.KeyAlgorithm {
+	return didv1.KeyAlgorithm(algorithm)
+}
+
+func APIFormatKeyEncoding(encoding types.KeyEncoding) didv1.KeyEncoding {
+	return didv1.KeyEncoding(encoding)
+}
+
+func APIFormatKeyCurve(curve types.KeyCurve) didv1.KeyCurve {
+	return didv1.KeyCurve(curve)
+}
+
+func APIFormatKeyType(keyType types.KeyType) didv1.KeyType {
+	return didv1.KeyType(keyType)
+}
+
+func APIFormatPermissions(permissions *types.Permissions) *didv1.Permissions {
+	if permissions == nil {
+		return nil
+	}
+	p := didv1.Permissions{
+		Grants: APIFormatDIDNamespaces(permissions.Grants),
+		Scopes: APIFormatPermissionScopes(permissions.Scopes),
+	}
+	return &p
+}
+
+func APIFormatPermissionScope(scope types.PermissionScope) didv1.PermissionScope {
+	return didv1.PermissionScope(scope)
+}
+
+func APIFormatPermissionScopes(scopes []types.PermissionScope) []didv1.PermissionScope {
+	var s []didv1.PermissionScope
+	for _, scope := range scopes {
+		s = append(s, APIFormatPermissionScope(scope))
+	}
+	return s
+}
+
+func APIFormatServiceRecord(service *types.Service) *didv1.ServiceRecord {
+	return &didv1.ServiceRecord{
+		Id:               service.Id,
+		ServiceType:      service.ServiceType,
+		Authority:        service.Authority,
+		Origin:           service.Origin,
+		Description:      service.Description,
+		ServiceEndpoints: service.ServiceEndpoints,
+		Permissions:      APIFormatPermissions(service.Permissions),
+	}
+}
+
+func APIFormatPubKeyJWK(jwk *types.PubKey_JWK) *didv1.PubKey_JWK {
+	return &didv1.PubKey_JWK{
+		Kty: jwk.Kty,
+		Crv: jwk.Crv,
+		X:   jwk.X,
+		Y:   jwk.Y,
+		N:   jwk.N,
+		E:   jwk.E,
+	}
+}
+
+func APIFormatPubKey(key *types.PubKey) *didv1.PubKey {
+	return &didv1.PubKey{
+		Role:      APIFormatKeyRole(key.GetRole()),
+		Algorithm: APIFormatKeyAlgorithm(key.GetAlgorithm()),
+		Encoding:  APIFormatKeyEncoding(key.GetEncoding()),
+		Curve:     APIFormatKeyCurve(key.GetCurve()),
+		KeyType:   APIFormatKeyType(key.GetKeyType()),
+		Raw:       key.GetRaw(),
+	}
+}
+
+func FormatEC2PublicKey(key *webauthncose.EC2PublicKeyData) (*types.PubKey_JWK, error) {
+	curve, err := GetCOSECurveName(key.Curve)
+	if err != nil {
+		return nil, err
+	}
+
+	jwkMap := map[string]interface{}{
+		"kty": "EC",
+		"crv": curve,
+		"x":   base64.RawURLEncoding.EncodeToString(key.XCoord),
+		"y":   base64.RawURLEncoding.EncodeToString(key.YCoord),
+	}
+
+	return MapToJWK(jwkMap)
+}
+
+func FormatRSAPublicKey(key *webauthncose.RSAPublicKeyData) (*types.PubKey_JWK, error) {
+	jwkMap := map[string]interface{}{
+		"kty": "RSA",
+		"n":   base64.RawURLEncoding.EncodeToString(key.Modulus),
+		"e":   base64.RawURLEncoding.EncodeToString(key.Exponent),
+	}
+
+	return MapToJWK(jwkMap)
+}
+
+func FormatOKPPublicKey(key *webauthncose.OKPPublicKeyData) (*types.PubKey_JWK, error) {
+	curve, err := GetOKPCurveName(key.Curve)
+	if err != nil {
+		return nil, err
+	}
+
+	jwkMap := map[string]interface{}{
+		"kty": "OKP",
+		"crv": curve,
+		"x":   base64.RawURLEncoding.EncodeToString(key.XCoord),
+	}
+
+	return MapToJWK(jwkMap)
+}
+
+func MapToJWK(m map[string]interface{}) (*types.PubKey_JWK, error) {
+	jwk := &types.PubKey_JWK{}
+	for k, v := range m {
+		switch k {
+		case "kty":
+			jwk.Kty = v.(string)
+		case "crv":
+			jwk.Crv = v.(string)
+		case "x":
+			jwk.X = v.(string)
+		case "y":
+			jwk.Y = v.(string)
+		case "n":
+			jwk.N = v.(string)
+		case "e":
+			jwk.E = v.(string)
+		}
+	}
+	return jwk, nil
+}
+
+func GetCOSECurveName(curveID int64) (string, error) {
+	switch curveID {
+	case int64(webauthncose.P256):
+		return "P-256", nil
+	case int64(webauthncose.P384):
+		return "P-384", nil
+	case int64(webauthncose.P521):
+		return "P-521", nil
+	default:
+		return "", fmt.Errorf("unknown curve ID: %d", curveID)
+	}
+}
+
+func GetOKPCurveName(curveID int64) (string, error) {
+	switch curveID {
+	case int64(webauthncose.Ed25519):
+		return "Ed25519", nil
+	default:
+		return "", fmt.Errorf("unknown OKP curve ID: %d", curveID)
+	}
+}
+
+// NormalizeTransports returns the transports as strings
+func NormalizeTransports(transports []protocol.AuthenticatorTransport) []string {
+	tss := make([]string, len(transports))
+	for i, t := range transports {
+		tss[i] = string(t)
+	}
+	return tss
+}
+
+// GetTransports returns the protocol.AuthenticatorTransport
+func ModuleTransportsToProtocol(transport []string) []protocol.AuthenticatorTransport {
+	tss := make([]protocol.AuthenticatorTransport, len(transport))
+	for i, t := range transport {
+		tss[i] = protocol.AuthenticatorTransport(t)
+	}
+	return tss
+}
+
+// ModuleFormatAPIServiceRecord formats a service record for the module
+func ModuleFormatAPIServiceRecord(service *didv1.ServiceRecord) *types.Service {
+	return &types.Service{
+		Id:               service.Id,
+		ServiceType:      service.ServiceType,
+		Authority:        service.Authority,
+		Origin:           service.Origin,
+		Description:      service.Description,
+		ServiceEndpoints: service.ServiceEndpoints,
+		Permissions:      ModuleFormatAPIPermissions(service.Permissions),
+	}
+}
+
+func ModuleFormatAPIPermissions(permissions *didv1.Permissions) *types.Permissions {
+	if permissions == nil {
+		return nil
+	}
+	p := types.Permissions{
+		Grants: ModuleFormatAPIDIDNamespaces(permissions.Grants),
+		Scopes: ModuleFormatAPIPermissionScopes(permissions.Scopes),
+	}
+	return &p
+}
+
+func ModuleFormatAPIPermissionScope(scope didv1.PermissionScope) types.PermissionScope {
+	return types.PermissionScope(scope)
+}
+
+func ModuleFormatAPIPermissionScopes(scopes []didv1.PermissionScope) []types.PermissionScope {
+	var s []types.PermissionScope
+	for _, scope := range scopes {
+		s = append(s, ModuleFormatAPIPermissionScope(scope))
+	}
+	return s
+}
+
+func ModuleFormatAPIDIDNamespace(namespace didv1.DIDNamespace) types.DIDNamespace {
+	return types.DIDNamespace(namespace)
+}
+
+func ModuleFormatAPIDIDNamespaces(namespaces []didv1.DIDNamespace) []types.DIDNamespace {
+	var s []types.DIDNamespace
+	for _, namespace := range namespaces {
+		s = append(s, ModuleFormatAPIDIDNamespace(namespace))
+	}
+	return s
+}

x/did/builder/chains.go

@@ -0,0 +1,70 @@
+package builder
+
+import (
+	"crypto/hmac"
+	"crypto/sha512"
+	"encoding/binary"
+	"errors"
+	"math/big"
+
+	"github.com/btcsuite/btcd/btcec/v2"
+	"github.com/onsonr/sonr/x/did/types"
+)
+
+// ComputeAccountPublicKey computes the public key of a child key given the extended public key, chain code, and index.
+func computeBip32AccountPublicKey(extPubKey PublicKey, chainCode types.ChainCode, index int) (*types.PubKey, error) {
+	// Check if the index is a hardened child key
+	if chainCode&0x80000000 != 0 && index < 0 {
+		return nil, errors.New("invalid index")
+	}
+
+	// Serialize the public key
+	pubKey, err := btcec.ParsePubKey(extPubKey.GetRaw())
+	if err != nil {
+		return nil, err
+	}
+	pubKeyBytes := pubKey.SerializeCompressed()
+
+	// Serialize the index
+	indexBytes := make([]byte, 4)
+	binary.BigEndian.PutUint32(indexBytes, uint32(index))
+
+	// Compute the HMAC-SHA512
+	mac := hmac.New(sha512.New, []byte{byte(chainCode)})
+	mac.Write(pubKeyBytes)
+	mac.Write(indexBytes)
+	I := mac.Sum(nil)
+
+	// Split I into two 32-byte sequences
+	IL := I[:32]
+
+	// Convert IL to a big integer
+	ilNum := new(big.Int).SetBytes(IL)
+
+	// Check if parse256(IL) >= n
+	curve := btcec.S256()
+	if ilNum.Cmp(curve.N) >= 0 {
+		return nil, errors.New("invalid child key")
+	}
+
+	// Compute the child public key
+	ilx, ily := curve.ScalarBaseMult(IL)
+	childX, childY := curve.Add(ilx, ily, pubKey.X(), pubKey.Y())
+	lx := newBigIntFieldVal(childX)
+	ly := newBigIntFieldVal(childY)
+
+	// Create the child public key
+	childPubKey := btcec.NewPublicKey(lx, ly)
+	pk, err := types.NewPublicKey(childPubKey.SerializeCompressed(), types.ChainCodeKeyInfos[chainCode])
+	if err != nil {
+		return nil, err
+	}
+	return pk, nil
+}
+
+// newBigIntFieldVal creates a new field value from a big integer.
+func newBigIntFieldVal(val *big.Int) *btcec.FieldVal {
+	lx := new(btcec.FieldVal)
+	lx.SetByteSlice(val.Bytes())
+	return lx
+}

x/did/builder/constants.go

@@ -0,0 +1,334 @@
+package builder
+
+import (
+	"github.com/onsonr/sonr/x/did/types"
+)
+
+type (
+	AuthenticatorAttachment string
+	AuthenticatorTransport  string
+)
+
+const (
+	// Platform represents a platform authenticator is attached using a client device-specific transport, called
+	// platform attachment, and is usually not removable from the client device. A public key credential bound to a
+	// platform authenticator is called a platform credential.
+	Platform AuthenticatorAttachment = "platform"
+
+	// CrossPlatform represents a roaming authenticator is attached using cross-platform transports, called
+	// cross-platform attachment. Authenticators of this class are removable from, and can "roam" among, client devices.
+	// A public key credential bound to a roaming authenticator is called a roaming credential.
+	CrossPlatform AuthenticatorAttachment = "cross-platform"
+)
+
+func ParseAuthenticatorAttachment(s string) AuthenticatorAttachment {
+	switch s {
+	case "platform":
+		return Platform
+	default:
+		return CrossPlatform
+	}
+}
+
+const (
+	// USB indicates the respective authenticator can be contacted over removable USB.
+	USB AuthenticatorTransport = "usb"
+
+	// NFC indicates the respective authenticator can be contacted over Near Field Communication (NFC).
+	NFC AuthenticatorTransport = "nfc"
+
+	// BLE indicates the respective authenticator can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).
+	BLE AuthenticatorTransport = "ble"
+
+	// SmartCard indicates the respective authenticator can be contacted over ISO/IEC 7816 smart card with contacts.
+	//
+	// WebAuthn Level 3.
+	SmartCard AuthenticatorTransport = "smart-card"
+
+	// Hybrid indicates the respective authenticator can be contacted using a combination of (often separate)
+	// data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using
+	// a smartphone.
+	//
+	// WebAuthn Level 3.
+	Hybrid AuthenticatorTransport = "hybrid"
+
+	// Internal indicates the respective authenticator is contacted using a client device-specific transport, i.e., it
+	// is a platform authenticator. These authenticators are not removable from the client device.
+	Internal AuthenticatorTransport = "internal"
+)
+
+func ParseAuthenticatorTransport(s string) AuthenticatorTransport {
+	switch s {
+	case "usb":
+		return USB
+	case "nfc":
+		return NFC
+	case "ble":
+		return BLE
+	case "smart-card":
+		return SmartCard
+	case "hybrid":
+		return Hybrid
+	default:
+		return Internal
+	}
+}
+
+type AuthenticatorFlags byte
+
+const (
+	// FlagUserPresent Bit 00000001 in the byte sequence. Tells us if user is present. Also referred to as the UP flag.
+	FlagUserPresent AuthenticatorFlags = 1 << iota // Referred to as UP
+
+	// FlagRFU1 is a reserved for future use flag.
+	FlagRFU1
+
+	// FlagUserVerified Bit 00000100 in the byte sequence. Tells us if user is verified
+	// by the authenticator using a biometric or PIN. Also referred to as the UV flag.
+	FlagUserVerified
+
+	// FlagBackupEligible Bit 00001000 in the byte sequence. Tells us if a backup is eligible for device. Also referred
+	// to as the BE flag.
+	FlagBackupEligible // Referred to as BE
+
+	// FlagBackupState Bit 00010000 in the byte sequence. Tells us if a backup state for device. Also referred to as the
+	// BS flag.
+	FlagBackupState
+
+	// FlagRFU2 is a reserved for future use flag.
+	FlagRFU2
+
+	// FlagAttestedCredentialData Bit 01000000 in the byte sequence. Indicates whether
+	// the authenticator added attested credential data. Also referred to as the AT flag.
+	FlagAttestedCredentialData
+
+	// FlagHasExtensions Bit 10000000 in the byte sequence. Indicates if the authenticator data has extensions. Also
+	// referred to as the ED flag.
+	FlagHasExtensions
+)
+
+type AttestationFormat string
+
+const (
+	// AttestationFormatPacked is the "packed" attestation statement format is a WebAuthn-optimized format for
+	// attestation. It uses a very compact but still extensible encoding method. This format is implementable by
+	// authenticators with limited resources (e.g., secure elements).
+	AttestationFormatPacked AttestationFormat = "packed"
+
+	// AttestationFormatTPM is the TPM attestation statement format returns an attestation statement in the same format
+	// as the packed attestation statement format, although the rawData and signature fields are computed differently.
+	AttestationFormatTPM AttestationFormat = "tpm"
+
+	// AttestationFormatAndroidKey is the attestation statement format for platform authenticators on versions "N", and
+	// later, which may provide this proprietary "hardware attestation" statement.
+	AttestationFormatAndroidKey AttestationFormat = "android-key"
+
+	// AttestationFormatAndroidSafetyNet is the attestation statement format that Android-based platform authenticators
+	// MAY produce an attestation statement based on the Android SafetyNet API.
+	AttestationFormatAndroidSafetyNet AttestationFormat = "android-safetynet"
+
+	// AttestationFormatFIDOUniversalSecondFactor is the attestation statement format that is used with FIDO U2F
+	// authenticators.
+	AttestationFormatFIDOUniversalSecondFactor AttestationFormat = "fido-u2f"
+
+	// AttestationFormatApple is the attestation statement format that is used with Apple devices' platform
+	// authenticators.
+	AttestationFormatApple AttestationFormat = "apple"
+
+	// AttestationFormatNone is the attestation statement format that is used to replace any authenticator-provided
+	// attestation statement when a WebAuthn Relying Party indicates it does not wish to receive attestation information.
+	AttestationFormatNone AttestationFormat = "none"
+)
+
+func ExtractAttestationFormats(p *types.Params) []AttestationFormat {
+	var formats []AttestationFormat
+	for _, v := range p.AttestationFormats {
+		formats = append(formats, parseAttestationFormat(v))
+	}
+	return formats
+}
+
+func parseAttestationFormat(s string) AttestationFormat {
+	switch s {
+	case "packed":
+		return AttestationFormatPacked
+	case "tpm":
+		return AttestationFormatTPM
+	case "android-key":
+		return AttestationFormatAndroidKey
+	case "android-safetynet":
+		return AttestationFormatAndroidSafetyNet
+	case "fido-u2f":
+		return AttestationFormatFIDOUniversalSecondFactor
+	case "apple":
+		return AttestationFormatApple
+	case "none":
+		return AttestationFormatNone
+	default:
+		return AttestationFormatPacked
+	}
+}
+
+type CredentialType string
+
+const (
+	CredentialTypePublicKeyCredential CredentialType = "public-key"
+)
+
+type ConveyancePreference string
+
+const (
+	// PreferNoAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party is not interested in authenticator attestation. For example, in order
+	// to potentially avoid having to obtain user consent to relay identifying information to the Relying Party, or to
+	// save a round trip to an Attestation CA or Anonymization CA.
+	//
+	// This is the default value.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-none)
+	PreferNoAttestation ConveyancePreference = "none"
+
+	// PreferIndirectAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party prefers an attestation conveyance yielding verifiable attestation
+	// statements, but allows the client to decide how to obtain such attestation statements. The client MAY replace the
+	// authenticator-generated attestation statements with attestation statements generated by an Anonymization CA, in
+	// order to protect the user’s privacy, or to assist Relying Parties with attestation verification in a
+	// heterogeneous ecosystem.
+	//
+	// Note: There is no guarantee that the Relying Party will obtain a verifiable attestation statement in this case.
+	// For example, in the case that the authenticator employs self attestation.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-indirect)
+	PreferIndirectAttestation ConveyancePreference = "indirect"
+
+	// PreferDirectAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party wants to receive the attestation statement as generated by the
+	// authenticator.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-direct)
+	PreferDirectAttestation ConveyancePreference = "direct"
+
+	// PreferEnterpriseAttestation is a ConveyancePreference value.
+	//
+	// This value indicates that the Relying Party wants to receive an attestation statement that may include uniquely
+	// identifying information. This is intended for controlled deployments within an enterprise where the organization
+	// wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless
+	// the user agent or authenticator configuration permits it for the requested RP ID.
+	//
+	// If permitted, the user agent SHOULD signal to the authenticator (at invocation time) that enterprise
+	// attestation is requested, and convey the resulting AAGUID and attestation statement, unaltered, to the Relying
+	// Party.
+	//
+	// Specification: §5.4.7. Attestation Conveyance Preference Enumeration (https://www.w3.org/TR/webauthn/#dom-attestationconveyancepreference-enterprise)
+	PreferEnterpriseAttestation ConveyancePreference = "enterprise"
+)
+
+func ExtractConveyancePreference(p *types.Params) ConveyancePreference {
+	switch p.ConveyancePreference {
+	case "none":
+		return PreferNoAttestation
+	case "indirect":
+		return PreferIndirectAttestation
+	case "direct":
+		return PreferDirectAttestation
+	case "enterprise":
+		return PreferEnterpriseAttestation
+	default:
+		return PreferNoAttestation
+	}
+}
+
+type PublicKeyCredentialHints string
+
+const (
+	// PublicKeyCredentialHintSecurityKey is a PublicKeyCredentialHint that indicates that the Relying Party believes
+	// that users will satisfy this request with a physical security key. For example, an enterprise Relying Party may
+	// set this hint if they have issued security keys to their employees and will only accept those authenticators for
+	// registration and authentication.
+	//
+	// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
+	// authenticatorAttachment SHOULD be set to cross-platform.
+	PublicKeyCredentialHintSecurityKey PublicKeyCredentialHints = "security-key"
+
+	// PublicKeyCredentialHintClientDevice is a PublicKeyCredentialHint that indicates that the Relying Party believes
+	// that users will satisfy this request with a platform authenticator attached to the client device.
+	//
+	// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
+	// authenticatorAttachment SHOULD be set to platform.
+	PublicKeyCredentialHintClientDevice PublicKeyCredentialHints = "client-device"
+
+	// PublicKeyCredentialHintHybrid is a PublicKeyCredentialHint that indicates that the Relying Party believes that
+	// users will satisfy this request with general-purpose authenticators such as smartphones. For example, a consumer
+	// Relying Party may believe that only a small fraction of their customers possesses dedicated security keys. This
+	// option also implies that the local platform authenticator should not be promoted in the UI.
+	//
+	// For compatibility with older user agents, when this hint is used in PublicKeyCredentialCreationOptions, the
+	// authenticatorAttachment SHOULD be set to cross-platform.
+	PublicKeyCredentialHintHybrid PublicKeyCredentialHints = "hybrid"
+)
+
+func ParsePublicKeyCredentialHints(s string) PublicKeyCredentialHints {
+	switch s {
+	case "security-key":
+		return PublicKeyCredentialHintSecurityKey
+	case "client-device":
+		return PublicKeyCredentialHintClientDevice
+	case "hybrid":
+		return PublicKeyCredentialHintHybrid
+	default:
+		return ""
+	}
+}
+
+type AttestedCredentialData struct {
+	AAGUID       []byte `json:"aaguid"`
+	CredentialID []byte `json:"credential_id"`
+
+	// The raw credential public key bytes received from the attestation data.
+	CredentialPublicKey []byte `json:"public_key"`
+}
+
+type ResidentKeyRequirement string
+
+const (
+	// ResidentKeyRequirementDiscouraged indicates the Relying Party prefers creating a server-side credential, but will
+	// accept a client-side discoverable credential. This is the default.
+	ResidentKeyRequirementDiscouraged ResidentKeyRequirement = "discouraged"
+
+	// ResidentKeyRequirementPreferred indicates to the client we would prefer a discoverable credential.
+	ResidentKeyRequirementPreferred ResidentKeyRequirement = "preferred"
+
+	// ResidentKeyRequirementRequired indicates the Relying Party requires a client-side discoverable credential, and is
+	// prepared to receive an error if a client-side discoverable credential cannot be created.
+	ResidentKeyRequirementRequired ResidentKeyRequirement = "required"
+)
+
+func ParseResidentKeyRequirement(s string) ResidentKeyRequirement {
+	switch s {
+	case "discouraged":
+		return ResidentKeyRequirementDiscouraged
+	case "preferred":
+		return ResidentKeyRequirementPreferred
+	default:
+		return ResidentKeyRequirementRequired
+	}
+}
+
+type (
+	AuthenticationExtensions    map[string]any
+	UserVerificationRequirement string
+)
+
+const (
+	// VerificationRequired User verification is required to create/release a credential
+	VerificationRequired UserVerificationRequirement = "required"
+
+	// VerificationPreferred User verification is preferred to create/release a credential
+	VerificationPreferred UserVerificationRequirement = "preferred" // This is the default
+
+	// VerificationDiscouraged The authenticator should not verify the user for the credential
+	VerificationDiscouraged UserVerificationRequirement = "discouraged"
+)

x/did/builder/macroon.go

@@ -0,0 +1,48 @@
+package builder
+
+import (
+	"net/http"
+
+	"github.com/labstack/echo/v4"
+	"gopkg.in/macaroon.v2"
+
+	"gopkg.in/macaroon-bakery.v2/bakery/checkers"
+)
+
+var PermissionNamespace *checkers.Namespace
+
+func ValidateMacaroonMiddleware(secretKey []byte, location string) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			// Extract the macaroon from the Authorization header
+			auth := c.Request().Header.Get("Authorization")
+			if auth == "" {
+				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Missing Authorization header"})
+			}
+
+			// Decode the macaroon
+			mac, err := macaroon.Base64Decode([]byte(auth))
+			if err != nil {
+				return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid macaroon encoding"})
+			}
+
+			token, err := macaroon.New(secretKey, mac, location, macaroon.LatestVersion)
+			if err != nil {
+				return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid macaroon"})
+			}
+
+			// Verify the macaroon
+			err = token.Verify(secretKey, func(caveat string) error {
+				// Implement your caveat verification logic here
+				// For example, you might check if the caveat is still valid (e.g., not expired)
+				return nil // Return nil if the caveat is valid
+			}, nil)
+			if err != nil {
+				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Invalid macaroon"})
+			}
+
+			// Macaroon is valid, proceed to the next handler
+			return next(c)
+		}
+	}
+}

x/did/builder/openid.go

@@ -0,0 +1,27 @@
+package builder
+
+import (
+	"fmt"
+
+	"github.com/onsonr/sonr/x/did/types/oidc"
+)
+
+func GetDiscovery(origin string) *oidc.DiscoveryDocument {
+	baseURL := "https://" + origin // Ensure this is the correct base URL for your service
+	discoveryDoc := &oidc.DiscoveryDocument{
+		Issuer:                 baseURL,
+		AuthorizationEndpoint:  fmt.Sprintf("%s/auth", baseURL),
+		TokenEndpoint:          fmt.Sprintf("%s/token", baseURL),
+		UserinfoEndpoint:       fmt.Sprintf("%s/userinfo", baseURL),
+		JwksUri:                fmt.Sprintf("%s/jwks", baseURL),
+		RegistrationEndpoint:   fmt.Sprintf("%s/register", baseURL),
+		ScopesSupported:        []string{"openid", "profile", "email", "web3", "sonr"},
+		ResponseTypesSupported: []string{"code"},
+		ResponseModesSupported: []string{"query", "form_post"},
+		GrantTypesSupported:    []string{"authorization_code", "refresh_token"},
+		AcrValuesSupported:     []string{"passkey"},
+		SubjectTypesSupported:  []string{"public"},
+		ClaimsSupported:        []string{"sub", "iss", "name", "email"},
+	}
+	return discoveryDoc
+}

x/did/builder/options.go

@@ -0,0 +1,82 @@
+package builder
+
+import (
+	"encoding/json"
+
+	"github.com/onsonr/sonr/x/did/types"
+)
+
+type AuthenticatorResponse struct {
+	// From the spec https://www.w3.org/TR/webauthn/#dom-authenticatorresponse-clientdatajson
+	// This attribute contains a JSON serialization of the client data passed to the authenticator
+	// by the client in its call to either create() or get().
+	ClientDataJSON URLEncodedBase64 `json:"clientDataJSON"`
+}
+
+type AuthenticatorAttestationResponse struct {
+	// The byte slice of clientDataJSON, which becomes CollectedClientData
+	AuthenticatorResponse
+
+	Transports []string `json:"transports,omitempty"`
+
+	AuthenticatorData URLEncodedBase64 `json:"authenticatorData"`
+
+	PublicKey URLEncodedBase64 `json:"publicKey"`
+
+	PublicKeyAlgorithm int64 `json:"publicKeyAlgorithm"`
+
+	// AttestationObject is the byte slice version of attestationObject.
+	// This attribute contains an attestation object, which is opaque to, and
+	// cryptographically protected against tampering by, the client. The
+	// attestation object contains both authenticator data and an attestation
+	// statement. The former contains the AAGUID, a unique credential ID, and
+	// the credential public key. The contents of the attestation statement are
+	// determined by the attestation statement format used by the authenticator.
+	// It also contains any additional information that the Relying Party's server
+	// requires to validate the attestation statement, as well as to decode and
+	// validate the authenticator data along with the JSON-serialized client data.
+	AttestationObject URLEncodedBase64 `json:"attestationObject"`
+}
+
+type PublicKeyCredentialCreationOptions struct {
+	RelyingParty           RelyingPartyEntity         `json:"rp"`
+	User                   UserEntity                 `json:"user"`
+	Challenge              URLEncodedBase64           `json:"challenge"`
+	Parameters             []CredentialParameter      `json:"pubKeyCredParams,omitempty"`
+	Timeout                int                        `json:"timeout,omitempty"`
+	CredentialExcludeList  []CredentialDescriptor     `json:"excludeCredentials,omitempty"`
+	AuthenticatorSelection AuthenticatorSelection     `json:"authenticatorSelection,omitempty"`
+	Hints                  []PublicKeyCredentialHints `json:"hints,omitempty"`
+	Attestation            ConveyancePreference       `json:"attestation,omitempty"`
+	AttestationFormats     []AttestationFormat        `json:"attestationFormats,omitempty"`
+	Extensions             AuthenticationExtensions   `json:"extensions,omitempty"`
+}
+
+func GetPublicKeyCredentialCreationOptions(origin string, subject string, vaultCID string, params *types.Params) (*PublicKeyCredentialCreationOptions, error) {
+	chal, err := CreateChallenge()
+	if err != nil {
+		return nil, err
+	}
+	return &PublicKeyCredentialCreationOptions{
+		RelyingParty:           NewRelayingParty(origin, subject),
+		User:                   NewUserEntity(subject, subject, vaultCID),
+		Parameters:             ExtractCredentialParameters(params),
+		Timeout:                20,
+		CredentialExcludeList:  nil,
+		Challenge:              chal,
+		AuthenticatorSelection: AuthenticatorSelection{},
+		Hints:                  nil,
+		Attestation:            ExtractConveyancePreference(params),
+		AttestationFormats:     ExtractAttestationFormats(params),
+		Extensions:             nil,
+	}, nil
+}
+
+func UnmarshalAuthenticatorResponse(data []byte) (*AuthenticatorResponse, error) {
+	var ar AuthenticatorResponse
+	err := json.Unmarshal(data, &ar)
+	if err != nil {
+		return nil, err
+	}
+	return &ar, nil
+}

x/did/builder/pubkey.go

@@ -0,0 +1,81 @@
+package builder
+
+import (
+	"fmt"
+
+	cryptotypes "github.com/cosmos/cosmos-sdk/crypto/types"
+	didv1 "github.com/onsonr/sonr/api/did/v1"
+	"github.com/onsonr/sonr/x/did/types"
+
+	"github.com/go-webauthn/webauthn/protocol/webauthncose"
+)
+
+// PublicKey is an interface for a public key
+type PublicKey interface {
+	cryptotypes.PubKey
+	Clone() cryptotypes.PubKey
+	GetRaw() []byte
+	GetRole() types.KeyRole
+	GetAlgorithm() types.KeyAlgorithm
+	GetEncoding() types.KeyEncoding
+	GetCurve() types.KeyCurve
+	GetKeyType() types.KeyType
+}
+
+// CreateAuthnVerification creates a new verification method for an authn method
+func CreateAuthnVerification(namespace types.DIDNamespace, issuer string, controller string, pubkey *types.PubKey, identifier string) *types.VerificationMethod {
+	return &types.VerificationMethod{
+		Method:     namespace,
+		Controller: controller,
+		PublicKey:  pubkey,
+		Id:         identifier,
+		Issuer:     issuer,
+	}
+}
+
+// CreateWalletVerification creates a new verification method for a wallet
+func CreateWalletVerification(namespace types.DIDNamespace, controller string, pubkey *types.PubKey, identifier string) *didv1.VerificationMethod {
+	return &didv1.VerificationMethod{
+		Method:     APIFormatDIDNamespace(namespace),
+		Controller: controller,
+		PublicKey:  APIFormatPubKey(pubkey),
+		Id:         identifier,
+	}
+}
+
+// ExtractWebAuthnPublicKey parses the raw public key bytes and returns a JWK representation
+func ExtractWebAuthnPublicKey(keyBytes []byte) (*types.PubKey_JWK, error) {
+	key, err := webauthncose.ParsePublicKey(keyBytes)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse public key: %w", err)
+	}
+
+	switch k := key.(type) {
+	case *webauthncose.EC2PublicKeyData:
+		return FormatEC2PublicKey(k)
+	case *webauthncose.RSAPublicKeyData:
+		return FormatRSAPublicKey(k)
+	case *webauthncose.OKPPublicKeyData:
+		return FormatOKPPublicKey(k)
+	default:
+		return nil, fmt.Errorf("unsupported key type")
+	}
+}
+
+// NewInitialWalletAccounts creates a new set of verification methods for a wallet
+func NewInitialWalletAccounts(controller string, pubkey *types.PubKey) ([]*didv1.VerificationMethod, error) {
+	var verificationMethods []*didv1.VerificationMethod
+	for method, chain := range types.InitialChainCodes {
+		nk, err := computeBip32AccountPublicKey(pubkey, chain, 0)
+		if err != nil {
+			return nil, err
+		}
+
+		addr, err := chain.FormatAddress(nk)
+		if err != nil {
+			return nil, nil
+		}
+		verificationMethods = append(verificationMethods, CreateWalletVerification(method, controller, nk, method.FormatDID(addr)))
+	}
+	return verificationMethods, nil
+}

x/did/builder/scopes.go

@@ -0,0 +1,56 @@
+package builder
+
+import (
+	"github.com/onsonr/sonr/x/did/types"
+	"gopkg.in/macaroon-bakery.v2/bakery/checkers"
+)
+
+var (
+	GenericPermissionScopeStrings = [...]string{
+		"profile.name",
+		"identifiers.email",
+		"identifiers.phone",
+		"transactions.read",
+		"transactions.write",
+		"wallets.read",
+		"wallets.create",
+		"wallets.subscribe",
+		"wallets.update",
+		"transactions.verify",
+		"transactions.broadcast",
+		"admin.user",
+		"admin.validator",
+	}
+
+	StringToModulePermissionScope = map[string]types.PermissionScope{
+		"PERMISSION_SCOPE_UNSPECIFIED":            types.PermissionScope_PERMISSION_SCOPE_UNSPECIFIED,
+		"PERMISSION_SCOPE_BASIC_INFO":             types.PermissionScope_PERMISSION_SCOPE_BASIC_INFO,
+		"PERMISSION_SCOPE_IDENTIFIERS_EMAIL":      types.PermissionScope_PERMISSION_SCOPE_PERMISSIONS_READ,
+		"PERMISSION_SCOPE_IDENTIFIERS_PHONE":      types.PermissionScope_PERMISSION_SCOPE_PERMISSIONS_WRITE,
+		"PERMISSION_SCOPE_TRANSACTIONS_READ":      types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_READ,
+		"PERMISSION_SCOPE_TRANSACTIONS_WRITE":     types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_WRITE,
+		"PERMISSION_SCOPE_WALLETS_READ":           types.PermissionScope_PERMISSION_SCOPE_WALLETS_READ,
+		"PERMISSION_SCOPE_WALLETS_CREATE":         types.PermissionScope_PERMISSION_SCOPE_WALLETS_CREATE,
+		"PERMISSION_SCOPE_WALLETS_SUBSCRIBE":      types.PermissionScope_PERMISSION_SCOPE_WALLETS_SUBSCRIBE,
+		"PERMISSION_SCOPE_WALLETS_UPDATE":         types.PermissionScope_PERMISSION_SCOPE_WALLETS_UPDATE,
+		"PERMISSION_SCOPE_TRANSACTIONS_VERIFY":    types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_VERIFY,
+		"PERMISSION_SCOPE_TRANSACTIONS_BROADCAST": types.PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_BROADCAST,
+		"PERMISSION_SCOPE_ADMIN_USER":             types.PermissionScope_PERMISSION_SCOPE_ADMIN_USER,
+		"PERMISSION_SCOPE_ADMIN_VALIDATOR":        types.PermissionScope_PERMISSION_SCOPE_ADMIN_VALIDATOR,
+	}
+)
+
+func ResolvePermissionScope(scope string) (types.PermissionScope, bool) {
+	uriToPrefix := make(map[string]string)
+	for _, scope := range GenericPermissionScopeStrings {
+		uriToPrefix["https://example.com/auth/"+scope] = scope
+	}
+	PermissionNamespace := checkers.NewNamespace(uriToPrefix)
+
+	prefix, ok := PermissionNamespace.Resolve("https://example.com/auth/" + scope)
+	if !ok {
+		return 0, false
+	}
+	permScope, ok := StringToModulePermissionScope[prefix]
+	return permScope, ok
+}

x/did/builder/service.go

@@ -0,0 +1,103 @@
+package builder
+
+import (
+	"crypto/rand"
+	"strings"
+
+	"github.com/onsonr/sonr/x/did/types"
+)
+
+// ChallengeLength - Length of bytes to generate for a challenge.
+const ChallengeLength = 32
+
+// CreateChallenge creates a new challenge that should be signed and returned by the authenticator. The spec recommends
+// using at least 16 bytes with 100 bits of entropy. We use 32 bytes.
+func CreateChallenge() (challenge URLEncodedBase64, err error) {
+	challenge = make([]byte, ChallengeLength)
+
+	if _, err = rand.Read(challenge); err != nil {
+		return nil, err
+	}
+
+	return challenge, nil
+}
+
+type CredentialEntity struct {
+	// A human-palatable name for the entity. Its function depends on what the PublicKeyCredentialEntity represents:
+	//
+	// When inherited by PublicKeyCredentialRpEntity it is a human-palatable identifier for the Relying Party,
+	// intended only for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".
+	//
+	// When inherited by PublicKeyCredentialUserEntity, it is a human-palatable identifier for a user account. It is
+	// intended only for display, i.e., aiding the user in determining the difference between user accounts with similar
+	// displayNames. For example, "alexm", "alex.p.mueller@example.com" or "+14255551234".
+	Name string `json:"name"`
+}
+
+func NewCredentialEntity(name string) CredentialEntity {
+	return CredentialEntity{
+		Name: name,
+	}
+}
+
+type CredentialParameter struct {
+	Type      CredentialType                `json:"type"`
+	Algorithm types.COSEAlgorithmIdentifier `json:"alg"`
+}
+
+func NewCredentialParameter(ki *types.KeyInfo) CredentialParameter {
+	return CredentialParameter{
+		Type:      CredentialTypePublicKeyCredential,
+		Algorithm: ki.Algorithm.CoseIdentifier(),
+	}
+}
+
+func ExtractCredentialParameters(p *types.Params) []CredentialParameter {
+	var keys []*types.KeyInfo
+	for k, v := range p.AllowedPublicKeys {
+		if strings.Contains(k, "webauthn") {
+			keys = append(keys, v)
+		}
+	}
+	var cparams []CredentialParameter
+	for _, ki := range keys {
+		cparams = append(cparams, NewCredentialParameter(ki))
+	}
+	return cparams
+}
+
+type RelyingPartyEntity struct {
+	CredentialEntity
+
+	// A unique identifier for the Relying Party entity, which sets the RP ID.
+	ID string `json:"id"`
+}
+
+func NewRelayingParty(name string, origin string) RelyingPartyEntity {
+	return RelyingPartyEntity{
+		CredentialEntity: NewCredentialEntity(origin),
+		ID:               origin,
+	}
+}
+
+type UserEntity struct {
+	CredentialEntity
+	// A human-palatable name for the user account, intended only for display.
+	// For example, "Alex P. Müller" or "田中 倫". The Relying Party SHOULD let
+	// the user choose this, and SHOULD NOT restrict the choice more than necessary.
+	DisplayName string `json:"displayName"`
+
+	// ID is the user handle of the user account entity. To ensure secure operation,
+	// authentication and authorization decisions MUST be made on the basis of this id
+	// member, not the displayName nor name members. See Section 6.1 of
+	// [RFC8266](https://www.w3.org/TR/webauthn/#biblio-rfc8266).
+	ID any `json:"id"`
+}
+
+func NewUserEntity(name string, subject string, cid string) UserEntity {
+	return UserEntity{
+		CredentialEntity: NewCredentialEntity(name),
+		DisplayName:      subject,
+		ID:               cid,
+	}
+}

x/did/builder/signer.go

@@ -0,0 +1,59 @@
+package builder
+
+import (
+	"github.com/onsonr/crypto"
+	"github.com/onsonr/sonr/x/did/types"
+)
+
+type Signer interface {
+	Sign(msg []byte) ([]byte, error)
+	Verify(msg []byte, sig []byte) error
+	PublicKey() []byte
+}
+
+type signer struct {
+	user *types.Keyshare
+	val  *types.Keyshare
+}
+
+func (k signer) Sign(msg []byte) ([]byte, error) {
+	valSignFunc, err := crypto.GetSignFunc(k.val, msg)
+	if err != nil {
+		return nil, err
+	}
+	usrSignFunc, err := crypto.GetSignFunc(k.user, msg)
+	if err != nil {
+		return nil, err
+	}
+	sig, err := crypto.RunMPCSign(valSignFunc, usrSignFunc)
+	if err != nil {
+		return nil, err
+	}
+	return crypto.SerializeMPCSignature(sig)
+}
+
+func (k signer) Verify(msg []byte, sig []byte) error {
+	sigMpc, err := crypto.DeserializeMPCSignature(sig)
+	if err != nil {
+		return err
+	}
+	pk, err := crypto.GetECDSAPublicKey(k.val)
+	if err != nil {
+		return err
+	}
+	ok := crypto.VerifyMPCSignature(sigMpc, msg, pk)
+	if !ok {
+		return types.ErrInvalidSignature
+	}
+	return nil
+}
+
+func (k signer) PublicKey() []byte {
+	if k.user != nil {
+		return k.user.PublicKey
+	}
+	if k.val != nil {
+		return k.val.PublicKey
+	}
+	return nil
+}

x/did/builder/webauthn.go

@@ -0,0 +1,169 @@
+package builder
+
+import (
+	"bytes"
+	"encoding/base64"
+	"reflect"
+
+	"github.com/go-webauthn/webauthn/protocol"
+)
+
+// Credential contains all needed information about a WebAuthn credential for storage.
+type Credential struct {
+	Subject         string   `json:"handle"`
+	AttestationType string   `json:"attestationType"`
+	Origin          string   `json:"origin"`
+	CredentialID    []byte   `json:"id"`
+	PublicKey       []byte   `json:"publicKey"`
+	Transport       []string `json:"transport"`
+	SignCount       uint32   `json:"signCount"`
+	UserPresent     bool     `json:"userPresent"`
+	UserVerified    bool     `json:"userVerified"`
+	BackupEligible  bool     `json:"backupEligible"`
+	BackupState     bool     `json:"backupState"`
+	CloneWarning    bool     `json:"cloneWarning"`
+}
+
+// NewCredential will return a credential pointer on successful validation of a registration response.
+func NewCredential(c *protocol.ParsedCredentialCreationData, origin, handle string) *Credential {
+	return &Credential{
+		Subject:         handle,
+		Origin:          origin,
+		AttestationType: c.Response.AttestationObject.Format,
+		CredentialID:    c.Response.AttestationObject.AuthData.AttData.CredentialID,
+		PublicKey:       c.Response.AttestationObject.AuthData.AttData.CredentialPublicKey,
+		Transport:       NormalizeTransports(c.Response.Transports),
+		SignCount:       c.Response.AttestationObject.AuthData.Counter,
+		UserPresent:     c.Response.AttestationObject.AuthData.Flags.HasUserPresent(),
+		UserVerified:    c.Response.AttestationObject.AuthData.Flags.HasUserVerified(),
+		BackupEligible:  c.Response.AttestationObject.AuthData.Flags.HasBackupEligible(),
+		BackupState:     c.Response.AttestationObject.AuthData.Flags.HasAttestedCredentialData(),
+	}
+}
+
+// Descriptor converts a Credential into a protocol.CredentialDescriptor.
+func (c *Credential) Descriptor() protocol.CredentialDescriptor {
+	return protocol.CredentialDescriptor{
+		Type:            protocol.PublicKeyCredentialType,
+		CredentialID:    c.CredentialID,
+		Transport:       ModuleTransportsToProtocol(c.Transport),
+		AttestationType: c.AttestationType,
+	}
+}
+
+// This is a signal that the authenticator may be cloned, see CloneWarning above for more information.
+func (a *Credential) UpdateCounter(authDataCount uint32) {
+	if authDataCount <= a.SignCount && (authDataCount != 0 || a.SignCount != 0) {
+		a.CloneWarning = true
+		return
+	}
+
+	a.SignCount = authDataCount
+}
+
+type CredentialDescriptor struct {
+	// The valid credential types.
+	Type CredentialType `json:"type"`
+
+	// CredentialID The ID of a credential to allow/disallow.
+	CredentialID URLEncodedBase64 `json:"id"`
+
+	// The authenticator transports that can be used.
+	Transport []AuthenticatorTransport `json:"transports,omitempty"`
+
+	// The AttestationType from the Credential. Used internally only.
+	AttestationType string `json:"-"`
+}
+
+func NewCredentialDescriptor(credentialID string, transports []AuthenticatorTransport, attestationType string) *CredentialDescriptor {
+	return &CredentialDescriptor{
+		CredentialID:    URLEncodedBase64(credentialID),
+		Transport:       transports,
+		AttestationType: attestationType,
+		Type:            CredentialTypePublicKeyCredential,
+	}
+}
+
+type AuthenticatorSelection struct {
+	// AuthenticatorAttachment If this member is present, eligible authenticators are filtered to only
+	// authenticators attached with the specified AuthenticatorAttachment enum.
+	AuthenticatorAttachment AuthenticatorAttachment `json:"authenticatorAttachment,omitempty"`
+
+	// RequireResidentKey this member describes the Relying Party's requirements regarding resident
+	// credentials. If the parameter is set to true, the authenticator MUST create a client-side-resident
+	// public key credential source when creating a public key credential.
+	RequireResidentKey *bool `json:"requireResidentKey,omitempty"`
+
+	// ResidentKey this member describes the Relying Party's requirements regarding resident
+	// credentials per Webauthn Level 2.
+	ResidentKey ResidentKeyRequirement `json:"residentKey,omitempty"`
+
+	// UserVerification This member describes the Relying Party's requirements regarding user verification for
+	// the create() operation. Eligible authenticators are filtered to only those capable of satisfying this
+	// requirement.
+	UserVerification UserVerificationRequirement `json:"userVerification,omitempty"`
+}
+
+type AuthenticatorData struct {
+	RPIDHash []byte                 `json:"rpid"`
+	Flags    AuthenticatorFlags     `json:"flags"`
+	Counter  uint32                 `json:"sign_count"`
+	AttData  AttestedCredentialData `json:"att_data"`
+	ExtData  []byte                 `json:"ext_data"`
+}
+
+type AttestationObject struct {
+	// The authenticator data, including the newly created public key. See AuthenticatorData for more info
+	AuthData AuthenticatorData
+
+	// The byteform version of the authenticator data, used in part for signature validation
+	RawAuthData []byte `json:"authData"`
+
+	// The format of the Attestation data.
+	Format string `json:"fmt"`
+
+	// The attestation statement data sent back if attestation is requested.
+	AttStatement map[string]any `json:"attStmt,omitempty"`
+}
+
+type URLEncodedBase64 []byte
+
+func (e URLEncodedBase64) String() string {
+	return base64.RawURLEncoding.EncodeToString(e)
+}
+
+// UnmarshalJSON base64 decodes a URL-encoded value, storing the result in the
+// provided byte slice.
+func (e *URLEncodedBase64) UnmarshalJSON(data []byte) error {
+	if bytes.Equal(data, []byte("null")) {
+		return nil
+	}
+
+	// Trim the leading spaces.
+	data = bytes.Trim(data, "\"")
+
+	// Trim the trailing equal characters.
+	data = bytes.TrimRight(data, "=")
+
+	out := make([]byte, base64.RawURLEncoding.DecodedLen(len(data)))
+
+	n, err := base64.RawURLEncoding.Decode(out, data)
+	if err != nil {
+		return err
+	}
+
+	v := reflect.ValueOf(e).Elem()
+	v.SetBytes(out[:n])
+
+	return nil
+}
+
+// MarshalJSON base64 encodes a non URL-encoded value, storing the result in the
+// provided byte slice.
+func (e URLEncodedBase64) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return []byte("null"), nil
+	}
+
+	return []byte(`"` + base64.RawURLEncoding.EncodeToString(e) + `"`), nil
+}

x/did/keeper/genesis.go

@@ -2,6 +2,7 @@ package keeper
 
 import (
 	"context"
+	"time"
 
 	"cosmossdk.io/log"
 	sdk "github.com/cosmos/cosmos-sdk/types"

x/did/keeper/ipfs.go

@@ -0,0 +1,106 @@
+package keeper
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	"github.com/ipfs/boxo/files"
+	"github.com/ipfs/boxo/path"
+	"github.com/ipfs/kubo/client/rpc"
+	"github.com/ipfs/kubo/core/coreiface/options"
+	"github.com/onsonr/sonr/internal/vfs"
+)
+
+// assembleInitialVault assembles the initial vault
+func (k Keeper) assembleInitialVault(ctx sdk.Context) (string, int64, error) {
+	cid, err := k.ipfsClient.Unixfs().Add(context.Background(), vfs.AssembleDirectory())
+	if err != nil {
+		return "", 0, err
+	}
+	return cid.String(), k.GetExpirationBlockHeight(ctx, time.Second*15), nil
+}
+
+// pinInitialVault pins the initial vault to the local IPFS node
+func (k Keeper) pinInitialVault(_ sdk.Context, cid string, address string) (bool, error) {
+	// Resolve the path
+	path, err := path.NewPath(cid)
+	if err != nil {
+		return false, err
+	}
+
+	// 1. Initialize vault.db sqlite database in local IPFS with Mount
+
+	// 2. Insert the InitialWalletAccounts
+
+	// 3. Publish the path to the IPNS
+	_, err = k.ipfsClient.Name().Publish(context.Background(), path, options.Name.Key(address))
+	if err != nil {
+		return false, err
+	}
+
+	// 4. Insert the accounts into x/auth
+
+	// 5. Insert the controller into state
+	return true, nil
+}
+
+// GetFromIPFS gets a file from the local IPFS node
+func (k Keeper) GetFromIPFS(ctx sdk.Context, cid string) (files.Directory, error) {
+	path, err := path.NewPath(cid)
+	if err != nil {
+		return nil, err
+	}
+	node, err := k.ipfsClient.Unixfs().Get(ctx, path)
+	if err != nil {
+		return nil, err
+	}
+	dir, ok := node.(files.Directory)
+	if !ok {
+		return nil, fmt.Errorf("retrieved node is not a directory")
+	}
+	return dir, nil
+}
+
+// HasIPFSConnection returns true if the IPFS client is initialized
+func (k *Keeper) HasIPFSConnection() bool {
+	if k.ipfsClient == nil {
+		ipfsClient, err := rpc.NewLocalApi()
+		if err != nil {
+			return false
+		}
+		k.ipfsClient = ipfsClient
+	}
+	return k.ipfsClient != nil
+}
+
+// HasPathInIPFS checks if a file is in the local IPFS node
+func (k Keeper) HasPathInIPFS(ctx sdk.Context, cid string) (bool, error) {
+	path, err := path.NewPath(cid)
+	if err != nil {
+		return false, err
+	}
+	v, err := k.ipfsClient.Unixfs().Get(ctx, path)
+	if err != nil {
+		return false, err
+	}
+
+	if v == nil {
+		return false, nil
+	}
+	return true, nil
+}
+
+// PinToIPFS pins a file to the local IPFS node
+func (k Keeper) PinToIPFS(ctx sdk.Context, cid string, name string) error {
+	path, err := path.NewPath(cid)
+	if err != nil {
+		return err
+	}
+	err = k.ipfsClient.Pin().Add(ctx, path, options.Pin.Name(name))
+	if err != nil {
+		return err
+	}
+	return nil
+}

x/did/keeper/server.go

@@ -2,6 +2,7 @@ package keeper
 
 import (
 	"context"
+	"encoding/json"
 
 	"cosmossdk.io/errors"
 	sdk "github.com/cosmos/cosmos-sdk/types"

x/did/keeper/state.go

@@ -0,0 +1,37 @@
+package keeper
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+
+	"github.com/onsonr/sonr/x/did/builder"
+	"github.com/onsonr/sonr/x/did/types"
+)
+
+// insertService inserts a service record into the database
+func (k Keeper) insertService(
+	ctx sdk.Context,
+	svc *types.Service,
+) (*types.MsgRegisterServiceResponse, error) {
+	record := builder.APIFormatServiceRecord(svc)
+	err := k.OrmDB.ServiceRecordTable().Insert(ctx, record)
+	if err != nil {
+		return nil, err
+	}
+	return &types.MsgRegisterServiceResponse{
+		Success: true,
+		Did:     record.Id,
+	}, nil
+func (k Keeper) insertAliasFromDisplayName() {
+}
+
+func (k Keeper) insertAssertionFromIdentity() {
+}
+
+func (k Keeper) insertAuthenticationFromCredential() {
+}
+
+func (k Keeper) insertControllerFromMotrVault() {
+}
+
+func (k Keeper) insertDelegationFromAccount() {
+}

x/did/module.go

@@ -67,7 +67,8 @@ func (a AppModuleBasic) Name() string {
 
 func (a AppModuleBasic) DefaultGenesis(cdc codec.JSONCodec) json.RawMessage {
 	return cdc.MustMarshalJSON(&types.GenesisState{
-		Params: types.DefaultParams(),
+		GlobalIntegrity: types.DefaultGlobalIntegrity(),
+		Params:          types.DefaultParams(),
 	})
 }
 
@@ -103,7 +104,11 @@ func (a AppModule) InitGenesis(ctx sdk.Context, marshaler codec.JSONCodec, messa
 	if err := a.keeper.Params.Set(ctx, didGenesisState.Params); err != nil {
 		panic(err)
 	}
-
+	nftGenesisState := nft.DefaultGenesisState()
+	if err := types.DefaultNFTClasses(nftGenesisState); err != nil {
+		panic(err)
+	}
+	a.nftKeeper.InitGenesis(ctx, nftGenesisState)
 	return nil
 }
 

x/did/types/accounts.pb.go

@@ -0,0 +1,634 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: did/v1/accounts.proto
+
+package types
+
+import (
+	fmt "fmt"
+	proto "github.com/cosmos/gogoproto/proto"
+	io "io"
+	math "math"
+	math_bits "math/bits"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
+
+type BtcAccount struct {
+}
+
+func (m *BtcAccount) Reset()         { *m = BtcAccount{} }
+func (m *BtcAccount) String() string { return proto.CompactTextString(m) }
+func (*BtcAccount) ProtoMessage()    {}
+func (*BtcAccount) Descriptor() ([]byte, []int) {
+	return fileDescriptor_2125a09fb14c3bc3, []int{0}
+}
+func (m *BtcAccount) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *BtcAccount) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_BtcAccount.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *BtcAccount) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_BtcAccount.Merge(m, src)
+}
+func (m *BtcAccount) XXX_Size() int {
+	return m.Size()
+}
+func (m *BtcAccount) XXX_DiscardUnknown() {
+	xxx_messageInfo_BtcAccount.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_BtcAccount proto.InternalMessageInfo
+
+type EthAccount struct {
+}
+
+func (m *EthAccount) Reset()         { *m = EthAccount{} }
+func (m *EthAccount) String() string { return proto.CompactTextString(m) }
+func (*EthAccount) ProtoMessage()    {}
+func (*EthAccount) Descriptor() ([]byte, []int) {
+	return fileDescriptor_2125a09fb14c3bc3, []int{1}
+}
+func (m *EthAccount) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *EthAccount) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_EthAccount.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *EthAccount) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_EthAccount.Merge(m, src)
+}
+func (m *EthAccount) XXX_Size() int {
+	return m.Size()
+}
+func (m *EthAccount) XXX_DiscardUnknown() {
+	xxx_messageInfo_EthAccount.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_EthAccount proto.InternalMessageInfo
+
+type IBCAccount struct {
+}
+
+func (m *IBCAccount) Reset()         { *m = IBCAccount{} }
+func (m *IBCAccount) String() string { return proto.CompactTextString(m) }
+func (*IBCAccount) ProtoMessage()    {}
+func (*IBCAccount) Descriptor() ([]byte, []int) {
+	return fileDescriptor_2125a09fb14c3bc3, []int{2}
+}
+func (m *IBCAccount) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *IBCAccount) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_IBCAccount.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *IBCAccount) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_IBCAccount.Merge(m, src)
+}
+func (m *IBCAccount) XXX_Size() int {
+	return m.Size()
+}
+func (m *IBCAccount) XXX_DiscardUnknown() {
+	xxx_messageInfo_IBCAccount.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_IBCAccount proto.InternalMessageInfo
+
+type SnrAccount struct {
+}
+
+func (m *SnrAccount) Reset()         { *m = SnrAccount{} }
+func (m *SnrAccount) String() string { return proto.CompactTextString(m) }
+func (*SnrAccount) ProtoMessage()    {}
+func (*SnrAccount) Descriptor() ([]byte, []int) {
+	return fileDescriptor_2125a09fb14c3bc3, []int{3}
+}
+func (m *SnrAccount) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *SnrAccount) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_SnrAccount.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *SnrAccount) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_SnrAccount.Merge(m, src)
+}
+func (m *SnrAccount) XXX_Size() int {
+	return m.Size()
+}
+func (m *SnrAccount) XXX_DiscardUnknown() {
+	xxx_messageInfo_SnrAccount.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_SnrAccount proto.InternalMessageInfo
+
+func init() {
+	proto.RegisterType((*BtcAccount)(nil), "did.v1.BtcAccount")
+	proto.RegisterType((*EthAccount)(nil), "did.v1.EthAccount")
+	proto.RegisterType((*IBCAccount)(nil), "did.v1.IBCAccount")
+	proto.RegisterType((*SnrAccount)(nil), "did.v1.SnrAccount")
+}
+
+func init() { proto.RegisterFile("did/v1/accounts.proto", fileDescriptor_2125a09fb14c3bc3) }
+
+var fileDescriptor_2125a09fb14c3bc3 = []byte{
+	// 145 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4d, 0xc9, 0x4c, 0xd1,
+	0x2f, 0x33, 0xd4, 0x4f, 0x4c, 0x4e, 0xce, 0x2f, 0xcd, 0x2b, 0x29, 0xd6, 0x2b, 0x28, 0xca, 0x2f,
+	0xc9, 0x17, 0x62, 0x4b, 0xc9, 0x4c, 0xd1, 0x2b, 0x33, 0x54, 0xe2, 0xe1, 0xe2, 0x72, 0x2a, 0x49,
+	0x76, 0x84, 0x48, 0x82, 0x78, 0xae, 0x25, 0x19, 0x48, 0x3c, 0x4f, 0x27, 0x67, 0x24, 0x5e, 0x70,
+	0x5e, 0x11, 0x94, 0xe7, 0x64, 0x73, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e,
+	0xc9, 0x31, 0x4e, 0x78, 0x2c, 0xc7, 0x70, 0xe1, 0xb1, 0x1c, 0xc3, 0x8d, 0xc7, 0x72, 0x0c, 0x51,
+	0x4a, 0xe9, 0x99, 0x25, 0x19, 0xa5, 0x49, 0x7a, 0xc9, 0xf9, 0xb9, 0xfa, 0xf9, 0x79, 0xc5, 0xf9,
+	0x79, 0x45, 0xfa, 0x60, 0xa2, 0x42, 0x1f, 0xe4, 0x92, 0x92, 0xca, 0x82, 0xd4, 0xe2, 0x24, 0x36,
+	0xb0, 0x23, 0x8c, 0x01, 0x01, 0x00, 0x00, 0xff, 0xff, 0x82, 0x7e, 0x89, 0x0a, 0x9d, 0x00, 0x00,
+	0x00,
+}
+
+func (m *BtcAccount) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *BtcAccount) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *BtcAccount) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *EthAccount) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EthAccount) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *EthAccount) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *IBCAccount) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *IBCAccount) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *IBCAccount) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *SnrAccount) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SnrAccount) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SnrAccount) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintAccounts(dAtA []byte, offset int, v uint64) int {
+	offset -= sovAccounts(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *BtcAccount) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *EthAccount) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *IBCAccount) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *SnrAccount) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func sovAccounts(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozAccounts(x uint64) (n int) {
+	return sovAccounts(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *BtcAccount) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAccounts
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BtcAccount: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BtcAccount: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAccounts(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAccounts
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EthAccount) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAccounts
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EthAccount: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EthAccount: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAccounts(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAccounts
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *IBCAccount) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAccounts
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IBCAccount: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IBCAccount: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAccounts(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAccounts
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SnrAccount) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowAccounts
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SnrAccount: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SnrAccount: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipAccounts(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthAccounts
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipAccounts(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowAccounts
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowAccounts
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowAccounts
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthAccounts
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupAccounts
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthAccounts
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthAccounts        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowAccounts          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupAccounts = fmt.Errorf("proto: unexpected end of group")
+)
+func init() { proto.RegisterFile("did/v1/accounts.proto", fileDescriptor_2125a09fb14c3bc3) }
+
+var fileDescriptor_2125a09fb14c3bc3 = []byte{
+	// 122 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4d, 0xc9, 0x4c, 0xd1,
+	0x2f, 0x33, 0xd4, 0x4f, 0x4c, 0x4e, 0xce, 0x2f, 0xcd, 0x2b, 0x29, 0xd6, 0x2b, 0x28, 0xca, 0x2f,
+	0xc9, 0x17, 0x62, 0x4b, 0xc9, 0x4c, 0xd1, 0x2b, 0x33, 0x74, 0xb2, 0x39, 0xf1, 0x48, 0x8e, 0xf1,
+	0xc2, 0x23, 0x39, 0xc6, 0x07, 0x8f, 0xe4, 0x18, 0x27, 0x3c, 0x96, 0x63, 0xb8, 0xf0, 0x58, 0x8e,
+	0xe1, 0xc6, 0x63, 0x39, 0x86, 0x28, 0xa5, 0xf4, 0xcc, 0x92, 0x8c, 0xd2, 0x24, 0xbd, 0xe4, 0xfc,
+	0x5c, 0xfd, 0xfc, 0xbc, 0xe2, 0xfc, 0xbc, 0x22, 0xfd, 0x8c, 0xf2, 0xc4, 0x4a, 0xfd, 0x0a, 0x7d,
+	0x90, 0x89, 0x25, 0x95, 0x05, 0xa9, 0xc5, 0x49, 0x6c, 0x60, 0xc3, 0x8c, 0x01, 0x01, 0x00, 0x00,
+	0xff, 0xff, 0x28, 0xd1, 0x54, 0x54, 0x65, 0x00, 0x00, 0x00,
+}

x/did/types/codec.go

@@ -13,6 +13,8 @@ import (
 	cryptotypes "github.com/cosmos/cosmos-sdk/crypto/types"
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	"github.com/cosmos/cosmos-sdk/types/msgservice"
+	"github.com/mr-tron/base58/base58"
+	"github.com/onsonr/crypto"
 	// this line is used by starport scaffolding # 1
 )
 

x/did/types/coins.go

@@ -0,0 +1,31 @@
+package types
+
+// Coin represents a cryptocurrency
+type Coin interface {
+	// FormatAddress formats a public key into an address
+	FormatAddress(pubKey []byte) (string, error)
+
+	// GetIndex returns the coin type index
+	GetIndex() int64
+
+	// GetPath returns the coin component path
+	GetPath() uint32
+
+	// GetSymbol returns the coin symbol
+	GetSymbol() string
+
+	// GetMethod returns the coin DID method
+	GetMethod() string
+
+	// GetName returns the coin name
+	GetName() string
+}
+
+// CoinBTCType is the coin type for BTC
+const CoinBTCType = int64(0)
+
+// CoinETHType is the coin type for ETH
+const CoinETHType = int64(60)
+
+// CoinSNRType is the coin type for SNR
+const CoinSNRType = int64(703)

x/did/types/genesis.go

@@ -41,7 +41,8 @@ const DefaultIndex uint64 = 1
 func DefaultGenesis() *GenesisState {
 	return &GenesisState{
 		// this line is used by starport scaffolding # genesis/types/default
-		Params: DefaultParams(),
+		GlobalIntegrity: DefaultGlobalIntegrity(),
+		Params:          DefaultParams(),
 	}
 }
 
@@ -49,7 +50,9 @@ func DefaultGenesis() *GenesisState {
 // failure.
 func (gs GenesisState) Validate() error {
 	// this line is used by starport scaffolding # genesis/types/validate
-
+	if gs.GlobalIntegrity == nil {
+		return fmt.Errorf("global integrity proof is nil")
+	}
 	return gs.Params.Validate()
 }
 

x/did/types/genesis.pb.go

@@ -28,6 +28,8 @@ const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 type GenesisState struct {
 	// Params defines all the parameters of the module.
 	Params Params `protobuf:"bytes,1,opt,name=params,proto3" json:"params"`
+	// GlobalIntegrity defines a zkp integrity proof for the entire DID namespace
+	GlobalIntegrity *GlobalIntegrity `protobuf:"bytes,2,opt,name=global_integrity,json=globalIntegrity,proto3" json:"global_integrity,omitempty"`
 }
 
 func (m *GenesisState) Reset()         { *m = GenesisState{} }
@@ -70,6 +72,82 @@ func (m *GenesisState) GetParams() Params {
 	return Params{}
 }
 
+func (m *GenesisState) GetGlobalIntegrity() *GlobalIntegrity {
+	if m != nil {
+		return m.GlobalIntegrity
+	}
+	return nil
+}
+
+// GlobalIntegrity defines a zkp integrity proof for the entire DID namespace
+type GlobalIntegrity struct {
+	Controller  string `protobuf:"bytes,1,opt,name=controller,proto3" json:"controller,omitempty"`
+	Seed        string `protobuf:"bytes,2,opt,name=seed,proto3" json:"seed,omitempty"`
+	Accumulator []byte `protobuf:"bytes,3,opt,name=accumulator,proto3" json:"accumulator,omitempty"`
+	Count       uint64 `protobuf:"varint,4,opt,name=count,proto3" json:"count,omitempty"`
+}
+
+func (m *GlobalIntegrity) Reset()         { *m = GlobalIntegrity{} }
+func (m *GlobalIntegrity) String() string { return proto.CompactTextString(m) }
+func (*GlobalIntegrity) ProtoMessage()    {}
+func (*GlobalIntegrity) Descriptor() ([]byte, []int) {
+	return fileDescriptor_fda181cae44f7c00, []int{1}
+}
+func (m *GlobalIntegrity) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *GlobalIntegrity) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_GlobalIntegrity.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *GlobalIntegrity) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_GlobalIntegrity.Merge(m, src)
+}
+func (m *GlobalIntegrity) XXX_Size() int {
+	return m.Size()
+}
+func (m *GlobalIntegrity) XXX_DiscardUnknown() {
+	xxx_messageInfo_GlobalIntegrity.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_GlobalIntegrity proto.InternalMessageInfo
+
+func (m *GlobalIntegrity) GetController() string {
+	if m != nil {
+		return m.Controller
+	}
+	return ""
+}
+
+func (m *GlobalIntegrity) GetSeed() string {
+	if m != nil {
+		return m.Seed
+	}
+	return ""
+}
+
+func (m *GlobalIntegrity) GetAccumulator() []byte {
+	if m != nil {
+		return m.Accumulator
+	}
+	return nil
+}
+
+func (m *GlobalIntegrity) GetCount() uint64 {
+	if m != nil {
+		return m.Count
+	}
+	return 0
+}
+
 // Params defines the set of module parameters.
 type Params struct {
 	// Whitelisted Assets
@@ -89,7 +167,7 @@ type Params struct {
 func (m *Params) Reset()      { *m = Params{} }
 func (*Params) ProtoMessage() {}
 func (*Params) Descriptor() ([]byte, []int) {
-	return fileDescriptor_fda181cae44f7c00, []int{1}
+	return fileDescriptor_fda181cae44f7c00, []int{2}
 }
 func (m *Params) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -694,6 +772,7 @@ func (m *Service) GetPermissions() map[string]string {
 
 func init() {
 	proto.RegisterType((*GenesisState)(nil), "did.v1.GenesisState")
+	proto.RegisterType((*GlobalIntegrity)(nil), "did.v1.GlobalIntegrity")
 	proto.RegisterType((*Params)(nil), "did.v1.Params")
 	proto.RegisterMapType((map[string]*KeyInfo)(nil), "did.v1.Params.AllowedPublicKeysEntry")
 	proto.RegisterType((*AssetInfo)(nil), "did.v1.AssetInfo")
@@ -848,6 +927,18 @@ func (m *GenesisState) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.GlobalIntegrity != nil {
+		{
+			size, err := m.GlobalIntegrity.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenesis(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
 	{
 		size, err := m.Params.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -861,6 +952,55 @@ func (m *GenesisState) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *GlobalIntegrity) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GlobalIntegrity) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GlobalIntegrity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Count != 0 {
+		i = encodeVarintGenesis(dAtA, i, uint64(m.Count))
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.Accumulator) > 0 {
+		i -= len(m.Accumulator)
+		copy(dAtA[i:], m.Accumulator)
+		i = encodeVarintGenesis(dAtA, i, uint64(len(m.Accumulator)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Seed) > 0 {
+		i -= len(m.Seed)
+		copy(dAtA[i:], m.Seed)
+		i = encodeVarintGenesis(dAtA, i, uint64(len(m.Seed)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Controller) > 0 {
+		i -= len(m.Controller)
+		copy(dAtA[i:], m.Controller)
+		i = encodeVarintGenesis(dAtA, i, uint64(len(m.Controller)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *Params) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -1420,6 +1560,34 @@ func (m *GenesisState) Size() (n int) {
 	_ = l
 	l = m.Params.Size()
 	n += 1 + l + sovGenesis(uint64(l))
+	if m.GlobalIntegrity != nil {
+		l = m.GlobalIntegrity.Size()
+		n += 1 + l + sovGenesis(uint64(l))
+	}
+	return n
+}
+
+func (m *GlobalIntegrity) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Controller)
+	if l > 0 {
+		n += 1 + l + sovGenesis(uint64(l))
+	}
+	l = len(m.Seed)
+	if l > 0 {
+		n += 1 + l + sovGenesis(uint64(l))
+	}
+	l = len(m.Accumulator)
+	if l > 0 {
+		n += 1 + l + sovGenesis(uint64(l))
+	}
+	if m.Count != 0 {
+		n += 1 + sovGenesis(uint64(m.Count))
+	}
 	return n
 }
 
@@ -1758,6 +1926,209 @@ func (m *GenesisState) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GlobalIntegrity", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenesis
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.GlobalIntegrity == nil {
+				m.GlobalIntegrity = &GlobalIntegrity{}
+			}
+			if err := m.GlobalIntegrity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenesis(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GlobalIntegrity) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenesis
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GlobalIntegrity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GlobalIntegrity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Controller", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenesis
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Controller = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Seed", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenesis
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Seed = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Accumulator", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenesis
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenesis
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Accumulator = append(m.Accumulator[:0], dAtA[iNdEx:postIndex]...)
+			if m.Accumulator == nil {
+				m.Accumulator = []byte{}
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Count", wireType)
+			}
+			m.Count = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenesis
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Count |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenesis(dAtA[iNdEx:])

x/did/types/integrity.go

@@ -0,0 +1,27 @@
+package types
+
+import "lukechampine.com/blake3"
+
+func (g *GlobalIntegrity) Update(address string) bool {
+	return true
+}
+
+func (g *GlobalIntegrity) getProof() (*Proof, error) {
+	if g.Accumulator == nil {
+		return NewProof(g.Controller, g.proofProperty(), g.seedKdf())
+	}
+	return &Proof{
+		Issuer:      g.Controller,
+		Property:    g.proofProperty(),
+		Accumulator: g.Accumulator,
+	}, nil
+}
+
+func (g *GlobalIntegrity) proofProperty() string {
+	return "did:sonr:integrity"
+}
+
+func (g *GlobalIntegrity) seedKdf() []byte {
+	res := blake3.Sum256([]byte(g.Seed))
+	return res[:]
+}

x/did/types/namespace.go

@@ -0,0 +1,102 @@
+package types
+
+import (
+	"cosmossdk.io/x/nft"
+)
+
+func (n DIDNamespace) ID() string {
+	switch n {
+	case DIDNamespace_DID_NAMESPACE_DWN:
+		return "did:dwn:0"
+	case DIDNamespace_DID_NAMESPACE_SONR:
+		return "did:sonr:0"
+	case DIDNamespace_DID_NAMESPACE_BITCOIN:
+		return "did:btc:0"
+	case DIDNamespace_DID_NAMESPACE_ETHEREUM:
+		return "did:eth:0"
+	case DIDNamespace_DID_NAMESPACE_IBC:
+		return "did:ibc:0"
+	case DIDNamespace_DID_NAMESPACE_WEBAUTHN:
+		return "did:authn:0"
+	case DIDNamespace_DID_NAMESPACE_SERVICE:
+		return "did:web:0"
+	case DIDNamespace_DID_NAMESPACE_IPFS:
+		return "did:ipfs:0"
+	}
+	return ""
+}
+
+func (n DIDNamespace) Name() string {
+	switch n {
+	case DIDNamespace_DID_NAMESPACE_DWN:
+		return "DecentralizedWebNode"
+	case DIDNamespace_DID_NAMESPACE_SONR:
+		return "SonrNetwork"
+	case DIDNamespace_DID_NAMESPACE_BITCOIN:
+		return "BitcoinNetwork"
+	case DIDNamespace_DID_NAMESPACE_ETHEREUM:
+		return "EthereumNetwork"
+	case DIDNamespace_DID_NAMESPACE_IBC:
+		return "IBCNetwork"
+	case DIDNamespace_DID_NAMESPACE_WEBAUTHN:
+		return "WebAuthentication"
+	case DIDNamespace_DID_NAMESPACE_SERVICE:
+		return "DecentrlizedService"
+	case DIDNamespace_DID_NAMESPACE_IPFS:
+		return "IPFSStorage"
+	}
+	return ""
+}
+
+func (n DIDNamespace) Symbol() string {
+	switch n {
+	case DIDNamespace_DID_NAMESPACE_DWN:
+		return "DWN"
+	case DIDNamespace_DID_NAMESPACE_SONR:
+		return "SONR"
+	case DIDNamespace_DID_NAMESPACE_BITCOIN:
+		return "BTC"
+	case DIDNamespace_DID_NAMESPACE_ETHEREUM:
+		return "ETH"
+	case DIDNamespace_DID_NAMESPACE_IBC:
+		return "IBC"
+	case DIDNamespace_DID_NAMESPACE_WEBAUTHN:
+		return "WEBAUTHN"
+	case DIDNamespace_DID_NAMESPACE_SERVICE:
+		return "SERVICE"
+	case DIDNamespace_DID_NAMESPACE_IPFS:
+		return "IPFS"
+	}
+	return ""
+}
+
+func (n DIDNamespace) Description() string {
+	switch n {
+	case DIDNamespace_DID_NAMESPACE_DWN:
+		return "DWN Service Provider"
+	case DIDNamespace_DID_NAMESPACE_SONR:
+		return "Sonr Network Gateway"
+	case DIDNamespace_DID_NAMESPACE_BITCOIN:
+		return "Bitcoin Network Gateway"
+	case DIDNamespace_DID_NAMESPACE_ETHEREUM:
+		return "Ethereum Network Gateway"
+	case DIDNamespace_DID_NAMESPACE_IBC:
+		return "IBC Network Gateway"
+	case DIDNamespace_DID_NAMESPACE_WEBAUTHN:
+		return "Web Authentication Key"
+	case DIDNamespace_DID_NAMESPACE_SERVICE:
+		return "Decentrlized Service"
+	case DIDNamespace_DID_NAMESPACE_IPFS:
+		return "Data Storage on IPFS"
+	}
+	return ""
+}
+
+func (n DIDNamespace) GetNFTClass() *nft.Class {
+	return &nft.Class{
+		Id:          n.ID(),
+		Name:        n.Name(),
+		Symbol:      n.Symbol(),
+		Description: n.Description(),
+	}
+}

x/did/types/oidc/DiscoveryDocument.pkl.go

@@ -0,0 +1,34 @@
+// Code generated from Pkl module `oidc`. DO NOT EDIT.
+package oidc
+
+type DiscoveryDocument struct {
+	Issuer string `pkl:"issuer" json:"issuer,omitempty" param:"issuer"`
+
+	AuthorizationEndpoint string `pkl:"authorization_endpoint" json:"authorization_endpoint,omitempty" param:"authorization_endpoint"`
+
+	TokenEndpoint string `pkl:"token_endpoint" json:"token_endpoint,omitempty" param:"token_endpoint"`
+
+	UserinfoEndpoint string `pkl:"userinfo_endpoint" json:"userinfo_endpoint,omitempty" param:"userinfo_endpoint"`
+
+	JwksUri string `pkl:"jwks_uri" json:"jwks_uri,omitempty" param:"jwks_uri"`
+
+	RegistrationEndpoint string `pkl:"registration_endpoint" json:"registration_endpoint,omitempty" param:"registration_endpoint"`
+
+	ScopesSupported []string `pkl:"scopes_supported" json:"scopes_supported,omitempty" param:"scopes_supported"`
+
+	ResponseTypesSupported []string `pkl:"response_types_supported" json:"response_types_supported,omitempty" param:"response_types_supported"`
+
+	ResponseModesSupported []string `pkl:"response_modes_supported" json:"response_modes_supported,omitempty" param:"response_modes_supported"`
+
+	SubjectTypesSupported []string `pkl:"subject_types_supported" json:"subject_types_supported,omitempty" param:"subject_types_supported"`
+
+	IdTokenSigningAlgValuesSupported []string `pkl:"id_token_signing_alg_values_supported" json:"id_token_signing_alg_values_supported,omitempty" param:"id_token_signing_alg_values_supported"`
+
+	ClaimsSupported []string `pkl:"claims_supported" json:"claims_supported,omitempty" param:"claims_supported"`
+
+	GrantTypesSupported []string `pkl:"grant_types_supported" json:"grant_types_supported,omitempty" param:"grant_types_supported"`
+
+	AcrValuesSupported []string `pkl:"acr_values_supported" json:"acr_values_supported,omitempty" param:"acr_values_supported"`
+
+	TokenEndpointAuthMethodsSupported []string `pkl:"token_endpoint_auth_methods_supported" json:"token_endpoint_auth_methods_supported,omitempty" param:"token_endpoint_auth_methods_supported"`
+}

x/did/types/oidc/Oidc.pkl.go

@@ -0,0 +1,36 @@
+// Code generated from Pkl module `oidc`. DO NOT EDIT.
+package oidc
+
+import (
+	"context"
+
+	"github.com/apple/pkl-go/pkl"
+)
+
+type Oidc struct {
+}
+
+// LoadFromPath loads the pkl module at the given path and evaluates it into a Oidc
+func LoadFromPath(ctx context.Context, path string) (ret *Oidc, err error) {
+	evaluator, err := pkl.NewEvaluator(ctx, pkl.PreconfiguredOptions)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		cerr := evaluator.Close()
+		if err == nil {
+			err = cerr
+		}
+	}()
+	ret, err = Load(ctx, evaluator, pkl.FileSource(path))
+	return ret, err
+}
+
+// Load loads the pkl module at the given source and evaluates it with the given evaluator into a Oidc
+func Load(ctx context.Context, evaluator pkl.Evaluator, source *pkl.ModuleSource) (*Oidc, error) {
+	var ret Oidc
+	if err := evaluator.EvaluateModule(ctx, source, &ret); err != nil {
+		return nil, err
+	}
+	return &ret, nil
+}

x/did/types/oidc/init.pkl.go

@@ -0,0 +1,9 @@
+// Code generated from Pkl module `oidc`. DO NOT EDIT.
+package oidc
+
+import "github.com/apple/pkl-go/pkl"
+
+func init() {
+	pkl.RegisterMapping("oidc", Oidc{})
+	pkl.RegisterMapping("oidc#DiscoveryDocument", DiscoveryDocument{})
+}

x/did/types/pubkey.go

@@ -0,0 +1,153 @@
+package types
+
+import (
+	"crypto/ecdsa"
+	"encoding/hex"
+
+	cryptotypes "github.com/cosmos/cosmos-sdk/crypto/types"
+	"github.com/mr-tron/base58/base58"
+	"github.com/onsonr/crypto"
+	"github.com/onsonr/crypto/macaroon"
+)
+
+var WalletKeyInfo = &KeyInfo{
+	Role:      KeyRole_KEY_ROLE_DELEGATION,
+	Curve:     KeyCurve_KEY_CURVE_SECP256K1,
+	Algorithm: KeyAlgorithm_KEY_ALGORITHM_ECDSA,
+	Encoding:  KeyEncoding_KEY_ENCODING_HEX,
+	Type:      KeyType_KEY_TYPE_BIP32,
+}
+
+var EthKeyInfo = &KeyInfo{
+	Role:      KeyRole_KEY_ROLE_DELEGATION,
+	Curve:     KeyCurve_KEY_CURVE_KECCAK256,
+	Algorithm: KeyAlgorithm_KEY_ALGORITHM_ECDSA,
+	Encoding:  KeyEncoding_KEY_ENCODING_HEX,
+	Type:      KeyType_KEY_TYPE_BIP32,
+}
+
+var SonrKeyInfo = &KeyInfo{
+	Role:      KeyRole_KEY_ROLE_INVOCATION,
+	Curve:     KeyCurve_KEY_CURVE_P256,
+	Algorithm: KeyAlgorithm_KEY_ALGORITHM_ECDSA,
+	Encoding:  KeyEncoding_KEY_ENCODING_HEX,
+	Type:      KeyType_KEY_TYPE_MPC,
+}
+
+var ChainCodeKeyInfos = map[ChainCode]*KeyInfo{
+	ChainCodeBTC: WalletKeyInfo,
+	ChainCodeETH: EthKeyInfo,
+	ChainCodeSNR: SonrKeyInfo,
+	ChainCodeIBC: WalletKeyInfo,
+}
+
+// NewEthPublicKey returns a new ethereum public key
+func NewPublicKey(data []byte, keyInfo *KeyInfo) (*PubKey, error) {
+	encKey, err := keyInfo.Encoding.EncodeRaw(data)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PubKey{
+		Raw:       encKey,
+		Role:      keyInfo.Role,
+		Encoding:  keyInfo.Encoding,
+		Algorithm: keyInfo.Algorithm,
+		Curve:     keyInfo.Curve,
+		KeyType:   keyInfo.Type,
+	}, nil
+}
+
+// Address returns the address of the public key
+func (k *PubKey) Address() cryptotypes.Address {
+	return nil
+}
+
+// Bytes returns the raw bytes of the public key
+func (k *PubKey) Bytes() []byte {
+	bz, _ := k.GetEncoding().DecodeRaw(k.GetRaw())
+	return bz
+}
+
+// Clone returns a copy of the public key
+func (k *PubKey) Clone() cryptotypes.PubKey {
+	return &PubKey{
+		Raw:       k.GetRaw(),
+		Role:      k.GetRole(),
+		Encoding:  k.GetEncoding(),
+		Algorithm: k.GetAlgorithm(),
+		Curve:     k.GetCurve(),
+		KeyType:   k.GetKeyType(),
+	}
+}
+
+// IssueMacaroon returns a macaroon for the public key with the given id and location
+func (pk *PubKey) IssueMacaroon(subject string, origin string) (*macaroon.Macaroon, error) {
+	return macaroon.New(pk.Bytes(), []byte(subject), origin, macaroon.LatestVersion)
+}
+
+// ECDSA returns the ECDSA public key
+func (k *PubKey) ECDSA() (*ecdsa.PublicKey, error) {
+	return crypto.ComputeEcdsaPublicKey(k.Bytes())
+}
+
+// VerifySignature verifies a signature over the given message
+func (k *PubKey) VerifySignature(msg []byte, sig []byte) bool {
+	pk, err := crypto.ComputeEcdsaPublicKey(k.Bytes())
+	sigMpc, err := crypto.DeserializeMPCSignature(sig)
+	if err != nil {
+		return false
+	}
+	return crypto.VerifyMPCSignature(sigMpc, msg, pk)
+}
+
+// Equals returns true if two public keys are equal
+func (k *PubKey) Equals(k2 cryptotypes.PubKey) bool {
+	if k == nil && k2 == nil {
+		return true
+	}
+	return false
+}
+
+// Type returns the type of the public key
+func (k *PubKey) Type() string {
+	return k.KeyType.String()
+}
+
+// DecodePublicKey extracts the public key from the given data
+func (k *KeyInfo) DecodePublicKey(data interface{}) ([]byte, error) {
+	var bz []byte
+	switch v := data.(type) {
+	case string:
+		bz = []byte(v)
+	case []byte:
+		bz = v
+	default:
+		return nil, ErrUnsupportedKeyEncoding
+	}
+
+	if k.Encoding == KeyEncoding_KEY_ENCODING_RAW {
+		return bz, nil
+	}
+	if k.Encoding == KeyEncoding_KEY_ENCODING_HEX {
+		return hex.DecodeString(string(bz))
+	}
+	if k.Encoding == KeyEncoding_KEY_ENCODING_MULTIBASE {
+		return base58.Decode(string(bz))
+	}
+	return nil, ErrUnsupportedKeyEncoding
+}
+
+// EncodePublicKey encodes the public key according to the KeyInfo's encoding
+func (k *KeyInfo) EncodePublicKey(data []byte) (string, error) {
+	if k.Encoding == KeyEncoding_KEY_ENCODING_RAW {
+		return string(data), nil
+	}
+	if k.Encoding == KeyEncoding_KEY_ENCODING_HEX {
+		return hex.EncodeToString(data), nil
+	}
+	if k.Encoding == KeyEncoding_KEY_ENCODING_MULTIBASE {
+		return base58.Encode(data), nil
+	}
+	return "", ErrUnsupportedKeyEncoding
+}

x/did/types/scopes.go

@@ -0,0 +1,53 @@
+package types
+
+import "gopkg.in/macaroon-bakery.v2/bakery/checkers"
+
+var (
+	PermissionScopeStrings = [...]string{
+		"profile.name",
+		"identifiers.email",
+		"identifiers.phone",
+		"transactions.read",
+		"transactions.write",
+		"wallets.read",
+		"wallets.create",
+		"wallets.subscribe",
+		"wallets.update",
+		"transactions.verify",
+		"transactions.broadcast",
+		"admin.user",
+		"admin.validator",
+	}
+
+	StringToPermissionScope = map[string]PermissionScope{
+		"PERMISSION_SCOPE_UNSPECIFIED":            PermissionScope_PERMISSION_SCOPE_UNSPECIFIED,
+		"PERMISSION_SCOPE_BASIC_INFO":             PermissionScope_PERMISSION_SCOPE_BASIC_INFO,
+		"PERMISSION_SCOPE_IDENTIFIERS_EMAIL":      PermissionScope_PERMISSION_SCOPE_PERMISSIONS_READ,
+		"PERMISSION_SCOPE_IDENTIFIERS_PHONE":      PermissionScope_PERMISSION_SCOPE_PERMISSIONS_WRITE,
+		"PERMISSION_SCOPE_TRANSACTIONS_READ":      PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_READ,
+		"PERMISSION_SCOPE_TRANSACTIONS_WRITE":     PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_WRITE,
+		"PERMISSION_SCOPE_WALLETS_READ":           PermissionScope_PERMISSION_SCOPE_WALLETS_READ,
+		"PERMISSION_SCOPE_WALLETS_CREATE":         PermissionScope_PERMISSION_SCOPE_WALLETS_CREATE,
+		"PERMISSION_SCOPE_WALLETS_SUBSCRIBE":      PermissionScope_PERMISSION_SCOPE_WALLETS_SUBSCRIBE,
+		"PERMISSION_SCOPE_WALLETS_UPDATE":         PermissionScope_PERMISSION_SCOPE_WALLETS_UPDATE,
+		"PERMISSION_SCOPE_TRANSACTIONS_VERIFY":    PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_VERIFY,
+		"PERMISSION_SCOPE_TRANSACTIONS_BROADCAST": PermissionScope_PERMISSION_SCOPE_TRANSACTIONS_BROADCAST,
+		"PERMISSION_SCOPE_ADMIN_USER":             PermissionScope_PERMISSION_SCOPE_ADMIN_USER,
+		"PERMISSION_SCOPE_ADMIN_VALIDATOR":        PermissionScope_PERMISSION_SCOPE_ADMIN_VALIDATOR,
+	}
+)
+
+func ResolvePermissionScope(scope string) (PermissionScope, bool) {
+	uriToPrefix := make(map[string]string)
+	for _, scope := range PermissionScopeStrings {
+		uriToPrefix["https://example.com/auth/"+scope] = scope
+	}
+	PermissionNamespace := checkers.NewNamespace(uriToPrefix)
+
+	prefix, ok := PermissionNamespace.Resolve("https://example.com/auth/" + scope)
+	if !ok {
+		return 0, false
+	}
+	permScope, ok := StringToPermissionScope[prefix]
+	return permScope, ok
+}

x/did/types/tx.pb.go

@@ -30,11 +30,9 @@ var _ = math.Inf
 // proto package needs to be updated.
 const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
-// MsgUpdateParams is the Msg/UpdateParams request type.
-//
-// Since: cosmos-sdk 0.47
-type MsgUpdateParams struct {
-	// authority is the address of the governance account.
+// MsgAllocateVault is the message type for the AllocateVault RPC.
+type MsgAllocateVault struct {
+	// authority is the address of the service account.
 	Authority string `protobuf:"bytes,1,opt,name=authority,proto3" json:"authority,omitempty"`
 	// params defines the parameters to update.
 	Params Params `protobuf:"bytes,2,opt,name=params,proto3" json:"params"`
@@ -42,18 +40,18 @@ type MsgUpdateParams struct {
 	Token string `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`
 }
 
-func (m *MsgUpdateParams) Reset()         { *m = MsgUpdateParams{} }
-func (m *MsgUpdateParams) String() string { return proto.CompactTextString(m) }
-func (*MsgUpdateParams) ProtoMessage()    {}
-func (*MsgUpdateParams) Descriptor() ([]byte, []int) {
+func (m *MsgAllocateVault) Reset()         { *m = MsgAllocateVault{} }
+func (m *MsgAllocateVault) String() string { return proto.CompactTextString(m) }
+func (*MsgAllocateVault) ProtoMessage()    {}
+func (*MsgAllocateVault) Descriptor() ([]byte, []int) {
 	return fileDescriptor_d73284df019ff211, []int{0}
 }
-func (m *MsgUpdateParams) XXX_Unmarshal(b []byte) error {
+func (m *MsgAllocateVault) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
 }
-func (m *MsgUpdateParams) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+func (m *MsgAllocateVault) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
 	if deterministic {
-		return xxx_messageInfo_MsgUpdateParams.Marshal(b, m, deterministic)
+		return xxx_messageInfo_MsgAllocateVault.Marshal(b, m, deterministic)
 	} else {
 		b = b[:cap(b)]
 		n, err := m.MarshalToSizedBuffer(b)
@@ -63,26 +61,26 @@ func (m *MsgUpdateParams) XXX_Marshal(b []byte, deterministic bool) ([]byte, err
 		return b[:n], nil
 	}
 }
-func (m *MsgUpdateParams) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_MsgUpdateParams.Merge(m, src)
+func (m *MsgAllocateVault) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MsgAllocateVault.Merge(m, src)
 }
-func (m *MsgUpdateParams) XXX_Size() int {
+func (m *MsgAllocateVault) XXX_Size() int {
 	return m.Size()
 }
-func (m *MsgUpdateParams) XXX_DiscardUnknown() {
-	xxx_messageInfo_MsgUpdateParams.DiscardUnknown(m)
+func (m *MsgAllocateVault) XXX_DiscardUnknown() {
+	xxx_messageInfo_MsgAllocateVault.DiscardUnknown(m)
 }
 
-var xxx_messageInfo_MsgUpdateParams proto.InternalMessageInfo
+var xxx_messageInfo_MsgAllocateVault proto.InternalMessageInfo
 
-func (m *MsgUpdateParams) GetAuthority() string {
+func (m *MsgAllocateVault) GetAuthority() string {
 	if m != nil {
 		return m.Authority
 	}
 	return ""
 }
 
-func (m *MsgUpdateParams) GetParams() Params {
+func (m *MsgAllocateVault) GetSubject() string {
 	if m != nil {
 		return m.Params
 	}
@@ -657,6 +655,8 @@ func init() {
 	proto.RegisterType((*MsgAuthorizeServiceResponse)(nil), "did.v1.MsgAuthorizeServiceResponse")
 	proto.RegisterType((*MsgRegisterService)(nil), "did.v1.MsgRegisterService")
 	proto.RegisterType((*MsgRegisterServiceResponse)(nil), "did.v1.MsgRegisterServiceResponse")
+	proto.RegisterType((*MsgUpdateParams)(nil), "did.v1.MsgUpdateParams")
+	proto.RegisterType((*MsgUpdateParamsResponse)(nil), "did.v1.MsgUpdateParamsResponse")
 }
 
 func init() { proto.RegisterFile("did/v1/tx.proto", fileDescriptor_d73284df019ff211) }
@@ -956,7 +956,7 @@ var _Msg_serviceDesc = grpc.ServiceDesc{
 	Metadata: "did/v1/tx.proto",
 }
 
-func (m *MsgUpdateParams) Marshal() (dAtA []byte, err error) {
+func (m *MsgAllocateVault) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -966,7 +966,7 @@ func (m *MsgUpdateParams) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *MsgUpdateParams) MarshalTo(dAtA []byte) (int, error) {
+func (m *MsgAllocateVault) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
@@ -1423,6 +1423,76 @@ func (m *MsgRegisterServiceResponse) MarshalToSizedBuffer(dAtA []byte) (int, err
 	return len(dAtA) - i, nil
 }
 
+func (m *MsgUpdateParams) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MsgUpdateParams) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MsgUpdateParams) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Token) > 0 {
+		i -= len(m.Token)
+		copy(dAtA[i:], m.Token)
+		i = encodeVarintTx(dAtA, i, uint64(len(m.Token)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	{
+		size, err := m.Params.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintTx(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	if len(m.Authority) > 0 {
+		i -= len(m.Authority)
+		copy(dAtA[i:], m.Authority)
+		i = encodeVarintTx(dAtA, i, uint64(len(m.Authority)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MsgUpdateParamsResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MsgUpdateParamsResponse) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MsgUpdateParamsResponse) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
 func encodeVarintTx(dAtA []byte, offset int, v uint64) int {
 	offset -= sovTx(v)
 	base := offset
@@ -1434,7 +1504,7 @@ func encodeVarintTx(dAtA []byte, offset int, v uint64) int {
 	dAtA[offset] = uint8(v)
 	return base
 }
-func (m *MsgUpdateParams) Size() (n int) {
+func (m *MsgAllocateVault) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -1645,7 +1715,7 @@ func sovTx(x uint64) (n int) {
 func sozTx(x uint64) (n int) {
 	return sovTx(uint64((x << 1) ^ uint64((int64(x) >> 63))))
 }
-func (m *MsgUpdateParams) Unmarshal(dAtA []byte) error {
+func (m *MsgAllocateVault) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1668,10 +1738,10 @@ func (m *MsgUpdateParams) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: MsgUpdateParams: wiretype end group for non-group")
+			return fmt.Errorf("proto: MsgAllocateVault: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: MsgUpdateParams: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: MsgAllocateVault: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:

x/did/types/txns/Msg.pkl.go

@@ -0,0 +1,6 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+type Msg interface {
+	GetTypeUrl() string
+}

x/did/types/txns/MsgDidAllocateVault.pkl.go

@@ -0,0 +1,44 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgDidAllocateVault interface {
+	Msg
+
+	GetAuthority() string
+
+	GetSubject() string
+
+	GetToken() *pkl.Object
+}
+
+var _ MsgDidAllocateVault = (*MsgDidAllocateVaultImpl)(nil)
+
+type MsgDidAllocateVaultImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Authority string `pkl:"authority"`
+
+	Subject string `pkl:"subject"`
+
+	Token *pkl.Object `pkl:"token"`
+}
+
+// The type URL for the message
+func (rcv *MsgDidAllocateVaultImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgDidAllocateVaultImpl) GetAuthority() string {
+	return rcv.Authority
+}
+
+func (rcv *MsgDidAllocateVaultImpl) GetSubject() string {
+	return rcv.Subject
+}
+
+func (rcv *MsgDidAllocateVaultImpl) GetToken() *pkl.Object {
+	return rcv.Token
+}

x/did/types/txns/MsgDidAuthorize.pkl.go

@@ -0,0 +1,60 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgDidAuthorize interface {
+	Msg
+
+	GetAuthority() string
+
+	GetController() string
+
+	GetAddress() string
+
+	GetOrigin() string
+
+	GetToken() *pkl.Object
+}
+
+var _ MsgDidAuthorize = (*MsgDidAuthorizeImpl)(nil)
+
+type MsgDidAuthorizeImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Authority string `pkl:"authority"`
+
+	Controller string `pkl:"controller"`
+
+	Address string `pkl:"address"`
+
+	Origin string `pkl:"origin"`
+
+	Token *pkl.Object `pkl:"token"`
+}
+
+// The type URL for the message
+func (rcv *MsgDidAuthorizeImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgDidAuthorizeImpl) GetAuthority() string {
+	return rcv.Authority
+}
+
+func (rcv *MsgDidAuthorizeImpl) GetController() string {
+	return rcv.Controller
+}
+
+func (rcv *MsgDidAuthorizeImpl) GetAddress() string {
+	return rcv.Address
+}
+
+func (rcv *MsgDidAuthorizeImpl) GetOrigin() string {
+	return rcv.Origin
+}
+
+func (rcv *MsgDidAuthorizeImpl) GetToken() *pkl.Object {
+	return rcv.Token
+}

x/did/types/txns/MsgDidProveWitness.pkl.go

@@ -0,0 +1,52 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgDidProveWitness interface {
+	Msg
+
+	GetAuthority() string
+
+	GetProperty() string
+
+	GetWitness() []int
+
+	GetToken() *pkl.Object
+}
+
+var _ MsgDidProveWitness = (*MsgDidProveWitnessImpl)(nil)
+
+type MsgDidProveWitnessImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Authority string `pkl:"authority"`
+
+	Property string `pkl:"property"`
+
+	Witness []int `pkl:"witness"`
+
+	Token *pkl.Object `pkl:"token"`
+}
+
+// The type URL for the message
+func (rcv *MsgDidProveWitnessImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgDidProveWitnessImpl) GetAuthority() string {
+	return rcv.Authority
+}
+
+func (rcv *MsgDidProveWitnessImpl) GetProperty() string {
+	return rcv.Property
+}
+
+func (rcv *MsgDidProveWitnessImpl) GetWitness() []int {
+	return rcv.Witness
+}
+
+func (rcv *MsgDidProveWitnessImpl) GetToken() *pkl.Object {
+	return rcv.Token
+}

x/did/types/txns/MsgDidRegisterController.pkl.go

@@ -0,0 +1,60 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgDidRegisterController interface {
+	Msg
+
+	GetAuthority() string
+
+	GetCid() string
+
+	GetOrigin() string
+
+	GetAuthentication() []*pkl.Object
+
+	GetToken() *pkl.Object
+}
+
+var _ MsgDidRegisterController = (*MsgDidRegisterControllerImpl)(nil)
+
+type MsgDidRegisterControllerImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Authority string `pkl:"authority"`
+
+	Cid string `pkl:"cid"`
+
+	Origin string `pkl:"origin"`
+
+	Authentication []*pkl.Object `pkl:"authentication"`
+
+	Token *pkl.Object `pkl:"token"`
+}
+
+// The type URL for the message
+func (rcv *MsgDidRegisterControllerImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgDidRegisterControllerImpl) GetAuthority() string {
+	return rcv.Authority
+}
+
+func (rcv *MsgDidRegisterControllerImpl) GetCid() string {
+	return rcv.Cid
+}
+
+func (rcv *MsgDidRegisterControllerImpl) GetOrigin() string {
+	return rcv.Origin
+}
+
+func (rcv *MsgDidRegisterControllerImpl) GetAuthentication() []*pkl.Object {
+	return rcv.Authentication
+}
+
+func (rcv *MsgDidRegisterControllerImpl) GetToken() *pkl.Object {
+	return rcv.Token
+}

x/did/types/txns/MsgDidRegisterService.pkl.go

@@ -0,0 +1,76 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgDidRegisterService interface {
+	Msg
+
+	GetController() string
+
+	GetOriginUri() string
+
+	GetScopes() *pkl.Object
+
+	GetDescription() string
+
+	GetServiceEndpoints() map[string]string
+
+	GetMetadata() *pkl.Object
+
+	GetToken() *pkl.Object
+}
+
+var _ MsgDidRegisterService = (*MsgDidRegisterServiceImpl)(nil)
+
+type MsgDidRegisterServiceImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Controller string `pkl:"controller"`
+
+	OriginUri string `pkl:"originUri"`
+
+	Scopes *pkl.Object `pkl:"scopes"`
+
+	Description string `pkl:"description"`
+
+	ServiceEndpoints map[string]string `pkl:"serviceEndpoints"`
+
+	Metadata *pkl.Object `pkl:"metadata"`
+
+	Token *pkl.Object `pkl:"token"`
+}
+
+// The type URL for the message
+func (rcv *MsgDidRegisterServiceImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgDidRegisterServiceImpl) GetController() string {
+	return rcv.Controller
+}
+
+func (rcv *MsgDidRegisterServiceImpl) GetOriginUri() string {
+	return rcv.OriginUri
+}
+
+func (rcv *MsgDidRegisterServiceImpl) GetScopes() *pkl.Object {
+	return rcv.Scopes
+}
+
+func (rcv *MsgDidRegisterServiceImpl) GetDescription() string {
+	return rcv.Description
+}
+
+func (rcv *MsgDidRegisterServiceImpl) GetServiceEndpoints() map[string]string {
+	return rcv.ServiceEndpoints
+}
+
+func (rcv *MsgDidRegisterServiceImpl) GetMetadata() *pkl.Object {
+	return rcv.Metadata
+}
+
+func (rcv *MsgDidRegisterServiceImpl) GetToken() *pkl.Object {
+	return rcv.Token
+}

x/did/types/txns/MsgDidSyncVault.pkl.go

@@ -0,0 +1,36 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgDidSyncVault interface {
+	Msg
+
+	GetController() string
+
+	GetToken() *pkl.Object
+}
+
+var _ MsgDidSyncVault = (*MsgDidSyncVaultImpl)(nil)
+
+type MsgDidSyncVaultImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Controller string `pkl:"controller"`
+
+	Token *pkl.Object `pkl:"token"`
+}
+
+// The type URL for the message
+func (rcv *MsgDidSyncVaultImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgDidSyncVaultImpl) GetController() string {
+	return rcv.Controller
+}
+
+func (rcv *MsgDidSyncVaultImpl) GetToken() *pkl.Object {
+	return rcv.Token
+}

x/did/types/txns/MsgDidUpdateParams.pkl.go

@@ -0,0 +1,44 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgDidUpdateParams interface {
+	Msg
+
+	GetAuthority() string
+
+	GetParams() *pkl.Object
+
+	GetToken() *pkl.Object
+}
+
+var _ MsgDidUpdateParams = (*MsgDidUpdateParamsImpl)(nil)
+
+type MsgDidUpdateParamsImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Authority string `pkl:"authority"`
+
+	Params *pkl.Object `pkl:"params"`
+
+	Token *pkl.Object `pkl:"token"`
+}
+
+// The type URL for the message
+func (rcv *MsgDidUpdateParamsImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgDidUpdateParamsImpl) GetAuthority() string {
+	return rcv.Authority
+}
+
+func (rcv *MsgDidUpdateParamsImpl) GetParams() *pkl.Object {
+	return rcv.Params
+}
+
+func (rcv *MsgDidUpdateParamsImpl) GetToken() *pkl.Object {
+	return rcv.Token
+}

x/did/types/txns/MsgGovDeposit.pkl.go

@@ -0,0 +1,44 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgGovDeposit interface {
+	Msg
+
+	GetProposalId() int
+
+	GetDepositor() string
+
+	GetAmount() []*pkl.Object
+}
+
+var _ MsgGovDeposit = (*MsgGovDepositImpl)(nil)
+
+type MsgGovDepositImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	ProposalId int `pkl:"proposalId"`
+
+	Depositor string `pkl:"depositor"`
+
+	Amount []*pkl.Object `pkl:"amount"`
+}
+
+// The type URL for the message
+func (rcv *MsgGovDepositImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgGovDepositImpl) GetProposalId() int {
+	return rcv.ProposalId
+}
+
+func (rcv *MsgGovDepositImpl) GetDepositor() string {
+	return rcv.Depositor
+}
+
+func (rcv *MsgGovDepositImpl) GetAmount() []*pkl.Object {
+	return rcv.Amount
+}

x/did/types/txns/MsgGovSubmitProposal.pkl.go

@@ -0,0 +1,45 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgGovSubmitProposal interface {
+	Msg
+
+	GetContent() *Proposal
+
+	GetInitialDeposit() []*pkl.Object
+
+	GetProposer() string
+}
+
+var _ MsgGovSubmitProposal = (*MsgGovSubmitProposalImpl)(nil)
+
+// Gov module messages
+type MsgGovSubmitProposalImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Content *Proposal `pkl:"content"`
+
+	InitialDeposit []*pkl.Object `pkl:"initialDeposit"`
+
+	Proposer string `pkl:"proposer"`
+}
+
+// The type URL for the message
+func (rcv *MsgGovSubmitProposalImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgGovSubmitProposalImpl) GetContent() *Proposal {
+	return rcv.Content
+}
+
+func (rcv *MsgGovSubmitProposalImpl) GetInitialDeposit() []*pkl.Object {
+	return rcv.InitialDeposit
+}
+
+func (rcv *MsgGovSubmitProposalImpl) GetProposer() string {
+	return rcv.Proposer
+}

x/did/types/txns/MsgGovVote.pkl.go

@@ -0,0 +1,42 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+type MsgGovVote interface {
+	Msg
+
+	GetProposalId() int
+
+	GetVoter() string
+
+	GetOption() int
+}
+
+var _ MsgGovVote = (*MsgGovVoteImpl)(nil)
+
+type MsgGovVoteImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	ProposalId int `pkl:"proposalId"`
+
+	Voter string `pkl:"voter"`
+
+	Option int `pkl:"option"`
+}
+
+// The type URL for the message
+func (rcv *MsgGovVoteImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgGovVoteImpl) GetProposalId() int {
+	return rcv.ProposalId
+}
+
+func (rcv *MsgGovVoteImpl) GetVoter() string {
+	return rcv.Voter
+}
+
+func (rcv *MsgGovVoteImpl) GetOption() int {
+	return rcv.Option
+}

x/did/types/txns/MsgGroupCreateGroup.pkl.go

@@ -0,0 +1,45 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgGroupCreateGroup interface {
+	Msg
+
+	GetAdmin() string
+
+	GetMembers() []*pkl.Object
+
+	GetMetadata() string
+}
+
+var _ MsgGroupCreateGroup = (*MsgGroupCreateGroupImpl)(nil)
+
+// Group module messages
+type MsgGroupCreateGroupImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Admin string `pkl:"admin"`
+
+	Members []*pkl.Object `pkl:"members"`
+
+	Metadata string `pkl:"metadata"`
+}
+
+// The type URL for the message
+func (rcv *MsgGroupCreateGroupImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgGroupCreateGroupImpl) GetAdmin() string {
+	return rcv.Admin
+}
+
+func (rcv *MsgGroupCreateGroupImpl) GetMembers() []*pkl.Object {
+	return rcv.Members
+}
+
+func (rcv *MsgGroupCreateGroupImpl) GetMetadata() string {
+	return rcv.Metadata
+}

x/did/types/txns/MsgGroupSubmitProposal.pkl.go

@@ -0,0 +1,60 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgGroupSubmitProposal interface {
+	Msg
+
+	GetGroupPolicyAddress() string
+
+	GetProposers() []string
+
+	GetMetadata() string
+
+	GetMessages() []*pkl.Object
+
+	GetExec() int
+}
+
+var _ MsgGroupSubmitProposal = (*MsgGroupSubmitProposalImpl)(nil)
+
+type MsgGroupSubmitProposalImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	GroupPolicyAddress string `pkl:"groupPolicyAddress"`
+
+	Proposers []string `pkl:"proposers"`
+
+	Metadata string `pkl:"metadata"`
+
+	Messages []*pkl.Object `pkl:"messages"`
+
+	Exec int `pkl:"exec"`
+}
+
+// The type URL for the message
+func (rcv *MsgGroupSubmitProposalImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgGroupSubmitProposalImpl) GetGroupPolicyAddress() string {
+	return rcv.GroupPolicyAddress
+}
+
+func (rcv *MsgGroupSubmitProposalImpl) GetProposers() []string {
+	return rcv.Proposers
+}
+
+func (rcv *MsgGroupSubmitProposalImpl) GetMetadata() string {
+	return rcv.Metadata
+}
+
+func (rcv *MsgGroupSubmitProposalImpl) GetMessages() []*pkl.Object {
+	return rcv.Messages
+}
+
+func (rcv *MsgGroupSubmitProposalImpl) GetExec() int {
+	return rcv.Exec
+}

x/did/types/txns/MsgGroupVote.pkl.go

@@ -0,0 +1,58 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+type MsgGroupVote interface {
+	Msg
+
+	GetProposalId() int
+
+	GetVoter() string
+
+	GetOption() int
+
+	GetMetadata() string
+
+	GetExec() int
+}
+
+var _ MsgGroupVote = (*MsgGroupVoteImpl)(nil)
+
+type MsgGroupVoteImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	ProposalId int `pkl:"proposalId"`
+
+	Voter string `pkl:"voter"`
+
+	Option int `pkl:"option"`
+
+	Metadata string `pkl:"metadata"`
+
+	Exec int `pkl:"exec"`
+}
+
+// The type URL for the message
+func (rcv *MsgGroupVoteImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgGroupVoteImpl) GetProposalId() int {
+	return rcv.ProposalId
+}
+
+func (rcv *MsgGroupVoteImpl) GetVoter() string {
+	return rcv.Voter
+}
+
+func (rcv *MsgGroupVoteImpl) GetOption() int {
+	return rcv.Option
+}
+
+func (rcv *MsgGroupVoteImpl) GetMetadata() string {
+	return rcv.Metadata
+}
+
+func (rcv *MsgGroupVoteImpl) GetExec() int {
+	return rcv.Exec
+}

x/did/types/txns/MsgStakingBeginRedelegate.pkl.go

@@ -0,0 +1,52 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgStakingBeginRedelegate interface {
+	Msg
+
+	GetDelegatorAddress() string
+
+	GetValidatorSrcAddress() string
+
+	GetValidatorDstAddress() string
+
+	GetAmount() *pkl.Object
+}
+
+var _ MsgStakingBeginRedelegate = (*MsgStakingBeginRedelegateImpl)(nil)
+
+type MsgStakingBeginRedelegateImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	DelegatorAddress string `pkl:"delegatorAddress"`
+
+	ValidatorSrcAddress string `pkl:"validatorSrcAddress"`
+
+	ValidatorDstAddress string `pkl:"validatorDstAddress"`
+
+	Amount *pkl.Object `pkl:"amount"`
+}
+
+// The type URL for the message
+func (rcv *MsgStakingBeginRedelegateImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgStakingBeginRedelegateImpl) GetDelegatorAddress() string {
+	return rcv.DelegatorAddress
+}
+
+func (rcv *MsgStakingBeginRedelegateImpl) GetValidatorSrcAddress() string {
+	return rcv.ValidatorSrcAddress
+}
+
+func (rcv *MsgStakingBeginRedelegateImpl) GetValidatorDstAddress() string {
+	return rcv.ValidatorDstAddress
+}
+
+func (rcv *MsgStakingBeginRedelegateImpl) GetAmount() *pkl.Object {
+	return rcv.Amount
+}

x/did/types/txns/MsgStakingCreateValidator.pkl.go

@@ -0,0 +1,77 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgStakingCreateValidator interface {
+	Msg
+
+	GetDescription() *pkl.Object
+
+	GetCommission() *pkl.Object
+
+	GetMinSelfDelegation() string
+
+	GetDelegatorAddress() string
+
+	GetValidatorAddress() string
+
+	GetPubkey() *pkl.Object
+
+	GetValue() *pkl.Object
+}
+
+var _ MsgStakingCreateValidator = (*MsgStakingCreateValidatorImpl)(nil)
+
+// Staking module messages
+type MsgStakingCreateValidatorImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	Description *pkl.Object `pkl:"description"`
+
+	Commission *pkl.Object `pkl:"commission"`
+
+	MinSelfDelegation string `pkl:"minSelfDelegation"`
+
+	DelegatorAddress string `pkl:"delegatorAddress"`
+
+	ValidatorAddress string `pkl:"validatorAddress"`
+
+	Pubkey *pkl.Object `pkl:"pubkey"`
+
+	Value *pkl.Object `pkl:"value"`
+}
+
+// The type URL for the message
+func (rcv *MsgStakingCreateValidatorImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgStakingCreateValidatorImpl) GetDescription() *pkl.Object {
+	return rcv.Description
+}
+
+func (rcv *MsgStakingCreateValidatorImpl) GetCommission() *pkl.Object {
+	return rcv.Commission
+}
+
+func (rcv *MsgStakingCreateValidatorImpl) GetMinSelfDelegation() string {
+	return rcv.MinSelfDelegation
+}
+
+func (rcv *MsgStakingCreateValidatorImpl) GetDelegatorAddress() string {
+	return rcv.DelegatorAddress
+}
+
+func (rcv *MsgStakingCreateValidatorImpl) GetValidatorAddress() string {
+	return rcv.ValidatorAddress
+}
+
+func (rcv *MsgStakingCreateValidatorImpl) GetPubkey() *pkl.Object {
+	return rcv.Pubkey
+}
+
+func (rcv *MsgStakingCreateValidatorImpl) GetValue() *pkl.Object {
+	return rcv.Value
+}

x/did/types/txns/MsgStakingDelegate.pkl.go

@@ -0,0 +1,44 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgStakingDelegate interface {
+	Msg
+
+	GetDelegatorAddress() string
+
+	GetValidatorAddress() string
+
+	GetAmount() *pkl.Object
+}
+
+var _ MsgStakingDelegate = (*MsgStakingDelegateImpl)(nil)
+
+type MsgStakingDelegateImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	DelegatorAddress string `pkl:"delegatorAddress"`
+
+	ValidatorAddress string `pkl:"validatorAddress"`
+
+	Amount *pkl.Object `pkl:"amount"`
+}
+
+// The type URL for the message
+func (rcv *MsgStakingDelegateImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgStakingDelegateImpl) GetDelegatorAddress() string {
+	return rcv.DelegatorAddress
+}
+
+func (rcv *MsgStakingDelegateImpl) GetValidatorAddress() string {
+	return rcv.ValidatorAddress
+}
+
+func (rcv *MsgStakingDelegateImpl) GetAmount() *pkl.Object {
+	return rcv.Amount
+}

x/did/types/txns/MsgStakingUndelegate.pkl.go

@@ -0,0 +1,44 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+type MsgStakingUndelegate interface {
+	Msg
+
+	GetDelegatorAddress() string
+
+	GetValidatorAddress() string
+
+	GetAmount() *pkl.Object
+}
+
+var _ MsgStakingUndelegate = (*MsgStakingUndelegateImpl)(nil)
+
+type MsgStakingUndelegateImpl struct {
+	// The type URL for the message
+	TypeUrl string `pkl:"typeUrl"`
+
+	DelegatorAddress string `pkl:"delegatorAddress"`
+
+	ValidatorAddress string `pkl:"validatorAddress"`
+
+	Amount *pkl.Object `pkl:"amount"`
+}
+
+// The type URL for the message
+func (rcv *MsgStakingUndelegateImpl) GetTypeUrl() string {
+	return rcv.TypeUrl
+}
+
+func (rcv *MsgStakingUndelegateImpl) GetDelegatorAddress() string {
+	return rcv.DelegatorAddress
+}
+
+func (rcv *MsgStakingUndelegateImpl) GetValidatorAddress() string {
+	return rcv.ValidatorAddress
+}
+
+func (rcv *MsgStakingUndelegateImpl) GetAmount() *pkl.Object {
+	return rcv.Amount
+}

x/did/types/txns/Proposal.pkl.go

@@ -0,0 +1,11 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+// Base class for all proposals
+type Proposal struct {
+	// The title of the proposal
+	Title string `pkl:"title"`
+
+	// The description of the proposal
+	Description string `pkl:"description"`
+}

x/did/types/txns/TxBody.pkl.go

@@ -0,0 +1,17 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+// Represents a transaction body
+type TxBody struct {
+	Messages []Msg `pkl:"messages"`
+
+	Memo *string `pkl:"memo"`
+
+	TimeoutHeight *int `pkl:"timeoutHeight"`
+
+	ExtensionOptions *[]*pkl.Object `pkl:"extensionOptions"`
+
+	NonCriticalExtensionOptions *[]*pkl.Object `pkl:"nonCriticalExtensionOptions"`
+}

x/did/types/txns/Txns.pkl.go

@@ -0,0 +1,36 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import (
+	"context"
+
+	"github.com/apple/pkl-go/pkl"
+)
+
+type Txns struct {
+}
+
+// LoadFromPath loads the pkl module at the given path and evaluates it into a Txns
+func LoadFromPath(ctx context.Context, path string) (ret *Txns, err error) {
+	evaluator, err := pkl.NewEvaluator(ctx, pkl.PreconfiguredOptions)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		cerr := evaluator.Close()
+		if err == nil {
+			err = cerr
+		}
+	}()
+	ret, err = Load(ctx, evaluator, pkl.FileSource(path))
+	return ret, err
+}
+
+// Load loads the pkl module at the given source and evaluates it with the given evaluator into a Txns
+func Load(ctx context.Context, evaluator pkl.Evaluator, source *pkl.ModuleSource) (*Txns, error) {
+	var ret Txns
+	if err := evaluator.EvaluateModule(ctx, source, &ret); err != nil {
+		return nil, err
+	}
+	return &ret, nil
+}

x/did/types/txns/init.pkl.go

@@ -0,0 +1,27 @@
+// Code generated from Pkl module `txns`. DO NOT EDIT.
+package txns
+
+import "github.com/apple/pkl-go/pkl"
+
+func init() {
+	pkl.RegisterMapping("txns", Txns{})
+	pkl.RegisterMapping("txns#Proposal", Proposal{})
+	pkl.RegisterMapping("txns#MsgGovSubmitProposal", MsgGovSubmitProposalImpl{})
+	pkl.RegisterMapping("txns#MsgGovVote", MsgGovVoteImpl{})
+	pkl.RegisterMapping("txns#MsgGovDeposit", MsgGovDepositImpl{})
+	pkl.RegisterMapping("txns#MsgGroupCreateGroup", MsgGroupCreateGroupImpl{})
+	pkl.RegisterMapping("txns#MsgGroupSubmitProposal", MsgGroupSubmitProposalImpl{})
+	pkl.RegisterMapping("txns#MsgGroupVote", MsgGroupVoteImpl{})
+	pkl.RegisterMapping("txns#MsgStakingCreateValidator", MsgStakingCreateValidatorImpl{})
+	pkl.RegisterMapping("txns#MsgStakingDelegate", MsgStakingDelegateImpl{})
+	pkl.RegisterMapping("txns#MsgStakingUndelegate", MsgStakingUndelegateImpl{})
+	pkl.RegisterMapping("txns#MsgStakingBeginRedelegate", MsgStakingBeginRedelegateImpl{})
+	pkl.RegisterMapping("txns#MsgDidUpdateParams", MsgDidUpdateParamsImpl{})
+	pkl.RegisterMapping("txns#MsgDidAllocateVault", MsgDidAllocateVaultImpl{})
+	pkl.RegisterMapping("txns#MsgDidProveWitness", MsgDidProveWitnessImpl{})
+	pkl.RegisterMapping("txns#MsgDidSyncVault", MsgDidSyncVaultImpl{})
+	pkl.RegisterMapping("txns#MsgDidRegisterController", MsgDidRegisterControllerImpl{})
+	pkl.RegisterMapping("txns#MsgDidAuthorize", MsgDidAuthorizeImpl{})
+	pkl.RegisterMapping("txns#MsgDidRegisterService", MsgDidRegisterServiceImpl{})
+	pkl.RegisterMapping("txns#TxBody", TxBody{})
+}

x/did/types/zkprop.go

@@ -0,0 +1,155 @@
+package types
+
+import (
+	"fmt"
+
+	"github.com/onsonr/crypto/accumulator"
+	"github.com/onsonr/crypto/core/curves"
+)
+
+// Accumulator is the accumulator for the ZKP
+type Accumulator []byte
+
+// Element is the element for the BLS scheme
+type Element = accumulator.Element
+
+// Witness is the witness for the ZKP
+type Witness []byte
+
+// NewProof creates a new Proof which is used for ZKP
+func NewProof(issuer, property string, pubKey []byte) (*Proof, error) {
+	input := append(pubKey, []byte(property)...)
+	hash := []byte(input)
+
+	curve := curves.BLS12381(&curves.PointBls12381G1{})
+	key, err := new(accumulator.SecretKey).New(curve, hash[:])
+	if err != nil {
+		return nil, fmt.Errorf("failed to create secret key: %w", err)
+	}
+
+	keyBytes, err := key.MarshalBinary()
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal secret key: %w", err)
+	}
+
+	return &Proof{
+		Issuer:      issuer,
+		Property:    property,
+		Accumulator: keyBytes,
+	}, nil
+}
+
+// CreateAccumulator creates a new accumulator for a Proof
+func CreateAccumulator(proof *Proof, values ...string) error {
+	curve := curves.BLS12381(&curves.PointBls12381G1{})
+	acc, err := new(accumulator.Accumulator).New(curve)
+	if err != nil {
+		return err
+	}
+
+	secretKey := new(accumulator.SecretKey)
+	if err := secretKey.UnmarshalBinary(proof.Accumulator); err != nil {
+		return err
+	}
+
+	fin, _, err := acc.Update(secretKey, ConvertValuesToZeroKnowledgeElements(values), nil)
+	if err != nil {
+		return err
+	}
+
+	accBytes, err := fin.MarshalBinary()
+	if err != nil {
+		return fmt.Errorf("failed to marshal accumulator: %w", err)
+	}
+
+	proof.Accumulator = accBytes
+	return nil
+}
+
+// CreateWitness creates a witness for the accumulator in a Proof for a given value
+func CreateWitness(proof *Proof, value string) ([]byte, error) {
+	curve := curves.BLS12381(&curves.PointBls12381G1{})
+	element := curve.Scalar.Hash([]byte(value))
+
+	secretKey := new(accumulator.SecretKey)
+	if err := secretKey.UnmarshalBinary(proof.Accumulator); err != nil {
+		return nil, err
+	}
+
+	accObj := new(accumulator.Accumulator)
+	if err := accObj.UnmarshalBinary(proof.Accumulator); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal accumulator: %w", err)
+	}
+
+	mw, err := new(accumulator.MembershipWitness).New(element, accObj, secretKey)
+	if err != nil {
+		return nil, err
+	}
+
+	witnessBytes, err := mw.MarshalBinary()
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal witness: %w", err)
+	}
+	return witnessBytes, nil
+}
+
+// VerifyWitness proves that a value is a member of the accumulator
+func VerifyWitness(proof *Proof, acc Accumulator, witness Witness) error {
+	secretKey := new(accumulator.SecretKey)
+	if err := secretKey.UnmarshalBinary([]byte(proof.Id)); err != nil {
+		return err
+	}
+
+	curve := curves.BLS12381(&curves.PointBls12381G1{})
+	publicKey, err := secretKey.GetPublicKey(curve)
+	if err != nil {
+		return err
+	}
+
+	accObj := new(accumulator.Accumulator)
+	if err := accObj.UnmarshalBinary(proof.Accumulator); err != nil {
+		return fmt.Errorf("failed to unmarshal accumulator: %w", err)
+	}
+
+	witnessObj := new(accumulator.MembershipWitness)
+	if err := witnessObj.UnmarshalBinary(witness); err != nil {
+		return fmt.Errorf("failed to unmarshal witness: %w", err)
+	}
+	return witnessObj.Verify(publicKey, accObj)
+}
+
+// UpdateAccumulator updates the accumulator in a Proof with new values
+func UpdateAccumulator(proof *Proof, addValues []string, removeValues []string) error {
+	secretKey := new(accumulator.SecretKey)
+	if err := secretKey.UnmarshalBinary(proof.Accumulator); err != nil {
+		return err
+	}
+
+	accObj := new(accumulator.Accumulator)
+	if err := accObj.UnmarshalBinary(proof.Accumulator); err != nil {
+		return fmt.Errorf("failed to unmarshal accumulator: %w", err)
+	}
+
+	updatedAcc, _, err := accObj.Update(secretKey, ConvertValuesToZeroKnowledgeElements(addValues), ConvertValuesToZeroKnowledgeElements(removeValues))
+	if err != nil {
+		return err
+	}
+
+	updatedAccBytes, err := updatedAcc.MarshalBinary()
+	if err != nil {
+		return fmt.Errorf("failed to marshal updated accumulator: %w", err)
+	}
+
+	proof.Accumulator = updatedAccBytes
+	return nil
+}
+
+// ConvertValuesToZeroKnowledgeElements converts a slice of strings to a slice of accumulator elements
+func ConvertValuesToZeroKnowledgeElements(values []string) []Element {
+	curve := curves.BLS12381(&curves.PointBls12381G1{})
+	elements := make([]accumulator.Element, len(values))
+	for i, value := range values {
+		elements[i] = curve.Scalar.Hash([]byte(value))
+	}
+	return elements
+}